U.S. ENVIRONMENTAL PROTECTION AGENCY

OFFICE OF INSPECTOR GENERAL

EPA Can Better Address 

Risks to the Security of the 

Nation’s Drinking Water 

Through New Authorities, 

Plans, and Information 

Report No. 13-P-0349 August 21, 2013 

Scan this mobile 

code to learn more 

about the EPA OIG. 
 

 

 

Report Contributors: Dan Engelberg 

 Anne Declerck 

 Stacey Banks 

 Allison Dutton 

Andre von Hoyer II 

Abbreviations 

CIPAC Critical Infrastructure Partnership Advisory Council 

DHS U.S. Department of Homeland Security 

EPA U.S. Environmental Protection Agency 

ERP Emergency Response Plan 

FMFIA Federal Managers’ Financial Integrity Act of 1982 

FY Fiscal Year 

GAO U.S. Government Accountability Office 

GPRA Government Performance and Results Act of 1993 

HSPD Homeland Security Presidential Directive 

ICR Information Collection Request 

NHSRC National Homeland Security Research Center 

OHS Office of Homeland Security 

OIG Office of Inspector General 

OMB U.S. Office of Management and Budget 

ORD Office of Research and Development 

OW Office of Water 

SAR Sector Annual Report 

SSP Sector Specific Plan 

VA Vulnerability Assessment 

WARN Water/Wastewater Agency Response Network 

WLA Water Laboratory Alliance 

WSD Water Security Division 

WSI Water Security Initiative 

Cover photo: A drinking water facility in Washington, D.C. (EPA photo) 

Hotline 

To report fraud, waste, or abuse, contact us through one of the following methods: 

email: OIG_Hotline@epa.gov write: EPA Inspector General Hotline 

phone: 

fax: 

1-888-546-8740 

202-566-2599 

1200 Pennsylvania Avenue, NW 

Mailcode 2431T 

online: http://www.epa.gov/oig/hotline.htm Washington, DC 20460 
 

 

 

U.S. Environmental Protection Agency 13-P-0349 

August 21, 2013 Office of Inspector General 

At a Glance
 

Why We Did This Review 

We conducted this review to 

determine how the 

U.S. Environmental Protection 

Agency (EPA): (1) ensures that 

its efforts and initiatives are 

safeguarding the nation’s 

drinking water supply from 

attacks and natural disasters; 

and (2) addressed 

recommendations and 

suggestions from prior 

evaluations of the water 

security program. 

Over 297 million people in the 

United States were served by 

51,460 community water 

systems as of September 2010. 

The September 11, 2001, 

attacks prompted a national 

effort to secure critical 

infrastructure and resources, 

including drinking water. Since 

the 2001 attacks, there have 

also been a number of natural 

disasters, such as Hurricanes 

Katrina and Irene. These 

events have threatened 

individual drinking water 

systems, resulting in unsafe 

drinking water and shortages. 

This report addresses the 

following EPA Goal or 

Cross-Cutting Strategy: 

 Protecting America’s waters. 

For further information, contact 

our Office of Congressional and 

Public Affairs at (202) 566-2391. 

The full report is at: 

www.epa.gov/oig/reports/2013/ 

20130821-13-P-0349.pdf 

EPA Can Better Address Risks to the Security 

of the Nation’s Drinking Water Through 

New Authorities, Plans, and Information 

What We Found 

EPA has implemented a number of activities to promote the security of drinking 

water systems. However, strategic planning and internal controls for the water 

security program need to be strengthened to allow the Agency to measure the 

program’s performance and progress in drinking water systems’ preparedness, 

prevention, response, and recovery capabilities. EPA’s strategic planning in this 

area is hampered by its limited authority over water security, the voluntary nature 

of its water security activities, and concerns related to protecting information. 

These impediments could be overcome by the water security program utilizing 

available data; using alternative methods to gather data; and seeking additional 

authority from Congress to collect, protect, and utilize information from water 

systems. EPA should also expand its internal controls to meet Federal Managers’ 

Financial Integrity Act requirements. 

EPA has made progress improving water security by taking corrective actions 

based on the recommendations and suggestions from prior evaluations. 

However, the Agency has not fully addressed three Office of Inspector General 

(OIG) suggestions to establish a baseline and measure improvements, despite 

agreeing with OIG’s assessment. Additional work remains for EPA, as the lead 

federal agency for the water sector, to enhance its efforts to manage the water 

security program and help reduce risks to drinking water systems and the public.

 Recommendations and Planned Agency Corrective Actions 

We recommend that EPA develop a comprehensive strategic plan, assess water 

security by gathering available data and incorporating measures into national 

guidance, and improve internal controls by developing a program review strategy 

and a multi-year review plan. We also recommend that EPA seek additional 

authority from Congress and utilize the authority, if granted, to develop a baseline 

and outcome measures. EPA initially agreed with four recommendations in the 

draft report. After further discussions with the Agency, the OIG modified the three 

remaining recommendations to seek additional authority and develop a baseline 

and outcome measures. As a result of these discussions and modifications, the 

Agency has also concurred with the remaining recommendations. The 

recommendations are resolved with corrective actions underway. 

 Noteworthy Achievements 

EPA developed the Water Security Initiative and Water Laboratory Alliance. 

The Agency also supported the establishment of many intrastate mutual aid and 

assistance agreements called Water/Wastewater Agency Response Networks. 
 

 

 Nancy Stoner, Acting Assistant Administrator 

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 

THE INSPECTOR GENERAL 

August 21, 2013 

MEMORANDUM 

SUBJECT: EPA Can Better Address Risks to the Security of the Nation’s Drinking Water 

Through New Authorities, Plans, and Information 

Report No. 13-P-0349 

FROM: Arthur A. Elkins Jr. 

TO: 

 Office of Water 

This is our report on the subject evaluation conducted by the Office of Inspector General (OIG) of the 

U.S. Environmental Protection Agency (EPA). This report contains findings that describe the problems 

the OIG has identified and corrective actions the OIG recommends. This report represents the opinion of 

the OIG and does not necessarily represent the final EPA position. Final determinations on matters in 

this report will be made by managers in accordance with established audit resolution procedures. 

Action Required 

You are not required to provide a written response to this report because you agreed to all 

recommendations and provided corrective actions and planned completion dates that meet the intent of 

our recommendations. All recommendations are resolved and open with corrective actions underway. 

Please update the EPA’s Management Audit Tracking System as you complete the planned corrective 

actions for the OIG’s recommendations. The OIG may make periodic inquiries on your progress in 

implementing these corrective actions. Please notify my staff if there is a significant change in agreed-to 

corrective actions. We will post this report to our website at http://www.epa.gov/oig. 

If you or staff have any questions regarding this report, please contact Carolyn Copper, 

Assistant Inspector General for Program Evaluation, at (202) 566-0829 or copper.carolyn@epa.gov; 

or Dan Engelberg, Director for Water, at (202) 566-0830 or engelberg.dan@epa.gov. 
 

 

 

 

 

 

EPA Can Better Address Risks to the Security of the Nation’s 13-P-0349 

Drinking Water Through New Authorities, Plans, and Information 

Table of Contents 

Chapters 

1 Introduction ........................................................................................................ 1

 Purpose ....................................................................................................... 1 

Background ................................................................................................. 1 

 Noteworthy Achievements ........................................................................... 4 

 Scope and Methodology .............................................................................. 5 

2 Strengthening Strategic Planning and Internal Controls 

Will Enhance EPA’s Drinking Water Security Program .................................. 7
 

EPA Assists Drinking Water Systems ......................................................... 7 

EPA Needs Improved Strategic Planning for Water Security ...................... 8 

Information Challenges Hinder Strategic Planning................................. 11 

EPA Needs Additional Internal Controls for Water Security ........................ 13 

Prior Recommendations Implemented but Some Suggestions Remain...... 15 

Conclusion................................................................................................... 15 

 Recommendations ...................................................................................... 16 

Agency Comments and OIG Evaluation............................................. 17 

Status of Recommendations and Potential Monetary Benefits.............................. 18
 

Appendices 

A Prior Drinking Water Security Reports............................................................. 19 

B Agency Response to the Draft Report and OIG Comments........................... 20 

C Distribution ......................................................................................................... 24 
 

 

 

Chapter 1

Introduction 

Purpose 

The purpose of this evaluation was to determine how effectively the 

U.S. Environmental Protection Agency (EPA) water security program is 

assisting drinking water systems protect against potential attacks and natural 

disasters. Our specific objectives were to determine: 

 How EPA ensures its efforts and initiatives are safeguarding the nation’s 

drinking water supply from attacks and natural disasters. 

 How EPA addressed recommendations and suggestions from prior 

evaluations of the water security program. 

Background 

Drinking water is one of the nation’s most vital resources. Over 297 million 

people in the United States were served by 51,460 community water systems as of 

September 2010. Potential threats to this resource include biological, chemical, 

and radiological contamination, and destruction of water infrastructure. The 

September 11, 2001, terrorist attacks prompted a national effort to secure critical 

infrastructure and resources, including drinking water. Since the 2001 attacks 

there have also been a number of natural disasters, such as Hurricanes Katrina and 

Irene. These events have threatened individual drinking water systems, resulting 

in unsafe drinking water and shortages. 

The Bioterrorism Act and Homeland Security Presidential Directives 

EPA’s authority to assist drinking water systems with protecting the drinking 

water supply against threats is primarily based on the Bioterrorism Act of 2002, 

and is further reinforced through two Homeland Security Presidential Directives 

(HSPDs). The Bioterrorism Act contained a one-time requirement for most 

drinking water systems1

 to submit a vulnerability assessment (VA)2 and 

emergency response plan (ERP)3 certification to EPA by the end of 2004. 

1

 Community water systems serving a population greater than 3,300 persons had to comply with the Bioterrorism 

Act of 2002. 

2

 A VA is a review of a drinking water system and its components to determine the likelihood that a terrorist attack 

or other intentional acts could substantially disrupt the ability of the system to provide a safe and reliable supply of 

drinking water.

3

 An ERP addresses the threats identified in the VA and includes the water system’s plans, procedures, and 

identification of equipment that can be used in the event of a terrorist attack or other intentional act. 

13-P-0349 1 
 

 

 

HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection, and 

HSPD-9, Defense of United States Agriculture and Food, describe EPA’s general 

responsibilities when dealing with terrorist attacks and natural disasters. These 

HSPDs have led to a range of water security activities, as discussed in chapter 2. 

The HSPDs do not provide EPA authority to require specific security measures at 

drinking water systems. 

HSPD-7 was issued in 2003. It established a national policy for the federal 

government to identify, prioritize, and protect critical infrastructure from terrorist 

attacks and natural disasters. It also designated EPA as the lead federal agency for 

ensuring the protection of the water sector. This involves assisting drinking water 

systems with protecting against terrorism and natural disasters. EPA does this by 

encouraging the use of risk management strategies. EPA supports the water sector 

by offering tools, training, and technical assistance. EPA is the sector-specific 

agency for the water sector and develops the Water Sector Specific Plan (Water 

SSP). The Water SSP is part of the overall National Infrastructure Protection Plan 

developed by the Department of Homeland Security (DHS).4

 The Water SSP 

details risk-based protection strategies. The Water SSP describes the processes 

and activities that enable protection and increased resilience of water sector 

infrastructure. EPA is required to submit a Water Sector Annual Report (SAR) to 

DHS as part of its sector responsibilities. The SAR details EPA’s water security 

activities. These activities are designed to mitigate risks, outline annual progress, 

and provide updates on water sector activities that are conducted or planned for 

the year. 

HSPD-9 was issued in 2004. It requires EPA to develop a robust and 

comprehensive surveillance and monitoring program. This program provides 

early detection of contaminants in water systems. HSPD-9 also directs EPA to 

develop a network of water quality laboratories to support the surveillance 

program. EPA has pursued these responsibilities through its Water Security 

Initiative (WSI) and Water Laboratory Alliance (WLA). 

Organizational Structure of EPA’s Water Security Program 

EPA’s Water Security Division (WSD) is the lead office for the water security 

program. WSD is located within the Office of Water (OW) and is supported by 

three other EPA offices: the Office of Homeland Security (OHS) in the 

Administrator’s Office, the Office of Research and Development’s (ORD’s) 

National Homeland Security Research Center (NHSRC), and the Office of Solid 

Waste and Emergency Response’s Office of Emergency Management. 

Coordination and collaboration efforts are needed because there are multiple 

offices involved in water security. An organizational chart of the water security 

program is in figure 1. 

4

 The National Infrastructure Protection Plan provides the framework for integrating the nation's critical 

infrastructure and key resource protection efforts across all sectors to achieve the goal of a safer, more secure nation. 

13-P-0349 2 
 

 

Figure 1: EPA water security organizational chart 

Source: EPA, Water SSP: An Annex to the National Infrastructure Protection Plan (2010). 

EPA Water Security Funding 

Current funding levels have declined from about $175.6 million in fiscal year (FY) 

2002 when EPA received the authority to oversee the VAs. According to budget 

data provided by EPA personnel, EPA’s water security program was funded at 

approximately $22 million across the four water security program offices for 

FY 2012. WSD received the largest portion of this funding—$12.4 million— 

of which $7.3 million was allotted to the WSI and WLA programs. 

Strategic Planning and Internal Controls 

Congress has made strategic planning and internal controls cornerstones for 

managing federal agency operations. Strategic planning is an essential business 

practice for ensuring that programs efficiently achieve desired goals. Internal 

controls provide a mechanism for managing program performance. They also 

protect against program risk. The Government Performance and Results Act of 

1993 (GPRA) and the Federal Managers’ Financial Integrity Act of 1982 

(FMFIA) set the principles and processes that underlie accomplishing federal 

agencies’ missions, goals, and objectives. These acts support results-oriented 

management which, in the case of the water security program, would be ensuring 

effective water security efforts and initiatives. 

13-P-0349 3 
 

 

GPRA requires agencies to develop strategic plans, set performance goals, and 

report annually on performance. Performance is assessed using outcome 

performance measures that are compared to a baseline to gauge progress. EPA 

supplements this agency-level reporting with program-level guidance. National 

Program Manager Guidance is issued annually by EPA program offices to 

provide direction on programmatic priorities and implementation strategies. 

FMFIA establishes specific requirements regarding internal controls. These 

requirements include an annual evaluation and report about the internal control 

systems that are used to protect the integrity of programs. Internal controls 

include policies, procedures, performance measures, reviews, and other activities. 

Effective internal controls provide assurance for the timely detection or 

prevention of risks to the design or operation of a program. FMFIA requires 

federal agencies to establish internal controls in accordance with U.S. Office of 

Management and Budget (OMB) Circular A-123 and U.S. Government 

Accountability Office (GAO) standards. 

EPA Order 1000.24 is the Agency’s strategy and framework for implementing 

FMFIA. Agencies must submit annual statements concerning their internal 

controls’ effectiveness at meeting FMFIA requirements and GAO standards. 

This is done through an annual assurance letter process. Each EPA program office 

submits an assurance letter to the EPA Administrator. These letters provide the 

basis for an annual statement of assurance to the President and Congress. EPA is 

required to identify key programs and develop program review strategies (referred 

to hererafter as “strategies”) as part of this process. The strategies must identify 

and rank the risks of not achieving program objectives. The strategies must also 

outline the internal controls used to mitigate those risks. Each EPA office must 

also assess the effectiveness of its programs’ internal controls using a multi-year 

internal control review plan (referred to hereafter as “multi-year plan”). This plan 

establishes priorities for assessing the internal controls based on risk levels 

assigned to programs in the strategy. The multi-year plan determines which 

programs and specific controls will be reviewed and in what order for each EPA 

office. 

Noteworthy Achievements 

EPA has conducted a number of activities to assist drinking water systems in 

addressing water security threats. These activities include: 

	 The Water Security Initiative: EPA developed and piloted a drinking 

water contamination warning system in five major cities. EPA also 

published interim guidance for other systems based on lessons learned 

from the pilots. 

13-P-0349 4 
 

 

	 The Water Laboratory Alliance: EPA has worked to establish a national 

network of laboratories to analyze water samples in the event of a terrorist 

attack or natural disaster. Notably, EPA has developed a WLA national 

response plan and has conducted exercises to test and obtain feedback on 

the feasibility of the plan. 

	 Water/Wastewater Agency Response Networks (WARNs): 

EPA supported establishing intrastate mutual aid and assistance agreements 

among water systems. These agreements outline how water systems assist 

each other with responding to and recovering from emergencies. 

Agreements exist in 47 states and the National Capital Region. 

Scope and Methodology 

We conducted this evaluation from February 2012 to February 2013 in 

accordance with generally accepted government auditing standards. Those 

standards require that we plan and perform the evaluation to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and 

conclusions based on our evaluation objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and conclusions based on 

our evaluation objectives. The scope of this evaluation was focused on drinking 

water security. Our scope excluded chemical security, cyber security, and 

wastewater facilities. 

We reviewed the Bioterrorism Act and HSPDs 7 through 10. We also reviewed 

the 2010 Water SSP Annex; the Water SAR; EPA’s water security strategic 

planning documents; and relevant prior reports by GAO, Congressional Research 

Service, and EPA OIG. We also reviewed OW’s National Program Manager 

Guidance. 

We conducted interviews at EPA headquarters with personnel from WSD, OHS, 

NHSRC, and Office of Emergency Management. We distributed an information 

request to these offices. The request asked to identify budgets and staffing, water 

security efforts and initiatives (activities) and performance measures. 

We collected information updates on EPA corrective actions taken due to prior 

EPA OIG and GAO water security report recommendations and suggestions. 5 

Further, we interviewed water security staff from EPA Regions 3 and 5. 

We interviewed staff from the DHS Office of Infrastructure Protection. 

Additional staff interviews were held with the Association of State Drinking 

Water Administrators, American Water Works Association, and National Rural 

Water Association. We followed up with GAO staff on past GAO water securityrelated reports and prior recommendations. 

5

 OIG suggestions were offered to EPA when not all elements needed for a recommendation were present; 

e.g., when the evaluation process was abbreviated. 

13-P-0349 5 
 

We analyzed EPA’s strategic planning elements. We also analyzed the FMFIA 

management integrity process for internal controls in place for the water security 

program. We focused our analysis of FMFIA management integrity processes for 

internal controls on EPA OW. We did this because WSD plays the lead role in 

EPA’s water security efforts. 

Prior Audit Coverage 

We collected information on the status of EPA’s corrective actions for 

recommendations and suggestions from past evaluations as part of answering our 

second evaluation objective. We identified nine drinking water security-related 

reports between 2003 and 2008. Six reports were issued by EPA OIG and three by 

GAO (appendix A). The prior reports are discussed in chapter 2. The OIG also 

issued reports about the effectiveness of EPA’s strategic planning efforts and on 

applying FMFIA. These reports relate to improving programmatic operations, 

internal controls, and the management integrity process. They also highlight the 

importance strategic planning and internal controls play in achieving 

programmatic success. 

13-P-0349 6 
 

Chapter 2

Strengthening Strategic Planning and 

Internal Controls Will Enhance 

EPA’s Drinking Water Security Program 

EPA has implemented a number of activities to promote the security of drinking 

water systems. However, strategic planning and internal controls for the water 

security program need to be strengthened to allow the Agency to measure the 

program’s performance and progress in drinking water systems’ preparedness, 

prevention, response, and recovery capabilities. EPA’s strategic planning is 

hampered by its limited authority over water security, the voluntary nature of its 

water security activities, and concerns related to protecting information. These 

impediments could be overcome by the water security program utilizing available 

data, using alternative methods to gather data, and seeking additional authority 

from Congress to collect, protect, and utilize information from water systems. 

Additionally, EPA’s water security program has not fully met FMFIA 

requirements for internal controls. EPA has made progress in improving water 

security by taking corrective actions based on the recommendations and several 

suggestions from prior evaluations. However, the Agency has not fully addressed 

three OIG suggestions from earlier reports, despite agreeing with the OIG’s 

assessment. EPA, as the lead federal agency for the water sector, needs additional 

strategic planning and internal controls in order to ensure it effectively assists 

drinking water systems in the protection of the nation’s drinking water, has 

current information on the state of drinking water security, and helps reduce risks 

to drinking water systems and the public. 

EPA Assists Drinking Water Systems 

EPA administers a number of activities to promote water security and assist 

drinking water systems to protect against terrorist attacks and natural disasters. 

These activities include providing training, tools, technical assistance, and 

guidance. They also include conducting water security-related research and 

working with the water sector on water security activities. The water sector 

consists of EPA, other federal agencies, states, local agencies, water systems, and 

water associations. EPA serves as chair of the Water Government Coordinating 

Council, which, along with its private sector counterpart, forms the water sector 

component of DHS’s Critical Infrastructure Partnership Advisory Council 

(CIPAC). CIPAC supports critical infrastructure protection, including the water 

sector. Below are some examples of EPA’s water security activities. 

13-P-0349 7 
 

 

 

 

Prevention and Preparedness 

	 WSI is an ongoing pilot program featuring a contamination warning and 

detection system EPA started in five cities. 

	 EPA’s water security program provides access to the Water Information 

Sharing and Analysis Center for EPA staff and state drinking water 

officials. The Water Information Sharing and Analysis Center is a 

subscription service that shares threat information with drinking water 

systems. 

	 NHSRC shares various tools and technical assistance based on its water 

security research. This research is related to VAs; emergency response 

planning; and contaminant sampling, analytical, and mitigation 

methodologies. 

	 WSD provides training and hosts webinars on water security-related tools. 

WSD also works with states to design water sector exercises. 

Response and Recovery 

	 EPA supports WARNs, an intrastate mutual aid network for water systems 

developed, through outreach, technical assistance, tabletop exercises, and 

development of operational plans. 

	 The WLA provides water sample analysis support during a terrorist attack 

or natural disaster. 

	 NHSRC conducts research and develops strategies to address 

decontamination challenges such as treatment protocols, disposal of 

decontamination waste, and the persistence of contaminants in water 

infrastructure. 

As a result of EPA’s activities, water systems now have access to resources 

which were not previously available. Information gathered from the WSI pilot 

programs is used to improve current tools for contamination monitoring systems. 

Water security training and exercises allow water systems to develop 

relationships with other systems; local, state, and federal entities; and responders. 

Exercises also enable water systems to test their ERPs. 

EPA Needs Improved Strategic Planning for Water Security 

The water security program needs to adopt a more thorough strategic planning 

process in order to assess its performance and guide future actions. Effective 

strategic planning involves five essential elements and should be framed by a 

comprehensive plan. The five essential strategic planning elements are outcome 

goal(s), long-term and annual outcome performance measure(s), output 

performance measure(s), and baseline(s).6

 EPA has carried out significant 

6

 The five essential elements of strategic planning are identified in the GPRA Modernization Act of 2010, 

OMB Circular A-11, and prior OIG reports. 

13-P-0349 8 
 

strategic planning efforts within the water security program. However, the 

Agency would benefit from a comprehensive strategic plan to guide its efforts 

across the four program offices that contribute to water security. A coordinated 

and collaborative planning approach is necessary to connect each office’s 

activities to EPA’s water security goals. EPA is also missing three of the five 

essential strategic planning elements that would allow it to better manage the 

water security program. The lack of these elements impacts EPA’s ability to 

determine whether its activities are effective in assisting water systems to identify 

vulnerabilities. 

Strategic Planning Efforts Are Not Comprehensive 

EPA does not have a comprehensive water security strategic plan containing the 

five essential strategic planning elements. Such a plan would link the activities of 

the four program offices involved to EPA’s overall water security goals. EPA’s 

water security program has instituted multiple strategic planning initiatives since 

the implementation of the Bioterrorism Act of 2002 and periodically reviews its 

current activities. These initiatives do not collectively or individually address all 

five of the essential strategic planning elements. 

Examples of existing water security planning documents include: (1) the Water 

SSP that serves as EPA’s water security strategic plan, (2) WSD’s Business Plans 

used to make the Water SSP operational, (3) ORD’s Homeland Security Strategic 

Research Action Plan which identifies the water sector’s research needs, and 

(4) OW’s SAR which details annual progress and updates on water sector activities 

being conducted or planned. A comprehensive strategic plan would allow EPA to 

organize the collective efforts of the four program offices toward water security. 

OHS recently collaborated with EPA program offices on a homeland security 

strategic review to identify future areas of work. The review covered eight areas 

and included water security. OHS completed a work plan to address these areas in 

May 2013. OHS’s strategic review does not contain all five essential strategic 

planning elements. 

Strategic Planning Elements Are Needed 

EPA also does not have all of the necessary strategic planning elements for the 

water security program in place. EPA’s water security program has two of the five 

elements (see table 1). However, EPA has not established a water security 

baseline, or annual and long-term outcome performance measures. These 

elements would allow EPA to understand how effective its activities are in 

assisting water systems and better manage the program. The documents listed 

below identify the water security program’s outcome goals and output 

performance measures. The documents also allow the agency to set output targets 

and keep track of activities. 

13-P-0349 9 
 

 

 

 Table 1: Essential strategic planning elements—water security program 

Strategic planning elements 

EPA’s water 

security 

program Strategic planning documents 

Outcome Goal7 Yes Water SSP 

Water SAR 

ORD’s Strategic Research Action Plan 

Long-Term Outcome Performance 

Measures 

No None Identified 

Annual Outcome Performance Measures No None Identified 

Output Performance Measures8 Yes Water SAR 

WSD’s Annual Business Plans 

Baseline for Program Measurement No None Identified

 Source: OIG Analysis of water security program documents provided by EPA. 

Water Security Baseline 

None of the water security planning documents we reviewed contains a 

baseline from which to measure the current status of water security. A 

baseline is an essential strategic planning component and is a reference 

point against which progress can be measured. A baseline is necessary to 

set and achieve water security goals. The effectiveness of any strategic 

planning effort is weakened if performance cannot be measured against a 

baseline. To establish a water security baseline, EPA needs to gather 

security information about a water system’s preventative measures, 

preparedness, response capability, and resiliency. A general example of 

baseline data for water security could include the percentage of 

community water systems that have an ERP, conduct ERP training and 

exercises, and review and update their ERP on a periodic basis. Once a 

water security baseline is established the Agency should be able to 

develop outcome performance measures to measure progress. 

Annual and Long-Term Outcome Performance Measures 

EPA does not identify annual or long-term outcome performance measures 

in any of the water security planning documents although it identifies output 

measures. While performance measures should distinguish between 

outcomes and outputs, there should be a logical connection between them, 

with outputs supporting outcomes. Annual and long-term outcome 

performance measures indicate progress toward overall water security 

7

 An outcome goal is the result or achievement toward which effort is directed. An outcome goal can be long- or 

short-term and may be expressed specifically or broadly. Progress against goals should be monitored using a suite of 

supporting targets, measures, and timeframes. 8

 An output measure is the tabulation, calculation, or recording of an activity or effort and can be expressed in a 

quantitative or qualitative manner. 

13-P-0349 10
 

goals, over the course of a year and several years, respectively. These 

outcome measures indicate what is being accomplished, whether results are 

being achieved, and indicate changes in conditions the program is trying to 

influence. Examples of performance measures could include the following: 

	 Annual: By the end of a specified annual date, a specific 

percentage of large community water systems will have an ERP, 

conduct ERP training and exercises, and review and update their 

ERP on a periodic basis. 

	 Long-Term: By the end of a specified long-term date, a specific 

percentage of large community water systems will have an ERP, 

conduct training on their ERP, carry out exercises on their ERP, and 

review and update their ERP on a periodic basis. 

OW’s National Program Manager Guidance for FY 2012 does not have 

any performance measures for the water security program. This is despite 

water security being identified as one of the 26 key programs through the 

FMFIA process and a national water program priority for the fiscal year. 

A foundation for water security performance measures in the National 

Program Manager Guidance could be provided by a comprehensive 

strategic plan. 

Information Challenges Hinder Strategic Planning 

Many of the problems with EPA’s strategic planning stem from the lack of 

information about water security. EPA lacks information about water systems, 

such as VAs, ERPs, and other data necessary to accurately evaluate the program’s 

status and progress. While the water security program is voluntary and lacks 

regulatory provisions to collect and protect information beyond the Bioterrorism 

Act requirements, the Agency has not used existing sources or alternative 

methods to collect information from water utilities. The lack of information 

impacts EPA’s ability to understand how its water security activities are assisting 

the water sector to protect against terrorism and natural disasters. 

Limitations of EPA’s Water Security Program 

EPA does not have specific knowledge of water systems’ security levels. This is 

because of the Agency’s limited authority, the voluntary nature of its program, and 

concerns associated with protecting information from public disclosure under the 

Freedom of Information Act. According to EPA, drinking water systems decide if 

and how they will use EPA’s water security program. EPA does not have authority 

to require water systems to submit security information; utilize training, tools, 

technical assistance, or guidance; or implement security enhancements or update 

their VAs and ERPs. Since EPA lacks the authority, the Agency has not requested 

any updates on VAs or ERPs since the Bioterrorism Act statutory deadline in 2004. 

13-P-0349 11 
 

 

Currently, EPA may not be able to protect from disclosure information gathered 

outside of the Bioterrorism Act under the Freedom of Information Act. 

WSD advised OIG that the program attempts to develop meaningful metrics. 

However, a means to collect information directly from water systems for outcome 

measures does not currently exist. WSD depends on its working relationships with 

water systems and attendance at conferences to gather anecdotal water security 

information. 

Approaches for Collecting Water Security Data 

OW currently collects various output measures that provide an idea of how 

prepared and resilient water systems are if an event occurs. These data focus on 

outputs but could be helpful for the establishment of a baseline and measurement 

of water security progress. EPA, however, does not use these output measures to 

manage the program. Examples of pertinent output measures include: the number 

of trainings conducted; the number of water systems participating in WARNs; 

lessons learned from actual incidents, drills and exercises; and the 18 measures 

suggested by the CIPAC. OW also collects data in response to metrics in the 

Water SAR. 

OW has also not used alternative information collection methods, such as an 

Information Collection Request (ICR), to gather more information about system 

preparedness and responsiveness. This information could include system data on 

preparedness and resiliency, such as security features and enhancements, staff 

security training, and the number of drills and exercises participated in. It could 

also include whether any EPA-based security tools are used by systems, and if 

VAs and ERPs are updated. OW has cited a number of reasons why an ICR may 

be impractical, including the cost of conducting an ICR, the lack of a statutory 

basis for obtaining OMB approval, and the unwillingness of water systems to 

provide such information. 

Currently, OW does not have any statutory authority to collect, protect, and utilize 

new information from the water sector. As such, EPA is limited in knowing how 

effective its efforts are in assisting the water sector to protect against terrorism 

and natural disasters. In 2009, EPA’s Assistant Administrator for Water testified 

before the Subcommittee on Energy and the Environment Committee on Energy 

and Commerce, U.S. House of Representatives, about the proposed Drinking 

Water Security Act of 2009, which primarily addressed chemical security at 

drinking water systems. The proposed act also considered risks in general and 

would have extended drinking water security requirements for drinking water 

systems as well as authority for the Agency. However, it did not pass both 

chambers of Congress. In January 2013, the Secure Water Facilities Act was 

referred to the Senate Committee on Environment and Public Works and would 

expand the requirements for vulnerability assessments, site security plans, and 

emergency response plans for both the Agency and drinking water systems. 

13-P-0349 12 
 

 

 

 

This bill also proposes performance standards and provides protection for water 

security information within vulnerability assessments and site security plans. 

The bill currently remains with the committee. Additional authority could 

improve EPA’s effectiveness in carrying out its water security duties and 

may further enable the Agency to establish a baseline and outcome 

performance measures. 

EPA Needs Additional Internal Controls for Water Security 

In its FY 2010 FMFIA Assurance Letter, OW identified the water security 

program as one of 26 key programs. OW established a strategy and multi-year 

plan for the WSD and its water security activities. We determined that, overall, 

the strategy and multi-year plan lack several elements required by FMFIA, as 

implemented by OMB and EPA guidance. 

Program Review Strategy 

OW’s water security strategy does not fully comply with the internal control 

standards in OMB Circular A-123, which are based upon the GAO Standards for 

Internal Control. Therefore it also does not fulfill FMFIA requirements.9

 There 

are five required GAO standards for internal controls: control environment, risk 

assessment, control activities, information and communications, and monitoring. 

OW must address and comply with each of these standards in its water security 

strategy. Also, the purpose of the strategy is to identify the risk associated with 

the program and the internal controls to mitigate the risk. EPA Order 1000.24 

directs that strategies meet the program’s needs. The strategy should be evaluated 

regularly because it serves as the basis for the FMFIA assurance letters. 

According to OMB Circular A-123, internal controls do not guarantee the success 

of an agency’s programs or the absence of waste, fraud, and mismanagement. 

Rather, internal controls are an essential means of managing the risks associated 

with the operations of the water security program, such as ineffective tools, 

insufficient training, waste of taxpayers’ dollars, and natural disasters. A strategy 

with inadequate internal controls will often fail to identify program risks and 

result in unaddressed vulnerabilities pertaining to preparedness, prevention, 

response, and recovery. Therefore, the application of additional internal controls 

in the water security strategy will lead to improvements in program operations, 

FMFIA compliance, and reduced programmatic risk. Examples of some of the 

shortcomings in the water security strategy are discussed below. 

9

 EPA OIG’s 2009 report, EPA Should Use FMFIA to Improve Programmatic Operations (Report No. 09-P-0203), 

found that EPA had not used FMFIA to improve program operations as intended. Further, the report stated that EPA 

offices were not developing strategies that systematically and annually assess the effectiveness of internal controls 

or include elements such as GPRA. These conclusions are aligned with observations noted from the water security 

program during this evaluation. 

13-P-0349 13 
 

Control Activities 

OW identified VAs, ERPs, tools, and technical assistance as water security 

strategy control activities. Control activities are policies, procedures, 

mechanisms, and performance measures. They mitigate the program’s risk 

and fulfill the program’s objective of helping water systems enhance their 

security and response capability. However, VAs and ERPs are insufficient 

control activities. They are handled by drinking water systems and not by 

WSD. In fact, there is no requirement for water systems to update VAs or 

ERPs, or submit updates to EPA. Further, OW does not currently use the 

information contained within VAs or ERPs that was originally submitted by 

the end of 2004. OW only has immediate control over its tools and technical 

assistance, which are appropriately identified as control activities. 

Monitoring 

The strategy also does not incorporate an adequate process for monitoring. 

According to the GAO standards and EPA Order 1000.24, the monitoring 

aspect of the strategy should assess the quality of a program’s 

performance over time. Monitoring can include periodic reviews, selfassessments, audits, comparisons of detective and preventative data, 

reconciliations, and separate external evaluations. Monitoring should be 

performed continually as part of the agency’s operations. OW identified 

conference calls, meetings, and conferences for the monitoring activities 

in the water security strategy. However, while these may be acceptable 

means for monitoring, our review of recent meeting minutes did not reveal 

any substantive discussions about internal controls. Therefore, we do not 

have evidence to suggest that the use of meetings, conferences, and calls 

for monitoring are effective to evaluate how well the program’s internal 

controls are performing. 

Multi-Year Internal Control Review Plan 

OW’s multi-year plan does not have an adequate process for evaluating the water 

security program’s internal controls. Along with the program review strategy, the 

multi-year plan is an Agency requirement, for FY 2010 and beyond, intended to 

establish more systematic and rigorous reviews of internal controls over 

programmatic operations. A multi-year plan evaluates implemented internal 

controls identified in the strategy for effectiveness at assessing the program’s 

operations. The multi-year plan is designed so any weaknesses or deficiencies can 

be identified and corrected. Examples of sources of information EPA could use 

for the multi-year plan are provided in OMB Circular A-123, EPA Order 1000.24, 

and EPA’s Management Integrity Program–FY 2011 Annual Guidance for 

Assessing Internal Control over Programmatic Operations. Internal control 

reviews for the multi-year plan can be done with audits, questionnaires, site visits, 

external evaluations, and internal self-assessments. Similar to the water security 

13-P-0349 14 
 

strategy previously discussed, conference calls, meetings, and conferences were 

identified as what the internal control evaluation process would include. Although 

they may serve as ways to review a program’s internal controls, we determined 

that there were no significant discussions on the program’s internal controls or 

potential deficiencies during the minutes we reviewed. Without improvement in 

the multi-year plan, water security program operations cannot be properly 

assessed. Any weaknesses that would hinder the program from reaching its goals 

may be overlooked and program management subsequently would not improve. 

Prior Recommendations Implemented but Some Suggestions Remain 

EPA has addressed OIG and GAO recommendations pertaining to EPA’s drinking 

water security program. EPA has also addressed six of the 11 OIG suggestions. 

However, three pertinent suggestions have not been fully addressed. Although 

OIG does not formally track EPA adherence to or implementation of suggestions, 

these past suggestions offered meaningful information on how to make 

improvements. Nonetheless, the priority is that the Agency address agreed-to 

recommendations, which was accomplished. 

EPA has implemented both OIG recommendations to evaluate VAs for 

completeness and prioritization of its research activities. However, EPA has not 

established a baseline or outcome-focused performance indicators (measures), 

which were outlined in three prior OIG suggestions. In 2003, EPA had agreed 

with OIG’s assessment for needed performance measures and baseline. EPA has 

made a significant effort to enlist the assistance of the CIPAC workgroup to be 

responsive to these OIG suggestions. Thus far, this effort has not resulted in the 

development of any of the missing performance measure elements: outcome 

performance measures and a baseline. As a result of this evaluation, OIG found 

that the missing performance elements continued to limit EPA’s ability to 

measure the water security program effectiveness and progress. For these reasons, 

we have elevated these prior suggestions to recommendations. 

Additionally, GAO made two drinking water security recommendations which 

EPA has implemented. GAO directed EPA to assess the need for public policy 

tools to encourage the Water ISAC to continue its protection activities and 

increase information sharing. GAO also directed EPA to consider how to best 

allocate security-related funds to drinking water systems and how securityenhancing activities should be supported. Both of these recommendations have 

been implemented and closed out by GAO. 

Conclusion 

EPA has taken a number of steps to assist drinking water systems to protect the 

nation’s drinking water against terrorist threats and natural disasters. However, 

EPA’s strategic planning and internal control processes for water security must be 

13-P-0349 15 
 

 

improved to enhance programmatic operations and minimize risks to critical 

infrastructure. We acknowledge that EPA’s strategic planning process in this area 

has been hampered by a number of impediments, namely, its lack of statutory 

authority, the voluntary nature of the water security program, and concerns 

pertaining to protecting security information. However, the Agency has not sought 

additional authority from Congress recently or utilized all available approaches to 

establish a water security baseline and outcome performance measures. Without 

additional authority, the water security program will be unable to fully gauge its 

effectiveness in assisting drinking water systems to protect the nation’s drinking 

water supply against attacks and natural disasters. The Agency needs authority that 

is commensurate with its responsibility as the lead federal agency for the water 

sector, and which allows it to properly address this national issue. EPA must 

strengthen management of the water security program, assess water security 

progress, and support resources expended in order to help water systems protect 

drinking water accessed by 297 million people in the United States. 

Recommendations 

We recommend that the Assistant Administrator for Water: 

1.	 Develop a comprehensive strategic plan across all program offices that are 

involved in EPA’s water security program. 

2.	 Utilize information currently available to assess the state of water security 

across the nation, specifically, by: 

a.	 Gathering water security data, and 

b.	 Incorporating water security-related performance measures, 

targets, and annual commitments into OW’s National Program 

Manager Guidance. 

3.	 Seek additional authority from Congress to better manage the security of 

drinking water systems and their water supply. Additional authorities 

should include the ability to collect, protect, and utilize water systemspecific security information 

4.	 If additional authority is granted, further assess the state of water security 

across the nation, specifically, by: 

a.	 Developing and utilizing a drinking water security baseline and 

conducting periodic reassessments, and 

b.	 Developing and utilizing annual and long-term outcome measures. 

13-P-0349 16 
 

5.	 Develop and implement a program review strategy and a multi-year internal 

control review plan for water security in accordance with requirements set 

by FMFIA, as implemented by OMB Circular A-123 and EPA Order 

1000.24, which enables the Agency to address risks, assess effectiveness, 

reveal any weaknesses, and monitor actions to address those weaknesses. 

Agency Comments and OIG Evaluation 

OW provided a written response to a draft of this report and expanded on and 

clarified that response in subsequent meetings with the OIG. OW’s response to 

the draft report, along with the OIG’s evaluation, is in appendix B. The Agency 

also provided technical comments. Where appropriate, we made changes to the 

report based on these comments. 

In its written response and in follow-up meetings, OW agreed to address all 

recommendations. EPA initially agreed with four recommendations in the draft 

report (currently recommendations 1, 2a, 2b, and 5). After further discussions 

with the Agency, the OIG modified the three remaining recommendations 

(currently recommendations 3, 4a, and 4b) to seek additional authority and 

develop a baseline and outcome measures. As a result of these discussions and 

modifications, the Agency has also concurred with the current recommendations 

3, 4a, and 4b. The OW provided corrective actions and estimated completion 

dates for the recommendations that it develop an agencywide work plan with 

enhanced metrics; include water security measures, targets, and commitments into 

the OW’s National Program Manager Guidance; seek additional authority; and 

develop and implement a program review strategy and multi-year internal control 

plan. If additional authority is granted, EPA has agreed to obtain the necessary 

information needed to establish a baseline and outcome measures. All 

recommendations are resolved and open with corrective actions underway. 

13-P-0349 17 
 

 

 

 

 

 

 

 

 

 

 

 

Status of Recommendations and 

Potential Monetary Benefits 

POTENTIAL MONETARY 

RECOMMENDATIONS BENEFITS (in $000s) 

Planned 

Rec. 

No. 

Page 

No. Subject Status1 Action Official 

Completion 

Date 

Claimed 

Amount 

Agreed-To 

Amount 

1 16 Develop a comprehensive strategic plan across all 

program offices that are involved in EPA’s water 

security program. 

O Assistant Administrator 

for Water 

6/30/14 

2 16 Utilize information currently available to assess the 

state of water security across the nation, 

specifically, by: 

 Assistant Administrator 

for Water 

a. Gathering water security data, and O 6/30/14 

b. Incorporating water security-related 

performance measures, targets, and annual 

commitments into OW’s National Program 

Manager Guidance. 

O 9/30/14 

3 16 Seek additional authority from Congress to better 

manage the security of drinking water systems and 

their water supply. Additional authorities should 

include the ability to collect, protect, and utilize 

water system-specific security information. 

O Assistant Administrator 

for Water 

3/31/14 

4 16 If additional authority is granted, further assess the 

state of water security across the nation, 

specifically, by: 

 Assistant Administrator 

for Water 

a. Developing and utilizing a drinking water 

security baseline and conducting periodic 

reassessments, and 

O 3/31/16 

b. Developing and utilizing annual and long-term O 3/31/16 

outcome measures 

5 17 Develop and implement a program review strategy 

and a multi-year internal control review plan for 

water security in accordance with requirements set 

by FMFIA, as implemented by OMB Circular A-123 

and EPA Order 1000.24, which enables the 

Agency to address risks, assess effectiveness, 

reveal any weaknesses, and monitor actions to 

address those weaknesses. 

O Assistant Administrator 

for Water 

12/31/14 

O = Recommendation is open with agreed-to corrective actions pending.
 

C = Recommendation is closed with all agreed-to actions completed.
 

U = Recommendation is unresolved with resolution efforts in progress.
 

13-P-0349 18 

1 
 

Appendix A 

Prior Drinking Water Security Reports 

EPA OIG 

Report Title Report No. Publication Date 

EPA Needs a Better Strategy to Measure Changes in the 

Security of the Nation’s Water Infrastructure 

2003-M-00016 September 11, 2003 

EPA Needs to Assess the Quality of Vulnerability 

Assessments Related to the Security of the Nation’s Water 

Supply 

2003-M-00013 September 24, 2003 

Survey Results on Information Used by Water Utilities to 

Conduct Vulnerability Assessments 

2004-M-0001 January 20, 2004 

EPA’s Final Water Security Research and Technical 

Support Action Plan May Be Strengthened Through Access 

to Vulnerability Assessments 

2004-P-00023 July 1, 2004 

EPA Needs to Determine What Barriers Prevent Water 

Systems from Securing Known Supervisory Control and 

Data Acquisition (SCADA) Vulnerabilities 

2005-P-00002 January 6, 2005 

Summary of Recent Developments in EPA’s Drinking Water 

Program and Areas for Additional Focus 

08-P-0120 March 31, 2008 

GAO 

Report Title Report No. Publication Date 

Critical Infrastructure Protection: Challenges for Selected 

Agencies and Industry Sectors 

GAO-03-233 February 2003 

Drinking Water: Experts’ Views on How Future Federal 

Funding Can Best Be Spent to Improve Security 

GAO-04-29 October 2003 

Protection of Chemical and Water Infrastructure: Federal 

Requirements, Actions of Selected Facilities, and 

Remaining Challenges 

GAO 05-327 March 2005

 Source: EPA OIG analysis. 

13-P-0349 19 
 

 

 

 

Appendix B 

Agency Response to the Draft Report 

and OIG Comments 

(Received April 24, 2013) 

MEMORANDUM 

SUBJECT: Response to the Office of Inspector General Draft Project No. OPE-FY12-006, 

“EPA Needs Additional Strategic Planning and Internal Controls to Enhance 

Drinking Water Security,” dated February 21, 2013 

FROM: Nancy K. Stoner /s/ 

Acting Assistant Administrator 

TO: Arthur A. Elkins, Jr. 

Inspector General 

Thank you for the opportunity to respond to the issues and recommendations in the subject 

audit report. Following is a summary of the agency's overall position, along with its position 

on each of the report recommendations. For those report recommendations with which the 

agency agrees, we have provided either high-level intended corrective actions and estimated 

completion dates to the extent we can or reasons why we are unable to provide high-level 

intended corrective actions and estimated completion dates at this time. For those report 

recommendations with which the agency does not agree, we have explained our position. For 

your consideration, we have included a Technical Comments Attachment to supplement this 

response. 

AGENCY'S OVERALL POSITION 

The EPA takes the responsibility of promoting risk reduction in the water sector with respect 

to all hazards, whether extreme weather events or intentionally malevolent acts very seriously. 

We welcome the IG's recommendations on potential improvements to this program in an 

effort to enhance the EPA's water security program. The EPA would like to acknowledge that 

the water security program is a non-regulatory program. This might pose a programmatic 

challenge when determining how the EPA can adopt some of the corrective actions cited in 

the IG's report. 

OIG Overall Response: 

The OIG understands that the agency currently is implementing a non-regulatory, voluntary program and 

has limited statutory authority. The OIG also recognizes the constraints identified by OW and has 

discussed them in the report, and we believe we have proposed a recommendation to provide EPA with 

the authorization it needs. The intent of the report recommendations was to provide the OW with ways to 

mitigate these limitations. Until the OW addresses these limitations, the water security program will 

continue to operate with inadequate performance measures and internal controls. 

13-P-0349 20 
AGENCY'S RESPONSE TO REPORT RECOMMENDATIONS

No. Recommendation High-Level Intended Corrective 

Actions 

Estimated Completion by Quarter and FY 

OIG Response

1 Develop a comprehensive 

strategic plan across all 

program offices involved in 

EPA's water security program 

The OW will meet on an annual basis with each office to describe the 

program outcomes and priorities that 

it intends to achieve and to determine 

how the other offices can contribute 

to these outcomes and priorities as their resources permit. 

1QFY14 Based upon OW’s re

discussions, the OIG corrective action wilthe recommendationfoster improved coorcollaboration with thmore complete work water security prograoperating from. In suthe OW estimated thwith more outcome-tcompleted by 3QFY

2(a) Gather water security data 

by utilizing existing information, and employing alternative means to gather data 

The EPA will be limited in its ability 

to fulfill this recommendation due to 

statutory constraints. 

NA In subsequent discus

was explained the OW available information state of water securitto develop more outcaugment the ones theof the work plan beinRecommendation 1. work plan will be co(June 2014). The OIG actions proposed by intent of this recomm

13-P-0349 
2(b) Develop and utilize a 

drinking water security baseline and conduct periodic reassessments 

The EPA will be limited in its ability 

to fulfill this recommendation due to 

statutory constraints. 

NA In subsequent discus

committed that, if adgranted (Recommendwith OMB and water to collect the necessadevelop a baseline to recommendation by (March 2016). The Oplans to address the ris Recommendation 

2(c) Develop and utilize annual 

and long-term outcome measure(s) to assess overall water security progress 

The EPA will be limited in its ability to fulfill this recommendation due to statutory constraints. 

NA In subsequent discus

committed that, if adgranted (Recommendwith OMB and water to collect the necessadevelop outcome merecommendation by (March 2016). The Oplans to address the ris Recommendation 

2(d) Incorporate water security 

related performance 

measures, targets and 

annual commitments into Office of Water's National Program Manager 

Guidance 

In future iterations of this guidance, EPA will include key water security 

metrics. 

4QFY14 The OIG accepts the 

the recommendationRecommendation 2b 

13-P-0349 
3 Seek additional authority 

from Congress to better manage the security of 

drinking water systems 

The EPA expects that it will need to operate the program under the current 

constraints. 

NA Based upon subseque

OW about this recombelieves the correctivthe OW will address recommendation. Thto meeting with Admoutside of EPA abouauthority for the watsecond quarter FY 20the OW’s plans to adrecommendation. 

4 Develop and implement a 

program review strategy 

and a multi-year internal 

control review plan for 

water security in accordance with FMFIA 

The EPA can commit to undertaking this recommendation with the caveat 

that the performance and outcomebased metrics required of these tasks 

will of necessity be limited to the output and limited outcome-based metrics that OW currently collects in assessing its water security program. 

1QFY14 The OIG agrees with 

corrective action to dplan within the limitathe program. This is the final report. 

Attachments Technical Comments cc: Mike Shapiro 

 Peter Grevatt  David Travers  Michael Mason  Marilyn Ramos 

13-P-0349 
 

Appendix C 

Distribution 

Office of the Administrator 

Assistant Administrator for Water 

Assistant Administrator for Solid Waste and Emergency Response 

Agency Follow-Up Official (the CFO) 

Agency Follow-Up Coordinator 

General Counsel 

Associate Administrator for Homeland Security 

Associate Administrator for Congressional and Intergovernmental Relations 

Associate Administrator for External Affairs and Environmental Education 

Regional Administrator, Region 3 

Regional Administrator, Region 5 

Principal Deputy Assistant Administrator for Water 

Principal Deputy Assistant Administrator for Research and Development 

Director, Office of Regional Operations 

Audit Follow-Up Coordinator, Office of Water 

Audit Follow-Up Coordinator, Office of Research and Development 

Audit Follow-Up Coordinator, Office of Solid Waste and Emergency Response 

Audit Follow-Up Coordinator, Region 3 

Audit Follow-Up Coordinator, Region 5 

13-P-0349 24