Embassy Evacuations: State Department Should Take Steps to Improve Emergency Preparedness
Published: 2017-07-17T00:00:00

Fast Facts:
U.S. government personnel at U.S. embassies and consulates continue to face security threats. During fiscal years 2013-2016, the State Department evacuated staff and their families from 23 overseas posts in response to threats, such as terrorism, civil unrest, and natural disasters.
The State Department has processes to prepare overseas posts for crises and evacuations, such as requiring posts to prepare emergency action plans and conduct drills. But we found significant gaps in emergency preparedness. For example, posts worldwide reported completing only 52% of required annual drills.
We made 5 recommendations to State to address these gaps.

Highlights:
section_title: Why GAO Did This Study
paragraphs: From October 2012 to September 2016, State evacuated overseas post staff and family members from 23 overseas posts in response to various threats, such as terrorism, civil unrest, and natural disasters. Overseas posts undergoing evacuations generally experience authorized departure or ordered departure of specific post staff or family members, potentially leading to suspended operations.
GAO was asked to review State policies and procedures for evacuating overseas posts. This report examines (1) the processes State has established to prepare posts for crises and to conduct evacuations and (2) State's implementation of preparedness processes for crises and evacuations. GAO reviewed State guidance and documents related to crisis and evacuation preparedness, including a sample of EAPs and State databases on EAP updates and post drills. GAO also interviewed U.S. officials in Washington, D.C., and in six countries selected because of posts' experiences with evacuations. This is the public version of a sensitive report that GAO issued in June 2017. Information that State deemed sensitive has been omitted.
section_title: What GAO Found
paragraphs: The Department of State (State) has established processes to prepare overseas posts for crises and to conduct evacuations. In particular, posts prepare by developing and updating Emergency Action Plans (EAP) and conducting drills. EAPs are to contain information to assist posts in responding to emergencies, such as checklists of response procedures and decision points to help determine when to evacuate post staff or family members. Posts are required to conduct nine types of drills each fiscal year to prepare for crises and evacuations. State also has established processes for conducting post evacuations. Following an evacuation, post staff are required to transmit an after-action report identifying lessons learned to State headquarters.
State has gaps in its crisis and evacuation preparedness for overseas posts. In fiscal years 2013–2016, almost a quarter of posts, on average, were late completing required annual EAP updates. While the completion rate improved from 46 percent to 92 percent of posts completing updates on time in fiscal years 2013 and 2016, respectively, GAO's review of a nongeneralizable sample of EAPs from 20 posts that had been approved by State's Bureau of Diplomatic Security showed that only 2 of 20 had updated all key EAP sections. GAO also found that EAPs are viewed as lengthy and cumbersome documents that are not readily usable in emergency situations, as required. In addition, GAO found that, on average for fiscal years 2013–2016, posts worldwide reported completing 52 percent of required annual drills; posts rated high or critical in political violence or terrorism reported completing 44 percent of these drills. As shown in the figure below, 78 percent of posts reported completing duck and cover drills, but only 36 percent of posts reported completing evacuation training drills. Overall, less than 4 percent of posts reported completing all required drills during fiscal years 2013-2016. In addition, although posts are required to transmit an after-action report listing lessons learned to State headquarters following evacuations, no such reports were submitted in fiscal years 2013–2016. Taken together, the gaps in State's crisis and evacuation preparedness increase the risk that post staff are not sufficiently prepared to handle crisis and emergency situations.
section_title: What GAO Recommends
paragraphs: In GAO's sensitive report, GAO made five recommendations to State focused on strengthening accountability for completion and review of posts' annual EAP updates and required emergency drills, enhancing the usability of EAPs, and ensuring that lessons learned reports are completed. State concurred with all five recommendations and described actions planned or under way to address them.

section_title: Letter
paragraphs: U.S. government personnel working at diplomatic and consular posts  overseas—as well as family members present with them—continue to  face threats to their security, including numerous attacks in high risk  locations in recent years. According to the Department of State’s (State)  Bureau of Diplomatic Security (DS), there were 22 attacks against U.S.  embassy facilities, consulates, or staff in 2013 alone, including an attack  against U.S. Embassy Ankara in Turkey in which a suicide bomber  detonated a concealed bomb in the embassy access pavilion. From  October 2012 to September 2016, in response to various threats, such as  terrorism, civil unrest, and natural disasters, State evacuated post staff  and their family members from 23 U.S. embassies and consulates. During  this period, several overseas posts—such as Embassy Bujumbura in  Burundi and Consulate Adana in Turkey—evacuated post staff or family  members on more than one occasion. At Embassy Sana’a in Yemen and  Embassy Tripoli in Libya, the threats were so severe and persistent that  State decided to suspend operations, withdrawing all post staff and family  members.
You asked us to review State policies and procedures for evacuating  overseas posts. This report examines (1) the processes State has  established to prepare overseas posts for crises and to conduct  evacuations and (2) State’s implementation of preparedness processes  for crises and evacuations at overseas posts.
This report is a public version of a sensitive but unclassified report that  was issued on June 28, 2017, copies of which are available upon request  for official use only by those with the appropriate need to know. State  deemed some of the information in our June report to be sensitive, which  must be protected from public disclosure. Therefore, this report omits  information identified by State as sensitive. Although the information  provided in this report is more limited, the report addresses the same  objectives as the sensitive report and uses the same methodology.
To examine the processes State has established to prepare overseas  posts for crises and to conduct evacuations, we reviewed State policies  and procedures established within the Foreign Affairs Manual (FAM) and  associated Foreign Affairs Handbooks (FAH), including a portion called  the Emergency Planning Handbook. We also reviewed memoranda of  agreement between State and the Department of Defense (DOD)  regarding coordination of U.S. military support to posts during  evacuations. We reviewed GAO’s most recent work regarding  evacuations overseas as well as DOD support for State in crises  situations. We conducted interviews with State officials at headquarters,  including with relevant regional bureaus and other groups that assist  posts during crises and evacuations, and with post staff at four overseas  posts. We also conducted interviews via secure video conferences with  two other posts and a DOD combatant command to discuss State policies  and procedures in embassy crisis and evacuation preparedness.
To assess State’s implementation of preparedness processes for crises  and evacuations at overseas posts, we conducted several analyses. First,  we reviewed DS data to determine the dates when overseas posts  completed required annual updates of their Emergency Action Plans  (EAP) for fiscal years 2013–2016. Second, we analyzed a  nongeneralizable, judgmental sample of 20 post EAPs that DS had  reviewed and approved to assess whether this sample of EAPs contained  evidence that key EAP sections, as identified by DS, had been updated.  More specifically, for all 20 EAPs, we examined the dates indicating each  key section’s most recent update to determine if the post had reviewed  and updated the information within required time frames. We selected the  sample of post EAPs to review to ensure that we examined posts that had  experienced evacuations or suspended operations since September  2012, whose evacuations or suspended operations had occurred for a  variety of reasons (e.g., natural disasters as well as security threats), with  different statuses regarding accompaniment of family members, and from  different geographic regions. We determined that the EAP data were  sufficiently reliable for the purposes of our report.
Third, we reviewed DS data on which overseas posts reported completion  of required annual drills for fiscal years 2013–2016. We determined that  these data were sufficiently reliable for that purpose. Fourth, we  requested from State officials at headquarters any required lessons  learned reports submitted by posts following evacuations for fiscal years  2013–2016. We also interviewed State and DOD officials at  headquarters, at four overseas posts, and—via secure video  conference—at two additional posts and a DOD combatant command to  gather their perspectives on State’s implementation of crisis and  evacuation preparedness processes for overseas posts. See appendix I  for further details about our scope and methodology.
The performance audit upon which this report is based was conducted  from March 2016 to June 2017 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate, evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives. We  subsequently worked with State from June 2017 to July 2017 to prepare  this version of the original sensitive but unclassified report for public  release. This public version was also prepared in accordance with these  standards.
subsections: section_title: Background
paragraphs: Overseas posts that undergo evacuations in response to threats to post  staff, family members, or facilities generally experience phased changes  to their operational status, such as an authorized or ordered departure,  potentially leading to suspended operations.
Under an authorized departure, specific overseas post staff under  chief-of-mission authority and family members may voluntarily choose  to leave the post for a designated safe haven.
Under an ordered departure, specific overseas post staff and family  members are ordered to leave for a designated safe haven. Some  staff designated by the Chief of Mission to be critical for ongoing  operations must remain at the post.
Under suspended operations, all remaining overseas post staff under  chief-of-mission authority are ordered to leave for a designated safe  haven.
An overseas post on authorized or ordered departure status goes through  a monthly review to determine if the threats to the post have since  abated. According to State officials, if the threats have abated, the post  can be taken off of departure status and placed on normal status or on  modified operating status. Figure 1 shows authorized departures, ordered  departures, and suspended operations that have occurred at overseas  posts during fiscal years 2013–2016.
While overseas posts are primarily responsible for initiating evacuations  of post staff and family members, other parts of State—and in some  cases DOD—have supporting roles. State’s Office of Crisis Management  and Strategy (CMS) provides posts with crisis management and  evacuation expertise and support. DS is responsible for security services  related to the protection of life, information, and property at overseas  posts and coordinates with posts’ DS agents—the Regional Security  Officers (RSO)—to respond to posts’ security needs. DS falls under the  Under Secretary for Management, who is the State headquarters official  responsible for approval of a number of evacuation-related decisions.
section_title: State Has Established Processes to Prepare Overseas Posts for Crises and to Conduct Evacuations
paragraphs: State has developed processes and requirements for overseas posts to  prepare EAPs and conduct drills in order to prepare for crises and  evacuations. It also has established processes for overseas posts to  follow when considering or implementing a drawdown of post personnel,  including evacuations under an authorized departure or an ordered  departure. In addition, State also has established a process for  determining whether U.S. presence in posts designated by State as high  threat and high risk should continue, discontinue, or restart operations.
subsections: section_title: Overseas Posts Prepare for Crises and Evacuations by Developing and Updating EAPs and Conducting Required Drills
paragraphs: The FAH assists posts in establishing processes and requirements to  create and annually update comprehensive, effective, and readily usable  plans to handle emergency situations at overseas posts. In particular,  checklists within a post’s EAP are to specify procedures for responding to  particular types of emergencies at overseas posts, such as civil disorder.  In addition, the FAH directs DS to review EAPs submitted annually by  overseas posts to ensure that EAPs include updated information needed  by State headquarters and other agencies to monitor or assist in  responding to emergency situations at posts.
The FAH also requires the EAP to identify decision points, which CMS  officials indicate help a post’s Emergency Action Committee (EAC)  determine when to authorize or order post staff and family members to  leave for a designated safe haven, when to initiate the evacuation of  American citizens, and when to suspend operations. The EAC is a group  of subject-matter experts designated by the Chief of Mission to provide  guidance in preparing for and responding to potential changes in risk that  might impact the safety and security of the post and the American citizens  in country. The FAH lays out several important responsibilities for a  post’s EAC, including drafting and updating the post’s EAP and  conducting drills and other crisis preparedness functions at the post.
The FAH also establishes requirements for overseas posts to regularly  conduct nine types of drills to prepare for crises and evacuations. These  drills are shown in figure 2. The required frequency of drills is determined  by a post’s threat ratings in the two Security Environment Threat List  categories: political violence and terrorism. Posts rated high or critical in  either political violence or terrorism are required to conduct each of the  drills at least twice every fiscal year. All other posts are required to  conduct these drills at least once every fiscal year.
Overseas post staff we visited reported that in addition to maintaining  EAPs and conducting required drills, other activities and training help their  posts prepare for crises and evacuations. For instance, staff at one  overseas post we visited reported that the Foreign Affairs Counter Threat  (FACT) training course and new arrival briefings help them prepare for  crises and evacuations. State established FACT to help safeguard and  prepare personnel serving in high threat countries by providing instruction  in personal security skills necessary for recognizing, avoiding, and  responding to potential terrorist and other threat situations. FACT training  will be required for all overseas post foreign affairs personnel and certain  family members by 2019. New arrival briefings—which the FAM  requires each post’s RSO to provide—are helpful because they acquaint  new post staff and family members with the post’s current security  situation and threat environment.
section_title: State Has Established Processes for Conducting Evacuations of Overseas Posts
paragraphs: The FAH establishes processes for overseas posts to follow when  considering or implementing a drawdown of post personnel, including  evacuations under an authorized departure or an ordered departure.  When a post determines that there is imminent danger to the lives of post  staff or their family members, the post’s Chief of Mission is to cable a  request for either an authorized or an ordered departure to State’s Under  Secretary for Management. Under an authorized departure, certain post  staff and all family members can voluntarily choose to depart the post by  submitting a request through the post’s EAC, which forwards it to the  Chief of Mission for a final decision. Under an ordered departure, certain  post staff and family members are ordered to depart the post. Authorized  and ordered departures can be tailored to fit the posts’ particular  circumstances. For instance, a Chief of Mission could recommend an (1)  authorized departure for certain family members only, such as children of  a certain age or spouses; (2) ordered departure of certain family  members only; or (3) ordered departure of certain family members  coupled with authorized departure of certain post staff. The FAH also  outlines how authorized and ordered departures are to be coordinated  among various sections at an overseas post, the relevant regional  bureau, and with others in State headquarters.
State guidance establishes that authorized and ordered departures are  approved for an initial period of 30 days, which may be extended in 30- day increments for a maximum of 180 days. Prior to the expiration of  each 30-day period, posts are to submit a recommendation to State  headquarters as to whether the authorized or ordered departure status  should be continued. To that end, the EAC at a post on departure status  is to meet to evaluate the security environment and determine if the crisis  situation leading to the evacuation has abated. If the EAC decides that  the crisis situation has abated, it can recommend that the Chief of Mission  submit a cable to State’s Under Secretary for Management requesting  approval to terminate the authorized or ordered departure. If an overseas  post continues on ordered departure status for 180 continuous days,  State headquarters can automatically change that post’s classification  status to unaccompanied. At unaccompanied posts, only post staff and  their post-employed family members may be present; other family  members are prohibited.
According to DS officials, if the crisis situation in-country deteriorates and  an overseas post requires U.S. military support to bolster its defensive  capabilities, the post can coordinate with DOD to receive such  assistance, depending on the location of the overseas post and the  availability of DOD assets. Overseas posts also can coordinate with DOD  in situations requiring U.S. military evacuation assistance from an  overseas post. Such DOD-assisted evacuations are known as  “noncombatant evacuation operations” and involve post personnel as well  as American citizens in country. According to the FAM, under State’s  “no double standard” policy, an overseas post is required to share the  same relevant threat information with private U.S. citizens in that country  as the post communicates to the official U.S. government community. In  cases where the evacuation of private U.S. citizens is necessary, the  policy also requires that private U.S. citizens be given the same  evacuation opportunities and assistance as the official U.S. government  community, when appropriate and feasible.
According to State officials, the costs associated with evacuations of  State staff and their family members from overseas posts are covered by  the appropriation for Emergencies in the Diplomatic and Consular  Service, also known as the K Fund. Other agencies with staff and family  members at overseas posts, such as the U.S. Agency for International  Development, are responsible for covering the costs associated with the  evacuation of their staff and family members. In fiscal years 2010 through  2016, State’s reported costs associated with evacuating from posts on 53  occasions were roughly $25.5 million. According to State officials, costs  associated with evacuations varied due to several factors, including the  number of post staff and family members evacuated. In fiscal year 2014,  costs associated with evacuating Embassy Maseru in Lesotho were  roughly $20,000, while in the same year, costs associated with  evacuating Embassy Sana’a in Yemen were roughly $1.9 million. Figure 3  displays the K Fund expenditures for post evacuations during fiscal years  2010–2016.
After an authorized or ordered departure has been terminated at an  overseas post, State guidance recommends that posts engage in a  lessons learned discussion. CMS at headquarters is to work with the  overseas post, the relevant regional bureau, and State’s Management  Bureau to facilitate a lessons learned discussion for the record. State  guidance also requires post staff to transmit an after-action report listing  lessons learned to State headquarters.
section_title: Overseas Posts Deemed Likely to Experience Crises and Evacuations Are Subject to Additional Review through the Vital Presence Validation Process
paragraphs: According to State officials, because of the attacks in Benghazi, Libya,  and other overseas posts in 2012, State developed and implemented a  risk assessment process called the Vital Presence Validation Process  (VP2). State officials indicated that VP2 is an annual assessment by  senior management at State headquarters—in consultation with affected  posts and respective regional bureaus—to determine whether the U.S.  presence in the approximately 30 posts designated by State as high  threat and high risk should continue, discontinue, or restart operations.  According to State officials, State also conducts VP2 reviews for opening  or reopening overseas posts categorized as critical threat, or high threat,  high risk. VP2 is not meant for determining short-term evacuations from a  post, such as authorized or ordered departures. State’s Office of  Management, Policy, Rightsizing, and Innovation is responsible for  coordinating VP2 assessments. During these assessments, the affected  overseas post and respective regional bureau are to complete a  document detailing, among other things, threats to a post and any  mitigating factors; the post’s staffing, mission, and programs; program  implementation; and program benefits. The Core High Threat Post  Review Board, which includes representatives from various State offices,  is to review and endorse each VP2 assessment before sending it for  approval to the Under Secretary for Political Affairs and the Under  Secretary for Management. The VP2 assessment is then sent to the  Deputy Secretary of State and the Deputy Secretary for Management and  Resources for consideration and final approval.
section_title: State Has Gaps in Its Crisis and Evacuation Preparedness for Overseas Posts
paragraphs: State’s implementation of preparedness processes for crises and  evacuations at overseas posts has multiple gaps:
Overseas posts have not updated EAPs annually within required time  frames.
When EAPs are submitted to DS for annual certification, DS does not  fully review key EAP sections that should be updated each year.
EAPs are lengthy and cumbersome documents that are not readily  usable in emergency situations, according to State officials.
Although overseas posts are required to conduct drills intended to  prepare for crises and evacuations, for fiscal years 2013–2016, posts  reported completing about half of their required drills.
Overseas posts have not submitted required lessons learned reports  following evacuations.
The gaps in State’s implementation of preparedness processes for crises  and evacuations at overseas posts increase the risk that post staff are not  sufficiently prepared to handle crisis and emergency situations.
subsections: section_title: Overseas Posts Have Not Updated Emergency Action Plans within Required Time Frames
paragraphs: Although the FAH requires each overseas post to comprehensively  review and update its EAP annually, from fiscal year 2013 to 2016, almost  a quarter of overseas posts, on average, did not complete required  annual EAP updates within specified time frames. During the  comprehensive review, each post must update any out-of-date  information and certify that all other information remains current.  Overseas posts have made considerable improvements in their timeliness  in completing EAP updates during fiscal years 2015-2016 compared to  fiscal years 2013-2014. State headquarters officials noted that, following  the attack in Benghazi, Libya, in September 2012, State took actions to  encourage overseas posts to improve their timeliness in completing  annual EAP updates. These actions included State headquarters  becoming more involved in annually reviewing decision points in posts’  EAPs as well as State headquarters issuing cables emphasizing that  posts need to update their EAPs annually.
In fiscal year 2016, about 1 in 12 overseas posts were late in completing  required annual updates. On average, these posts were about 6 months  late in completing their EAP updates. For fiscal year 2016, the list of  posts that were late in completing their annual EAP updates included 7  posts rated high or critical in political violence or terrorism. Table 1 shows,  for fiscal years 2013 to 2016, the percentage of overseas posts that did  not complete required annual updates of EAPs within the 1-year deadline and the average number of months these EAP updates were late. See  appendix II for additional details on posts that were late in completing  their EAP updates for fiscal year 2016.
Officials at all six overseas posts we met with reported some difficulties  using the current electronic system to update their EAPs. Difficulties in  using the current system, as well as challenges in reviewing and updating  a relatively large document, may impact posts’ timely completion of EAP  updates. Overseas posts with EAPs that have not been annually  reviewed and updated as required could leave post staff insufficiently  prepared to handle emergency situations, placing them and others with  them at increased risk of harm.
According to DS officials, in response to our ongoing work, in December  2016 DS developed new guidance and policy to encourage posts to  complete their annual EAP updates on time. In particular, DS developed a  standardized 60-day notice e-mail and established policy to send these  standardized notices to all posts 60 days before the deadline for posts’  annual EAP update submissions. While implementation of this action may  assist in reminding all posts of the relevant requirements, further steps,  such as focusing follow-up efforts on the posts that are late in their  submission, could result in improved timeliness.
section_title: DS Does Not Fully Review Key Sections of EAPs Submitted by Overseas Posts
paragraphs: The FAH directs DS to review each EAP submitted by an overseas post  during the annual EAP review cycle to ensure that EAPs include updated  information needed by State headquarters and other agencies to monitor  or assist in responding to emergency situations at posts. To conduct  these annual reviews, DS Emergency Plans Review Officers in  Washington use a list of 27 key EAP sections that the Emergency Plans  Review Office has determined should be updated each year. According  to DS officials, Emergency Plans Review Officers spot check these 27  key EAP sections to review and approve each EAP. In addition, DS  officials told us that Review Officers consider forms included in key EAP  sections that they spot check to meet the annual update requirement if  the forms were updated up to 3 years prior to the check.
DS does not document its annual EAP review process. We requested the  results of the Emergency Plans Review Officer reviews, including data on  who conducted them and what deficiencies, if any, were found. Federal  internal control standards call for agency management to evaluate  performance and hold individuals accountable for their internal control  responsibilities. However, DS was unable to provide copies of the  reviews completed because the Emergency Plans Review Officers do not  document these results.
Our analysis of a nongeneralizable sample of EAPs for 20 posts that DS  had reviewed and approved showed that only 2 of the 20 posts’ EAPs  included evidence that posts had updated all 27 key sections. In the  remaining 18 of 20 posts’ EAPs, we found at least 1 key EAP section that  had not been updated. The extent to which each post had not updated its  EAP varied. For example, one post had not updated almost 90 percent of  the 27 key EAP sections that we reviewed, while another post had not  updated about 20 percent of the 27 key EAP sections that we reviewed.  For all 20 EAPs we reviewed, on average, posts had not updated over 50  percent of the key EAP sections we reviewed. In addition, in several  EAPs we reviewed, we found emergency supplies listed that were a year  or more past their expiration dates. Because DS Emergency Plans  Review Officers do not check all 27 key EAP sections, EAPs submitted to  DS have not been fully reviewed. Overseas posts with EAPs that have  not been fully reviewed may leave post staff—especially new staff— insufficiently prepared to respond to emergencies and leave State and  other agencies without accurate information to assist an affected post  during an emergency.
section_title: Emergency Action Plans Are Viewed As Lengthy and Cumbersome Documents That Are Not Readily Usable in Emergency Situations
paragraphs: According to the FAH, EAPs should be readily usable plans to handle  emergency situations and should contain information to assist post staff in  responding to emergencies. In addition, federal internal control  standards call for an agency to internally communicate necessary quality  information to achieve the agency’s objectives.
However, at both State headquarters and at all six posts we met with,  officials told us that EAPs are lengthy and cumbersome documents that  are not readily usable in emergency situations. Officials at all six posts  also said that EAPs are voluminous documents that contain large  amounts of boilerplate content, and officials at four of six posts we met  with noted that this includes especially explicit instructions on how to fill  out each of the plan’s sections and subsections. The boilerplate content  in EAPs is automatically generated by the electronic system that all posts  use to draft and update their EAPs; this content focuses on information  about how posts should update their plans rather than information on how  to handle emergency situations. In addition, none of the nongeneralizable  sample of 20 EAPs that we reviewed had a single, comprehensive table  of contents or index, potentially making it challenging for post staff to  search for and find a particular section quickly, especially during an  emergency.
While officials from State headquarters and all six posts we met with told  us that EAPs are not readily usable in emergency situations, officials at  five of the six posts we met with also said there is value for post staff to  participate in the process of updating EAPs to prepare for emergencies.  The process of updating the EAP, they noted, includes reviewing  applicable checklists and contact lists before an emergency occurs, which  can help post staff be better prepared in the event of an emergency.  Officials at two of the six posts we met with also observed that EAPs  contain large amounts of guidance because it is easier for responsible  staff at post to complete required updates to their specific sections if all  the guidance they need is directly written into each EAP.
However, officials at five of the six posts we met with suggested that  having a streamlined version of the EAP—such as a shorter EAP with just  checklists and contact lists—in addition to the full EAP could make the  EAP more readily usable in emergency situations. Officials at five of the  six posts we met with also suggested that making a streamlined EAP that  is not marked as sensitive or classified and could be stored on a mobile  device could also be helpful in an emergency situation. This could allow  staff at post who do not have security clearances—such as locally  employed security personnel—to more readily access the EAP. While the  FAH requires posts to maintain full copies of their EAPs—in printed hard  copy and CD-ROM forms—it does not contain a provision for preparing or  maintaining alternate streamlined versions of the posts’ EAPs. Absent  such a change in State’s relevant policy and procedures, officials may not  have readily usable important information during a crisis.
State is in the process of developing a new electronic system for  overseas posts to draft and update their EAPs to address issues with the  current system, according to State headquarters officials. For example,  officials told us that post staff have complained that the current system is  cumbersome to work with, difficult to search and navigate, and makes  drafting and updating their EAPs difficult and time consuming. State  headquarters officials also said they hope the new system will allow staff  to more quickly and easily draft and update their EAPs. They also said  they hope the new system will result in more streamlined EAPs. State  plans to launch the new system in the second half of 2017. As State  develops its system, officials could consider turning their hopes for  streamlined EAPs into specific requirements for the planned system.
section_title: Overseas Posts Reported Completing About Half of Required Drills Intended to Prepare Post Staff for Crises and Evacuations
paragraphs: Although the FAH establishes requirements for overseas posts to  annually conduct nine types of drills to prepare for crises and  evacuations, we found that, on average for fiscal years 2013–2016,  overseas posts reported completing 52 percent of required drills.  Officials at headquarters and at all six overseas posts we met with told us  that regularly conducting required annual drills is one of the most  important steps to help prepare post staff for crises and evacuations and  to keep them safe during crisis events. The required frequency of  required drills is determined by ratings in the two Security Environment  Threat List categories of political violence and terrorism. Posts that are  not rated high or critical in political violence or terrorism are required to  conduct nine types of drills at least once per fiscal year. Posts that are  rated high or critical in political violence or terrorism are required to  conduct the same nine types of drills at least twice per fiscal year.
Relevant incident commanders at posts, including RSOs, are tasked with  organizing and conducting required drills under their respective areas of expertise or responsibilities. RSOs record their posts’ completion of drills  into DS’s Security Management Console, which logs the drill records into  a drilling database maintained by DS. While DS collects the information  submitted by RSOs in the database, DS does not independently verify the  data to ensure its accuracy or validity.
State officials told us that when posts are identified as being  noncompliant with drilling reporting during post security program reviews,  DS works with posts either to retroactively input data on completed drills  or conduct remaining drills in a timely manner. DS officials also told us  that, partly in response to our ongoing work, the bureau has recently  developed a standard operating procedure to review drilling data  quarterly. However, the results of the first analysis of these data were  unavailable at the time of our review.
As shown in table 2, for fiscal years 2013 through 2016, overseas posts  reported completing an average of 52 percent of required annual drills.  For fiscal years 2013 through 2016, overseas posts rated high or critical  in political violence or terrorism reported completing an average of 44  percent of required annual drills.
Figure 4 provides a breakdown by drill type of the percentage of overseas  posts reporting completion of each type of required annual drill, on  average, for fiscal years 2013 through 2016. Completion rates for the  drills ranged from a high of 78 percent to a low of 22 percent, depending  on the type of drill. For example, in fiscal years 2013 through 2016, an  average of 78 percent of posts reported completing required duck and  cover drills; an average of 58 percent of posts reported completing  required employee warden system drills; an average of 36 percent of  posts reported completing required evacuation/drawdown training drills;  and an average of 22 percent of posts reported completing the required  consular warden system drills.
For fiscal years 2013 through 2016, we found that, on average, 3.4  percent of posts reported completing all required annual drills (see   table 3).
For those posts rated high or critical in political violence or terrorism, we  found that, on average for fiscal years 2013 through 2016, 2.3 percent of  posts reported completing all drills at least twice per fiscal year as  required (see table 4).
State headquarters officials told us that, while posts are aware of the  requirements to report completed drills, posts may be underreporting drills  completed. They said that post RSOs have significant workloads and that  this may result in RSOs failing to report a post’s completion of some  required drills. When RSOs report completion of drills in the DS Security  Management Console, the FAH also requires that they record information  about how the drill was conducted, including post participation,  deficiencies identified, and corrective actions. These additional reporting  requirements further add to RSO workloads and may contribute to  underreporting, according to State headquarters officials. Moreover, State  officials told us that incident commanders responsible for conducting  certain types of drills may not notify RSOs about completed drills. Absent  more complete drill reporting, State headquarters and post leadership  lack information on posts’ preparedness for responding to crises and  conducting evacuations.
DS officials told us that—partly in response to our ongoing work—the  bureau recently has established a DS Drills Working Group to clarify RSO  roles and requirements for reporting drills and to address some of the  challenges leading to underreporting the completion of required drills. DS  officials also told us that they plan to modify the new electronic system for  drafting and updating EAPs to include a post drills reporting feature. This  feature, projected by DS to be incorporated into the new system in 2018,  would allow incident commanders to report completion of drills for which  they are responsible. DS officials said that they hope this new feature will  improve the reporting of completed required drills.
Nevertheless, officials at three posts we met with told us that posts may  not be completing required drills because compliance with annual drilling  requirements is not a priority in State’s organizational culture. For  example, officials at one post rated high in political violence and terrorism  told us that the previous RSO had not adhered to the post’s drilling  schedule for meeting annual drilling requirements. The new RSO at this  post told us that the previous RSO had completed less than 40 percent of  required drills in fiscal year 2016. Another official at the same post told us  that the Ambassador had denied requests for additional drills that the new  RSO deemed necessary, saying that the post was too busy to hold such  drills. If drills are not conducted as required, overseas post staff may lack  the preparation to respond to a crisis, which could endanger post staff  and family members.
section_title: Overseas Posts Have Not Submitted Required Lessons Learned Reports following Evacuations
paragraphs: During fiscal years 2013 through 2016, there were 31 evacuations from  overseas posts; however, according to CMS, none of the posts submitted  required lessons learned reports to State headquarters following the  termination of their authorized or ordered departures. We requested that  State headquarters provide us with any documents—produced by  overseas posts—containing lessons learned or any challenges  encountered by posts that experienced an evacuation during fiscal years  2013 through 2016. State was unable to provide any documents  responsive to our request. CMS officials told us that State currently does  not have an established process for centrally collecting and assessing  lessons learned documents, but that CMS is taking steps to develop and  implement such a process. In September 2016, CMS formed a new unit  to work on, among other tasks, lessons learned projects to ease the  burden on posts and to develop a collection and assessment process for  lessons learned. Separately from CMS, DS provided us with two  classified reports containing some lessons learned about overseas posts  that had experienced evacuations. However, neither of these documents  was produced by the overseas posts themselves and, according to DS  and CMS officials, DS is not the entity within State that is responsible for  collecting and assessing lessons learned reports from posts following  evacuations.
As previously discussed, State guidance recommends that posts engage  in a lessons learned discussion after an authorized or ordered departure  has been terminated. State’s CMS team at headquarters is to work with  the overseas post, the relevant regional bureau, and State’s Management  Bureau to facilitate a lessons learned discussion for the record.  Additionally, the FAH requires post staff to transmit an after-action report  listing any lessons learned from their experience to State headquarters.  In addition, federal internal control standards call for agency management  to hold individuals accountable for their internal control responsibilities  and to establish and operate monitoring activities to monitor the internal  control system and evaluate the results.
CMS officials told us that overseas posts often lack sufficient resources to  produce lessons learned reports following termination of the post’s  authorized or ordered departure. CMS officials also told us that even after  the crisis leading to an evacuation has abated and staff have returned to  post, there is often a backlog of tasks to be completed. They also said  completing these tasks is a priority for post staff, which limits their ability  to develop and submit lessons learned reports. Moreover, CMS officials  said that post staff curtailments also can challenge a post’s ability to  develop and submit lessons learned reports following an evacuation, as  staff present during the evacuation may no longer be present when the  post resumes normal operations.
We learned of several challenges that posts faced in different evacuations  in discussions with officials from the six posts with whom we met.  Different posts mentioned various challenges, including disorganized  evacuation logistics and transportation, unclear communication with local  staff, confusion surrounding the policy for evacuating pets, problems with  shipment and delivery of personal effects, difficulty tracking the  destination of staff who were relocated, poor communication with senior  State leadership regarding the post’s evacuation status, difficulties getting  reimbursement for lodging or personal expenses related to the  evacuation, and other similar challenges.
Absent a functioning lessons learned process, State’s ability to identify  lessons learned and to share best practices from staff that have  experienced evacuations may be constrained. According to CMS officials,  holding lessons learned exercises can help to identify challenges that a  post faced during an evacuation within a reasonable time frame. The  subsequent after-action reports could be used to modify guidance for  posts on how to best respond to emergency situations. According to CMS  officials, these reports also can help staff at other overseas posts learn  about the challenges the evacuated posts faced, identify relevant insights  and best practices, and prepare for potential future evacuations.
section_title: Conclusions
paragraphs: U.S. personnel working at overseas posts, along with the family members  who accompany them, face a range of threats to their safety and  security—such as terrorism, civil unrest, and natural disasters. To help  protect them, State has established processes to prepare overseas posts  for crises and to conduct evacuations. However, State has significant  gaps in implementation of its preparedness processes for crises and  evacuations at overseas posts. Overseas posts are not completing  required annual EAP updates, DS is not identifying incomplete updates in  its EAP reviews, and the EAPs themselves are not readily usable during  emergency situations. In addition, although regular drilling is a critical  crisis preparedness task, very few overseas posts have completed all  required annual drills. Finally, because overseas posts are not submitting  required after-action reports containing lessons learned following  evacuations, State is missing important opportunities to identify  challenges and best practices and to make changes to prepare for future  evacuations from overseas posts. While State has taken initial actions— including some actions in response to our ongoing work—to improve  implementation of its preparedness processes for crises and evacuations,  significant shortcomings exist. While each of these gaps is of concern,  taken together, they increase the risk that post staff are not sufficiently  prepared to handle crisis and emergency situations.
section_title: Recommendations for Executive Action
paragraphs: To address gaps in State’s crisis and evacuation preparedness, we  recommend that the Secretary of State take the following five actions:  1.  Take additional steps to ensure that overseas posts complete annual  updates of their EAPs within required time frames, such as identifying  posts that are late in completing their annual updates and continuing  to follow up with those posts until they complete their annual EAP  updates.  2.  Establish a monitoring and tracking process to ensure that DS fully  reviews and documents the review of key sections of EAPs submitted  to it during the annual EAP review cycle.  3.  Take steps to make the EAP more readily usable during emergency  situations. For example, State could develop a more streamlined  version of the EAP—consisting of key sections, checklists, and  contact lists—that could be used by overseas post staff, in addition to  the full EAP. In addition, for its new system planned for later this year,  State could consider including requirements for streamlined EAPs.  4.  Take steps to ensure that overseas posts complete and report  completion of required drills within mandated time frames.  5.  Take steps to ensure that overseas posts complete required lessons  learned reports following authorized or ordered departures and submit  the reports to State headquarters for analysis.
section_title: Agency Comments
paragraphs: We provided a draft of the sensitive but unclassified report to State and  DOD for comment. State’s comments on the sensitive but unclassified  report are reprinted in appendix IV. In its comments, State concurred with  all five recommendations and described actions planned or under way to  address them. For example, State concurred with our recommendation  that the department take steps to make the EAP more readily usable  during emergency situations. State further said that it is developing a  redesigned EAP that minimizes redundancy, groups content according to  posts’ planning and response needs, and makes the EAP organized and  user-friendly for all EAC members and other users. State also provided  technical comments on the draft of the sensitive but unclassified report,  which we incorporated as appropriate. DOD did not provide comments on  the draft of the sensitive but unclassified report.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of State, and the Secretary of Defense. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix V.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report examines (1) the processes the Department of State (State)  has established to prepare overseas posts for crises and to conduct  evacuations and (2) State’s implementation of preparedness processes  for crises and evacuations at overseas posts. This report is a public  version of a sensitive but unclassified report that was issued on June 28,  2017, copies of which are available upon request for official use only by  those with the appropriate need to know. State deemed some of the  information in our June report to be sensitive, which must be protected  from public disclosure. Therefore, this report omits information identified  by State as sensitive. Although the information provided in this report is  more limited, the report addresses the same objectives as the sensitive  report and uses the same methodology.
To conduct this review, we obtained and analyzed guidance from State’s  Foreign Affairs Manual (FAM) and Foreign Affairs Handbooks (FAH),  including a portion called the Emergency Planning Handbook. We  analyzed information from State’s Emergency Action Plans (EAP) drilling  database, Security Environment Threat List, and the State account for  Emergencies in the Diplomatic and Consular Service known as the K  fund. In addition, we interviewed officials from State’s Bureau of  Diplomatic Security (DS); Office of Management Policy, Rightsizing, and  Innovation; Crisis Management Support; Africa Regional Bureau; Western  Hemisphere Regional Bureau; Near Eastern Affairs Regional Bureau; and  European Regional Bureau. We reviewed GAO’s most recent work  regarding evacuations and the Department of Defense’s (DOD) support  for State in crisis situations. We also interviewed representatives from  DOD’s Under Secretary of Defense for Policy.
We conducted fieldwork at four overseas posts in the Africa and the Near  East geographic regions. We are not naming the specific posts we visited  for this review due to security concerns. In addition, we conducted  interviews—via secure video conference—with two additional posts in the  Near East and Africa geographic regions, and with a DOD combatant  command to gather their perspectives on State’s implementation of crisis  and evacuation preparedness processes for overseas posts. This sample  of countries was designed to account for geographic diversity and to  include posts that have experienced authorized departure, ordered  departure, and suspended operations since September 2012; had a mix  of posts where family members or members of household were  authorized or not authorized to reside; and a mix of both high-risk posts  and posts where a Vital Presence Validation Process (VP2) assessment  had been conducted. At posts we visited, we met with a variety of post  staff including Emergency Action Committee members, Ambassadors,  Deputy Chiefs of Mission, Regional Security Officers (RSO), Management  Counselors, Community Liaison Office Coordinators, and U.S. staff and  locally employed staff who had experienced previous evacuations.
To examine the processes State has established to prepare overseas  posts for crises and to conduct evacuations, we reviewed State’s policies  and procedures in the FAM and associated FAH requiring posts to  prepare EAPs and to conduct crisis-situation and evacuation drills, as well  as policies and procedures to conduct evacuations at overseas posts. We  also reviewed memoranda of agreement between State and DOD  regarding coordination of U.S. military support to posts during  evacuations. We interviewed State officials at headquarters, including  from relevant regional bureaus and other offices and groups that assist  posts during crises and evacuations, and at four overseas posts. Further,  we interviewed officials via secure video conferences at two additional  posts and a DOD combatant command to discuss State policies and  procedures that define their roles in crisis and evacuation preparedness.
To determine the amount State had spent on evacuation-related  expenses, we assessed State-provided expenditure data from the K Fund  by totaling the amounts reported for overseas post evacuations that took  place in fiscal years 2010–2016; we did not conduct a financial audit of  the expenditure data. The K Fund is used to cover post evacuation- related expenditures. State provided K Fund data on overseas post  evacuations that it collects and tracks through its Global Financial  Management System for these years. We assessed the reliability of these  data by querying knowledgeable State officials about them. We  determined that the data were sufficiently reliable to present State’s  expenditures on evacuations in fiscal years 2010 through 2016.
To assess State’s implementation of preparedness processes for crises  and evacuations at overseas posts, we conducted several analyses. First,  to assess the extent to which overseas posts annually updated EAPs  within required time frames, we reviewed DS data to identify the dates  when overseas posts completed the required annual updates of their  EAPs for fiscal years 2013–2016. To assess the reliability of DS data on  when posts completed their annual EAP updates, we performed basic  logic checks on the data provided and reviewed DS’s responses to a  series of data reliability questions. We concluded that the DS data on  EAP annual updates were sufficiently reliable for the purposes of our  report. Second, to determine the extent to which DS met requirements to  fully review key sections of EAPs submitted by overseas posts, we  requested documentation from DS on the reviews completed, including  who conducted them and what deficiencies, if any, were found.
Third, we analyzed a nongeneralizable, judgmental sample of 20 post  EAPs that DS had reviewed and approved to assess whether this sample  of EAPs contained evidence that key EAP sections, as identified by DS,  had been updated. We selected the sample of post EAPs to ensure that  we examined EAPs from posts that had experienced evacuations or  suspended operations since September 2012, whose evacuations or  suspended operations that had occurred for a variety of reasons (e.g.,  natural disasters as well as security threats), with different statuses  regarding accompaniment of family members, and from different  geographic regions. For all 20 EAPs, we examined the dates indicating  each key section’s most recent update to determine if the overseas post  had reviewed and updated the information within required time frames.  The dates we reviewed are updated by State’s current electronic system  for generating and updating EAPs whenever a section of the EAP is  edited and put through the approval process for republication. We  reviewed available unclassified and classified portions of the 20 EAPs  requested. However, the classified and unclassified portions of these  EAPs were not current as of the same date; therefore, we restricted our  analysis to the unclassified portions. By reviewing the available  unclassified portions of these EAPs, we were able to assess an average  of over 70 percent of the 27 key EAP sections for the 20 EAPs in our  nongeneralizable sample. State officials explained that each overseas  post determines which portions of its EAP should be classified. The  portions of EAPs that were classified varied by post—both the number of  portions that were classified and which ones—due to the differing  situations and risks faced by each post. To assess the degree to which  the EAPs are readily usable in emergency situations, we interviewed staff  at overseas posts and State headquarters about the utility of EAPs in  emergency situations. In addition, for the sample of 20 EAPs we  reviewed, we determined the average number of pages of those  documents.
Fourth, to understand the extent to which posts have complied with  requirements to conduct drills intended to prepare them for crises and  evacuations, we reviewed DS’s drilling database for overseas posts for  fiscal years 2013–2016. RSOs report completion of their post’s drills into  DS’s RSO Security Management Console, which logs the drill records  into a drilling database maintained by DS. The data elements we  assessed from the drilling database were for overseas posts that reported  completing required drills for fiscal years 2013–2016. DS officials  indicated that some posts may be underreporting completion of their  required drills. In addition, DS is unable to confirm that all drills completed  by posts for fiscal years 2013–2016 were reported in DS’s RSO Security  Management Console. Consequently, the data elements we assessed  from the drilling database do not fully capture the extent to which drills  might have been completed at posts for fiscal years 2013–2016. In  analyzing the data, we also requested and received from DS information  on those posts that were rated high or critical for terrorism or political  violence on its Security Environment Threat List for fiscal years 2013– 2016, as those posts have more frequent annual drilling requirements.
Upon reviewing the Security Environment Threat List data along with the  data on posts from the drilling database, we found 23 posts with potential  data anomalies. We sent DS follow-up questions to clarify these  anomalies and received responses from DS. To assess the reliability of  the drilling database, we performed basic logic checks on the database  and reviewed State’s responses to a series of data reliability questions.  We concluded that, although State does not independently verify the  accuracy of data reported within DS’s RSO Security Management  Console to ensure its accuracy or validity, the data are sufficiently reliable  for the purposes of reviewing which overseas posts reported completing  required annual drills for fiscal years 2013-2016.
Fifth, to determine the extent to which overseas posts that had  experienced evacuations complied with requirements to submit lessons  learned reports to State headquarters following the termination of an  authorized or ordered departure, we requested from State officials at  headquarters any required lessons learned reports submitted by posts  following evacuations for fiscal years 2013–2016. State was unable to  provide us with any lessons learned reports.
The performance audit upon which this report is based was conducted  from March 2016 to June 2017 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate, evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives. We  subsequently worked with State from June 2017 to July 2017 to prepare  this version of the original sensitive but unclassified report for public  release. This public version was also prepared in accordance with these  standards.
section_title: Appendix II: U.S. Overseas Posts Late in Completing Required Annual Update of Their Emergency Action Plan for Fiscal Year 2016
paragraphs: For fiscal year 2016, 203 overseas posts were required to complete  annual updates of their Emergency Action Plans (EAP). Of these, the 17  posts listed below were late in completing their required annual updates.
section_title: Appendix III: Main Sections, Annexes, and Appendixes of the Emergency Action Plan (EAP) and 27 Key EAP Sections
paragraphs: The Foreign Affairs Handbook directs the Department of State’s (State)  Bureau of Diplomatic Security (DS) to review the Emergency Action Plans  (EAP) annually submitted by overseas posts to ensure that it contains the  necessary information. Each EAP for an overseas post includes the main  sections, annexes, and appendixes listed below. To conduct the annual  reviews, DS Emergency Plans Review Officers in Washington, D.C., use  a list of 27 key EAP sections that the program office has determined  should be updated each year. The 27 key EAP sections reviewed by DS  are also listed below, indicated with a  (key) symbol. Several of the key  EAP sections contain related checklists or forms.
section_title: Appendix IV: Comments from the Department of State
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Thomas Costa (Assistant  Director), Ian Ferguson (Analyst-in-Charge), Mason Thorpe Calhoun,  David Dayton, Neil Doherty, Ming Chen, Martin de Alteriis, and Mark  Dowling made key contributions to this report.