Chemical, Biological, Radiological, and Nuclear Risk Assessments: DHS Should Establish More Specific Guidance for Their Use
Published: 2012-01-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The 2001 anthrax attacks in the United States highlighted the need to develop response plans and capabilities to protect U.S. citizens from chemical, biological, radiological, and nuclear (CBRN) agents. Since 2004, the Department of Homeland Security (DHS) has spent at least $70 million developing more than 20 CBRN risk assessments. GAO was requested to assess, from fiscal year 2004 to the present, the extent to which DHS has used its CBRN risk assessments to inform CBRN response plans and CBRN capabilities, and has institutionalized their use. GAO examined relevant laws, Homeland Security Presidential Directives, an Executive Order, DHS guidance, and all 12 relevant interagency CBRN response plans developed by DHS. Based on a review of a United States governmentwide CBRN database and DHS interviews, among other things, GAO selected a nongeneralizable set of seven DHS capabilities used specifically for detecting or responding to CBRN incidents to identify examples of DHSs use of its CBRN risk assessments. GAO also interviewed relevant DHS officials. This is a public version of a classified report that GAO issued in October 2011. Information DHS deemed sensitive or classified has been redacted.
section_title: What GAO Found
paragraphs: Since 2004, DHSs use of its CBRN risk assessments to inform its CBRN response plans has varied, from directly influencing information in the plans to not being used at all. DHS guidance states that response planning and resource decisions should be informed by risk information. GAOs analysis showed that DHS used its CBRN risk assessments to directly inform 2 of 12 CBRN response plans GAO identified because planners considered the risk assessments to be more accurate than earlier DHS planning assumptions. For another 7 of the 12 plans, DHS officials said that the assessments indirectly informed the plans by providing background information prior to plan development. However, GAO could not independently verify this because DHS officials could not document how the risk assessments influenced the information contained in the plans. GAOs analysis found general consistency between the risk assessments and the plans. For the remaining 3 plans, DHS officials did not use the risk assessments to inform the plans; for 2 of the 3 plans DHS officials told GAO they were not aware of the assessments. DHS officials also noted that there was no departmental guidance on when or how the CBRN risk assessments should be used when developing such plans.
Since 2004, DHSs use of its CBRN risk assessments to inform its CBRN-specific capabilities has varied, from directly impacting its capabilities to not being used at all. Of the 7 capabilities GAO reviewed, one was directly informed by the risk assessments; DHS used its biological agent risk assessments to confirm that its BioWatch program could generally detect the biological agents posing the greatest risk. For 5 of the 7 capabilities, DHS officials said they used the risk assessments along with other information sources to partially inform these capabilities. For example, DHS used its chemical agent risk assessments to determine whether its chemical detectors and the risk assessments were generally aligned for the highest risk agents. For 3 of these 5 capabilities, GAO could not independently verify that they were partially informed by the risk assessments because DHS officials could not document how the risk assessments influenced the capabilities. DHS did not use its CBRN risk assessments to inform the remaining CBRN capability because the assessments were not needed to meet the capabilitys mission.
DHS and its components do not have written procedures to institutionalize their use of DHSs CBRN risk assessments for CBRN response planning and capability investment decisions. Standards for internal control in the federal government call for written procedures to better ensure managements directives are enforced. DHS does not have procedures that stipulate when and how DHS officials should use the departments CBRN risk assessments to inform CBRN response planning and capability investment decisions, and GAO found variation in the extent to which they were used. DHS officials agree with GAO that without written procedures, the consistent use of the departments CBRN risk assessments by DHS officials may not be ensured beyond the tenure of any given agency official. DHS could better help to ensure that its CBRN response plans and capabilities are consistently informed by the departments CBRN risk assessments by establishing written procedures detailing when and how DHS officials should consider using the risk assessments to inform their activities.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS develop more specific guidance, including written procedures, that details when and how DHS components should consider using the departments CBRN risk assessments to inform related response planning efforts and capability investment decision making. DHS agreed with the recommendation.

section_title: Letter
paragraphs: The anthrax attacks of 2001 raised concerns that the United States is  vulnerable to threats from chemical, biological, radiological, and nuclear  (CBRN) agents. Moreover, the 2007 National Strategy for Homeland  Security stated that terrorists have declared their intention to acquire and  use CBRN agents as weapons to inflict catastrophic attacks against the  United States. More recently, the May 2010 National Security Strategy  noted that the American people face no greater or more urgent danger  than a terrorist attack with a nuclear weapon. The strategy further said  that the effective dissemination of a lethal biological agent within a U.S.  city would endanger the lives of hundreds of thousands of people and  have unprecedented economic, societal, and political consequences.addition, multiple stakeholders have assessed the federal government’s  ability to protect the nation from CBRN agents and deemed it inadequate.  For example, in January 2010, the congressionally mandated  Commission on the Prevention of Weapons of Mass Destruction  Proliferation and Terrorism reported that the federal government lacked  the capability to rapidly recognize, respond to, and recover from a terrorist  attack using biological agents.
Because CBRN agents differ in their potential to be used to cause  widespread illness and death, members of Congress have expressed the  need for the Department of Homeland Security (DHS) to assess the risks  posed by CBRN agents to identify those that are highest risk and develop  necessary response plans and capabilities.DHS produces CBRN threat and risk assessments that analyze the  potential for adverse outcomes as a result of an attack with such agents.  Since 2004, DHS has spent over $70 million developing these analyses.  Assessing the risks posed by CBRN agents requires analyzing and  modeling areas of uncertainty, including determining an adversary’s  capability to acquire these agents, develop them into weapons, and  disseminate them to estimate the plausibility and consequences of such  attacks. These assessments are designed so that decision makers can  use them to inform priorities, develop or compare courses of action, and  inform federal planning and investments for responding to the highest risk  CBRN incidents.
To address these needs,  The 2007 National Strategy for Homeland Security (Strategy) notes that  the nation must apply a risk-based framework across all homeland  security efforts to identify and assess potential hazards, determine what  levels of relative risk are acceptable, and prioritize and allocate resources  among homeland security partners to, among other things, respond to  and recover from CBRN incidents. The Strategy states that a disciplined  approach to managing risk will help to achieve overall effectiveness and  efficiency in securing the nation. Further, the Strategy notes that for  homeland security efforts to succeed federal dollars must be allocated  based on risk assessments and on accountability for results; once  allocated, funds must be used to support or develop operational plans  and their derivative requirements and capabilities.
In June 2011 we reported on DHS and the Department of Health and  Human Services (HHS) coordination for developing CBRN risk  assessments.other and with other federal departments to varying extents over time to  develop CBRN risk assessments, but that neither department has written  procedures for developing these assessments. We recommended that   We found that DHS and HHS have coordinated with each  DHS develop time frames and milestones to better ensure timely  development of and interagency agreement on written procedures for the  development of its CBRN risk assessments, and DHS agreed with our  recommendation. DHS stated that the department had begun efforts to  develop milestones and time frames for development of strategic and  implementation plans for interagency CBRN risk assessment  development.
You asked us to examine DHS’s use of its CBRN risk assessments. This  report assesses the extent to which, from 2004 to the present, DHS (1)  used its CBRN risk assessments to inform its CBRN response plans and  (2) CBRN capabilities, and (3) institutionalized the use of its CBRN risk  assessments for such activities through written policies and procedures.
This report is a public version of the prior classified report that we  provided to you. DHS deemed some of the information in the prior report  as sensitive or classified, which must be protected from public disclosure.  Therefore, this report omits sensitive or classified information contained in  DHS’s CBRN risk assessments and CBRN response plans. In addition,  this report omits sensitive or classified information about DHS CBRN  capabilities. Although the information provided in this report is more  limited in scope, it addresses the same objectives as the classified report.  Also, the overall methodology used for both reports is the same.
To address objectives 1 and 2, we analyzed relevant federal laws,  presidential directives, executive orders, and national strategies. For  example, we reviewed presidential directives on national preparedness  and CBRN-related activities and an executive order on the distribution of  medical countermeasures in the event of a domestic biological attack. We  analyzed these documents to identify requirements for DHS to develop  CBRN risk assessments as well as interagency CBRN-specific response  plans and capabilities, and for any criteria contained within these  documents to guide the use of DHS’s CBRN risk assessments to inform  response planning activities and capability program management. We  analyzed the CBRN risk assessments, response plans, and documents  on the capabilities DHS has developed since 2004—the year initial  legislative requirements were enacted for the department to develop the  assessments—to determine the contents of these assessments and  these plans. For the purposes of this report, we consider DHS’s CBRN  risk assessments to include its Terrorism Risk Assessments (TRAs) and  Material Threat Assessments (MTAs).
We analyzed all 12 CBRN-specific interagency response plans developed  by DHS that are designed for responding to CBRN incidents to determine  the extent to which they identify DHS’s CBRN risk assessments as a  source of information contained within the plans. We also asked DHS  officials to provide us with documentation showing how specific  information from the risk assessments, if any, was incorporated into the  plans. We then reviewed the response plans to identify CBRN agent- specific planning assumptions contained within the plans. We selected  assumptions that contained information about the unique features of the  CBRN agent, the threat, the attack scenario, DHS’s ability to detect the  agent and respond, public health consequences of an attack, or time  frames for response. We excluded generic statements regarding  coordination of the federal response to an attack and the roles and  responsibilities of relevant agencies because the CBRN risk assessments  do not assess these topics. We compared these assumptions to the  information contained in the risk assessments to determine the relative  level of consistency between examples of this type of information  contained in the plans and in the assessments. Our analysis did not  compare all assumptions in the plans, including those that were non- CBRN agent specific, to all the assumptions in the risk assessments.
Further, we identified a nongeneralizable set of seven CBRN-specific  capabilities by interviewing DHS component program officials and  conducting a search of a Department of Defense database that contains a  listing of U.S. governmentwide CBRN capabilities and activities. We used  these interviews and the database to limit our scope to capabilities that  are specifically deployed and are being used by DHS components to  prevent, detect, and respond to CBRN incidents. We did not include  within our scope capabilities for responding to all-hazards that may also  be used for responding to CBRN incidents, nor did we include, among  others, capabilities related to intelligence, law enforcement, training, or  research and development. We reviewed documentation of these  programs to determine the extent to which they are informed by DHS’s  CBRN risk assessments. When possible, we directly compared the lists of  threat agents that are addressed by the capabilities to the relevant lists of  high-risk agents identified in the CBRN risk assessments. We did not  compare any other information in the CBRN risk assessments—such as  assumptions about U.S. vulnerabilities to specific threat agents or attack  consequences—to the capabilities.
We also interviewed officials from DHS offices, components, and  agencies to obtain information on whether and how they used the TRAs  and MTAs in developing a given response plan or developing and  managing a given capability. Specifically, we interviewed DHS officials  from DHS’s:
Science and Technology Directorate (S&T),
Office of the Chief Financial Officer (CFO), Program Analysis and  Evaluations (PA&E),
Office of Health Affairs (OHA),
Office of Operations Coordination (OPS),
Office of Policy (POLICY),
National Protection and Programs Directorate’s (NPPD) Office of Risk  Management and Analysis (RMA),
Domestic Nuclear Detection Office (DNDO), and
Federal Emergency Management Agency (FEMA).
To address the third objective, we analyzed Standards for Internal Control  in the Federal Government for guidelines on internal controls. We then  obtained written policies or procedures developed by DHS offices,  components, or agencies that describe whether and how DHS’s CBRN  risk assessments should be used when DHS officials develop CBRN  response plans or capabilities. We compared the standards for internal  control against the status of DHS’s development of policies and  procedures for using its CBRN risk assessments to inform its plans and  capabilities. We also interviewed DHS officials to obtain information on  the reasons why DHS has or has not institutionalized use of the TRAs  and MTAs through written policies and procedures.
We conducted this performance audit from February through December  2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Multiple DHS offices, components, and agencies have roles and  responsibilities in DHS’s development of CBRN risk assessments,  response plans, and capabilities. Specifically:
S&T is responsible for the development of DHS’s CBRN risk  assessments—the TRAs and MTAs.
CFO’s PA&E unit is responsible for developing resource allocation  decisions for capability investments through DHS’s Planning,  Programming, Budgeting and Execution system.
OHA is responsible for leading DHS’s biological and chemical defense  activities and provides medical and public health expertise to support  the department’s efforts.
OPS is responsible for coordinating DHS’s operational activities for  incident response, including for CBRN incidents.
POLICY is responsible for advising the Secretary of Homeland  Security in the development of DHS’s policies for CBRN plans and  capabilities.
NPPD’s RMA is responsible for leading DHS’s approach to risk  management and the application of risk information to departmental  activities.
DNDO is responsible for domestic radiological and nuclear detection  efforts and integration of federal nuclear forensics programs.
FEMA is responsible for leading the nation’s effort for preparing to  respond to emergencies and disasters.
subsections: section_title: DHS Risk Management
paragraphs: DHS engages in risk management activities to help ensure the nation’s  ability to protect against and respond to incidents using CBRN agents.  DHS’s Risk Lexicon provides the following definitions for risk-related  terms:
Risk—potential for an adverse outcome assessed as a function of  threats, vulnerabilities, and consequences associated with an  incident, event, or occurrence.
Risk Assessment—product or process which collects information and  assigns values to risks for the purpose of informing priorities,  developing or comparing courses of action, and informing decision  making.
Risk Management—process of identifying, analyzing, assessing, and  communicating risk and accepting, avoiding, transferring, or  controlling it to an acceptable level considering associated costs and  benefits of any actions taken.
The department’s 2010 Quadrennial Homeland Security Review notes the  importance of incorporating information from risk assessments into  departmental decision making, one aspect of the department’s homeland  security risk management process. According to DHS doctrine, risk  management applications include the use of risk information to inform,  among others, strategic and operational planning and resource decisions.  This report focuses on DHS’s use of the third step of its risk management  process—risk assessment—and the application of risk assessment  results to inform CBRN response plans and capabilities. DHS notes that  risk information is usually one of many factors—not necessarily the sole  factor—that decision makers consider when deciding which strategies to  pursue for managing risk. These additional factors may include strategic  and political considerations, among others. See figure 1 for a graphic  depiction of DHS’s risk management process.
DHS is responsible for assessing the risks posed by various CBRN  agents, as directed by the Project BioShield Act of 2004 and Homeland  Security Presidential Directives 10 – Biodefense for the 21st Century, 18  – Medical Countermeasures against Weapons of Mass Destruction, and  22 – National Domestic Chemical Defense. To this end, S&T develops  CBRN TRAs and MTAs.
Each TRA assesses the relative risks posed by multiple CBRN agents  based on variable threats, vulnerabilities, and consequences. Since 2006,  DHS has developed eight TRA reports:
Biological Terrorism Risk Assessments (BTRA) in 2006, 2008, and
Chemical Terrorism Risk Assessments (CTRA) in 2008 and 2010;
Radiological/Nuclear Terrorism Risk Assessment (R/NTRA) in 2011;  and  Integrated CBRN Terrorism Risk Assessments (ITRA) in 2008 and  2011.
Each MTA assesses the threat posed by a given, individual CBRN agent  or class of agents and the potential number of human exposures in  plausible, high-consequence scenarios. Since 2004, DHS has developed  17 MTA reports. DHS uses the MTAs to determine which CBRN agents  pose a material threat sufficient to affect national security.
The Project BioShield Act describes specific ways in which the MTAs may  be used in efforts to procure certain medical countermeasures.  However, the various presidential directives note that while the TRAs may  be used to inform decision making, they are not specific as to when or  how these risk assessments should be used by DHS officials to inform  CBRN response planning or capability investments.
section_title: DHS’s CBRN Response Plans and Capabilities
paragraphs: (U) We identified CBRN-specific interagency response plans among three  families of interagency plans developed by DHS that are designed for  responding to CBRN incidents. These families of plans include plans  developed under (1) Executive Order 13527 – Establishing Federal  Capability for the Timely Provision of Medical Countermeasures Following  a Biological Attack (Executive Order 13527) and (2) Homeland Security  Presidential Directive 8 Annex I – National Planning (HSPD 8 Annex I),  and as a part of (3) the National Response Framework’s (NRF) CBRN- specific incident annexes.reviewed.
section_title: DHS Used Its CBRN Risk Assessments to Directly or Indirectly Inform 9 of 12 of Its CBRN Response Plans
paragraphs: Since the first DHS CBRN risk assessments were developed in 2004,  DHS used the risk assessments to varying degrees to directly or indirectly  inform development of 9 of the 12 CBRN-specific response plans we  identified. Our analysis showed that 2 of the 12 plans were directly  informed by the risk assessments, while DHS officials told us that 7 of the  12 plans were indirectly informed by the risk assessments. However, we  could not independently verify this for these 7 plans because DHS  officials could not document how the risk assessments influenced  information contained in the plans. Three of the response plans were not  informed by the risk assessments, according to DHS officials. Our  analysis of a limited set of planning assumptions in the plans compared to  information contained in the risk assessments showed general  consistency between the plans and the risk assessments.
DHS’s guidelines state that response plans should be informed by risk  assessment information to supplement risk-related information contained  in the National Planning Scenarios (NPS) used for developing emergency  response plans. DHS’s 2009 Integrated Planning System (IPS) also  identifies risk assessments as one source of information that should be  used to inform response plan development. This guidance, however,  does not define what it means for response plans to be informed by risk  assessments or how planners should use specific types of risk  assessments, such as DHS’s TRAs and MTAs, when developing or  revising related plans. Of the 12 CBRN response plans developed by  DHS that we reviewed, none of the plans were developed solely in  response to a given CBRN threat agent being identified as high risk in  DHS’s CBRN risk assessments. Rather, these plans were developed in  response to requirements in an executive order and as part of families of  plans developed in response to provisions in presidential directives.table 3 for a list of the CBRN response plans and whether each plan was  directly, indirectly, or not informed by DHS’s CBRN risk assessments  during its development.
section_title: DHS Used Its CBRN Risk Assessments to Directly or Partially Inform Six of Seven of Its CBRN Capabilities
paragraphs: Since 2004, DHS’s use of its CBRN risk assessments to inform its CBRN- specific capability investments has varied, from directly impacting its  capabilities to not being used at all. Six of the seven CBRN capabilities  we examined were informed by DHS’s CBRN risk assessments to some  extent, according to program officials, DHS documents, and our analysis  (see table 4).was directly informed by the risk assessments, while our analysis showed  or DHS officials told us that five of the seven capabilities were partially   Our analysis showed that one of the seven capabilities  informed by the risk assessments. However, we could not independently  verify this for three of these five capabilities because DHS officials could  not document how the risk assessments influenced the capabilities. DHS  has developed policies and guidance on the use of risk information for the  department’s activities, but DHS has not issued guidance to program  managers that specifies when or how they should use the CBRN risk  assessments to inform CBRN capabilities (this is discussed in the third  objective of this report). The DHS Strategic Plan for 2008-2013 states that  resource decisions should be informed by relevant risk assessments, but  does not provide specific guidance on when or how such decisions  should be informed by the department’s CBRN risk assessments.  Additionally, the Secretary of Homeland Security’s March 2011  Management Directive stated that DHS policy is to use risk information  and analysis to inform decision making and instructs DHS components to  establish mission-appropriate risk management capabilities. See table 4  for a summary of the CBRN capabilities and whether each capability was  directly, partially, or not informed by DHS’s CBRN risk assessments.
Our analysis showed that the extent to which the CBRN capabilities we  examined were informed by DHS’s CBRN risk assessments varied, but  DHS officials described reasons for this variance, as discussed below. In  addition, DHS officials noted that basic scientific differences between  chemical, biological, and radiological/nuclear threat agents and materials  also provide explanations about the differences in how the CBRN risk  assessments are used to inform capabilities. For example, DHS officials  told us that the relative risk rankings amongst biological agents may be  more meaningful than the ranking amongst radiological materials  because there are greater differences associated with detecting biological  agents, as well as their consequences.
subsections: section_title: Select DHS Chemical Capabilities
paragraphs: DHS program managers used the risk assessments to partially inform the  program management of the RDCDS and the CSAC, as described below.  The Director of the CSAC told us that because there are over 13 million  possible chemicals that could be considered threat agents, it is  impossible to come up with a relative risk ranking of all the chemicals.  Therefore, the results of the CTRA are designed to be representative of  the highest risk chemical agents and used as a guide—not a definitive  resource—for informing capability and planning decisions related to such  agents. Additionally, certain chemical compounds have similar enough  compositions to be considered together when developing capabilities and  response plans.
Rapidly Deployable Chemical Detection System (RDCDS). The OHA  Chemical Defense Program used the CTRA to partially inform its RDCDS,  according to our analysis as well as DHS officials and documentation. We  compared the lists of threat agents that have been programmed to be  detected by RDCDS detectors against chemical agents of significant  concern in the 2008 and 2010 CTRAs and found that they were generally  consistent. The RDCDS program manager told us that the list of threat  agents monitored by RDCDS has not changed since 2005 as DHS  developed the first and second iterations of the CTRA. However, the  program manager told us that when the first CTRA was issued in 2008,  program officials reviewed its content to determine whether chemical  agents of significant concern in the CTRA were aligned with the  chemicals detected by RDCDS. The official said that based on this initial  assessment, the RDCDS was generally aligned with the chemical agents  of greatest concern.
Chemical Security Analysis Center (CSAC). The Director of the CSAC  told us that because a key CSAC mission is to develop the CTRA and the  chemical MTAs, these risk assessments are used—to varying extents—to  inform the other capabilities that the CSAC maintains. Other capabilities  include providing 24/7 technical assistance to other DHS components that  encounter possible chemical attack situations, such as the National  Operations Center. According to the CSAC Director, information from the  CTRA is included in the knowledge management system that is used in  maintaining this technical assistance capability. However, the CSAC  could not provide us with documentation of how it had used the CBRN  risk assessments to inform this capability. Further, the CSAC Director told  us that the CTRA also informs the CSAC’s work in developing models for  other DHS components on the effects of certain chemical incidents. We  reviewed a CSAC study for the DHS Transportation Security  Administration about the release of chemical gases into the atmosphere  and found that in the study the CSAC had modeled releases of two  different chemical agents, both of which are among the chemical agents  of significant concern in the CTRA.
section_title: Select DHS Biological Capabilities
paragraphs: We analyzed the extent to which DHS officials used the BTRA and the  biological MTAs to inform the program management of three  capabilities—BioWatch, the NBFAC, and the NBIC. Our analysis showed  that DHS program managers used the risk assessments to either directly  inform (BioWatch) or partially inform (NBFAC and NBIC) their decisions,  as described below. The program manager of BioWatch told us that it  makes sense for the program to use the most reliable tool available to  them—in this case, the CBRN risk assessments—to determine what  agents to program into their detection system. The director of the NBFAC  told us that the BTRA was used on one occasion to directly inform  program management and prioritization. The NBIC branch chief told us  that the BTRA is used at a strategic level and that the center’s staff is  very familiar with the contents of the BTRA and the biological MTAs.  However, he stated that the NBIC’s mission is to monitor detection efforts  for all biological agents, particularly emerging infectious diseases, and to  provide alerts about potentially dangerous biological incidents to state  and local homeland security professionals. Therefore, the NBIC branch  chief said that the relative risk ranking of a given biological agent would  not be an appropriate basis for the prioritization of resources at the  operational level.
BioWatch. We found that the BioWatch program was generally  consistent with the biological agents of significant concern identified in the  BTRA. DHS documents state that the BTRA is to be used to update the  list of threat agents monitored by BioWatch. DHS deployed BioWatch in  2003, before the release of the first BTRA in 2006. Since then, DHS has  reprogrammed BioWatch detection efforts once, in response to the 2006  BTRA. The BioWatch program manager told us that they review each  iteration of the BTRA to ensure that the BioWatch program is aligned with  the biological agents of significant concern. We compared the lists of  threat agents that have been programmed to be detected by the  BioWatch program since 2006 against the biological agents of significant  concern in the 2006, 2008, and 2010 BTRAs and found them generally  consistent.
The BioWatch program manager also told us that future generations of  BioWatch are being developed to detect a larger number of biological  threat agents. According to BioWatch documents, these agents are to be  determined by the BTRA’s risk rankings. OHA officials told us they use  the BTRA to inform BioWatch because it is the most relevant CBRN risk  assessment available to them and because it allows OHA to focus  BioWatch detection efforts on the biological agents of significant concern.
National Bioforensic Analysis Center (NBFAC). We found that the  NBFAC used the CBRN risk assessments to partially inform its  capabilities. Officials from NBFAC told us that the center used information  from the BTRA to inform its priorities for developing tools needed to  support their work in biological forensic attribution. Our analysis showed  that the NBFAC’s forensic attribution capabilities were generally  consistent with the biological agents of significant concern in the BTRA.  However, NBFAC officials stated that because the NBFAC is mandated to  maintain capabilities for other biological materials, including biological  agents that are not considered high risk, future BTRA results would not  necessarily lead to reprioritization of NBFAC’s attribution capability  development efforts.
National Biosurveillance Integration Center (NBIC). We found that the  NBIC used the CBRN risk assessments to partially inform its activities.  According to the OHA branch chief responsible for the NBIC, NBIC  personnel are aware of the information in DHS’s CBRN risk assessments  and consider this information at a strategic level. However, the NBIC  could not provide us with documentation of how it had used the CBRN  risk assessments to inform its capabilities at the strategic level. The NBIC  branch chief also stated that NBIC does not use information from the  BTRA or biological MTAs at an operational level to inform the  management of their capability. The official provided documentation  showing that the NBIC’s mission is to collect and integrate information  about biological agent detection from a variety of federal government  detection systems. The OHA branch chief stated that because the  NBIC’s mission is to integrate and provide alerts on all biological agents,  including emerging and infectious diseases that are not included in the  CBRN risk assessments, it is not relevant whether the biological agents  the NBIC is monitoring are considered to be high risk according to the  BTRA or the MTAs, although these agents are also monitored.
section_title: Select DHS Radiological and Nuclear Capabilities
paragraphs: Our analysis showed that DHS program managers’ use of the risk  assessments to inform radiological and nuclear capabilities varied from  partially informing their decisions to not informing their decision at all.  Officials from the NTNFC told us that because of the relatively small  universe of radiological and nuclear materials, the risk rankings among  these materials did not matter as much as the relative threat and  consequence information for biological and chemical agents. Additionally,  DHS officials told us the challenges that first responders would face in  responding to a nuclear explosion in a city may be a more important  concern than the type of threat material used in such an attack.
Nuclear Incident Response Teams (NIRTs). FEMA officials told us that  information from the R/NTRA appendix to the 2008 ITRA partially  informed the program management of the NIRTs and FEMA’s other  nuclear response capabilities. Specifically, FEMA officials said that  information in the R/NTRA appendix, among other sources, was used to  inform FEMA’s IND Response and Recovery Program. Starting in 2010,  FEMA officials said that NIRT-related activities were aligned with the IND  Response and Recovery Program. FEMA officials told us that because of  this, their management of the NIRTs is partially informed, by extension,  by the R/NTRA appendix. However, FEMA could not provide us with  documentation of how it specifically had used the R/NTRA appendix to  inform the NIRTs.
National Technical Nuclear Forensics Center (NTNFC). An NTNFC  official told us that the NTNFC did not use information contained in the  R/NTRA appendix to the 2008 ITRA, and the NTNFC does not intend to  use the 2011 R/NTRA (once published) to inform its activities. The same  official told us that these CBRN risk assessments do not provide useful  information to inform NTNFC activities because nuclear forensic  capabilities are developed for all radiological and nuclear materials,  regardless of their relative risk. Further, he stated that NTNFC is already  aware of the universe of possible radiological and nuclear materials that  could be used to attack the nation. DHS S&T’s Chief Medical and Science  Advisor, the official who oversees the development of DHS’s CBRN risk  assessments, agreed that NTNFC’s capabilities need to be able to  identify all radiological and nuclear materials, and that therefore the  CBRN risk assessments were not relevant for NTNFC’s efforts.
section_title: Specific Guidance Not Established to Help Ensure DHS’s CBRN Risk Assessments Are Used to Inform Its Response Plans and Capabilities
paragraphs: DHS policy states that DHS components should use risk assessment  information to inform planning and capability investment decisions, but  DHS has not established specific guidance, such as written procedures,  that details when and how DHS components should consider using the  department’s CBRN-specific risk assessments to inform such activities.  According to the National Strategy for Homeland Security of 2007, the  assessment and management of risk underlies all homeland security  activities, including decisions about when, where, and how to invest in  resources—including planning and capabilities—that eliminate, control, or  mitigate risks. The TRAs and MTAs—the department’s most CBRN- specific risk assessments—were used to inform to varying extents 9 of 12  response plans and 6 of 7 capabilities we analyzed, and how the risk  assessments were used to inform these plans and capabilities varied.  DHS officials told us that while DHS policy calls for the use of risk  information to inform the department’s activities, no DHS guidance  specifically requires DHS officials to use the TRAs and MTAs for CBRN  planning and capability investments or explains how officials should use  the risk assessments to inform their decision making. As a result, the  CBRN risk assessments were used to varying extents and in varying  ways by DHS components for the plans and capabilities we analyzed.  DHS officials said that they considered the risk assessments but chose  not to use them to inform one of the plans and one of the capabilities we  reviewed because they were not useful for the plan or the capability. In  addition, the risk assessments were not considered at all for two of the  plans we reviewed.
Since at least 2007, DHS has emphasized the need to incorporate risk  information derived from risk assessments into departmental activities,  and since 2009 DHS has issued a range of guidance—including an  interim framework, a policy memo, a management directive, and a  doctrine—on the use of such risk information. Specifically, DHS’s Interim  Integrated Risk Management Framework of January 2009 identified risk  assessments as a fundamental information source for risk-informed  decision making and noted that the BTRA and CTRA are examples of risk  assessments produced by the department that can be used to inform risk  management efforts. In May 2010, the Secretary of Homeland Security  issued a policy memo that requires, among other things, the use of risk  assessments to inform decision making and the establishment of  mechanisms for sharing risk assessments with relevant stakeholders. In  March 2011, as called for in the Secretary’s memo, DHS issued a  management directive on integrated risk management at the  department. This management directive, among other things, tasks the  Director of the Office of Risk Management and Analysis (RMA) within  DHS’s NPPD with establishing a system to facilitate the sharing of risk  analysis and data across the department. Further, in April 2011, DHS  issued its doctrine for risk management—titled Risk Management  Fundamentals—the first in a series of publications that RMA plans to  issue to provide a structured approach for the distribution and  employment of risk information and analysis efforts across the  department.
DHS’s existing guidance on risk management generally identifies the  importance of using risk assessments to inform departmental decision  making, but it does not specifically address when and how particular risk  assessments—including the TRAs and MTAs—should be considered for  use by departmental entities for planning and capability investment  purposes. DHS officials stated that more specific guidance has not been  developed by the department or its components and agencies because  they were not required to do so. However, Standards for Internal Control  in the Federal Government state that officials should take actions, such  as establishing written procedures, to help ensure that management’s  directives are carried out.Management Framework of January 2009 stated that DHS must establish  processes that make risk information available among the department  and its components and agencies when and where it is needed, noting  that the ability to receive and provide meaningful and usable risk  information in a timely manner requires well coordinated and established  processes.
In addition, DHS’s Interim Integrated Risk  While DHS has issued guidance that generally states that risk  assessments should be used to inform departmental activities, DHS could  better help to ensure that its relevant CBRN-specific risk assessments— the TRAs and MTAs—are considered for use in informing CBRN-specific  planning and capability investments if more specific guidance requiring  such consideration is established. DHS officials also stated that  establishing written procedures for such consideration could better help to  ensure that officials responsible for CBRN response planning and  capability investment decision making consider the CBRN risk  assessments as a means to obtain current risk information for specific  CBRN threat agents. This information could be used to inform the  planning assumptions that CBRN response plans are designed to  address, as well as the requirements development process for CBRN  capabilities. In addition, DHS officials noted that the lack of written  procedures requiring DHS officials to consider using the TRAs and MTAs  to inform DHS’s CBRN plans and capabilities could negatively affect the  likelihood that future DHS officials consider using the risk assessments  when planning and making investment decisions. By establishing more  specific guidance that details when and how DHS components should  consider using the TRAs and MTAs to inform CBRN plans and  capabilities, DHS would be better positioned to ensure that officials  consider and, as appropriate, incorporate the department’s most detailed  CBRN-specific risk information. As a result, DHS would be better  positioned to ensure that its CBRN response plans and capabilities align  with the assumptions and results contained within the TRAs and MTAs.
section_title: Conclusions
paragraphs: The anthrax attacks of 2001 raised concerns that the United States is  vulnerable to terrorist attacks using CBRN agents. Since 2001, DHS has  developed a range of CBRN risk assessments, response plans, and  related capabilities to prepare for such attacks. DHS has spent at least  $70 million developing these risk assessments. Using its CBRN risk  assessments to help inform CBRN response planning and capability  investments is consistent with DHS policy and could help to better ensure  that relevant information contained in the risk assessments is used to  inform such plans and capabilities. Further, given that there are  thousands of CBRN agents that could potentially pose a risk to the nation  in an era of declining federal budgets and constrained resources, the  federal government must ensure that it is focusing its limited resources on  preparing to respond to the highest risk agents. Without procedures for  using the risk assessments to inform capability investment decision  making, use of the assessments for such decisions may continue to vary  or not occur at all. More specific guidance on when and how DHS officials  should consider using the department’s CBRN risk assessments to inform  planning and investments could better help to ensure their consistent use  and that this use is sustained beyond the tenure of any given agency  official.
section_title: Recommendation for Executive Action
paragraphs: To better ensure the consistent use of DHS’s CBRN risk assessments at  the department’s components and agencies, we recommend that the  Secretary of Homeland Security:
Establish more specific guidance, including written procedures, that  details when and how DHS components should consider using the  department’s CBRN risk assessments to inform related response plan  and capability investment decision making.
section_title: Agency Comments
paragraphs: We received written comments on the draft report, which are reproduced  in full in appendix I. DHS also provided technical comments, which were  incorporated as appropriate. DHS concurred with the basis for the  recommendation and discussed an action that S&T—which is responsible  for developing the department’s CBRN risk assessments—plans to take  to address the recommendation. Specifically, DHS noted that it is  currently developing user guidelines for its CBRN risk assessments. In  addition, DHS also stated that S&T is committed to continuing to work  with relevant stakeholders to ensure that its risk assessments are useful  for informing response planning and capability investment decision  making.
We are sending copies of this report to the Secretary of Homeland  Security, appropriate congressional committees, and other interested  parties. The report also is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any further questions about this report, please  contact me at (202) 512-8777 or jenkinswo@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Key contributors to this report are listed in  appendix II.
section_title: Appendix I: Comments from the Department of Homeland Security
section_title: Appendix II: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Edward George (Assistant  Director), David Lysy (Analyst-in-Charge), David Schneider, Bonnie Doty,  David Alexander, Tracey King, and Katherine Davis made key  contributions to this report.
section_title: Related GAO Products
paragraphs: National Preparedness: DHS and HHS Can Further Strengthen  Coordination for Chemical, Biological, Radiological, and Nuclear Risk  Assessments. GAO-11-606. Washington, D.C.: June 21, 2011.
Public Health Preparedness: Developing and Acquiring Medical  Countermeasures Against Chemical, Biological, Radiological, and  Nuclear Agents. GAO-11-567T. Washington, D.C.: April 13, 2011.
Measuring Disaster Preparedness: FEMA Has Made Limited Progress in  Assessing National Capabilities. GAO-11-260T. Washington, D.C.: March  17, 2011.
Biosurveillance: Efforts to Develop a National BioSurveillance Capability  Need a National Strategy and a Designated Leader. GAO-10-645.  Washington, D.C.: June 30, 2010.
Homeland Defense: DOD Can Enhance Efforts to Identify Capabilities to  Support Civil Authorities during Disasters. GAO-10-386. Washington,  D.C.: March 30, 2010.
Combating Nuclear Terrorism: Actions Needed to Better Prepare to  Recover from Possible Attacks Using Radiological or Nuclear Materials.  GAO-10-204. Washington, D.C.: January 29, 2010.
Biosurveillance: Developing a Collaboration Strategy Is Essential to  Fostering Interagency Data and Resource Sharing. GAO-10-171.  Washington, D.C.: December 18, 2009.
Homeland Defense: Planning, Resourcing, and Training Issues Challenge  DOD’s Response to Domestic Chemical, Biological, Radiological,  Nuclear, and High-Yield Explosive Incidents. GAO-10-123. Washington,  D.C.: October 7, 2009.
Homeland Defense: Preliminary Observations on Defense Chemical,  Biological, Radiological, Nuclear, and High-Yield Explosives  Consequence Management Plans and Preparedness. GAO-09-927T.  Washington, D.C.: July 28, 2009.
Project BioShield Act: HHS Has Supported Development, Procurement,  and Emergency Use of Medical Countermeasures to Address Health  Threats. GAO-09-878R. Washington, D.C.: July 24, 2009.
Project BioShield: HHS Can Improve Agency Internal Controls for Its New  Contracting Authorities. GAO-09-820. Washington, D.C.: July 21, 2009.
National Preparedness: FEMA Has Made Progress, but Needs to  Complete and Integrate Planning, Exercise, and Assessment Efforts.  GAO-09-369. Washington, D.C.: April 30, 2009.
Homeland Security: First Responders’ Ability to Detect and Model  Hazardous Releases in Urban Areas is Significantly Limited.   GAO-08-180. Washington, D.C.: June 27, 2008.
Risk Management: Strengthening the Use of Risk Management Principles  in Homeland Security. GAO-08-904T. Washington, D.C.: June 25, 2008.
Emergency Management: Observations on DHS’s Preparedness for  Catastrophic Disasters. GAO-08-868T. Washington, D.C.: June 11, 2008.
Highlights of a Forum: Strengthening the Use of Risk Management  Principles in Homeland Security. GAO-08-627SP. Washington, D.C.: April  15, 2008.
Project BioShield: Actions Needed to Avoid Repeating Past Problems  with Procuring New Anthrax Vaccine and Managing the Stockpile of  Licensed Vaccine. GAO-08-88. Washington, D.C.: October 23, 2007.
Homeland Security: Applying Risk Management Principles to Guide  Federal Investments. GAO-07-386T. Washington, D.C.: February 7,  2007.
Chemical and Biological Defense: Management Actions Are Needed to  Close the Gap Between Army Chemical Unit Preparedness and State  National Priorities. GAO-07-143. Washington, D.C.: January 19, 2007.
Risk Management: Further Refinements Needed to Assess Risk and  Prioritize Protective Measures at Ports and Other Critical Infrastructure.  GAO-06-91. Washington, D.C.: December 15, 2005.
Internal Control: Standards for Internal Control in the Federal  Government. GAO/AIMD-00-21.3.1. Washington, D.C.: November 1,  1999.