Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for Emergencies
Published: 2005-04-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To ensure that essential government services are available in emergencies, federal agencies are required to develop continuity of operations plans. According to guidance from the Federal Emergency Management Agency (FEMA), which is responsible for providing guidance for and assessing agency continuity plans, a key element of a viable capability is the proper identification of essential functions. GAO previously reported on agency continuity plan compliance, and determined that a number of agencies and their components did not have continuity plans in place on October 1, 2002, and those that were in place did not generally comply with FEMA's guidance. GAO was asked to testify on its most recent work in continuity planning, which is discussed in a separate report, being released today (GAO-05-577). In this report, GAO reviewed to what extent (1) major federal agencies used sound practices to identify and validate their essential functions, (2) agencies had made progress since 2002 in improving compliance with FEMA guidance, and (3) agency continuity of operations plans addressed the use of telework arrangements (in which work is performed at an employee's home or at a work location other than a traditional office) during emergencies.
section_title: What GAO Found
paragraphs: Many of the 23 agencies that GAO reviewed reported using sound practices for identifying and validating essential functions, but few provided documentation sufficient for GAO to confirm their responses. (GAO identified these sound practices based on published literature and in consultation with experts on continuity planning.) Agency responses indicate that--although aware of the practices--agencies may not have followed them thoroughly or effectively. Further, the essential functions identified by agencies varied widely: the number of functions identified in each plan ranged from 3 to 538 and included ones that appeared to be of secondary importance. The absence in FEMA's guidance of specific criteria for identifying essential functions contributed to this condition. Subsequent guidance significantly addresses the sound practices that GAO identified. Also, the White House has begun a process to improve continuity planning. If this guidance and process are implemented effectively, they could lead to improved identification of essential functions in the executive branch. As of May 1, 2004, agencies had made progress in improving compliance with FEMA guidance, but significant weaknesses remained. Agencies that had plans in place in both years showed significant improvement in the area of tests, training, and exercises. However, although some improvement occurred for other planning areas, important weaknesses remained: for example, 31 of 45 plans did not fully identify mission-critical systems and data necessary to conduct essential functions. Inadequate oversight by FEMA contributed to the level of weaknesses in agency continuity plans. FEMA plans to improve oversight using an online readiness reporting system, which it plans to have fully operational later this year, and it has already taken other steps to help agencies improve their plans, such as conducting an interagency exercise. However, FEMA does not plan to verify the readiness information that agencies will report in the system. Finally, even though FEMA's continuity planning guidance in place in May 2004 did not address telework, one agency's continuity plan at that time included plans to use telework in response to an emergency. In addition, 10 agencies reported that they planned to use telework following a COOP event, but their plans were not clearly documented. In its report, GAO made recommendations aimed at helping to improve continuity planning. These included establishing a schedule for the completion of recently initiated efforts, developing a strategy for short-term oversight in the meantime, and developing and implementing procedures that verify the agency-reported data used in oversight of agency continuity of operations planning. The report includes comments from FEMA. In commenting, FEMA agreed that there has been improvement in COOP plans and that additional oversight is needed.

section_title: Letter
paragraphs: I appreciate the opportunity to participate in the Committee’s  hearing on federal continuity of operations planning. As you know,  essential government services can be interrupted by a range of  events, including terrorist attacks, severe weather, or building-level  emergencies. Federal agencies are required by Presidential Decision  Directive 67 to develop plans for ensuring the continuity of such  services in emergency situations. The Federal Emergency  Management Agency (FEMA), which was designated executive  agent for executive branch continuity of operations (COOP)  planning, issued Federal Preparedness Circular 65 in July 1999 as  planning guidance to agencies. The circular states that, in order to  have a viable COOP capability, agencies should identify their  essential functions. These functions then provide the basis for  subsequent planning steps. The circular also identified eight  elements of a viable COOP capability.
We previously reviewed agency COOP plan compliance with  FEMA’s guidance, at your request. At that time, we found that a  number of agencies and their components did not have continuity  plans in place as of October 1, 2002, and those that were in place did  not generally comply with FEMA’s guidance.
We subsequently assessed plans in place on May 1, 2004, both from  the agencies that had plans in place in 2002 and from agencies that  subsequently adopted plans. We examined to what extent  ●  major federal agencies used sound practices to identify and validate  ●  agencies had made progress in improving compliance with the  guidance outlined in FPC 65 since our 2002 review, and  ●  agency continuity of operations plans addressed the use of telework  arrangements (in which work is performed at an employee’s home  or at a work location other than a traditional office) during  emergencies.
At your request, I am summarizing today the findings and  recommendations of the report on this most recent work, which is  being released today.
subsections: section_title: Background
paragraphs: Federal operations and facilities have been disrupted by a range of  events, including the terrorist attacks on September 11, 2001; the  Oklahoma City bombing; localized shutdowns due to severe weather  conditions, such as the closure of federal offices in the Washington,  D.C., area in September 2003 due to Hurricane Isabel; and building- level events, such as asbestos contamination at the Department of  the Interior’s headquarters. Such disruptions, particularly if  prolonged, can lead to interruptions in essential government  services. Prudent management, therefore, requires that federal  agencies develop plans for dealing with emergency situations,  including maintaining services, ensuring proper authority for  government actions, and protecting vital assets.
Until relatively recently, continuity planning was generally the  responsibility of individual agencies. In October 1998, Presidential  Decision Directive (PDD) 67 identified the Federal Emergency  Management Agency (FEMA)—which is responsible for responding  to, planning for, recovering from, and mitigating against disasters— as the executive agent for federal COOP planning across the federal  executive branch. FEMA was an independent agency until March  2003, when it became part of the Department of Homeland Security  (DHS), reporting to the Under Secretary for Emergency  Preparedness and Response. Under PDD 67, its responsibilities  include  ●  formulating guidance for agencies to use in developing viable plans;  ●  coordinating interagency exercises and facilitating interagency  coordination, as appropriate; and  ●  overseeing and assessing the status of COOP capabilities across the  executive branch.
According to FEMA officials, the directive also required that  agencies have COOP plans in place by October 1999.
In July 1999, FEMA first issued Federal Preparedness Circular  (FPC) 65. FPC 65 is guidance to the federal executive branch for use  in developing viable and executable contingency plans that facilitate  the performance of essential functions during any emergency.  Specifically, the guidance  ●  established the identification of essential functions as the basis for  ●  defined essential functions as those that enable agencies to provide  vital services, exercise civil authority, maintain safety, and sustain  the economy during an emergency;  ●  defined the elements of a viable continuity of operations capability  according to eight topic areas: identification of essential functions;  development of plans and procedures; identification of orders of  succession; delegations of authority; provision for alternate  facilities; provision of interoperable communications; availability of  vital records; and conduct of regular tests, training, and exercises;  and  ●  set up an interagency working group to coordinate continuity  planning.
FPC 65 applies to all federal executive branch departments and  agencies at all levels, including locations outside Washington, D.C. It  directed the heads of each agency to assume responsibilities  including  ●  developing, approving, and maintaining agency continuity plans and  ●  developing a COOP multiyear strategy and program management  ●  conducting tests and training of agency continuity plans,  contingency staffs, and essential systems and equipment.
At your request, we previously reported on federal agency  headquarters contingency plans in place in October 2002. At that  time, we determined that most agencies identified at least one  function as essential, but the functions varied in number and  apparent importance. Furthermore, while 20 of 23 agencies had  documented COOP plans, none addressed all the guidance in FPC  65. We identified inadequate guidance and oversight as factors  contributing to these weaknesses, and recommended that DHS  (1) ensure that agencies without plans develop them, (2) ensure that  agencies address weaknesses in their plans, and (3) conduct  assessments of plans that included an independent verification of  agency-provided data and an assessment of identified essential  functions. In response to these recommendations, DHS reported in  July 2004 that it (1) was developing an online system to collect data  from agencies on the readiness of their continuity plans that would  evaluate compliance with the guidance, (2) had conducted an  interagency exercise, and (3) had developed a training program for  agency continuity planning managers. DHS added that it planned to  conduct an independent validation of each agency’s self-assessment  after deployment of the readiness system.
section_title: Many Agencies Reported Using Sound Continuity Practices, but Few Provided Adequate Supporting Documentation
paragraphs: Based on an analysis of published literature and in consultation with  experts on continuity planning, we identified eight sound practices  related to essential functions that organizations should use when  developing their COOP plans. These practices, listed in table 1,  constitute an ongoing process that includes identifying and  validating essential functions.
With regard to COOP plans in place on May 1, 2004, many of the 23  agencies reported using some of the sound practices in developing  plans, included identifying and validating essential functions, but  few provided documentation sufficient for us to validate their  responses. This indicates that agencies—although aware of these  practices—may not have followed them thoroughly or effectively.  For example, it is unlikely that a thorough risk analysis of essential  functions could be performed without being documented.
Further, the essential functions identified by agencies varied widely:  the number of functions identified in each plan ranged from 3 to 538.  In addition, the apparent importance of the functions was not  consistent. For example, a number of essential functions were of  clear importance, such as  ●  “conduct payments to security holders” and  ●  “carry out a rapid and effective response to all hazards,  emergencies, and disasters.”
Other identified functions appeared vague or of questionable  importance:  ●  “champion decision-making decisions” and  ●  “provide advice to the Under Secretary.”
subsections: section_title: New Guidance and Review Process Could Result in More Consistent Identification of Essential Functions
paragraphs: The high level of generality in FEMA’s guidance on essential  functions contributed to the inconsistencies in agencies’  identification of these functions. As was the case during our 2002  review, the version of FPC 65 in place on May 1, 2004, defined  essential functions as those that enable agencies to provide vital  services, exercise civil authority, maintain safety, and sustain the  economy during an emergency. The document did not, however,  define a process that agencies could use to select their essential  functions.
In June 2004, FEMA released an updated version of FPC 65,  providing additional guidance to agencies on each of the topics  covered in the original guidance, including an annex on essential  functions. The annex lists several categories that agencies must  consider when determining which functions are essential, including  ●  functions that must continue with minimal interruption or cannot be  interrupted for more than 12 hours without compromising the  organization’s ability to perform its mission and  ●  functions assigned to the agency by federal law or by order of the  President.
The new guidance goes on to outline steps addressing the  prioritization of selected functions as well as the identification of  resources necessary to accomplish them and of interdependencies  with other agencies.
On January 10, 2005, the Assistant to the President for Homeland  Security issued a memorandum outlining additional guidance on  essential functions and initiated a process to identify and validate  agency-level functions. The memorandum noted that in the past  many departments and agencies had had difficulty clearly  identifying and articulating their essential functions. It attributed  this difficulty, in part, to the lack of a defined set of national-level  essential functions to guide agency continuity planning, resulting in  multiple efforts to develop agency essential functions for different  specific purposes (e.g., planning for Year 2000 computer continuity,  information technology planning, and critical infrastructure  planning). Further, it noted that departments and agencies  sometimes do not distinguish between a “function” and the specific  activities necessary to perform the function.
To address these issues, the memorandum identified eight National  Essential Functions that are necessary to lead and sustain the  country during an emergency and, therefore, must be supported  through continuity capabilities. Table 2 lists the eight National  Essential Functions.
The memorandum asked major agencies to identify their Priority  Mission Essential Functions—those functions that must be  performed to support or implement the National Essential  Functions before, during, and in the immediate aftermath of an  emergency. The document stated that, generally, priority functions  must be uninterrupted or resumed during the first 24 to 48 hours  after the occurrence of an emergency and continued through full  resumption of all government functions.
When identifying their functions, agencies were asked to also  identify the National Essential Function that each priority function  supports, the time in which the priority function must be  accomplished, and the partners necessary to perform the priority  function. The memorandum asked agencies to reply by February 18,  2005.
The memorandum emphasized the need for the involvement of  senior-level agency officials, calling for each agency’s functions to  be first approved by an official with agencywide responsibilities.  The memorandum then laid out a process by which the functions  would be validated by an interagency group within the Homeland  Security Council. According to FEMA officials, two agencies’  essential functions have already been reviewed, and there are plans  to complete all agency reviews by the end of the summer. The  validated functions would then be used to support development of a  new continuity policy and would be used to develop and implement  improved requirements for capabilities, inform the annual budget  process, establish program metrics, and guide training and exercises  and other continuity program activities. The memorandum did not  set any time frames for these later steps.
Together, FEMA’s revised guidance and the guidance from the  White House significantly address the best practices that we  identified. For example:  ●  Both documents call for agencies to identify dependencies  necessary to perform the functions.  ●  FEMA’s guidance calls for agencies to prioritize their essential  functions and identify the resources necessary to perform them.  ●  The White House guidance calls on agencies to identify the recovery  time necessary for each function and outlines a process to validate  the initial list of functions.
If implemented effectively, the new guidance and the review process  conducted by the White House could result in more consistent  identification of essential functions across the executive branch.  The functions could then form the basis for better plans for  continuing the most critical functions following a disruption to  normal operations. However, without time frames for completing  the outlined process, it is unclear when the expected improvement will occur.
section_title: Agency COOP Plans Have Improved, but None Address All of FEMA’s Guidance
paragraphs: When compared with our prior assessment, agency continuity plans  in place on May 1, 2004, showed improved compliance with FEMA’s  guidance in two ways:  ●  One agency and nine component agencies that did not have  documented continuity plans in place at the time of our 2002 had put such plans in place by May 1.
For each of the topic areas outlined in  generally made progress in increasing compliance. owever, two major agencies did not have plans in place on May 1,  H 2004. As of April 2005, one of these two had finalized its plan.
In addition, after analyzing these plans, we found that none in place  on May 1 followed all of FEMA’s guidance. Of the eight topic areas  identified in FPC 65, these 45 COOP plans generally complied with  the guidance in two areas (developing plans and procedures and  order of succession); generally did not comply in one area (tests,  training, and exercises); and showed mixed compliance in the other  five areas. Specifically, when examining the governmentwide results  of our analysis of the eight planning topics outlined in FPC 65, we  determined the following:  ●  Essential functions. Most agency plans identified at least one  unction as essential and identified which functions must be  f continued under all circumstances. However, less than half th e  COOP plans identified interdependencies among the functions,  established staffing and resource requirements, or identified themission-critical systems and data needed to perform the function s.
Plans and procedures. Most plans followed the guidance in this area including establishing a roster of COOP personnel, activation  ,  procedures, and the appropriate planning time frame (12 hours to 30  days).  ●  Orders of succession. All but a few agency plans identified an order  of succession to the agency head. Most plans included orders of  succession for other key officials or included officials outside of the  local area in the succession to the agency head. Many plans did not  include the orders of succession in the agency’s vital records or  document training for successors on their emergency duties.  ●  Delegations of authority. Few plans adequately documented the  legal authority for officials to make policy decisions in an  emergency.  ●  Alternate facilities. Most plans documented the acquisition of at  least one alternate facility, and many included alternate facilities  inside and outside of the local area. However, few plans  documented that agencies had sufficient space for staff, pre- positioned equipment, or appropriate communications capabilities  at their alternate facilities.  ●  Redundant emergency communications. Most plans identified at  least two independent media for voice communication. Less than  half of the plans included adequate contact information, and few  provided information on backup data links.  ●  Vital records. Less than half of the plans fully identified the agency’s  vital records. Few plans documented the locations of all vital  records or procedures for updating them.  ●  Tests, training, and exercises. While many agencies documented  some training, very few agencies documented that they had  conducted tests, training, and exercises at the recommended  frequency.
subsections: section_title: Inadequate Oversight by FEMA Contributes to Noncompliance
paragraphs: During our prior review of 2002 plans, we found that insufficient  oversight by FEMA contributed to agencies’ lack of compliance with  the guidance. Specifically, we noted that FEMA had not conducted  an assessment of agency contingency plans since 1999. As a result,  we recommended that it conduct assessments of agency continuity  plans that include independent verification of agency-reported  information. In response, DHS reported that it was developing a  readiness reporting system to assist it in assessing agency plans and  planned to verify the information reported by the agencies.
Although neither of these planned actions was completed by May 1,  2004, FEMA has made subsequent efforts to improve its oversight.  According to FEMA officials, development of the readiness  reporting system was completed in March 2005, and the system is  expected to be operational and certified by October 2005, at which  time there will be seven locations (including two FEMA locations)  using the system. They added that once the system becomes fully  operational, agencies will be required to periodically provide  updated information on their compliance with FEMA’s guidance.  These officials also reported that the agency had taken additional  steps to improve readiness. Specifically, they stated that the  interagency exercise held in mid-May 2004 successfully activated  and tested agency plans; they based this assessment on reports  provided by the agencies. Furthermore, FEMA has begun planning  for another interagency exercise in 2006. In addition, as of April  2005, FEMA had provided training to 682 federal, state, and local  officials from 30 major federal departments and agencies and 209  smaller agencies—including state, local, and tribal entities. FEMA  officials stated that because of these additional successful efforts to  improve readiness, they no longer planned to verify agency-reported  readiness data.
While the revised guidance, recent exercise, and ongoing training  should help ensure that agency continuity plans follow FEMA’s  guidance, FEMA’s ongoing ability to oversee agency continuity  planning activities will be limited by its reliance on agency-provided  data. Without verification of such data, FEMA lacks assurance that  agency plans are compliant and that the procedures outlined in  those plans will allow agencies to effectively continue to perform  their essential functions following a disruption.
section_title: One Agency Plans to Use Telework in Response to an Emergency
paragraphs: Telework, also referred to as telecommuting or flexiplace, has  gained widespread attention over the past decade in both the public  and private sectors as a human capital flexibility that offers a variety  of potential benefits to employers, employees, and society. In a 2003  report to Congress on the status of telework in the federal  government, the Director of the Office of Personnel Management  (OPM) described telework as “an invaluable management tool  which not only allows employees greater flexibility to balance their  personal and professional duties, but also allows both management  and employees to cope with the uncertainties of potential  disruptions in the workplace, including terrorist threats.”
As we reported in an April 2004 report, telework is an important and  viable option for federal agencies in COOP planning and  implementation efforts, especially as the duration of an emergency  event is extended. In a July 2003 GAO report, we defined 25 key  telework practices for implementation of successful federal  telework programs.
Although not required to do so, 1 of the 21 agency continuity plans  in place on May 1, 2004, documented plans to address some  essential functions through telework. Two other agencies reported  that they planned to use telework to fulfill their essential functions,  and eight agencies reported that they planned for nonessential staff  to telework during a COOP event, but their continuity plans do not  specifically mention telework.
However, none of the agencies that are planning to use telework  during a COOP event documented that the necessary preparations  had taken place. These preparations—derived from the 25 key  telework practices for the development of an effective telework  program—include informing and training the staff, ensuring that  there is adequate technological capacity for telework, providing  technological assistance, and testing the ability to telework.
In summary, Mr. Chairman, although agency COOP plans have  shown improvement since our prior assessment of 2002 plans, most  plans in place on May 1, 2004, continued to exhibit inconsistencies  in the identification of essential functions and significant lack of  compliance with FEMA’s guidance. Both FEMA’s revision to this  guidance and a recently initiated White House effort have the  potential, if effectively implemented, to help agencies better identify  their essential functions and thus develop better continuity plans.  However, the lack of a schedule to complete the White House effort  makes it unclear when these improvements might take place.  Agencies’ efforts to develop continuity plans could also be aided by  FEMA’s efforts to develop a readiness reporting system, conduct a  governmentwide exercise, and train agency COOP planners, as well  as by any guidance or policies that result from the White House  effort.
Finally, even though FEMA’s continuity planning guidance in place  in May 2004 did not address telework, one agency’s continuity plan  at that time included plans to use telework in response to an  emergency. In addition, 10 agencies reported that they planned to  use telework following a COOP event, but their plans were not  clearly documented.
In our report, we make recommendations aimed at helping to ensure  that agencies are adequately prepared to perform essential functions  following an emergency. We recommended that the Assistant to the  President for Homeland Security establish a schedule for the  completion of the recently initiated effort to validate agency  essential functions and refine federal continuity of operations  policy. We also recommended that the Secretary of Homeland  Security direct the Under Secretary for Emergency Preparedness  and Response to  ●  develop a strategy for short-term oversight that ensures that  agencies are prepared for a disruption in essential functions while  the current effort to identify essential functions and develop new  guidance is ongoing;  ●  develop and implement procedures that verify the agency-reported  data used in oversight of agency continuity of operations planning;  and  ●  develop, in consultation with OPM, guidance on the steps that  agencies should take to adequately prepare for the use of telework  during a COOP event.
In commenting on our findings and recommendations, the Under  Secretary for Emergency Preparedness and Response of DHS stated  that the department agreed that there has been improvement in  COOP plans and attributed that improvement to a renewed  emphasis by DHS and the White House. The department also agreed  with the need for additional oversight and noted that FEMA had  begun conducting COOP site assessments at departments and  agencies to improve readiness. The Under Secretary’s letter drew  attention to a number of actions taken after the May 1, 2004, cutoff  date for our assessment. Finally, the Under Secretary pointed out  that the readiness reporting system that FEMA is developing was  not intended to be a COOP plan assessment tool, but that it instead  provides key officials with the ability to determine plan status in  near real time. We continue to believe that it is important for FEMA  to assess agency plans as part of its oversight responsibilities.  Regardless of the system’s intended use, we believe its capabilities,  as described by FEMA, make it a valuable tool that the agency  should use when exercising these responsibilities.
Mr. Chairman, this concludes my statement. I would be pleased to  respond to any questions that you or other members of the  Committee may have at this time.
section_title: Contacts and Acknowledgements
paragraphs: For information about this testimony, please contact Linda D.  Koontz at (202) 512-6240 or at koontzl@gao.gov, or James R.  Sweetman at (202) 512-3347 or sweetmanj@gao.gov. Other key  contributors to this testimony include Barbara Collier, Mike Dolak,  Nick Marinos, and Jessica Waselkow.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.