Homeland Security: Assessment of the National Capital Region Strategic Plan
Published: 2006-09-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Among other things, the Office of National Capital Region Coordination is to coordinate efforts within the National Capital Region (NCR) to ensure execution of domestic preparedness activities. In our May 2004 report and June 2004 testimony before the House Government Reform Committee, GAO recommended that the NCR develop a strategic plan to establish and monitor the achievement of regional goals and priorities for emergency preparedness and response. GAO subsequently testified on the status of the NCR's strategic planning efforts before the Subcommittee on Oversight of Government Management, the Federal Workforce, and the District of Columbia in July 2005 and March 2006. The Subcommittee asked GAO to provide comments on the NCR's strategic plan, which the NCR partners approved in September 2006. In this testimony, GAO discusses its assessment of the recently completed NCR homeland security strategic plan and the extent to which the new plan includes desirable strategic plan characteristics and how the substance of the plan might be further strengthened when the plan is reviewed and possibly revised.
section_title: What GAO Found
paragraphs: A coordinated strategic plan to establish and monitor the achievement of regional goals and priorities is fundamental to implementing a coordinated approach to enhancing emergency preparedness and response capacities in the NCR. In March 2006, GAO observed that the NCR's strategic plan could benefit from addressing all six characteristics GAO considers to be desirable for a regional homeland security strategy. These characteristics were used to evaluate the final plan. These include, for example, goals, subordinate objectives, activities, and performance measures; resources, investments, and risk management; and organizational roles, responsibilities, and coordination. The NCR approved its strategic plan in September 2006. The NCR homeland security strategic plan includes all six characteristics we consider desirable for a regional homeland security strategy. To illustrate, the plan includes regional priorities and presents the rationale for the goals and related objectives and initiatives. This includes information on how the plan addresses national priorities and targeted capabilities from the National Preparedness Goal, an Emergency Management Accreditation Program assessment of local and regional preparedness and emergency management capabilities against recognized national standards, and the Department of Homeland Security's Nationwide Plan Review of emergency plans. The plan structure is more streamlined, containing an overview, core plan, and detailed appendix with information on factors such as risks, costs, and roles and responsibilities. However, the substance of the information within these six characteristics could be improved to guide decision makers. Two examples: (1) the plan does not reflect a comprehensive risk assessment for the region, which, when completed, may result in changes in some of the priorities in the current plan; and (2) although the NCR plan defines objectives as being key, measurable milestones for reaching each goal, many objectives include language such as "strengthen," "enhance," "increase," "improve," and "expand" rather than more specific performance measures and targets. Several of our observations regarding potential plan substance are the same as those we provided in our March 2006 testimony. The NCR has made considerable progress in developing its first strategic plan. Although GAO has noted some remaining limitations and areas of potential improvement, the NCR strategic plan provides the basic foundation for regional preparedness, including what is needed in case of a catastrophic event. Now, the challenge is ensuring that initiatives to implement the goals and objectives are funded, completed, and appropriately assessed to determine if they have achieved the NCR's strategic goals while continually monitor the plan's implementation to determine what adjustments are needed for continuing improvement.

section_title: Letter
paragraphs: I appreciate the opportunity to be here today to discuss the National  Capital Region’s (NRC) September 2006 homeland security strategic plan.  A well-defined, comprehensive homeland security strategic plan for the  NCR is essential for assuring that the region is prepared for the risks it  faces, whether those risks are from nature or human action. We reported  on NCR strategic planning, among other issues, in May 2004 and  September 2004, testified before the House Committee on Government  Reform in June 2004, and testified before your Committee in July 2005 and  March 2006. In 2004 and 2005, we recommended that the Secretary of the  Department of Homeland Security work with the NCR jurisdictions to  develop a coordinated strategic plan to establish goals and priorities to  enhance first responder capacities that can be used to guide the use of  federal emergency preparedness funds—a recommendation that the  department agreed to implement.
In March 2006, I commented on the status of the NCR strategic planning  and again emphasized that the Secretary of the Department of Homeland  Security should work with the NCR jurisdictions to quickly complete a  coordinated strategic plan. To improve the plan’s effectiveness as it was  being developed, we provided six characteristics we considered to be  desirable for a regional homeland security strategy. These characteristics  included (1) purpose, scope, and methodology; (2) problem definition and  risk assessment; (3) goals, subordinate activities, and performance  measures; (4) resources, investments, and risk management; (5)  organizational roles, responsibilities, and coordination; and (6) integration  and implementation.
Today, my statement provides our assessment of the recently completed  NCR homeland security strategic plan and the extent to which the new  plan includes the six characteristics and how the substance of the plan  might be further strengthened when the plan is reviewed and possibly  revised. We did our work in accordance with generally accepted  government auditing standards.
subsections: section_title: Background
paragraphs: The Homeland Security Act established the Office of National Capital  Region Coordination within the Department of Homeland Security. The  ONCRC is responsible for overseeing and coordinating federal programs  for and relationships with state, local, and regional authorities in the NCR  and for assessing and advocating for the resources needed by state, local,  and regional authorities in the NCR to implement efforts to secure the  homeland. One of the ONCRC mandates is to coordinate with federal,  state, local, and regional agencies and the private sector in NCR on  terrorism preparedness to ensure adequate planning, information sharing,  training, and execution of domestic preparedness activities among these  agencies and entities.
In our earlier work, we reported that the ONCRC and the NCR faced  interrelated challenges in managing federal funds in a way that maximizes  the increase in first responder capacities and preparedness while  minimizing inefficiency and unnecessary duplication of expenditures. One  of these challenges included a coordinated regionwide plan for  establishing first responder performance goals, needs, and priorities, and  assessing the benefits of expenditures in enhancing first responder  capabilities.
All states and urban areas are to align existing preparedness strategies  within the National Preparedness Goal’s eight national priorities. An  overarching national priority for the National Preparedness Goal is the  embracing of regional approaches to building, sustaining, and sharing  capabilities at all levels of government. DHS required states and urban  areas, including the NCR, to assess their preparedness needs by reviewing  their existing programs and capabilities and using those findings to  develop a plan and formal investment justification outlining major  statewide, sub-state, or interstate initiatives for which they will seek  federal funding under the Homeland Security Grant Program. The target  capabilities are intended to serve as a benchmark against which states,  regions, and localities can measure their own capabilities. According to  DHS, the funding initiatives are to focus efforts on how to build and  sustain programs and capabilities within and across state boundaries  while aligning with the National Preparedness Goal and national priorities.
In fiscal year 2006 DHS funding guidance, regional collaboration included  specific implementation benchmarks. These benchmarks included   (1) formalizing mutual aid agreements with surrounding communities and  states to share equipment, personnel, and facilities during emergencies;   (2) conducting exercises of the execution of mutual aid agreements to  identify the challenges and familiarize officials with resources that are  available in the region; and (3) coordinating homeland security  preparedness assistance expenditures and planning efforts on a regional  basis to avoid duplicative or inconsistent investments.
In earlier work on effective regional coordination for emergency  preparedness, we defined regional coordination as the use of  governmental resources in a complementary way toward goals and  objectives that are mutually agreed upon by various stakeholders in a  region. In later work for this Committee on federal agency collaboration,  we defined collaboration in a similar manner, defining it as any joint  activity by two or more organizations intended to produce more public  value than could be produced when the organizations act alone.  Successful coordination or collaboration occurs not only vertically among  federal, state, and local governments, but also across jurisdictions within  regions. In the coordination or collaborative effort, strategic plans can be  effective tools to focus resources and efforts to address problems through  features such as goals and objectives that are measurable and quantifiable.
By specifying goals and objectives, plans can also give planners and  decision makers a structure for allocating funding to those goals and  objectives. A well-defined, comprehensive homeland security strategic  plan for the NCR is essential for assuring that the region is prepared for  the risks it faces.
In advance of our March 2006 testimony, Office of the National Capital  Region Coordination officials provided us with several documents that  they said when taken as a whole constituted the basic elements of NCR’s  strategic plan, such as a November 2005 document containing information  on NCR strategic goals, objectives, and initiatives and February and March  2006 documents related to homeland security grant program funding. In  our testimony, we outlined desirable characteristics for a strategic plan  based on past work. The desirable characteristics, adjusted for a regional  strategy, are    Purpose, scope, and methodology that address why the strategy was  produced, the scope of its coverage, and the process by which it was  developed.
Problem definition and risk assessment that address the particular  regional problems and threats the strategy is directed towards.
Goals, subordinate objectives, activities, and performance measures  that address what the strategy is trying to achieve, steps to achieve  those results, as well as the priorities, milestones, and performance  measures to gauge results.
Resources, investments, and risk management that address what the  strategy will cost, the sources and types of resources and investments  needed, and where resources and investments should be targeted by  balancing risk reductions and costs.
Organizational roles, responsibilities, and coordination that address  who will be implementing the strategy, what their roles will be  compared to those of others, and mechanisms for them to coordinate  their efforts.  Integration and implementation that address how a regional strategy  relates to other strategies’ goals, objectives and activities, and to state  and local governments within their region and their plans to implement  the strategy.
section_title: The NCR Strategic Plan Contains Desirable Characteristics, but Additional Information Could be Provided
paragraphs: The plan’s structure contains the six characteristics and related elements  that we identified in earlier work as desirable in a national strategy that  would also be useful for a regional approach to homeland security  strategic planning. Instead of the multiple documents provided in advance  of our March 2006 testimony, the plan is now one document with three  parts—an overview, a core plan, and appendices with more detailed  information. The core plan includes information on purpose, scope, and  methodology; goals and objectives; problem definition and risk  assessment; implementation and sustainment of the strategic plan,  including organizational roles, responsibilities, and coordination; and  alignment with other strategies and planning efforts. The appendix  document provides extensive information on initiatives, including  priorities, rationale, key tasks and programs, estimates of costs and cost  assumptions, types of resources and investments, time frame, the lead  organization responsible for each initiative, and performance assessment  information, including measures, baselines, and targets. The plan will be  reviewed and updated on a 3-year cycle.
However, the substance of the information within several of the six  characteristics could be further strengthened as the plan is reviewed and  revised to enable the NCR jurisdictions set clear priorities and sustain  their collaborative efforts. As I will point out, several of our observations  regarding improvements are the same as those we provided in our March  2006 testimony.
subsections: section_title: Plan Purpose, Scope, and Methodology
paragraphs: The first desirable characteristic is purpose, scope, and methodology— addressing why the strategy was produced, the scope of its coverage, and  the process by which it was developed. Elements of this characteristic  include, for example, what major functions, mission areas, or activities it  covers; principles or theories that guided its development; and the process  to produce the strategy.
The plan includes a section on purpose, scope, and methodology. For  example, according to the strategic plan document, the plan is intended to  provide a framework and guidance for programming, budgeting, and  execution of homeland security programs in the NCR over the next 3 years  and serve as the basis for planning for the next 5 years. Scope information  discusses regionwide mission areas and initiatives and notes that the  strategic plan is not an operational plan and is not a replacement for local  and state emergency operations plan. Its purpose is not to be an  investment plan and, therefore, does not allocate funding to any initiatives  or change the funding, budgeting, and resource allocation processes for  individual funding sources.
The plan describes its development by the NCR Partners—a group  consisting of the NCR’s local, state, regional, and federal entities; citizen  community groups; private-sector organizations; non-profit organizations;  and non-governmental organizations. The plan describes the consensus- based process guided by the NCR’s Homeland Security Senior Policy  Group (SPG).
section_title: Problem Definition and Risk Assessment
paragraphs: The second desirable characteristic is problem definition and risk  assessment—addressing the particular regional problems and threats the  strategy is directed toward. Elements of this characteristic include, for  example, a discussion or definition of problems, their causes, and  operating environment, and risk assessment, including an analysis of  threats and vulnerabilities.
subsections: section_title: Risk- and Capabilities-Based Approach
paragraphs: The plan describes the approach used to identify threats, vulnerabilities,  and consequences of the risks facing the region. The plan focuses  attention and resources on initiatives that address the highest risks for the  region. The document states that numerous gap and shortfall analyses,  conducted by the NCR’s homeland security senior leaders and  independent analysts, helped define the plan’s four goals. Further, it is  stated that each state jurisdiction also completed an extensive hazard  analysis.
Although the plan states that a combined risk- and capabilities-based  approach was used, it also recognizes the need for a more formal, in-depth  risk assessment based on a common framework and includes a major  priority initiative to meet this need. The plan states that over the past few  years, several vulnerability assessments have been completed for the NCR  and its member institutions, but our assessment of the plan indicates that  information from past assessments may not have been fully utilized.  According to the plan, one initiative calls for the development of a NCR  risk assessment methodology and a regionwide threat analysis, leveraging  assessments and analyses to date conducted by the states, local  jurisdictions, and federal partners. Another initiative is to create a high  priority list of recommended critical infrastructure protective actions  based on security assessment findings already completed and shared with  the NCR.
It is unfortunate that the strategic plan’s goals do not yet reflect the  completion and maintenance of a comprehensive, integrated risk  assessment for the region. We noted in our March 2006 testimony that in  the aftermath of the September 11, 2001, terrorist attacks and the creation  of the ONCRC in 2003, we would have expected that the vast majority of  risk assessment work should have been completed. An ongoing risk  assessment methodology should be in place to identify emerging risks.
section_title: Capability Development
paragraphs: Until the new risk assessment is completed, the plan states the NCR is  utilizing a compilation of regional gaps in capabilities, some the same as  those identified in the EMAP assessment, considered alongside threat and  impact factors, in developing strategic plan goals, objectives and  prioritization of initiatives. These regional capability gaps included   (1) standardized alert notification procedures; (2) regional mitigation plan;  (3) regionwide strategic communications plan; (4) public information  dissemination during all phases of emergencies; (5) inclusion of the  private sector information in planning; (6) public–private coordination;   (7) analysis of threats, vulnerabilities and consequences; (8) resource  management and prioritization; (9) understanding of long-term recovery  issues; (10) special needs considerations for response and recovery;   (11) mass care; and (12) infrastructure.
The document states that the plan addresses the EMAP assessment  recommendations and 54 of the 58 EMAP national standards. In addition,  the National Preparedness Goal’s 37 capabilities that federal, state, local,  and tribal entities must achieve to perform critical tasks for homeland  security missions served as a target in developing the plan’s initiatives. In  the plan, each regional initiative rationale identifies whether it addresses a  national capability from the national target capabilities list, an EMAP  standard, and/or an identified regional gap. Further, the plan states that it  addresses all of the Nationwide Plan Review’s overall emergency and  catastrophic planning conclusions for all states and urban areas. in the  nation. Other sources of information for the strategic planning included  the National Capital Region Program and Capability Enhancement Plan,  the Nationwide Plan Review, and the National Preparedness Goal and  related target capabilities.
We are encouraged that the NCR plan emphasizes enhancing capabilities  consistent with currently known regional capability shortfalls and others  based on a variety of information sources. It is clear that a great deal of  work has gone into identifying needed capabilities as part of the planning  approach.
In revising the plan, NCR officials might consider two observations. First,  although the plan recognized the importance of the Nationwide Plan  Review’s specific phase 2 findings for the NCR emergency plans and the  status of catastrophic and evacuation planning, it did not reflect specific  NCR findings. As you know, the review was conducted in response to the  shortfalls in preparedness identified during Hurricane Katrina. A brief  scorecard presenting Review NCR findings provided to us said that,  overall, the DHS review found the NCR plan’s adequacy, feasibility, and  acceptability not sufficient to meet the requirements of a catastrophic  incident. While the assessment found the NCR’s resource management  annex and communications annex sufficient to meet the requirements of a  catastrophic incident, others were only partially sufficient or not  sufficient, including the basic plan, direction and control annex, warning  annex, emergency public information annex, evacuation annex, mass care  annex, and the health and medical annex.
According to NCR officials, the assessment tools of the Review and the  EMAP assessment were flawed because they focus on a single jurisdiction,  not a multi-jurisdictional approach. In addition, the assessments assume  that the entity under review is an operational jurisdiction which the NCR  is not.  NCR officials told us they found the reviews of limited usefulness  because of this flaw. The officials said NCR states have individual state  plan reviews that are more valid. However, they said the NCR addressed  findings they thought were appropriate and useful and did focus on the  national findings, which are included in the NCR strategic plan. If the plan  was to include all sources of capability gaps, to guide problem definition  and risk assessment, NCR officials should consider if it would be useful to  describe the specific Review’s findings for the NCR that the officials did  accept, and align plan objectives and specific initiatives to those accepted  findings.
Also, instead of referencing preparedness capabilities from different  sources, it might be more useful for the plan to have one set of capabilities  for action. This would integrate all sources of necessary capabilities (and  their varying definitions) into a common set on which the region agrees,  whether the source of the needed capability is national goal directives,  assessment standards, or individual regional gap analysis. This integration  might also include remarks on the progress in developing a capability.  While all of the capabilities may be important, it is unclear from the plan  those capabilities are fully or partially developed and those that remain to  be developed. Milestones and the priority designations at the initiative  level provide an indication of progress, but it is difficult for the reader to  understand what is the complete picture of the status of individual  capability implementation.
section_title: Goals, Subordinate Objectives, Activities, and Performance Measures
paragraphs: The third desirable characteristic is goals, subordinate objectives,  activities, and performance measures—addressing what the strategy is  trying to achieve, steps to achieve those results, as well as the priorities,  milestones, and performance measures to gauge results. Elements of this  characteristic include, for example, a hierarchy of strategic goals and  subordinate objectives and priorities, milestones, and outcome-related  performance measures.
The NCR homeland security strategic plan includes the region’s four long- term homeland security strategic goals and related objectives for the next  3 to 5 years. Specific initiatives are described for each objective, with cost  estimates and performance measures for fiscal years 2007 through 2009.  The NCR’s strategic plan vision, mission, goals, and objectives are shown  in table 1. According to the document, each goal has equal standing.
The four NCR strategic goals are defined as broadly stated long-term  outcomes that, if reached, collectively enable the NCR jurisdictions to  realize the NCR’s vision. The objectives in the strategic plan are defined as  key, measurable milestones along the path toward reaching each goal.  Similar to performance goals under the Government Performance and  Results Act, the objectives should be based on the strategic goals and  help to determine the achievement of strategic goals. For future plan  assessments, NCR officials might consider developing strategic  performance expectations where substantive action is needed and  describe the full set of objectives needed to achieve planned goals.
The plan describes an evolution of the strategic plan beginning with  consensus building for close to a year (August 2004 to June 2005),  initiative development for several months (June 2005 to November 2005),  and program management and implementation for another 7 months  (January 2006 to July 2006). However, Goal 1—covering planning and  decisionmaking—has objectives to strengthen regional planning and  decisionmaking, establish a process to identify and close preparedness  gaps, and enhance oversight and accountability. It is unclear why these  efforts over this amount of time have not produced well-established  planning and decision-making processes and responsibilities. NCR  officials should assess if future plans might focus on the remaining three  goals that emphasize preparedness, prevention, protection, response, and  recovery.
Further, the plan states that the 12 objectives presented in the plan are  essential, but not necessarily sufficient to attain these goals. This raises  the question of what is missing and what is the potential impact of the  missing elements on achieving the plan’s goals. The plan states that  additional objectives will emerge to take the place of those already  accomplished, but provides no further details of what might be sufficient  now to meet the plan’s goal. While any strategic plan is considered a  “living” document, at the point of its initial issuance or revision, it should  strive to be as complete as possible, particularly when the objectives are  considered milestones toward the accomplishment of each goal.
subsections: section_title: Steps to Achieve Results
paragraphs: In addition to the plan’s goals and objectives, initiatives to achieve the  objectives complete the core of the NCR strategic plan. The plan identifies  30 initiatives, with 14 prioritized based on their alignment with and  support of national priorities, DHS target capabilities, and regional gaps.  The 14 priority initiatives, according to the plan, are to be considered first  in line for implementation and funding, with the other initiatives  considered secondary in terms of execution. In our March 2006 testimony,  we noted that any future NCR strategic plan should include a review of  initiatives to determine if the initiatives will fully meet the results expected  of the objectives. The initiatives appear overall to reflect the objectives’  general intent.
However, NCR officials might consider clarifying the plan’s distinction  between priority and non-priority initiatives in achieving the objectives.  For example, goal 1 has four of its six initiatives labeled as priorities.  These include initiatives such as developing and periodically updating the  strategic plan and related processes and establishing regional oversight  and accountability. The initiative under this goal to develop an investment  life-cycle planning approach to ensure infrastructure and resources are  available to support multi-year operational capabilities was seen as a  secondary initiative. The plan does not present a rationale for making this  a secondary initiative when it can be argued that a functioning life-cycle  investment process is essential to identifying and managing the resources  needed to sustain key preparedness and response capabilities, once  established.
section_title: Performance Measures
paragraphs: The NCR strategic plan contains a measure for each goal, measure(s) for  each objective, and an initiative performance assessment consisting of a  measure (performance indicator), current baseline performance, and  performance targets. For example, the measure for goal 1 (planning and  decisionmaking) is support for NCR plans and decisions among NCR  partners and stakeholders, measured by a survey. The first objective’s  (strengthen the regional approach to planning and decision making)  measures include (1) stakeholder satisfaction with the strategic plan as  determined by survey and (2) NCR Partners’ satisfaction with program  plans as determined by survey. One initiative’s (developing and updating  the plan and related processes) measure under this objective is the time to  develop and adopt a strategic plan with the baseline performance of   2 years and a target to be adopted by September 2006.
The NCR plan defines objectives as being key, measurable milestones  along the path toward reaching each goal. Many objectives include  language such as “strengthen,” “enhance,” “increase,” “improve,” and  “expand.” These objective statements have their own measures to define  performance. For example, one current objective is “strengthen the  exchange and analysis of information across disciplines for improved  situational awareness.” Its measure is “participants’ after-the-fact informed  ratings of their situational awareness during test and real events.”
In our March testimony, we only addressed measurement at the initiative  level. With three levels of measurement—goal, objective, and initiative, the  NCR might further refine the measures for full measurement coverage and  yet not duplicate measurement. For example, the goal 1 measure is  virtually the same as the measures for objective 1.1 under the goal.   The other two objectives’ measures address implementation of  countermeasures and satisfied performance commitments, which do not  appear to be measured by the goal measure.
Further, measurement at the initiative level is very important as these  serve as the means to achieve the objectives and, in turn, the strategic  goals. In our March testimony, we stated that a NCR strategic plan could  more fully measure initiative expectations by improving performance  measures and targets. The performance measures should readily lend  themselves to actual quantitative or qualitative measurement through a  tabulation, a calculation, a recording of activity or effort, or an assessment  of results that is compared to an intended purpose. In our work on results  management practices, we have found that leading organizations said they  used a diversity of performance comparisons, depending on the goal, to  set performance targets. The comparisons included (1) predefined  performance specifications, (2) future performance levels or changes in  levels to be achieved at a later date, (3) best practice benchmarks from  other organizations, and (4) program implementation milestones.
Our earlier testimony also stated that a strategic plan could be improved  by (1) expanding the use of outcome measures and targets in the plan to  reflect the results of its activities and (2) limiting the use of other types of  measures. The NCR strategic plan uses a variety of measures and  comparisons at the initiative level, and I see this as a valuable approach for  future strategic plans. The current strategic plan also has emphasized  outcome measures. The NCR might consider reviewing the many output  measures that remain, such as “regional emergency messaging tests per  year,” “number of registered volunteers,” and “average hours of training  per volunteer” to see if they might become more outcome-oriented.
While the new NCR strategic plan has markedly improved its initiative  measures over those presented in documents in advance of the final plan,  further attention may be warranted. For example, a few measures are not  clearly defined or will be difficult to measure, such as “improvement in  performance- and risk-based assessment results,” “utilization rates for  collaboration and information-sharing systems,” and “proportion of  desired information exchanges occurring.” In addition, some measures do  not assess the initiative. For example, one initiative is to “design and  conduct a risk-based threat analysis to identify gaps in regional  preparedness.” The measure is “  rating on the usefulness of threat analysis in decision-making.” This  measure is essentially a general satisfaction survey. Two measures for the  initiative for establishing a regional oversight and accountability function  with appropriate tools and resources for performance accountability are  “utilization rates for collaboration and information-sharing systems” and  “Partners’ awareness of NCR activity status.” Neither of these two  measures directly assess establishing an oversight and accountability  system.
section_title: Milestones
paragraphs: In March, we said that a future NCR strategic plan could also be  strengthened by including more complete time frames for initiative  accomplishment, including specific milestones and having time frames  matching the initiative. The new strategic plan has identified milestones  for all key tasks and programs under each initiative, as well as overall  timeframe within the strategic planning cycle. The specification of the  milestone information helps the reader to better understand the  sequencing of actions.
However, NCR officials may want to review the distribution of the  milestones. The strategic plan’s implementation time frame is for the  period fiscal year 2007-fiscal year 2009. However, the strategic plan’s  initiatives are heavily weighted for completion by the end of fiscal year  2007. Based on the milestone dates provided in the plan, 18 of the   30 initiatives are planned to be complete by that time and another 9 by the  end of fiscal year 2008. A few initiatives appear to be close to completion  based on completed milestones or those that will soon be completed.  Their inclusion may reflect a desire to record accomplishments to date.  For example, initiative milestones for objective 1 under goal 1 (planning  and decisionmaking) reflect actions to be taken before September 2006  when the new plan was approved.
section_title: Resources, Investments, and Risk Management
paragraphs: The fourth desirable characteristic is resources, investments, and risk  management—addressing what the strategy will cost, the sources and  types of resources and investments needed, and where resources and  investments should be targeted by balancing risk reductions and costs.  Examples of elements for this characteristic include resources and  investments associated with the strategy, sources of resources, and risk  management principles.
In March, we testified that a future NCR strategic plan could provide fuller  information on the resources and investments associated with each  initiative. More specific cost information by initiative, such as funded and  unfunded grant information, would facilitate decision making in  comparing trade-offs as options are considered.
As mentioned earlier, the NCR strategic plan includes costs for each  initiative. Cost estimates are stated in a rough order of magnitude,  providing an estimate of the scale range of cost to inform the launch of  individual initiative operational planning. The costs of the initiatives range  from over $100 million to nearly $150 million, with some initiative cost  data still in development. Data are also provided on resource investment  and projects for each initiative. The plan states that funding source  identification, investment justification, and allocation decisions will be  made as a part of the implementation planning process. Funding source  analysis and allocation is not part of the NCR strategic planning effort.
Building and sustaining the needed capabilities in the NCR will require the  effective use of federal, state, and local funds. Identifying resource and  investment information, including types and sources of resources—at least  at a high level—would better define how initiatives will be funded and  when. In the absence of such information, it is difficult to judge if the   30 initiatives, including those considered priorities, are likely to be  implemented within the planned time frames. This is particularly  important as the plan notes that due to recent action by the administration  in allocating Urban Area Strategic Initiative fiscal year 2006 funds for the  NCR ($46.5 million, rather than the requested $188 million), when and to  what extent the NCR can implement the initiatives remains uncertain. The  UASI funding decision was made several months prior to the approval of  the strategic plan. Therefore, the plan should recognize that if the plan’s  initiatives are to be implemented on schedule, especially those with  milestones in the coming year, NCR jurisdictions will need to contribute  more than originally anticipated toward their completion.
section_title: Organizational Roles, Responsibilities, and Coordination
paragraphs: The fifth desirable characteristic is organizational roles, responsibilities,  and coordination—addressing who will be implementing the strategy,  what their roles will be compared to others, and mechanisms for them to  coordinate their efforts. Examples of elements for this characteristic  include lead, support, and partner roles and responsibilities; an  accountability and oversight framework; and specific processes for  coordination and collaboration.
Our March testimony noted that any future NCR strategic plan could  expand on organizational roles, responsibilities, coordination, and  integration and implementation plans. Organizational roles,  responsibilities, and coordination for each initiative would clarify  accountability and leadership for completion of the initiative. I also said  the plan might include information on how the plan will be integrated with  the strategic plans of NCR jurisdictions and that of the ONCRC and plans  to implement the regional strategy.
subsections: section_title: NCR Governance
paragraphs: The new plan’s description of organizational roles, responsibilities, and  coordination provides detailed information concerning NCR governance.  The plan states that at the strategic level, NCR Partners review  assessments of regional capabilities and develop a long-term homeland  security strategy for enhancing prioritized capabilities. Additional  overarching guidance, such as budget and policy documents, is also issued  at this level to facilitate activities at the levels below. Regional priorities  are formulated at the strategic level through an iterative process of  consensus-building among representatives from the key stakeholders of  the NCR, represented by three key governance groups: the Senior Policy  Group (SPG), representing state-level interests; the Chief Administrative  Officers Committee (CAO), representing local government level interests;  and the Regional Emergency Preparedness Council (EPC), representing  broader NCR stakeholder interests.
The plan states SPG membership consists of senior officials from  Maryland, Virginia, the District of Columbia, and DHS and the Director for  the ONCRC. The group exercises oversight of the implementation and  funding process and determines priority actions for both increasing  regional preparedness and response capabilities and reducing vulnerability  to terrorist attacks. According to the plan, the SPG ensures full integration  of NCR activities by providing final approval for programs within the NCR  as well all projects within a program. The SPG oversees directors of the  regional working groups in guiding the execution of their work on  approved homeland security initiatives, programs, and projects. The SPG,  it is said, is ultimately accountable for the impact of the work at the  program level of the NCR. The Chief Administrative Officers are city and  county-level administrators who serve on the CAO Committee on  Homeland Security. They work in partnership with the SPG members on  all strategic matters, operating more as a single unit. The CAO Committee,  along with the SPG members, served as key architects of the strategic  plan.
The plan describes the Regional Emergency Preparedness Council (EPC)  as an advisory body established by the Metropolitan Washington Council  of Government (MWCOG) Board of Directors and includes a broad array  of representatives from each of the NCR’s stakeholder categories.  According to the plan, the EPC makes policy, procedural, and other  recommendations to the MWCOG Board or through the MWCOG Board to  various regional agencies with emergency preparedness responsibilities or  operational response authority. In addition, the plan notes representatives  of the private sector have a critical advisory role in the region’s strategic  planning process. The private sector is represented on the Regional  Emergency Preparedness Council, Regional Emergency Support Function  Committees, and Regional Program Working Groups.
section_title: Lead Organizations
paragraphs: One element of the characteristic regarding roles, responsibilities, and  coordination we recommended for a strategic plan is specifying who has  lead, support, and partner roles and responsibilities. In the plan, a lead  organization is identified for each initiative. According to the plan, the  initiative leads are responsible for the definition, development, and  enhancement of the initiatives. They are to provide oversight for the  performance of the initiative against the goals and objectives.
In our view, the lead organizations are extremely important to the success  of the strategic plan. However, the leads for the 30 initiatives are dispersed  across multiple organizations, many of which are emergency support  function groups, regional working groups, or the NCR’s Homeland  Security Grants and Program Office. It is not clear if these organizations  have the authority, resources, or mechanisms to carry out all of their roles,  responsibilities, and coordination duties in implementing the plan. For  example, the plan describes the regional working groups as consisting of  practitioners, policymakers, and representatives from both the civic and  private sectors who have many duties, including filling gaps not covered  by any of the existing regional emergency support functions. The Grants  and Program Office manages grant performance, provides staff support for  various working groups, and manages NCR processes relating to  implementation and grant deadlines. These organizations may not be able  to establish policies, procedures, and other means to direct initiative  implementation. As the strategic plan is implemented, it may be useful for  the NCR to carefully assess initiative leadership and make adjustments as  necessary to ensure implementation of the plan.
section_title: Integration and Implementation
paragraphs: The final desirable characteristic is integration and implementation— addressing how a regional strategy relates to other strategies’ goals,  objectives, and activities, and to state and local governments within their  region and their plans to implement the strategy. Examples of elements  include, for example, horizontal and vertical integration; details on  specific federal, state, local or private strategies and plans; and  implementation guidance.
The document states that the strategic plan is but one part of a family of  plans at the strategic, programmatic, budget, and operational levels  existing within the NCR. The plan is intended to align jurisdictional  strategy planning efforts with national efforts and provide a mechanism  for NCR Partner input and guidance into jurisdiction programmatic and  budgetary planning processes. The plan is intended to identify common  goals, objectives, and initiatives implemented over the 3 to 5 years of the  plan. One initiative is designed to align and integrate response plans  across the jurisdictions, with emphasis on continuity of government,  operations, and evacuation.
The plan document states that the plan does not (1) dictate how the NCR  should spend its homeland security funds and (2) address operational  level issues or require operational plans at the regional level. Although the  plan does not directly affect the jurisdictional and emergency function  operational plans (e.g., local hazard mitigation plans, emergency response)  or address operational level issues, the plan is intended to influence  specific capabilities resourced by the jurisdictions that support  operational plans. According to the plan, detailed operational plans, where  necessary, will be updated by initiative leads as the strategic initiatives are  implemented.
The plan also states that the state homeland security investments made in  the jurisdictions comprising the NCR must take into account their own  regional considerations. The plan itself notes that the priorities for  preparedness in the homeland security plans for Virginia, Maryland, and  the District of Columbia reflect unique assessments of the threats and  vulnerabilities across each jurisdiction and have varying strategic plan  priorities. The annual review of the strategic plan is timed to correspond  with the federal, Maryland, Virginia, and District of Columbia budget  cycles, which should, according to the plan, facilitate the acquisition of  funding for initiative projects. As the plan is implemented, the jurisdictions  should, according to the plan, be able to determine their level of  contribution and commitment to the achievement of the plan’s goals and  initiatives. The plan describes the commitment of District of Columbia,  Virginia, and Maryland officials to a collaborative approach in eight  specific areas, which the plan states are addressed by at least one of the  NCR strategic plan goals.
For all initiatives, the plan document notes that the Emergency  Preparedness Council will convene a quarterly performance review. In  these sessions, each initiative lead will present the performance results of  their initiative. Initiative leads will present their results compared with the  pre-defined targets; analysis of results, trends, and root causes; and  recommended actions to maximize performance. The Emergency  Preparedness Council will discuss this information, make decisions, and  issue direction to improve project performance as necessary. While an  initiative is in the implementation stage, the review session is to serve as a  project management aid, reviewing schedule and budget status versus  milestones and exercising implementation management actions. When a  plan initiative is completed, the document states its review will transition  to an outcome-oriented performance discussion.
One of the plan’s initiatives is to establish a regional oversight and  accountability function with appropriate tools and resources for  performance transparency. According to the milestones, NCR entities will  report against the measures in January 2007 and performance reviews will  be in March 2007.
As we testified in March, implementation of regional initiatives not  covered by Homeland Security Grant Program funding likely would  require NCR jurisdictions acting individually or in combination with  others. If the plan is intended to align regional with state and local efforts  through identification of common goals, objectives, and initiatives  implemented by the jurisdictions over the 3 to 5 years of the plan, it is  critical that jurisdictional plans reflect the regional goals, objectives, and  initiatives. Although the plan notes that the District of Columbia, Virginia,  and Maryland have a commitment to the eight critical areas previously  mentioned, it is not known what the actual commitment is to all of the  goals, objectives, and initiatives in the NCR plan.
Our work to date has not included an assessment of individual  jurisdictional commitment or planned efforts to implement the NCR  strategic plan goals, objectives, and initiatives to determine if unfunded  initiatives, particularly those considered priority initiatives, might be  addressed by one or more of the NCR jurisdictions. While the NCR  strategic plan might guide or influence implementation of the initiatives,  there is no guarantee state and local plans and related investments will  respond to the initiatives. Even if the NCR jurisdictions initially commit to  the plan’s initiatives, with performance monitored by the Emergency  Preparedness Council, there is no vehicle or central responsible  organization with the authority to ensure implementation. Further work  would be required to determine to what extent, if any, the NCR initiatives  are addressed in other federal funding applications or individual NCR  jurisdictional homeland security initiatives.
A major organizational and functional challenge noted in the plan is that  the NCR is not organized as an operational entity and does not have the  authority to execute operations as an independent body. The NCR’s  authority only exists, the plan notes, to the extent the member  jurisdictions are willing to extend decision-making rights to the NCR.  Under the plan, the SPG is to exercise oversight of the implementation and  funding process and determine priority actions and the EPC is to do  quarterly performance reviews.
However, if regional collaboration and building capabilities in line with the  NCR goals are to become a reality, operational commitment is necessary.  As I stated earlier, the Office of National Capital Region Coordination was  created as a means of coordinating emergency preparedness and response  efforts across the region. The ONCRC is to oversee and coordinate federal  programs for and relationships with NCR state, local, and regional  authorities. One ONCRC mandate is to coordinate with NCR federal, state,  local, and regional agencies and the private sector on terrorism  preparedness to ensure adequate planning, information sharing, training,  and execution of domestic preparedness activities among these agencies  and entities. A challenge for the ONCRC is to work with the NCR  jurisdictions to provide effective oversight, accountability, and overall  leadership and management of the various NCR governance entities such  as the Senior Policy Group and Emergency Preparedness Council to  continually assess the strategic plan’s implementation and steps needed to  keep implementation on track.
In addition, the Department of Homeland Security beyond the ONCRC has  a role to play. As we noted in our work on regional coordination, the  federal government can encourage regional coordination through its grant  programs. As DHS emphasizes regional coordination and capability  building through implementation of the National Preparedness Goal, it can  provide additional oversight to determine if regional strategic plans have  specific and measurable goals and that resources are aligned to the goals.
section_title: Concluding Observations
paragraphs: As I stated when last before this Committee, there is no more important  element in results-oriented management than the effort of strategic  planning. Strategic planning defines what an organization seeks to  accomplish, identifies strategies it will use to achieve desired results, and  then determines success in reaching results-oriented goals and achieving  objectives.
The NCR has made considerable progress in developing its first strategic  plan. Although we have noted some remaining limitations and areas of  potential improvement, the NCR strategic plan provides the basic  foundation for regional preparedness, including what is in case of a  catastrophic event. Now, the challenge is ensuring that initiatives to  implement the goals and objectives are funded, completed, and  appropriately assessed to determine if they have achieved the NCR’s  strategic goals while continually monitor the plan’s implementation to  determine what adjustments are needed for continuing improvement.  - - - - -  That concludes my statement, Mr. Chairman. I would be pleased to  respond to any questions you or other Members of the Committee may  have.
section_title: Contact and Acknowledgments
paragraphs: For questions regarding this testimony, please contact William O. Jenkins,  Jr. at (202) 512-8757, email jenkinswo@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this testimony. Sharon L. Caudle also made key contributions  to this testimony.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.