IRS Emergency Planning: Headquarters Plans Supported Response to 2006 Flooding, but Additional Guidance Could Improve All Hazard Preparedness
Released: 2007-05-16T00:00:00

Letter

Background

IRS administers America’s tax laws and collects the revenues that fund government operations and public services. In fiscal year 2006, IRS collected more than $2.5 trillion in revenue. IRS’s Taxpayer Service and Enforcement programs generate more than 96 percent of the total federal revenue collected for the U.S. government. Total federal revenues have fluctuated from roughly 16 to 21 percent of gross domestic product between 1962 and 2004. Given the amount of federal revenue collected by IRS, a disruption of IRS operations could have great impact on the U.S. economy.

The IRS headquarters building is located in Washington, D.C., and houses over 2,200 of the agency’s estimated 104,000 employees. The headquarters building contains the offices of IRS executive leaders, such as the Commissioner and deputy commissioners, and headquarters personnel for 14 of the agency’s 17 individual business units.

Flood of IRS’s Headquarters Building

On June 25, 2006, the IRS headquarters building suffered flooding during a period of record rainfall and sustained extensive damage to its infrastructure. The subbasement and basement were flooded, and critical parts of the facility’s electrical and mechanical equipment were destroyed or heavily damaged. The subbasement—which contained equipment such as electrical transformers, electrical switchgears, and chillers—was submerged in more than 20 feet of water. In addition, the basement level— which housed the building’s fitness center, food service canteens, computer equipment, and the basement garage—was flooded with 5 feet of water. As a result of the flood damage, the building was closed until December 8, 2006. In response to the flood and the closure of the building, IRS headquarters officials reported activating several of the agency’s emergency operations plans. Over 2,000 employees normally assigned to the headquarters building were relocated to other facilities throughout the Washington, D.C., metropolitan area.

Although the flood severely damaged the building and necessitated the relocation of IRS employees to alternate office space, particular circumstances limited potential damage and made response and recovery activities easier: No employees were injured, killed, or missing as a result of the flood. Damage was limited to the basement and subbasement levels, and employees were able to enter the building to retrieve equipment and assets 5 days following the flood. IRS and the General Services Administration were able to identify and allocate alternate work space to accommodate all displaced employees, not just those considered critical or essential.

According to IRS status reports following the flood, facility space was provided for critical personnel within 10 days and for all headquarters employees within 29 days. Table 1 provides a time line of activities following the flood.

The Treasury Inspector General for Tax Administration also reviewed the IRS response to the flooding. According to the Inspector General’s reports, IRS adequately protected sensitive data and restored computer operations to all employees approximately 1 month following the flood. In addition, he reported that the flood caused no measurable impact on tax administration because of the nature of the work performed at this building and the contingency plans that IRS had in place. Finally, he reported that IRS paid $4.2 million in salary costs for 101,000 hours of administrative leave granted to IRS personnel following the flooding. While $3 million was paid for administrative leave during the first week following the flooding, the amount paid for administrative leave decreased in subsequent weeks.

IRS Headquarters Emergency Operations Plans

IRS headquarters has multiple emergency operations plans that if activated, are intended to work in conjunction with each other during emergencies. These plans include a suite of business continuity plans comprised of, among others, a business resumption plan for each IRS business unit and an Incident Management Plan. In addition, IRS has a COOP plan for emergency events affecting IRS executive leadership and essential functions. Table 2 summarizes the IRS emergency operations plans and their purposes.

Federal Guidance for Continuity Planning

FEMA developed FPC 65 to provide guidance to federal executive branch departments and agencies in developing contingency plans and programs to ensure the continuity of essential agency operations. All federal executive branch agencies are required to have such a capability in place to maintain essential government services across a wide range of all hazard emergencies. This guidance defines the elements of a viable continuity capability for agencies to address in developing their continuity plans.

Table 3 summarizes eight general elements of federal continuity guidance that agency plans should address.

IRS supplemented federal guidance with sections of its Internal Revenue Manual—a document outlining the agency’s organization, policies, and procedures—related to business resumption plans. Similar to the federal continuity guidance, the Internal Revenue Manual outlined minimum requirements for business resumption plans, including the need to identify people and resources to perform critical functions.

IRS Headquarters Emergency Operations Plans Partially Addressed Elements Outlined in Federal Guidance

The IRS headquarters emergency operations plans we reviewed collectively addressed several of the general elements of guidance identified in FPC 65. For example, the plans adequately identified the people needed to continue performing essential functions and had established procedures for activation. However, other elements were not addressed or were addressed only in part. Specifically, IRS identified two separate lists of essential functions—critical business processes and essential functions for IRS leadership—within its plans but only prioritized one of the lists. Furthermore, although the COOP plan outlined provisions for tests, training, and exercises, neither the business resumption plans we reviewed—from Criminal Investigation (CI), Wage and Investment (W&I), and Chief Counsel—nor the Incident Management Plan outlined the need to conduct such activities. While IRS’s Office of Physical Security and Emergency Preparedness provided overall guidance to business units on their business resumption plans, the guidance was inconsistent with the federal guidance on several elements, including the preparation of resources and facilities needed to support essential functions and requirements for regular tests, training, and exercises. Until IRS requires all of the plans that contribute to its ability to quickly resume essential functions to fully address federal guidance, it will lack assurance that it is adequately prepared to respond to the full range of potential disruptions.

IRS Internal Guidance Did Not Fully Address Elements of a Viable Continuity Capability

Inconsistencies between IRS’s business resumption plans and federal guidance can be attributed in part to gaps in IRS internal guidance. IRS provided its business units with guidance on developing business resumption plans, including general guidance within IRS’s Internal Revenue Manual and a business resumption plan template disseminated to the business units. The Internal Revenue Manual provided IRS business units with minimum requirements of elements to include in their plans, such as identifying critical personnel and resources. In addition, the Office of Physical Security and Emergency Preparedness disseminated a business resumption plan template to business units that included, among other things, sections for identifying the critical business processes and personnel to support the resumption of critical activities.

IRS’s internal guidance addressed several of the elements of a viable continuity capability. For example, the Internal Revenue Manual stated that business resumption plans should include a list of critical personnel, and the business resumption plan template asked each business unit to list its critical team leaders and members and their contact information. Similarly, the IRS guidance adequately addressed execution and resumption.

For other continuity planning elements, however, IRS guidance on developing business resumption plans was inconsistent with federal guidance. Specifically, IRS guidance on resources directed business units to identify their need for vital records, systems, and equipment. However, rather than procuring those resources before an event occurs, as outlined in federal guidelines, IRS guidance assumed that business units will work with teams outlined within the Incident Management Plan to acquire those resources following a disruption. Similarly, IRS directed business units to identify alternate work space requirements for personnel, but not to prepare or acquire them until after a disruption occurs. Finally, IRS guidance did not address the need for tests, training, or exercises involving the critical personnel identified within business resumption plans. Officials from the Office of Physical Security and Emergency Preparedness stated that it was the responsibility of business units to conduct adequate tests, training, and exercises of their business resumption plans.

Officials further stated that the IRS response to the June 2006 flooding validated the use of its incident command structure outlined in its Incident Management Plan. Although the incident command structure can be effective at securing needed resources over time, IRS will be able to respond to a disruption more quickly if it prepares necessary resources and facilities before an event occurs. This is especially critical in the case of business processes that need to be restored within 24 to 36 hours. Similarly, if personnel are unfamiliar with emergency procedures because of inadequate training and exercises, the agency’s response to a disruption could be delayed.

IRS Emergency Plans Contributed to the Agency’s Flood Response

IRS officials largely relied upon the Incident Management Plan to direct their response to the emergency conditions created by the June 2006 flooding. This plan guided officials in establishing roles and responsibilities for command and control of the overall resumption effort and a capability for the procurement of alternate facility space and equipment. Business unit officials were initially guided by their business resumption plans, but later response activities differed from those plans because of the circumstances resulting from the event. According to IRS headquarters officials, the headquarters COOP plan was not activated because local space availability made moving the executive leadership to the alternate COOP facility unnecessary and the safety of the leadership was not at risk.

The Incident Management Plan Contributed to Establishing a Command and Control Structure Immediately Following the Flood

We previously reported that in responding to emergencies, roles and responsibilities for leadership must be clearly defined and effectively communicated in order to facilitate rapid and effective decision making. The IRS Incident Management Plan provided agency officials with clear leadership roles and responsibilities for managing the response and recovery process, including the procurement of temporary facility space and equipment necessary to continue critical business processes.

Consistent with the plan, the Incident Commander acted as the leader of IRS headquarters response and recovery activities immediately following the flood. To assist in managing the incident, the Incident Commander activated members of the IRS Incident Management Team and other supporting sections, whose roles and responsibilities were outlined in the plan. These individuals included business resumption team leaders from each of the IRS business units and personnel from the central service divisions, such as Real Estate and Facilities Management and Modernization and Information Technology Services.

According to minutes from Incident Management Team meetings held in the days following the flood, the following Incident Management supporting teams were activated and provided the following contributions: 1. The Operations Section, responsible for conducting response and recovery activities, gathered information regarding the facility space and equipment requests from the IRS business units, as well as preferences on alternate work location assignments. 2. The Logistics Section, responsible for providing all nonfinancial logistical support, procured and allocated facility space and equipment to IRS business units. 3. The Planning Section, responsible for providing documentation of the emergency, documented decisions and conducted reporting. For example, the Planning Section prepared documents for hearings and maintained relocation schedules and information. 4. The Finance and Administrative Section, responsible for providing all financial support, provided assistance in monitoring agency costs and developing travel and leave policies.

According to IRS status reports following the flood, facility space was provided for critical personnel within 10 days and for all headquarters employees within 29 days. The Incident Commander reported that the Incident Management Team and its supporting units stepped down approximately 2 months after the flood.

Business Resumption Plans Guided Initial Business Unit Flood Responses

The three business units we reviewed reported that their business resumption plans guided their initial responses to the flood. In later phases of their responses, the business units differed from their plans to account for conditions at the time, such as current work priorities and the availability of alternate office space for more staff than the minimum necessary to perform the most critical functions. The following sections outline how selected business units relied on their business resumption plans when responding to the flood.

Criminal Investigation

CI used its business resumption plan to (1) establish an internal command structure to coordinate emergency activities following the flood and (2) identify short-term facility space for selected employees. According to the CI business resumption executive, the business unit used alternate facilities previously identified within the CI business resumption plan to relocate personnel within the first 2 days. CI leadership determined which personnel would be placed first and at what locations, since its business unit’s resumption plan did not specify such information. According to the CI business resumption executive, after learning from the Incident Commander that relocation would be for a longer period and that alternate facility space was available to accommodate all displaced CI employees, CI officials submitted a request for facility space and equipment for all of their employees to the Incident Commander and Incident Management Team.

In discussing lessons learned, the CI business resumption executive acknowledged that the unit’s plan primarily addressed relocation to alternate facilities for short-term emergencies rather than longer-term events like the flood, and that CI should work with IRS’s central organizations to better plan for relocation in such situations. Furthermore, the executive stated that better tests and exercises of the CI plan could assist in better preparing for a wider range of future emergencies.

Wage and Investment

W&I officials used their plan to identify and prioritize critical tasks. W&I managers gathered at a previously scheduled off-site retreat the morning following the flood and conducted a review of the business unit’s resumption plan, according to the new W&I business resumption executive. The executive stated that the activity was particularly useful in addressing identified knowledge gaps in the wake of the prior W&I business resumption leader’s sudden death the day before the flood. Critical business processes and supporting tasks, initially prioritized within the plan, were adjusted to reflect the criticality of several tasks at that time of year. According to the business resumption executive, the revised list of critical business processes allowed W&I managers to identify critical personnel and resources, which were submitted to the Incident Management Team as facility space and resource requests. In addition, the executive stated that W&I managers established a system for placing employees in alternate work space based on their association with the prioritized tasks, although it was not reflected in the W&I business resumption plan.

W&I created a document to capture lessons learned following the flood and established an internal business resumption working group to ensure a business resumption capability in all W&I field offices. As W&I officials did not anticipate the need to readjust tasks, one item discussed in the document addressed the need to create a rolling list of critical business processes and critical personnel, as processes and tasks will vary throughout the year. In addition, the W&I business resumption working group developed minimum requirements for all W&I plans and conducted a gap analysis of field office plans to identify areas for improvement. According to the W&I business resumption executive, the working group will conduct a training session for field office business resumption coordinators after the 2007 filing season.

Chief Counsel

Although the Chief Counsel resumption efforts were led by people identified within its plan, the unit’s business resumption officials reported that use of the plan was limited because of the high-level content of the document. According to the Chief Counsel’s business resumption executive, the plan was written at a high level because it was expected that specific priorities would be determined by the active caseload at the time of the emergency. The executive stated that following the flood, Chief Counsel prioritized resumption activities based on the active caseload and the need to address emerging requirements, such as (1) ensuring that mail addressed to the business unit’s processing division was rerouted and processed at another facility and (2) supporting a specific court case being conducted in New York City because of its level of criticality and time sensitivity. The executive further stated that officials identified alternate work space in Chief Counsel offices in the Washington, D.C., metropolitan area and placed approximately 180 employees prioritized based on the organizational hierarchy. Chief Counsel submitted requests to the Incident Commander and Incident Management Team for facility space and resources for over 500 remaining employees.

Although Chief Counsel was able to identify tasks, such as tax litigation, that were consistent with responsibilities outlined in its plan and procured facility space and resources for personnel, it established a task force that identified recommendations to improve the business unit’s plan in a report documenting lessons learned following the flood. Recommendations included measures to improve the prioritization of critical functions and people and outline provisions for mail processing. In addition, because Chief Counsel experienced delays in recovering a computer server that had not been identified in the business resumption plan but proved to be important following the flood, the task force addressed the need to ensure redundancy of information technology equipment. Chief Counsel is currently drafting an action plan to carry out the recommendations of the task force. In addition, a Chief Counsel business resumption official stated that agencywide tests and exercises of business resumption plans could assist in better integration of emergency efforts for a wider range of future emergencies.

IRS Headquarters Continuity of Operations Plan Was Not Used in Flood Response

According to IRS headquarters officials, the headquarters COOP plan was not activated because local space availability made movement of executive leadership to the alternate COOP facility unnecessary and the safety of the leadership was not at risk.

Conclusions

When the June 2006 flood occurred at the IRS headquarters building, the agency had in place a suite of emergency plans that helped guide its response. The agency’s Incident Management Plan was particularly useful in establishing clear lines of authority and communications, conditions that we have previously reported to be critical to an effective emergency response. Unit-level business resumption plans we reviewed contributed to a lesser extent and the headquarters COOP plan was not activated because of conditions particular to the 2006 flood. Specifically, damage to the building was limited to the basement and subbasement levels, and employees were able to enter the building to retrieve equipment and assets. In addition, alternate work space was available for all employees within a relatively short period, reducing the importance of identifying critical personnel. Such conditions, however, may not be present during future disruptions.

The plans IRS had in place at the time of the flood did not address all of the elements outlined in federal continuity guidance. In particular, the IRS plans did not (1) prioritize all essential functions and set targets for recovery times; (2) outline the preparation of resources and alternate facilities necessary to perform those functions; and (3) develop provisions for tests, training, and exercises of all of its plans. In discussions on lessons learned from the flood response, IRS business unit officials recognized the need to incorporate many of these elements. Unless IRS addresses these gaps, it will have limited assurance that it will be prepared to continue essential functions following a disruption more severe than the 2006 flood.

Recommendations for Executive Action

To strengthen the ability of IRS to respond to the full range of potential disruptions to essential operations, we are making two recommendations to the Commissioner of Internal Revenue: Revise IRS internal emergency planning guidance to fully reflect federal guidance on the elements of a viable continuity capability, including the identification and prioritization of essential functions; the preparation of necessary resources and alternate facilities; and the regular completion of tests, training, and exercises of continuity capabilities.

Revise IRS emergency plans in accordance with the new internal guidance.

Agency Comments

The Commissioner of Internal Revenue provided comments on a draft of this report in a March 26, 2007, letter which is reprinted in appendix II. The Commissioner agreed with our recommendations. His letter notes that the agency is actively committed to improving its processes. Specifically the agency will (1) conduct a thorough gap analysis between FPC 65 elements and business continuity planning guidance; (2) update the Internal Revenue Manual guidance and business resumption plan templates to reflect areas of improvement resulting from the gap analysis; and (3) formally direct annual tests, training, and exercises of business resumption plans through the agency’s Emergency Management and Preparedness Steering Committee. Finally, the Commissioner stated that the agency will revise and implement its emergency plans based on the results of the aforementioned activities.

As agreed with your staff, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its date. At that time, we will send copies of this report to the Secretary of the Treasury, the Commissioner of Internal Revenue, and other interested parties. This report will also be available at no charge on the GAO Web site at http://www.gao.gov.

Should you or your staff have questions on matters discussed in this report, please contact Bernice Steinhardt at (202) 512-6543 or steinhardtb@gao.gov, or Linda Koontz at (202) 512-6240 or koontzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributions to this report were made by William Doherty, Assistant Director; James R. Sweetman, Jr., Assistant Director; Thomas Beall; Michaela Brown; Terrell Dorn; Nick Marinos; and Nhi Nguyen.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to evaluate how the Internal Revenue Service’s (IRS) emergency operations plans address federal guidance related to continuity planning and evaluate the extent to which IRS emergency operations plans contributed to the actions taken by IRS officials in response to the flood.

To address how IRS emergency operations plans address federal guidance related to continuity planning, we obtained the IRS headquarters emergency operations plans that were available to agency officials at the time of the June 2006 flood. These included the Continuity of Operations (COOP) plan and a suite of business continuity plans, including the Incident Management Plan and 13 business resumption plans from business units affected by the flood. Although we also obtained the headquarters Occupant Emergency Plan, we did not evaluate its contributions to addressing the elements because its purpose is limited to outlining procedures for building occupants and emergency personnel in responding to threats that require building evacuations or shelter in place. We did not obtain the Disaster Recovery Plan, a contingency plan for the recovery of information technology equipment, because recovery of information technology equipment was addressed in a report from the Treasury Inspector General for Tax Administration.

To evaluate IRS’s emergency operations plans in relation to federal guidance on continuity planning, we analyzed Federal Preparedness Circular (FPC) 65 to identify the elements needed to ensure the continuity of essential functions and compared IRS emergency operations plans to the resulting generalized list. Because FPC 65 covers all hazard emergencies, but provides continuity guidance specifically for agency COOP plans, we developed the general elements of guidance to be able to collectively evaluate all IRS emergency operations plans we obtained. From our analysis of FPC 65, we identified eight general elements of guidance related to developing a viable continuity capability. See table 3 for a listing and description of the elements. We reviewed IRS’s plans and analyzed how they collectively addressed or did not address these eight general elements of guidance.

We also reviewed IRS-defined criteria and guidance for emergency operations plans, including sections of the Internal Revenue Manual— which provides guidance to IRS officials on developing several of the agency’s emergency operations plans—and an internal template provided by IRS’s Office of Physical Security and Emergency Preparedness, which is responsible for agencywide emergency planning and policy to guide plan development.

Since each business unit within IRS headquarters has an individual plan for business resumption activities, we selected and examined 3 of 13 business resumption plans available for use during the flood from the 3 business units with the most employees affected by the flooding in the headquarters building. According to employee relocation lists from IRS following the flood, the 3 largest business units in the building are Criminal Investigation, Wage and Investment, and Chief Counsel, which collectively represent over 50 percent of the headquarters building employees.

To address the extent to which IRS emergency operations plans contributed to the actions taken by IRS officials in response to the flood, we interviewed IRS officials responsible for the development, oversight, and implementation of the headquarters emergency operations plans. In our interviews, we asked IRS officials responsible for each emergency operations plan how the general elements identified in their respective plans guided their actions following the flood, if at all.

To supplement the information gained from the interviews, we reviewed agency documentation related to emergency operations activities following the flood, including IRS status reports, employee relocation lists, and emergency operations team meeting minutes. In addition, we reviewed documentation regarding lessons learned from the flood, provided by various headquarters business units, and obtained any updates or changes to emergency operations plans following the flood.

We conducted our review in accordance with generally accepted government auditing standards from July 2006 through March 2007.

Appendix II: Comments from the Internal Revenue Service