Multiple DHS offices, components, and agencies have roles and responsibilities in DHS's development of CBRN risk assessments, response plans, and capabilities. Specifically: S&T is responsible for the development of DHS's CBRN risk assessments--the TRAs and MTAs. CFO's PA&E unit is responsible for developing resource allocation decisions for capability investments through DHS's Planning, Programming, Budgeting and Execution system. OHA is responsible for leading DHS's biological and chemical defense activities and provides medical and public health expertise to support the department's efforts. OPS is responsible for coordinating DHS's operational activities for incident response, including for CBRN incidents. POLICY is responsible for advising the Secretary of Homeland Security in the development of DHS's policies for CBRN plans and capabilities. NPPD's RMA is responsible for leading DHS's approach to risk management and the application of risk information to departmental activities. DNDO is responsible for domestic radiological and nuclear detection efforts and integration of federal nuclear forensics programs. FEMA is responsible for leading the nation's effort for preparing to respond to emergencies and disasters. DHS engages in risk management activities to help ensure the nation's ability to protect against and respond to incidents using CBRN agents. DHS's Risk Lexicon provides the following definitions for risk-related terms: Risk--potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences associated with an incident, event, or occurrence. Risk Assessment--product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making. Risk Management--process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring, or controlling it to an acceptable level considering associated costs and benefits of any actions taken. The department's 2010 Quadrennial Homeland Security Review notes the importance of incorporating information from risk assessments into departmental decision making, one aspect of the department's homeland security risk management process. According to DHS doctrine, risk management applications include the use of risk information to inform, among others, strategic and operational planning and resource decisions. This report focuses on DHS's use of the third step of its risk management process--risk assessment--and the application of risk assessment results to inform CBRN response plans and capabilities. DHS notes that risk information is usually one of many factors--not necessarily the sole factor--that decision makers consider when deciding which strategies to pursue for managing risk. These additional factors may include strategic and political considerations, among others. See figure 1 for a graphic depiction of DHS's risk management process. DHS is responsible for assessing the risks posed by various CBRN agents, as directed by the Project BioShield Act of 2004 and Homeland Security Presidential Directives 10 - Biodefense for the 21st Century, 18 - Medical Countermeasures against Weapons of Mass Destruction, and 22 - National Domestic Chemical Defense. To this end, S&T develops CBRN TRAs and MTAs. Each TRA assesses the relative risks posed by multiple CBRN agents based on variable threats, vulnerabilities, and consequences. Since 2006, DHS has developed eight TRA reports: Biological Terrorism Risk Assessments (BTRA) in 2006, 2008, and Chemical Terrorism Risk Assessments (CTRA) in 2008 and 2010; Radiological/Nuclear Terrorism Risk Assessment (R/NTRA) in 2011; and Integrated CBRN Terrorism Risk Assessments (ITRA) in 2008 and 2011. Each MTA assesses the threat posed by a given, individual CBRN agent or class of agents and the potential number of human exposures in plausible, high-consequence scenarios. Since 2004, DHS has developed 17 MTA reports. DHS uses the MTAs to determine which CBRN agents pose a material threat sufficient to affect national security. The Project BioShield Act describes specific ways in which the MTAs may be used in efforts to procure certain medical countermeasures. However, the various presidential directives note that while the TRAs may be used to inform decision making, they are not specific as to when or how these risk assessments should be used by DHS officials to inform CBRN response planning or capability investments. (U) We identified CBRN-specific interagency response plans among three families of interagency plans developed by DHS that are designed for responding to CBRN incidents. These families of plans include plans developed under (1) Executive Order 13527 - Establishing Federal Capability for the Timely Provision of Medical Countermeasures Following a Biological Attack (Executive Order 13527) and (2) Homeland Security Presidential Directive 8 Annex I - National Planning (HSPD 8 Annex I), and as a part of (3) the National Response Framework's (NRF) CBRN- specific incident annexes.reviewed. Since the first DHS CBRN risk assessments were developed in 2004, DHS used the risk assessments to varying degrees to directly or indirectly inform development of 9 of the 12 CBRN-specific response plans we identified. Our analysis showed that 2 of the 12 plans were directly informed by the risk assessments, while DHS officials told us that 7 of the 12 plans were indirectly informed by the risk assessments. However, we could not independently verify this for these 7 plans because DHS officials could not document how the risk assessments influenced information contained in the plans. Three of the response plans were not informed by the risk assessments, according to DHS officials. Our analysis of a limited set of planning assumptions in the plans compared to information contained in the risk assessments showed general consistency between the plans and the risk assessments. DHS's guidelines state that response plans should be informed by risk assessment information to supplement risk-related information contained in the National Planning Scenarios (NPS) used for developing emergency response plans. DHS's 2009 Integrated Planning System (IPS) also identifies risk assessments as one source of information that should be used to inform response plan development. This guidance, however, does not define what it means for response plans to be informed by risk assessments or how planners should use specific types of risk assessments, such as DHS's TRAs and MTAs, when developing or revising related plans. Of the 12 CBRN response plans developed by DHS that we reviewed, none of the plans were developed solely in response to a given CBRN threat agent being identified as high risk in DHS's CBRN risk assessments. Rather, these plans were developed in response to requirements in an executive order and as part of families of plans developed in response to provisions in presidential directives.table 3 for a list of the CBRN response plans and whether each plan was directly, indirectly, or not informed by DHS's CBRN risk assessments during its development. Since 2004, DHS's use of its CBRN risk assessments to inform its CBRN- specific capability investments has varied, from directly impacting its capabilities to not being used at all. Six of the seven CBRN capabilities we examined were informed by DHS's CBRN risk assessments to some extent, according to program officials, DHS documents, and our analysis (see table 4).was directly informed by the risk assessments, while our analysis showed or DHS officials told us that five of the seven capabilities were partially Our analysis showed that one of the seven capabilities informed by the risk assessments. However, we could not independently verify this for three of these five capabilities because DHS officials could not document how the risk assessments influenced the capabilities. DHS has developed policies and guidance on the use of risk information for the department's activities, but DHS has not issued guidance to program managers that specifies when or how they should use the CBRN risk assessments to inform CBRN capabilities (this is discussed in the third objective of this report). The DHS Strategic Plan for 2008-2013 states that resource decisions should be informed by relevant risk assessments, but does not provide specific guidance on when or how such decisions should be informed by the department's CBRN risk assessments. Additionally, the Secretary of Homeland Security's March 2011 Management Directive stated that DHS policy is to use risk information and analysis to inform decision making and instructs DHS components to establish mission-appropriate risk management capabilities. See table 4 for a summary of the CBRN capabilities and whether each capability was directly, partially, or not informed by DHS's CBRN risk assessments. Our analysis showed that the extent to which the CBRN capabilities we examined were informed by DHS's CBRN risk assessments varied, but DHS officials described reasons for this variance, as discussed below. In addition, DHS officials noted that basic scientific differences between chemical, biological, and radiological/nuclear threat agents and materials also provide explanations about the differences in how the CBRN risk assessments are used to inform capabilities. For example, DHS officials told us that the relative risk rankings amongst biological agents may be more meaningful than the ranking amongst radiological materials because there are greater differences associated with detecting biological agents, as well as their consequences. DHS program managers used the risk assessments to partially inform the program management of the RDCDS and the CSAC, as described below. The Director of the CSAC told us that because there are over 13 million possible chemicals that could be considered threat agents, it is impossible to come up with a relative risk ranking of all the chemicals. Therefore, the results of the CTRA are designed to be representative of the highest risk chemical agents and used as a guide--not a definitive resource--for informing capability and planning decisions related to such agents. Additionally, certain chemical compounds have similar enough compositions to be considered together when developing capabilities and response plans. Rapidly Deployable Chemical Detection System (RDCDS). The OHA Chemical Defense Program used the CTRA to partially inform its RDCDS, according to our analysis as well as DHS officials and documentation. We compared the lists of threat agents that have been programmed to be detected by RDCDS detectors against chemical agents of significant concern in the 2008 and 2010 CTRAs and found that they were generally consistent. The RDCDS program manager told us that the list of threat agents monitored by RDCDS has not changed since 2005 as DHS developed the first and second iterations of the CTRA. However, the program manager told us that when the first CTRA was issued in 2008, program officials reviewed its content to determine whether chemical agents of significant concern in the CTRA were aligned with the chemicals detected by RDCDS. The official said that based on this initial assessment, the RDCDS was generally aligned with the chemical agents of greatest concern. Chemical Security Analysis Center (CSAC). The Director of the CSAC told us that because a key CSAC mission is to develop the CTRA and the chemical MTAs, these risk assessments are used--to varying extents--to inform the other capabilities that the CSAC maintains. Other capabilities include providing 24/7 technical assistance to other DHS components that encounter possible chemical attack situations, such as the National Operations Center. According to the CSAC Director, information from the CTRA is included in the knowledge management system that is used in maintaining this technical assistance capability. However, the CSAC could not provide us with documentation of how it had used the CBRN risk assessments to inform this capability. Further, the CSAC Director told us that the CTRA also informs the CSAC's work in developing models for other DHS components on the effects of certain chemical incidents. We reviewed a CSAC study for the DHS Transportation Security Administration about the release of chemical gases into the atmosphere and found that in the study the CSAC had modeled releases of two different chemical agents, both of which are among the chemical agents of significant concern in the CTRA. We analyzed the extent to which DHS officials used the BTRA and the biological MTAs to inform the program management of three capabilities--BioWatch, the NBFAC, and the NBIC. Our analysis showed that DHS program managers used the risk assessments to either directly inform (BioWatch) or partially inform (NBFAC and NBIC) their decisions, as described below. The program manager of BioWatch told us that it makes sense for the program to use the most reliable tool available to them--in this case, the CBRN risk assessments--to determine what agents to program into their detection system. The director of the NBFAC told us that the BTRA was used on one occasion to directly inform program management and prioritization. The NBIC branch chief told us that the BTRA is used at a strategic level and that the center's staff is very familiar with the contents of the BTRA and the biological MTAs. However, he stated that the NBIC's mission is to monitor detection efforts for all biological agents, particularly emerging infectious diseases, and to provide alerts about potentially dangerous biological incidents to state and local homeland security professionals. Therefore, the NBIC branch chief said that the relative risk ranking of a given biological agent would not be an appropriate basis for the prioritization of resources at the operational level. BioWatch. We found that the BioWatch program was generally consistent with the biological agents of significant concern identified in the BTRA. DHS documents state that the BTRA is to be used to update the list of threat agents monitored by BioWatch. DHS deployed BioWatch in 2003, before the release of the first BTRA in 2006. Since then, DHS has reprogrammed BioWatch detection efforts once, in response to the 2006 BTRA. The BioWatch program manager told us that they review each iteration of the BTRA to ensure that the BioWatch program is aligned with the biological agents of significant concern. We compared the lists of threat agents that have been programmed to be detected by the BioWatch program since 2006 against the biological agents of significant concern in the 2006, 2008, and 2010 BTRAs and found them generally consistent. The BioWatch program manager also told us that future generations of BioWatch are being developed to detect a larger number of biological threat agents. According to BioWatch documents, these agents are to be determined by the BTRA's risk rankings. OHA officials told us they use the BTRA to inform BioWatch because it is the most relevant CBRN risk assessment available to them and because it allows OHA to focus BioWatch detection efforts on the biological agents of significant concern. National Bioforensic Analysis Center (NBFAC). We found that the NBFAC used the CBRN risk assessments to partially inform its capabilities. Officials from NBFAC told us that the center used information from the BTRA to inform its priorities for developing tools needed to support their work in biological forensic attribution. Our analysis showed that the NBFAC's forensic attribution capabilities were generally consistent with the biological agents of significant concern in the BTRA. However, NBFAC officials stated that because the NBFAC is mandated to maintain capabilities for other biological materials, including biological agents that are not considered high risk, future BTRA results would not necessarily lead to reprioritization of NBFAC's attribution capability development efforts. National Biosurveillance Integration Center (NBIC). We found that the NBIC used the CBRN risk assessments to partially inform its activities. According to the OHA branch chief responsible for the NBIC, NBIC personnel are aware of the information in DHS's CBRN risk assessments and consider this information at a strategic level. However, the NBIC could not provide us with documentation of how it had used the CBRN risk assessments to inform its capabilities at the strategic level. The NBIC branch chief also stated that NBIC does not use information from the BTRA or biological MTAs at an operational level to inform the management of their capability. The official provided documentation showing that the NBIC's mission is to collect and integrate information about biological agent detection from a variety of federal government detection systems. The OHA branch chief stated that because the NBIC's mission is to integrate and provide alerts on all biological agents, including emerging and infectious diseases that are not included in the CBRN risk assessments, it is not relevant whether the biological agents the NBIC is monitoring are considered to be high risk according to the BTRA or the MTAs, although these agents are also monitored. Our analysis showed that DHS program managers' use of the risk assessments to inform radiological and nuclear capabilities varied from partially informing their decisions to not informing their decision at all. Officials from the NTNFC told us that because of the relatively small universe of radiological and nuclear materials, the risk rankings among these materials did not matter as much as the relative threat and consequence information for biological and chemical agents. Additionally, DHS officials told us the challenges that first responders would face in responding to a nuclear explosion in a city may be a more important concern than the type of threat material used in such an attack. Nuclear Incident Response Teams (NIRTs). FEMA officials told us that information from the R/NTRA appendix to the 2008 ITRA partially informed the program management of the NIRTs and FEMA's other nuclear response capabilities. Specifically, FEMA officials said that information in the R/NTRA appendix, among other sources, was used to inform FEMA's IND Response and Recovery Program. Starting in 2010, FEMA officials said that NIRT-related activities were aligned with the IND Response and Recovery Program. FEMA officials told us that because of this, their management of the NIRTs is partially informed, by extension, by the R/NTRA appendix. However, FEMA could not provide us with documentation of how it specifically had used the R/NTRA appendix to inform the NIRTs. National Technical Nuclear Forensics Center (NTNFC). An NTNFC official told us that the NTNFC did not use information contained in the R/NTRA appendix to the 2008 ITRA, and the NTNFC does not intend to use the 2011 R/NTRA (once published) to inform its activities. The same official told us that these CBRN risk assessments do not provide useful information to inform NTNFC activities because nuclear forensic capabilities are developed for all radiological and nuclear materials, regardless of their relative risk. Further, he stated that NTNFC is already aware of the universe of possible radiological and nuclear materials that could be used to attack the nation. DHS S&T's Chief Medical and Science Advisor, the official who oversees the development of DHS's CBRN risk assessments, agreed that NTNFC's capabilities need to be able to identify all radiological and nuclear materials, and that therefore the CBRN risk assessments were not relevant for NTNFC's efforts. DHS policy states that DHS components should use risk assessment information to inform planning and capability investment decisions, but DHS has not established specific guidance, such as written procedures, that details when and how DHS components should consider using the department's CBRN-specific risk assessments to inform such activities. According to the National Strategy for Homeland Security of 2007, the assessment and management of risk underlies all homeland security activities, including decisions about when, where, and how to invest in resources--including planning and capabilities--that eliminate, control, or mitigate risks. The TRAs and MTAs--the department's most CBRN- specific risk assessments--were used to inform to varying extents 9 of 12 response plans and 6 of 7 capabilities we analyzed, and how the risk assessments were used to inform these plans and capabilities varied. DHS officials told us that while DHS policy calls for the use of risk information to inform the department's activities, no DHS guidance specifically requires DHS officials to use the TRAs and MTAs for CBRN planning and capability investments or explains how officials should use the risk assessments to inform their decision making. As a result, the CBRN risk assessments were used to varying extents and in varying ways by DHS components for the plans and capabilities we analyzed. DHS officials said that they considered the risk assessments but chose not to use them to inform one of the plans and one of the capabilities we reviewed because they were not useful for the plan or the capability. In addition, the risk assessments were not considered at all for two of the plans we reviewed. Since at least 2007, DHS has emphasized the need to incorporate risk information derived from risk assessments into departmental activities, and since 2009 DHS has issued a range of guidance--including an interim framework, a policy memo, a management directive, and a doctrine--on the use of such risk information. Specifically, DHS's Interim Integrated Risk Management Framework of January 2009 identified risk assessments as a fundamental information source for risk-informed decision making and noted that the BTRA and CTRA are examples of risk assessments produced by the department that can be used to inform risk management efforts. In May 2010, the Secretary of Homeland Security issued a policy memo that requires, among other things, the use of risk assessments to inform decision making and the establishment of mechanisms for sharing risk assessments with relevant stakeholders. In March 2011, as called for in the Secretary's memo, DHS issued a management directive on integrated risk management at the department. This management directive, among other things, tasks the Director of the Office of Risk Management and Analysis (RMA) within DHS's NPPD with establishing a system to facilitate the sharing of risk analysis and data across the department. Further, in April 2011, DHS issued its doctrine for risk management--titled Risk Management Fundamentals--the first in a series of publications that RMA plans to issue to provide a structured approach for the distribution and employment of risk information and analysis efforts across the department. DHS's existing guidance on risk management generally identifies the importance of using risk assessments to inform departmental decision making, but it does not specifically address when and how particular risk assessments--including the TRAs and MTAs--should be considered for use by departmental entities for planning and capability investment purposes. DHS officials stated that more specific guidance has not been developed by the department or its components and agencies because they were not required to do so. However, Standards for Internal Control in the Federal Government state that officials should take actions, such as establishing written procedures, to help ensure that management's directives are carried out.Management Framework of January 2009 stated that DHS must establish processes that make risk information available among the department and its components and agencies when and where it is needed, noting that the ability to receive and provide meaningful and usable risk information in a timely manner requires well coordinated and established processes. In addition, DHS's Interim Integrated Risk While DHS has issued guidance that generally states that risk assessments should be used to inform departmental activities, DHS could better help to ensure that its relevant CBRN-specific risk assessments-- the TRAs and MTAs--are considered for use in informing CBRN-specific planning and capability investments if more specific guidance requiring such consideration is established. DHS officials also stated that establishing written procedures for such consideration could better help to ensure that officials responsible for CBRN response planning and capability investment decision making consider the CBRN risk assessments as a means to obtain current risk information for specific CBRN threat agents. This information could be used to inform the planning assumptions that CBRN response plans are designed to address, as well as the requirements development process for CBRN capabilities. In addition, DHS officials noted that the lack of written procedures requiring DHS officials to consider using the TRAs and MTAs to inform DHS's CBRN plans and capabilities could negatively affect the likelihood that future DHS officials consider using the risk assessments when planning and making investment decisions. By establishing more specific guidance that details when and how DHS components should consider using the TRAs and MTAs to inform CBRN plans and capabilities, DHS would be better positioned to ensure that officials consider and, as appropriate, incorporate the department's most detailed CBRN-specific risk information. As a result, DHS would be better positioned to ensure that its CBRN response plans and capabilities align with the assumptions and results contained within the TRAs and MTAs. The anthrax attacks of 2001 raised concerns that the United States is vulnerable to terrorist attacks using CBRN agents. Since 2001, DHS has developed a range of CBRN risk assessments, response plans, and related capabilities to prepare for such attacks. DHS has spent at least $70 million developing these risk assessments. Using its CBRN risk assessments to help inform CBRN response planning and capability investments is consistent with DHS policy and could help to better ensure that relevant information contained in the risk assessments is used to inform such plans and capabilities. Further, given that there are thousands of CBRN agents that could potentially pose a risk to the nation in an era of declining federal budgets and constrained resources, the federal government must ensure that it is focusing its limited resources on preparing to respond to the highest risk agents. Without procedures for using the risk assessments to inform capability investment decision making, use of the assessments for such decisions may continue to vary or not occur at all. More specific guidance on when and how DHS officials should consider using the department's CBRN risk assessments to inform planning and investments could better help to ensure their consistent use and that this use is sustained beyond the tenure of any given agency official. To better ensure the consistent use of DHS's CBRN risk assessments at the department's components and agencies, we recommend that the Secretary of Homeland Security: Establish more specific guidance, including written procedures, that details when and how DHS components should consider using the department's CBRN risk assessments to inform related response plan and capability investment decision making. We received written comments on the draft report, which are reproduced in full in appendix I. DHS also provided technical comments, which were incorporated as appropriate. DHS concurred with the basis for the recommendation and discussed an action that S&T--which is responsible for developing the department's CBRN risk assessments--plans to take to address the recommendation. Specifically, DHS noted that it is currently developing user guidelines for its CBRN risk assessments. In addition, DHS also stated that S&T is committed to continuing to work with relevant stakeholders to ensure that its risk assessments are useful for informing response planning and capability investment decision making. We are sending copies of this report to the Secretary of Homeland Security, appropriate congressional committees, and other interested parties. The report also is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any further questions about this report, please contact me at (202) 512-8777 or jenkinswo@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. In addition to the contact named above, Edward George (Assistant Director), David Lysy (Analyst-in-Charge), David Schneider, Bonnie Doty, David Alexander, Tracey King, and Katherine Davis made key contributions to this report. National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments. GAO-11-606. Washington, D.C.: June 21, 2011. Public Health Preparedness: Developing and Acquiring Medical Countermeasures Against Chemical, Biological, Radiological, and Nuclear Agents. GAO-11-567T. Washington, D.C.: April 13, 2011. Measuring Disaster Preparedness: FEMA Has Made Limited Progress in Assessing National Capabilities. GAO-11-260T. Washington, D.C.: March 17, 2011. Biosurveillance: Efforts to Develop a National BioSurveillance Capability Need a National Strategy and a Designated Leader. GAO-10-645. Washington, D.C.: June 30, 2010. Homeland Defense: DOD Can Enhance Efforts to Identify Capabilities to Support Civil Authorities during Disasters. GAO-10-386. Washington, D.C.: March 30, 2010. Combating Nuclear Terrorism: Actions Needed to Better Prepare to Recover from Possible Attacks Using Radiological or Nuclear Materials. GAO-10-204. Washington, D.C.: January 29, 2010. Biosurveillance: Developing a Collaboration Strategy Is Essential to Fostering Interagency Data and Resource Sharing. GAO-10-171. Washington, D.C.: December 18, 2009. Homeland Defense: Planning, Resourcing, and Training Issues Challenge DOD's Response to Domestic Chemical, Biological, Radiological, Nuclear, and High-Yield Explosive Incidents. GAO-10-123. Washington, D.C.: October 7, 2009. Homeland Defense: Preliminary Observations on Defense Chemical, Biological, Radiological, Nuclear, and High-Yield Explosives Consequence Management Plans and Preparedness. GAO-09-927T. Washington, D.C.: July 28, 2009. Project BioShield Act: HHS Has Supported Development, Procurement, and Emergency Use of Medical Countermeasures to Address Health Threats. GAO-09-878R. Washington, D.C.: July 24, 2009. Project BioShield: HHS Can Improve Agency Internal Controls for Its New Contracting Authorities. GAO-09-820. Washington, D.C.: July 21, 2009. National Preparedness: FEMA Has Made Progress, but Needs to Complete and Integrate Planning, Exercise, and Assessment Efforts. GAO-09-369. Washington, D.C.: April 30, 2009. Homeland Security: First Responders' Ability to Detect and Model Hazardous Releases in Urban Areas is Significantly Limited. GAO-08-180. Washington, D.C.: June 27, 2008. Risk Management: Strengthening the Use of Risk Management Principles in Homeland Security. GAO-08-904T. Washington, D.C.: June 25, 2008. Emergency Management: Observations on DHS's Preparedness for Catastrophic Disasters. GAO-08-868T. Washington, D.C.: June 11, 2008. Highlights of a Forum: Strengthening the Use of Risk Management Principles in Homeland Security. GAO-08-627SP. Washington, D.C.: April 15, 2008. Project BioShield: Actions Needed to Avoid Repeating Past Problems with Procuring New Anthrax Vaccine and Managing the Stockpile of Licensed Vaccine. GAO-08-88. Washington, D.C.: October 23, 2007. Homeland Security: Applying Risk Management Principles to Guide Federal Investments. GAO-07-386T. Washington, D.C.: February 7, 2007. Chemical and Biological Defense: Management Actions Are Needed to Close the Gap Between Army Chemical Unit Preparedness and State National Priorities. GAO-07-143. Washington, D.C.: January 19, 2007. Risk Management: Further Refinements Needed to Assess Risk and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005. Internal Control: Standards for Internal Control in the Federal Government. GAO/AIMD-00-21.3.1. Washington, D.C.: November 1, 1999.

Summary:
The 2001 anthrax attacks in the United States highlighted the need to develop response plans and capabilities to protect U.S. citizens from chemical, biological, radiological, and nuclear (CBRN) agents. Since 2004, the Department of Homeland Security (DHS) has spent at least $70 million developing more than 20 CBRN risk assessments. GAO was requested to assess, from fiscal year 2004 to the present, the extent to which DHS has used its CBRN risk assessments to inform CBRN response plans and CBRN capabilities, and has institutionalized their use. GAO examined relevant laws, Homeland Security Presidential Directives, an Executive Order, DHS guidance, and all 12 relevant interagency CBRN response plans developed by DHS. Based on a review of a United States governmentwide CBRN database and DHS interviews, among other things, GAO selected a nongeneralizable set of seven DHS capabilities used specifically for detecting or responding to CBRN incidents to identify examples of DHS's use of its CBRN risk assessments. GAO also interviewed relevant DHS officials. This is a public version of a classified report that GAO issued in October 2011. Information DHS deemed sensitive or classified has been redacted. Since 2004, DHS's use of its CBRN risk assessments to inform its CBRN response plans has varied, from directly influencing information in the plans to not being used at all. DHS guidance states that response planning and resource decisions should be informed by risk information. GAO's analysis showed that DHS used its CBRN risk assessments to directly inform 2 of 12 CBRN response plans GAO identified because planners considered the risk assessments to be more accurate than earlier DHS planning assumptions. For another 7 of the 12 plans, DHS officials said that the assessments indirectly informed the plans by providing background information prior to plan development. However, GAO could not independently verify this because DHS officials could not document how the risk assessments influenced the information contained in the plans. GAO's analysis found general consistency between the risk assessments and the plans. For the remaining 3 plans, DHS officials did not use the risk assessments to inform the plans; for 2 of the 3 plans DHS officials told GAO they were not aware of the assessments. DHS officials also noted that there was no departmental guidance on when or how the CBRN risk assessments should be used when developing such plans. Since 2004, DHS's use of its CBRN risk assessments to inform its CBRN-specific capabilities has varied, from directly impacting its capabilities to not being used at all. Of the 7 capabilities GAO reviewed, one was directly informed by the risk assessments; DHS used its biological agent risk assessments to confirm that its BioWatch program could generally detect the biological agents posing the greatest risk. For 5 of the 7 capabilities, DHS officials said they used the risk assessments along with other information sources to partially inform these capabilities. For example, DHS used its chemical agent risk assessments to determine whether its chemical detectors and the risk assessments were generally aligned for the highest risk agents. For 3 of these 5 capabilities, GAO could not independently verify that they were partially informed by the risk assessments because DHS officials could not document how the risk assessments influenced the capabilities. DHS did not use its CBRN risk assessments to inform the remaining CBRN capability because the assessments were not needed to meet the capability's mission. DHS and its components do not have written procedures to institutionalize their use of DHS's CBRN risk assessments for CBRN response planning and capability investment decisions. Standards for internal control in the federal government call for written procedures to better ensure management's directives are enforced. DHS does not have procedures that stipulate when and how DHS officials should use the department's CBRN risk assessments to inform CBRN response planning and capability investment decisions, and GAO found variation in the extent to which they were used. DHS officials agree with GAO that without written procedures, the consistent use of the department's CBRN risk assessments by DHS officials may not be ensured beyond the tenure of any given agency official. DHS could better help to ensure that its CBRN response plans and capabilities are consistently informed by the department's CBRN risk assessments by establishing written procedures detailing when and how DHS officials should consider using the risk assessments to inform their activities. GAO recommends that DHS develop more specific guidance, including written procedures, that details when and how DHS components should consider using the department's CBRN risk assessments to inform related response planning efforts and capability investment decision making. DHS agreed with the recommendation.