IRS’s mission is to provide America’s taxpayers top-quality service by helping them understand and meet their tax responsibilities and by applying the tax law with integrity and fairness to all. To fulfill this mission, IRS has more than 100,000 employees deployed among more than 600 offices nationwide and in select international cities. Some of these offices are part of eight IRS campuses, which have the physical facilities for processing tax forms and some of the facilities to respond to customer inquiries. In response to the increased electronic filing of taxes, IRS is consolidating the physical facilities it uses for processing tax forms, also called processing centers. The rest of IRS’s work is completed in noncampus offices and on-site at taxpayer offices, such as large corporations. Following the IRS Restructuring and Reform Act of 1998, IRS organized itself into four business units to serve different types of taxpayers. The Wage and Investment (W&I) business unit works with individual taxpayers; the Small Business/Self-Employed (SB/SE) business unit works with full or partially self employed individuals and small businesses; the Large and Mid-Size Business (LMSB) works with corporations and partnerships with assets greater than $10 million; and the Tax Exempt and Government Entities (TE/GE) business unit works with employee plans, tax exempt organizations, and governments. The concept of resilience has gained particular importance and application in a number of areas of federal planning. Both the Congress and executive branch agencies have addressed resilience in relation to the importance of the recovery of the nation’s critical infrastructure from damage. Accordingly, most of the current focus is on assets, systems, and networks rather than agencies or organizations. In February 2006, the Task Force of the Homeland Security Advisory Council defined resiliency as “the capability of a system to maintain its functions and structure in the face of internal and external change and to degrade gracefully when it must.” Later in 2006, the Department of Homeland Security’s National Infrastructure Protection Plan—again focusing on critical infrastructure, not agencies—defined resilience as “the capability of an asset, system, or network to maintain its function during or to recover from a terrorist attack or other incident.” In May 2008, the House Committee on Homeland Security held a series of hearings focusing on resilience at which government and private sector representatives, while agreeing on the importance of the concept, presented a variety of definitions and interpretations of resilience. For the purposes of this report, when we discuss resilience, we will be referring to organizational resilience. At the agency level, the current focus is primarily on continuity of operations and the recently issued Federal Continuity Directives. According to the Federal Continuity Directive 1, “an organization’s continuity capability—its ability to perform its essential functions continuously—rests upon key components and pillars, which are in turn built on the foundation of continuity planning and program management.” The Federal Continuity Directive states that an organization’s resilience is directly related to the effectiveness of its continuity capability. In contrast to continuity of operations, organizational resilience looks at more than just essential functions, and accordingly, we have developed the five categories described below. Because there is no widely accepted definition, we defined organizational resilience for the purposes of our report and developed a framework to assess a federal agency’s resilience. Organizational resilience is the quality that would enable an organization to restore itself or thrive following a disruption that has the potential to substantially compromise the organization’s ability to accomplish its mission. A highly resilient organization is identified by the speed and agility it demonstrates in achieving a return to its normal state (or new normal state) and its resulting enhanced ability to respond to future disruptions. To make our definition of organizational resilience more practical and observable, we identified 21 attributes particularly associated with resilience and assigned them to five related categories. These categories provide a useful assessment framework. (See figure 1.) These related categories are networked organizations. However, whatever assessments are undertaken, it is important to note that the severity or circumstance of a particular disruption to an organization may be so severe or unusual as to make recovery not attainable even if the organization has evidenced attributes of resilience prior to the disruption. Similarly, given the specific nature of the disruption or the specific circumstances of the disruption, perhaps one attribute relative to others may prove particularly useful in helping the organization to recover successfully. The attributes associated with organizational resilience are discussed in summary below and each attribute is discussed in greater detail in appendix II. Emergency planning identifies disruptions that could potentially affect an organization and defines and tests strategies to face those disruptions or similar challenges. For example, in 2004, the Federal Emergency Management Agency’s (FEMA) Hurricane Pam exercise simulated a category 3 hurricane. In the exercise scenario, 15 to 20 feet of water inundated New Orleans. This scenario was similar to the actual conditions of Hurricane Katrina. Based on this exercise, FEMA was able to implement some strategies which proved helpful during Hurricane Katrina, such as FEMA’s working with hospital and university officials to create temporary medical operations around the state. However, FEMA’s exercise also identified other problems that it did not address, such as the need to plan for evacuating those with special needs. A resilient organization has a workforce that can respond to a range of disruptions with appropriate purpose, initiative, and comfort with change. One aspect of organizational flexibility is an ability to accept change as a learning opportunity. For example, the 9/11 Commission report criticized the Federal Aviation Administration for failing to consider in its planning the possibility of certain types of terrorist attacks. Specifically, the commission determined that if the agency had examined a possible suicide hijacking and reviewed existing security provisions, they could have identified vulnerabilities. According to the commission, agencies tend to accept the status quo, and accept that efforts to identify or fix certain vulnerabilities are too costly, controversial, or disruptive to fix. This inability to tackle necessary change can leave an organization with unaddressed vulnerabilities, as was the case with the Federal Aviation Administration. Additionally, knowing when to change rules helped give federal agencies access to additional resources during the Year 2000 (Y2K) Computing Challenge. Specifically, increased latitude with human capital practices in the federal government allowed agencies to access a larger pool of skilled employees that could be allocated as needs arose. The Office of Personnel Management recognized that personnel would need to be increased to meet Y2K compliance and provided additional, more flexible hiring authorities for agencies who needed employees to work on the conversion. This included changing some authorities for re-hiring federal retirees, exceptions on limitations on premium pay, and providing retention allowances. Prior GAO work credited creative human capital decisions and an adequate pool of human resources as contributing to the federal government’s ability to meet the Y2K challenge. Leaders who demonstrate respect for their employees and are accountable for results are more likely to garner the employee commitment that will be needed after a disruption that substantially compromises the organization’s ability to accomplish its mission. Additionally, when leadership abilities are distributed broadly through the workforce, an organization is more likely to be resilient. For example, the Senate Homeland Security and Governmental Affairs Committee found that, after Hurricane Katrina, the Coast Guard had empowered front-line leaders to make decisions when they needed to be made, which it found was perhaps more important to their resilience than their regular training. Also, once it was known that the September 11 hijackers entered the United States on valid visas, the Department of State devolved leadership authority by empowering consular staff to distinguish legitimate visitors from potential terrorists through antiterrorism training, access to databases with names of potential terrorists, foreign language training, and more staff to handle the workload. Within a workforce that is committed to the organization, individuals are motivated to make significant personal investments and provide the knowledge that may be necessary for organizational success following a disruption. One aspect of employee commitment is understanding the ways that the organization works. One expert referred to this attribute as the ability to “have the organization in your head.” For example, a bipartisan House of Representatives committee reported after Hurricane Katrina that a lack of understanding of the command and control structure among employees slowed and complicated the response effort after the hurricanes. Another key aspect of this category is a workforce with the needed skills to meet the organization’s mission. The committee report also noted that, after Hurricanes Katrina and Rita, the Department of Homeland Security and FEMA were not prepared, in part, due to a lack of experienced and trained staff. Solid internal and external networks can facilitate and strengthen other resilience attributes. For example, having dependable connections will likely expand and expedite an organization’s access to resources when the organization is faced with a disruption. Specifically, being aware of interdependencies, knowing when reinforcement is needed, and being able to communicate among interdependent units can give an organization an extended reach for information, resources, and advice. Furthermore, an organization’s knowledge of its supply chain interdependencies can help identify vulnerabilities, which can inform risk assessments and emergency planning. For example, after the terrorist attacks of September 11, 2001, many companies in the financial sector found that they relied on the same electronic data system backup sites, which were also affected by the attacks. As a result, key institutions realized that their individual plans for preparedness for disasters or other crises significantly affected others, both directly and indirectly. Accordingly, the Securities and Exchange Commission recommended that financial institutions explore the usefulness of coordinated testing of plans. Additionally, the Y2K challenge was met through the collaborative efforts of the Congress, the administration, federal agencies, state and local governments, and the private sector. Had any of these sectors failed to take the Y2K problem seriously, neglected to remedy computer systems, or failed to work together with partners on common issues such as contingency planning, critical services could have been disrupted. Although these five categories of attributes contribute to organizational resilience, all disruptions are individual situations and even a relatively resilient organization may not be able to restore operations under certain circumstances. Furthermore, during a disruption, some attributes may prove to be more important than others. For example, IRS found that, after the 2006 flood of IRS headquarters, IRS did not have to activate its headquarters continuity of operations plan. Alternate work space was quickly made available for all headquarters employees, so identifying critical personnel, a required step of continuity of operations planning, was much less important. Additionally, with many attributes, excess of a positive attribute becomes negative. For example, too much experience with change could make employees suffer from innovation fatigue and become less open and receptive to change. IRS has a record of responding to external events, which have offered lessons and opportunities for IRS to strengthen practices that enhance resilience. The examples below show how IRS was able respond to unanticipated external events because it had learned from prior experiences. IRS was able to improve the speed of its response to disruptions by adapting its information technology processes. After Hurricanes Katrina and Rita in August and September 2005, IRS deployed more than 5,000 employees at its call sites to help register disaster victims with FEMA. During the response effort, IRS officials estimated that IRS staff may have handled more than 50 percent of FEMA’s calls. In order to fill this increased need for capacity, IRS expanded the size of its workforce by bringing back about 4,000 seasonal employees, who are typically hired to assist with the tax filing season. IRS completed a similar service for FEMA during Hurricanes Ike and Gustav in 2008, and was able to incorporate lessons learned from the response to Hurricanes Katrina and Rita. Specifically, during the response to Katrina and Rita, IRS employees were able to log into either the IRS system or the FEMA system but not quickly able to transition between the two to serve the needs of the individual callers. After this experience, IRS’s information technology staff identified ways for IRS employees to toggle between the two systems and thus work where demand was greatest. IRS implemented lessons from past stimulus payments and delivered a generally successful tax filing season. During the peak of the 2008 taxpayer filing season, IRS also had to process payments to taxpayers as directed by the 2008 economic stimulus legislation. IRS processed stimulus payments totaling $94 billion and handled more than twice as many calls from individuals looking for assistance than they received in 2007. In addition, IRS processed almost 9 million “economic stimulus only” tax returns from individuals who would not otherwise have had to file a return. Because many of these individuals had never filed a return, the error rate on these returns was higher than usual. Because of the timing of the economic stimulus package, IRS did not have time to hire, conduct background checks for, and train additional staff to handle the increased volume of telephone calls for taxpayer assistance. Instead, IRS maximized the use of its workforce by asking its compliance staff to answer incoming calls from taxpayers about the stimulus. IRS knew the adjustments that it would have to make to its workforce based on its experience implementing past economic stimulus bills. As a result, even with this increased workload, IRS was also able to deliver a generally successful filing season. Nevertheless IRS had to make trade-offs in other key areas. As a result of decisions to shift staff from collection cases to telephone assistance, IRS estimated that its costs and foregone revenues would reach up to $960 million. IRS has been generally successful in the face of past disruptions. However valuable these experiences have been, though, they can not provide experiences for all possible disruptions nor provide experience to all IRS employees. For example, an influenza pandemic, in which a large portion of the workforce could be absent from work for extended periods, would entail a different type of response from the experiences required by past events. Accordingly, IRS relies on its emergency planning process and its test and exercise plans to assist in preparing for disruptions it has not yet experienced. IRS’s test and exercise strategy focuses on four types of tests and exercises. First, call tree tests check the accuracy and completeness of contact information for key emergency personnel. Second, IRS staff annually check that all four types of IRS business continuity plans are up to date and accurate. Third, key emergency response personnel from each business unit are required to complete a tabletop exercise in which they familiarize themselves with the business resumption plan, their roles within the plan, and the steps they would take in case of an emergency. Participants in the tabletop exercise then walk through possible scenarios to discuss ways they would respond. Last, in large geographic areas, emergency personnel from multiple business units participate together in an integrated tabletop exercise. The goal of the integrated tabletop exercise is to provide a better understanding of how emergency response personnel from different organizations work together and identify the required time needed for resumption and recovery activities. The tabletop exercises—while required agencywide since September 2006—are not regularly conducted. TIGTA found that more than half of the business resumption plans they sampled had not been tested through tabletop exercises in calendar year 2007. In addition, IRS officials noted that the tabletop exercises are not always well designed. For example, they said that one tabletop exercise presented so many scenario events that participants found the exercise to be unrealistic and, during the exercise, chose to decrease the number of scenario events and the duration of the exercise. In response to the need to improve exercises across IRS and implement new requirements from the Federal Continuity Directives, IRS assembled its Emergency Management and Preparedness Working Group, which coordinates emergency activities among its business units, for a 2-day workshop. With the goal of reducing the variation in the quality of the tabletop exercises, the workshop leaders discussed and encouraged sharing among all the participants of how to prepare and conduct successful tabletop exercises. Headquarters has also recently made additional resources available to assist the business units with implementing the tabletop exercises. For example, they recently established the Incident Management Business Resumption Group as a resource available to the business units to plan and conduct training, testing, and exercises. In addition to tabletop exercises, FEMA has identified and recommended two additional types of tests and exercises: Functional exercise: fully simulated interactive exercise that tests the capability of an organization to respond to a simulated event. This type of exercise strives for realism, short of actual deployment of equipment and personnel. Full-scale exercise: a simulated emergency event, as close to reality as possible. It involves all emergency response functions and requires full deployment of equipment and personnel. The value of exercises that involve simulation was underscored by the experts we interviewed. They noted that a resilient organization provides opportunities for employees to respond to stressful circumstances. The simulations involved in these types of exercises create more realistic conditions and a better experience to prepare employees to contend with an actual emergency event. The senior IRS official responsible for emergency preparedness believes that these more in-depth tests and exercises would be beneficial because they would stretch IRS leadership and emergency personnel to confront and learn from more realistic challenges. As part of this discussion, he acknowledged that these more extensive tests and exercises are more expensive than tabletop exercises and require a significant time commitment from agency personnel. Accordingly, he thought that it would be better to initially implement these tests on a limited pilot basis. According to the experts we interviewed, some of the benefits of a functional or full-scale exercise may be accomplished with the investment of fewer resources, by simply making routine drills more stressful by taking steps such as withholding an expected resource. For example, one IRS campus held a fire drill in which use of cell phones was prohibited. This experience taught employees to practice different modes of communication and to use “runners” to spread information among employees. This same campus held an additional evacuation drill where selected employees remained in the building during the drill to test the ability of the employees tasked with assuring the building was cleared of occupants to locate missing employees. IRS has a strategy to build resilience through geographic dispersion of leadership, data systems, personnel, and other capabilities. Accordingly, IRS’s campus operations are carried out at eight locations across the country; each campus has the capability to handle taxpayer calls and process tax returns. (See figure 2.) The network of IRS campuses is geographically dispersed and also highly redundant in function. IRS officials have stated that, after a disruption, all campus operations could be transferred to another campus if needed. Also, work is routinely shifted among campuses if the workload of one campus exceeds the campus’s capacity. IRS has made strategic decisions based on the importance of flexibility to its overall resilience. Specifically, to reduce unneeded capacity caused by the increase in the number of taxpayers submitting tax returns electronically, IRS is in the process of consolidating its total number of paper processing centers. However, in considering the optimal number of paper processing centers to retain for individual returns, IRS officials used an analysis of the potential effects, in the face of an emergency, of losing some campus redundancies. Based on this analysis, IRS will keep three— rather than two—individual tax return sites open. When combined with two paper processing centers for small business tax returns, IRS will have a total of five centers that process paper tax forms, making it better able, in its view, to maintain the degree of flexibility that it needs for resilience. In other IRS operations that do not require as much access to IRS equipment and facilities, distributed capacity is achieved through moving work among a dispersed workforce. To move work among noncampus employees—who typically work in field offices or on site with a taxpayer—the business units have developed electronic case management files and have given employees access to laptops so that work can be completed from any site. This is important because, in many cases, the work of the noncampus employees is highly specialized, and accordingly, IRS officials said that they preferred to keep workload within a business unit after a disruption rather than redistributing it to other business units. In contrast, the call center operations are routinely shifted among individuals—located at 26 call sites nationwide—who respond to taxpayer questions. The Joint Operations Center, located at the Atlanta campus, routes incoming calls for taxpayer assistance to available assistors. This center monitors the number of calls and customer waiting times and distributes calls across its nationwide network of call centers. This process allows IRS to ensure that taxpayer calls are promptly answered by directing the workload to the first available individual who is able to provide taxpayer assistance. Furthermore, the Joint Operations Center itself is redundant; another fully capable Joint Operations Center is located in Memphis, Tennessee. Within a campus, many employees can perform multiple tasks and can be reassigned within the campus as needed. As workload needs change, employees are routinely shifted between managing telephone and paper correspondence from taxpayers. Furthermore, as needed, employees who process paper returns are routinely shifted between jobs, such as sorting or examining envelopes to ensure that checks have not been left behind. This provides the flexibility needed for the campus operations to respond to change. In past disruptions, IRS has used its seasonal workforce to respond to changing circumstances. IRS has a seasonal workforce of about 30,000 workers, who are needed to assist IRS as the workload increases during tax filing season. IRS contacts seasonal employees needed for each day’s workload, allowing the IRS campus workforce to expand and contract as needed. During emergencies, IRS has called on these employees for other purposes as well. For example, as discussed above, IRS called on 4,000 seasonal workers to assist FEMA in responding to calls for assistance after Hurricanes Katrina and Rita. IRS has also demonstrated the ability to be flexible after disruptions and reallocate physical resources quickly. For example, as a result of a flood at IRS headquarters building during a period of record rainfall in June 2006, the building sustained extensive damage to its infrastructure, and critical parts of the building’s electrical and mechanical equipment were destroyed or heavily damaged, requiring the headquarters building to be closed until December 2006 to allow for repairs. Within 1 month of the flood, over 2,000 employees normally assigned to the headquarters building were relocated to 15 other locations throughout the Washington, D.C., metropolitan area. IRS has many systems in place to develop its overall leadership capability. Among these are readiness programs to develop managers and executive leadership (see table 1 for details). Through coursework and—in the case of executive development programs—rotational opportunities, these programs are designed to help employees develop leadership skills and assess whether a manager position fits their career interest and abilities. Participants can learn about and try manager competencies without committing to a position, and managers can identify talented future managers without promising every participant a manager position. After completing a program, interested participants are selected for positions on a competitive basis. Not only are these programs intended to help address IRS’s projected need for managers, they allow nonmanagers to be trained in leadership skills, which distributes leadership skills throughout the IRS workforce and could be helpful in assisting IRS during a disruption. For the past five years, the IRS Commissioner and Oversight Board have received quarterly updates on the percent of managers completing these programs in a timely manner. We have reported that attention from high level agency officials to training initiative performance measures can directly contribute to the development of employees who are capable and motivated to accomplish the agency’s mission and goals. Accordingly, based on the performance information he has received, the IRS Commissioner determined that employees would be better able to fulfill agency needs by making adjustments to IRS’s criterion for timeliness. Specifically, IRS managers are now expected to receive training before or within 9 months of their promotion, a shorter time frame than was the case in the past. IRS’s performance management system is structured to build employees’ understanding of the organization’s mission and values and their roles within the organization. Through the performance management system, all managers are expected to set employee expectations and align these expectations with the IRS mission and strategic objectives. We have reported that an explicit alignment of employee expectations with broader organizational goals is a defining feature of an effective performance management system in high performing organizations. We have noted that these organizations use their performance management systems to improve performance by helping individuals see the connection between their daily activities and organizational goals, and this type of system encourages individuals to focus on their roles and responsibilities to help meet their goals. Accordingly, IRS employees have communicated through employee interviews and surveys that they know their roles in the organization’s mission. The 2008 IRS Employee Survey found that more than 85 percent of respondents IRS-wide agree with the statement, “I know how my work relates to the agency’s goals and priorities.” Managers are also held accountable for the engagement of the employees whom they supervise, an asset to resilient organizations. All managers are held directly accountable for their workgroup’s score on an Employee Engagement Index, which is based on the annual IRS Employee Survey. (See table 1 for details.) IRS defines employee engagement as the degree of employees’ motivation, commitment, and involvement in the mission of the organization, and has created IRS-wide annual targets to increase engagement scores. Managers of workgroups that receive a score in the bottom 10 percent of all IRS workgroups are automatically enrolled in the Leadership Coaching Program. (See table 1 for details.) The coaching program is intended to give these managers greater tools for improving or addressing employee concerns. Managers in all four IRS business units broadly praised the program. Additionally, according to IRS, scores on questions in the engagement index improved by almost 40 percent between 2007 and 2008 for workgroups with managers in the coaching program. Another IRS-wide initiative aimed at bolstering management accountability for employee engagement is ES Tracker. (See table 1.) Issues from the Employee Survey, workgroup issues, or other concerns are entered into a database by workgroup managers. Managers are responsible for taking action on the items or elevating them up the management chain until an individual or committee addresses the issue. For example, in a recent meeting of one workgroup, current employees expressed frustration with the skill sets of newly hired employees. They mentioned a past practice that included an additional level of screening before hiring employees, and asked that management explain why this screening was no longer in place. This question was entered into ES Tracker and elevated for management to address. Through ES Tracker, employees have also shared new and useful technologies to make work more efficient and improve taxpayer relations. For example, workgroups identified the need for financial market data terminals which would assist IRS staff. The employees said that the software would validate source information that taxpayers provided to TE/GE revenue agents. These technologies were provided to workgroups after management was alerted through ES Tracker. The Human Capital Office can track trends in the system across IRS. This transparency helps increase accountability by allowing employees to see what issues management has addressed. Although IRS has a number of programs in place to build staff motivation, less than half of respondents in the 2008 IRS Employee Survey agree with the statement, “In my organization, leaders generate high levels of motivation and commitment in the workforce.” This is lower than the percentage of IRS employees responding positively to most other survey questions, with which an average of more than 65 percent agreed. According to IRS managers, this response may be due to the geographic dispersion of IRS offices and hierarchical distance between employees and leadership. In many cases, IRS employees will only see IRS senior leaders once a year, if at all. Many of the IRS managers we talked to expressed concern about this disconnect and have developed individual methods in addition to the IRS and division initiatives to bridge the geographic and professional distance between leadership and frontline workers. Managers and leaders have reported including their pictures on e-mail messages, creating intranet pages to communicate with employees, and making visits to IRS sites. Formal initiatives include town hall meetings, which are run by IRS leadership and provide employee exposure to senior leadership and a forum for leadership to address employees. Additionally, E-talk, a Web- based comment submission system, allows employees in one business unit to anonymously share positive and negative comments directly with senior leadership. IRS has included this survey question in the above discussed employee engagement index, and accordingly, the steps taken in response to the index—such as the coaching initiative—may affect this score. Despite IRS’s large size and distributed workforce, there are many formal ways for employees to communicate across different parts of the agency. At the time of our review, IRS had a number of cross-business-unit initiatives, including over two dozen internal advisory committees to address human capital, technology, security, and other operational issues. Also, business units have established working groups, as needed, to address cross-functional tax administration issues, and in some cases, teams of employees from multiple units do the work. Some of IRS’s formal and informal human capital practices further enhance internal networks. Formally, participants in the Executive Readiness Program may complete assignments in other units of IRS. This helps employees make contacts throughout the agency and observe the operations of other units, which may better enable them to call on others for assistance in the face of a disruption. IRS is also developing corporatewide training for its Revenue Agent staff, a position that is common to many of the business units. The training will help employees to make contacts throughout the agency. Many IRS employees move between business units during their careers. For example, IRS’s Workforce Plan shows that it is common for SB/SE employees to move to LMSB. IRS also works with a number of outside groups. Table 2 highlights examples of such groups. Federal Continuity Directive 1 requires that agencies perform annual tests of the internal and external interdependencies identified in their continuity plan, with respect to performing mission-essential functions. Agencies are also required to have an opportunity to demonstrate inter- and intra- agency communication capabilities and to test equipment used in internal and external communication. However, the Federal Continuity Directive does not specify whether representatives of external entities need to be present at the tests and exercises, or whether they can simply be represented by agency personnel. IRS is currently implementing the requirements from the Federal Continuity Directive. IRS guidelines require business units to include internal stakeholder groups in tests and exercises but do not have parallel requirements for external stakeholder groups. Internal groups include Modernization and Information Technology Services and Agency Wide Shared Services that move resources throughout IRS and provide services necessary for employees to do their jobs. Internal interdependencies are tested through integrated tabletop exercises, which IRS requires for large geographic regions as part of its annual test and exercise strategy. However, IRS currently has no requirement for including external stakeholders in tests and exercises. As a result, tests and exercises involving these entities have been inconsistent across IRS. The few IRS exercises involving external entities tend to be centered on a large city or on IRS campuses. In the exercises in which external partners participated, IRS benefited by identifying important lessons to integrate into its plans. In one case, IRS held an integrated tabletop exercise with FEMA and the Central U.S. Earthquake Consortium—an educational organization that coordinates multistate efforts in emergency planning for an earthquake in the central United States—where IRS managers and Business Resumption Plan coordinators reacted to a detailed earthquake scenario. FEMA was able to provide IRS with a specific impact analysis on its facilities, which showed that the affected area would be much larger than IRS had anticipated. As a result of the exercise, IRS recognized that an alternative computing site would be unusable after an earthquake, and now plans to relocate the site. In some cities, IRS also participates in exercises hosted by the local Federal Executive Boards that bring together federal agencies located in the same city. By participating in an Atlanta Federal Executive Board exercise, IRS was able to establish important contacts with local government officials. However, even in campus locations, some exercises occur without participation from external entities. For example, IRS’s Atlanta campus has its own on-site post office, and is co-located with the Centers for Disease Control and Prevention, but neither the post office nor the Centers for Disease Control and Prevention participates in IRS exercises. In a recent exercise, participants from IRS have discussed the possible response of the post office, but postal representatives were not included in the tabletop exercises. By not having regular external participation in tests and exercises, IRS missed several opportunities for strengthening ties that could play a critical role during a disruption. For example, an SB/SE office in New Jersey that faced a possible anthrax contamination learned that the local authorities on whom IRS relies in such situations were ill prepared and even unaware of how to put on protective suits. Rather than learning these deficiencies during a no-risk situation, such as an exercise, IRS identified the local authorities’ lack of preparedness during a situation that could have proved harmful. The need to include stakeholders is particularly relevant for providers of electronic tax software and Electronic Return Originators. As we recently reported, electronic tax software and the associated electronic return originators, which electronically submit returns to IRS, are key to the tax administration system. In 2007, 39 million tax returns were prepared using commercial software and the majority of electronically submitted returns went through electronic return originators. Even though these organizations are a critical component of the tax administration system, they are not formally included as part of IRS’s test and exercise strategy. We recently recommended that IRS develop and plan for effectively monitoring compliance with recommended security and privacy standards for the 2010 filing season. We should note, however, that with one recent exception which did not have a significant effect, tax software companies have been generally reliable providers of electronic filing services. In the face of tax law changes and natural disasters, IRS has exhibited a considerable degree of resilience. After these experiences, it has also demonstrated it is able to incorporate lessons from these past disruptions into its planning and policies. IRS’s strategic flexibilities and tools to distribute leadership capabilities through the workforce and hold individuals accountable are additional ways that IRS builds its capacity for resilience. While IRS has been generally successful in the face of past disruptions, its current test and exercise strategy does not include simulations of real events through functional or full-scale exercises, which limits the ability of IRS staff to gain experience in responding to more realistic circumstances. Realistic and stressful circumstances are important to include in tests and exercises, because they build in employees the capacity to respond to the stress of actual events. At the same time, functional and full-scale exercises require greater financial and staff investment than do tabletop exercises. Accordingly, these types of tests and exercises could be done on a limited basis and the results evaluated to assess the costs and benefits before conducting them more widely. At the same time, stressful circumstances can still be included in routine drills, which affect a wider range of employees than specific planning exercises, with a lower cost and less time commitment. Furthermore, the innovation required in the face of some disruptions includes knowing how to draw on the agency’s own resources and the resources of others. This capacity cannot be achieved with simple planning exercises alone or in isolation, but requires individuals to have the opportunity to practice responding to stressful circumstances with key stakeholders. To improve the resilience of IRS operations, we recommend that the Commissioner of the Internal Revenue Service direct the appropriate officials to take the following three actions: 1. Establish a plan to conduct a limited number of functional or full-scale exercises to include IRS leadership and emergency personnel. These tests and exercises should be followed by an evaluation of their costs and benefits. Based on the evaluations, IRS emergency plans should be revised to reflect the degree to which the tests should be replicated more broadly. 2. Establish plans for the inclusion of some degree of stressful circumstances in the routine evacuation and shelter-in-place drills in which all IRS employees participate. 3. Modify test and exercise standards to include involvement of external stakeholders. We provided a draft of this report to officials at IRS for their review and comment. IRS’s comments are reproduced in appendix III. In its comments, IRS agreed with all three of our recommendations. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Commissioner of the IRS. The report also is available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-6543 or steinhardtb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix IV. The objectives of this report were to define organizational resilience and its dimensions, determine the degree to which selected IRS field operations exhibit the attributes of organizational resilience, and identify challenges and opportunities to improve organizational resilience at IRS. To define organizational resilience and the attributes of resilience we reviewed academic literature from the fields of psychology, ecology, organizational and management science, high-reliability organizations, continuity, and disaster management, as well as relevant GAO and Treasury Inspector General for Tax Administration (TIGTA) reports. In addition, we interviewed 11 academic and practitioner experts—in emergency preparedness and disaster management, management and organizational psychology, critical infrastructure, and strategic planning— regarding organizational resilience. These experts were chosen based on their publications, contributions to their field, and the frequency with which other experts cited their work. Through an iterative process with the experts, we developed a list of 21 attributes related to organizational resilience. These attributes were then arranged into five broad categories: emergency planning, organizational flexibility, leadership, committed workforce, and networks. To identify the ways that the Internal Revenue Service (IRS) exhibits the attributes of organizational resilience and the opportunities that IRS has to take on additional practices which would make it more resilient we selected relevant parts of IRS, completed a document review, observed organizational meetings, and held interviews with IRS officials. The four business units of IRS were selected for review: Wage and Investment (W&I), Small Business/Self-Employed, Large and Mid-Size Businesses, and Tax Exempt/Government Entities. We selected these divisions because their work fulfills the statutory authority of IRS. Additionally, we examined the specific units and offices within IRS headquarters and functional units which support the work of the business units including the Human Capital Office, Agency-Wide Shared Services (AWSS), and Modernization Information and Technology Services (MITS) office. To learn about IRS practices which relate to organizational resilience, we reviewed GAO and TIGTA reports, IRS documents, and interviewed IRS representatives. For each of the four business units and IRS headquarters, the Commissioner or designated representatives as well as representatives from the offices of human capital and emergency planning were interviewed. For the functional unit AWSS, representatives from the offices of emergency planning, facilities management, and the Senior Commissioner Representatives were interviewed. For the functional unit MITS, representatives of relevant offices to organizational resilience, including End-User Services and Cyber Security, were interviewed. Representatives from the cross-IRS working groups of Workforce of Tomorrow, Emergency Management and Preparedness Working Group, and Security Services and Privacy Executive Steering Committee also were interviewed. Additionally, we interviewed the president of the National Treasury Employees Union. To gain perspectives on the views and working relationships of IRS employees, we reviewed survey data and observed selected meetings and offices. We reviewed IRS Employee Survey results for 2007 and 2008; IRS provided the raw data for these surveys to GAO. We determined that available data were sufficiently reliable for the purposes of this report. However, we should note that the response rate to the survey was about 60 percent, a rate which typically raises concerns about possible bias due to nonresponse. To address this concern, we reviewed IRS’s response bias analysis that had determined no adjustments were required to correct for nonrespondents. In addition, based on the average positive response rate of about 65 percent, we set a threshold for reportable positive responses of more than 80 percent and a threshold for negative responses of less than 50 percent, and selected only responses from those that exceeded these thresholds. Additionally IRS provided documentation and analysis related to the IRS Employee Engagement Index, which is based on the IRS Employee Survey data. Furthermore, we observed IRS employees at the Emergency Management and Planning Working Group monthly meetings; the AWSS-sponsored Federal Continuity Directives 1 and 2 seminar for emergency planning representatives from all IRS business, headquarters, and functional units; and the W&I call center routing center, submissions processing, and accounts management facilities. We conducted this performance audit from January 2008 to April 2009, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We assessed the reliability of data used in this report by (1) performing electronic testing of required data elements, (2) reviewing existing information about the data and the system that produced them, and (3) interviewing agency officials knowledgeable about the data. We determined that the data were sufficiently reliable for the purpose of this report. Organizational resilience is the quality that would enable an organization to restore itself or thrive following a disruption, by which we mean a sudden and externally imposed circumstance that has the potential to substantially compromise an organization’s ability to accomplish its mission. A highly resilient organization is identified by the speed and agility it demonstrates in achieving a return to its normal state (or new normal state) and its resulting enhanced ability to respond to future disruptions. To make our definition of organizational resilience more practical and observable, we identified 21 attributes that can be placed in five related categories. We found that organizational attributes related to emergency planning, organizational flexibility, leadership, workforce commitment, and networked organizations are particularly associated with resilience and provide a useful assessment framework. These characteristics can help an organization be resilient after a disruption, but under certain circumstances, even a relatively resilient organization might not be able to recover. (See figure 3.) Emergency planning identifies disruption that could potentially affect an organization and defines and tests strategies to face disruptions. An organization that performs regular tests and exercises of their emergency plans will likely better know how to handle a real disruption. According to Federal Emergency Management Administration (FEMA) training materials, an exercise is a practice that “places the participants in a simulated situation requiring them to function in the capacity that would be expected of them in a real event. Its purpose is to promote preparedness by testing policies and plans and training personnel.” An exercise program should include long-range goals, schedules, and roles and responsibilities for executing the tests and exercises. Tests and exercises should be challenging and include a variety of scenarios. As one of our experts suggested, organizations should occasionally withhold an expected resource, which forces participants to improvise and use creativity. Aside from learning how to react to a scenario, tests and exercises are an opportunity to expose flaws in plans. After a test or exercise, participants should be debriefed and participate in a discussion about lessons from the scenario. Resulting lessons should be incorporated into revisions to plans, guidance, training or other related documents. Not implementing such changes leaves organizations vulnerable to recommitting mistakes. To demonstrate this attribute, an organization should have after-action reports from tests and exercises, and documentation of implementing changes that result from the reports. An organization that is aware of its surroundings and takes its risks and vulnerabilities into account during decision making could diminish effects of a disruption. A couple of our experts emphasized the importance of having realistic views of hazards and vulnerabilities, with one of them emphasizing the need for identifying consequences and possible solutions. Prior GAO work has defined risk management as a strategic process for helping decision makers make decisions about assessing risk, allocating finite resources, and taking actions under conditions of uncertainty. The risk management process includes setting strategic goals, objectives, and constraints; performing threat, vulnerability, and criticality assessments; evaluating alternatives; selecting an alternative; and implementing and monitoring decisions. Aside from the content and implementation of plans, it is important for an organization to have an open and participative process for creating emergency plans. This includes acknowledging and, as appropriate, including employee feedback in the planning process. Giving employees a relationship with a plan helps ensure that they are familiar with it, according to one of our experts. Evidence for this attribute could be found in rosters of participants in emergency planning sessions or membership lists of any planning committees, or documentation of any employee- initiated changes. A flexible organization that is receptive to change has a workforce that can respond to a range of disruptions flexibly and with agility. When employees have a wide breadth of expertise and the ability to work in different positions and areas of the organization, the organization has a broader array of human resources to draw on and compensate for any losses after a disruption. Employees with experience in different locations, levels, units, or occupations within an organization likely have the type of broad knowledge necessary to act quickly and fill in when an organization is lacking in resources. Breadth of expertise can be obtained through crosstraining, serving on details or rotations among different organizational units, or by having different roles through natural career progression. An organization with physical and human resources that are geographically dispersed is more likely to be resilient because of an ability to relocate operations should a facility need to close. An increased number of pathways for operating decreases the effect of a disruption at any one site. Redundancies can be physical or equipment-based, such as having a field office structure, designating alternative sites, or having storage areas for backup files or equipment that are not co-located with office sites. Redundancies can also exist in human resources, meaning that more than one employee is capable of performing a specific job should some employees be unable to work. This attribute can be demonstrated through the existence of multiple work sites and plans that identify alternative sites and backup personnel. An organization’s breadth of expertise and distributed capacity will likely be effective only if adequate assets are in reserve to support reallocating employees and resources. Specifically, an organization needs the ability to free employees, budget, and physical and technology resources during a disruption, sometimes referred to as margin. Organizations with overstretched resources and excessive workloads will likely find it difficult to shift employees, finances, or office space into alternate configurations. This attribute can be seen in looking at the organization’s workload inventory, identification of any chronic staff shortages, or assessments of how an organization works under budgetary constraints. Employees who have demonstrated an ability to think independently and use creative problem-solving skills will likely be more resourceful and able to improvise after a disruption. Organizations can encourage and facilitate the development of these skills by giving employees opportunities to propose solutions to workplace challenges, and to involve employees in identifying improvements. An organization that supports these skills may also offer related training, or it may have job descriptions or competencies for employees that set performance expectations for their ability to think creatively and apply new ideas. Similarly, the organization may recognize employees who introduce new processes and ideas with awards that are visible within the organization. An organization that resists rigidity and accepts that improvements can accompany change will likely be better able to address vulnerabilities, respond with agility during a disruption, and thrive afterwards. This includes having a tolerance for ambiguity and a willingness to keep multiple options open when faced with decisions. Rigidity or an overreliance on bureaucratic structures can increase vulnerability to disruption and can paralyze an organization during a disruption. Furthermore, after change occurs, the organization should be able to grow its competence based on increased knowledge and experience. Observing ways the organization has dealt with change or assessing the levels of employee or outside involvement in decision making can serve as anecdotal evidence for this attribute. Additional evidence might include training on change management to employees, or job descriptions or competencies for employees that set performance expectations for ability to accept change. Leaders who demonstrate respect for their employees and are accountable for results are more likely to garner the employee commitment that will be needed after a disruption. Additionally, when leadership abilities are distributed broadly through the workforce, an organization is more likely to be resilient. Leaders who understand and accommodate the needs of their employees and acknowledge a necessary work/life balance, particularly after a disruption, can increase resilience, as it is important to help resolve employees’ personal problems because of the problems’ potential to affect the workplace. As one of our experts stated, leaders should acknowledge the emotion and uncertainties that surround an event, be realistic about its effects, and have strong communication with employees. Respect could be seen in availability of support or counseling services for employees after a disruption, or through work/life balance provisions such as telework. As one of our experts said, leaders need to be empowered in a crisis to take initiative and make logical decisions without fear of punishment. This autonomy can come from a management style that encourages independent action. An organization should have provisions that enable individuals to exercise judgment, discretion, and to make and recover from mistakes, according to one expert. Rather than strictly relying on hierarchy, leaders of a resilient organization should delegate to enhance employee development and to maximize the achievement of organizational goals. This requires an awareness of employee strengths and skills. One of our experts emphasized the need to devolve authority to the employees equipped to deal with a specific situation and who know the work. Leaders must then support employee decisions by granting autonomy and providing the necessary coordination and resources. This attribute could be seen in managers’ use of horizontal teams and task forces for decision making, and managers having a knowledge and skills database to catalog special employee skills. An organization that supports continuing education, professional development, and expanded leadership opportunities will be more likely to be resilient. As one of our experts said, leaders can help employees learn to have confidence in their ability to perform a task or achieve an outcome. Competence is based on training, experience, and development of specialized knowledge, and as competence grows so does one’s ability to respond and recover from unfamiliar or challenging situations. Opportunities for employees to further their professional knowledge and experiences lead to increased confidence and competence. Organizations with mechanisms to hold individual leaders accountable for unit and organizational performance will likely have a pre-existing focus on responsibilities for organizational accomplishments that will aid in resilience. Accountability is especially important during catastrophic disasters, as it helps to ensure that resources are used appropriately. Prior GAO work has shown that performance management systems can help reinforce individual accountability for organizational results. This includes creating pay, incentive, and reward systems that link employee knowledge, skills, and contributions to organizational results. In addition, requiring and tracking follow-up actions on performance gaps and requiring follow-up actions to address organizational priorities can increase accountability. A workforce that is committed to the organization provides individual motivation to make significant personal investments and provide the organizational knowledge that may be necessary for organizational success following a disruption. An explicit alignment of daily activities with broader results helps individuals see the connection between their daily activities and organizational goals and encourages individuals to focus on their roles and responsibilities to help achieve those goals. This helps with employee accountability, but can also provide employees with a sense of purpose, both of which are an advantage for resilience. If an organization faces a disruption and employees know their roles in achieving the organization’s mission and goals, they will have organizational principles to guide their actions. Leaders can dispense and reinforce this knowledge through including specific goals in individual employee performance plans and job elements, and updating employees on progress on organizational goals. Not only should employees know their roles in the organizational mission, but if they are committed to that mission there is an increased likelihood that employees will extend themselves and give the organization momentum during a disruption. According to one of our experts, the commitment should be to the organization’s mission, not the organization itself. Thus employees’ self interest should overlap with the interests of the organization. This attribute can be observed through employee feedback and employee involvement in organization-wide initiatives. An organization that has few critical skill gaps will likely be better able to meet the daily needs of the organization and those that could arise during a disruption. Similar to having a workforce with a breadth of expertise, an organization’s employees should have some universal skill sets beyond those needed for their current duties. In the words of one of the experts we spoke with, the more skills that an employee has, the more problems they are able to see, thus enabling them to interact and intervene earlier during a disruption; if someone is lacking in skills they will likely overlook potential problems. Additionally, employees should be able to act under ambiguous and unstructured circumstances. Organizations can demonstrate this attribute by performing regular skill gap analyses and taking steps to fill any deficiencies, by providing for continuous education and career development, particularly through cross-functional assignments or training. An organization that has an alert workforce and a culture in which employees can call attention to errors will be better off during and after a disruption. According to one author, employees in a resilient organization need to seek and examine potentially disturbing information. This includes doing scans of the environment and understanding the risks and priorities of the organization; or, in the words of another expert, having a “broad horizon.” The information gathered through situational awareness and other sources helps inform the risk management process. An organization can demonstrate this attribute by providing ways for employees to report problems, and rewarding employees who identify and suggest ways to address potential problems. Solid internal and external networks can facilitate and strengthen other resilience attributes. For example, having dependable connections will likely expand and expedite an organization’s access to resources when faced with a disruption. Specifically, being aware of interdependencies, knowing when reinforcement is needed, and being able to communicate among interdependent units can give an organization an extended reach for information, resources, and advice. Furthermore, an organization’s knowledge of its supply chain interdependencies can help identify vulnerabilities, which can inform risk assessments and emergency planning. Having a plan to communicate with employees, clients, and other stakeholders in the event of a disruption will likely help an organization to acquire and share information during a disruption, and correct any misinformation. Communication with employees about the status of the organization (i.e., building closures and leave policies) and any revised expectations for performance can reduce uncertainty and help employees adjust to change. Communication with clients about any changes in service can help to manage reputations after a disruption. Communication should occur through multiple formats, and should occur through a designated official source. An organization can demonstrate this attribute by having information hotlines or Web sites ready to disseminate information, or by having a media relations public affairs office. Having connections with partners or peer organizations could also prove helpful in delivering a message. Collaboration and connections among employees can increase an organization’s resilience by decentralizing information and decision making, thereby strengthening knowledge, commitment, and problem- solving abilities. Networks throughout the organization can also help build other resilience attributes. For example, employees’ ability to connect with one other to access resources from other units or locations can increase the organization’s distributed capacity and make better use of the organization’s breadth of expertise. A collaborative and connected workforce is also more likely to be aligned and committed to the organization, according to a couple of our experts. This attribute can be observed through the presence of cross-functional working groups, classes, or information-sharing sessions. Resilient organizations need a sense of where to go if there is a disruption and no ordinary means to obtain resources, according to one expert. Both internal and external interdependencies should be assessed as part of the risk management process, and should be checked through tests and exercises. An organization can demonstrate this attribute by having contracts with backup suppliers, putting in supplier contracts expectations during a disruption, and involving internal and external entities in tests and exercises. An organization that has a network of partners and alliances with other organizations will likely have access to additional advice, help, and resources during a disruption. Partners could include peer organizations, professional organizations, government entities, or co-located organizations. In addition to providing resources to increase an organization’s margin, partners can provide employees with opportunities to build breadth of expertise through professional contacts and programs, they can provide feedback from customers, and they can give a broader perspective on emergency preparedness. This attribute can be seen in employee participation in professional organizations, employee participation in conferences or external training, or formalized agreements for resource sharing with other organizations. All of these attributes contribute to potential organizational resilience but do not ensure it, because all disruptions are individual situations and even a resilient organization may not be able to restore operations after a disruption. Furthermore, during a disruption, some attributes may prove to be more important than others. For example, we found after the 2006 flood of IRS headquarters that IRS did not activate the headquarters continuity of operations plan because of the specific conditions of the flood. Specifically, alternate work space was available for all headquarters employees within a relatively short period, reducing the importance of identifying critical personnel, a required step of continuity of operations planning. Additionally, with many attributes, there is the potential for condition where the excess of a positive attribute becomes negative. For example, too much experience with change could make employees suffer from innovation fatigue and become less open and receptive to change. In addition to the contacts listed above, William J. Doherty (Assistant Director) and Mallory Barg Bulman (Analyst-in-Charge) supervised the development of this report. Lindsay Welter, Colleen A. Moffatt, and Daniel Berring made significant contributions to all aspects of the report. James R. White and Neil A. Pinney provided expertise on tax administration. Martin De Alteriis, Beverly Ross, and Karen O’Connor assisted with design, methodology, and data analysis. Sabrina Streagle provided legal counsel. Melanie H. Papasian provided editing assistance. William Trancucci verified the information in the report. In addition, Robert Love, John F. Mortin, and James R. Sweetman made key contributions to this report.

Summary: The Internal Revenue Service (IRS) collects the revenues that fund the federal government and issues billions of dollars in refunds. Consequently, IRS's ability to demonstrate agility and speed in restoring its functions after a disruption is vital to the government and the economy. GAO (1) identified the definition and attributes of organizational resilience; (2) examined the extent to which these attributes are exhibited within IRS; and (3) reviewed the challenges and opportunities faced by the IRS in becoming more resilient. GAO gathered and analyzed the attributes of resilience based on discussions with academic and practitioner experts in the field. GAO then reviewed IRS human capital and emergency preparedness policies and strategic plans, observed campus operations and emergency working group meetings, and interviewed officials from headquarters and each of the four business units. Organizational resilience is the quality that would enable an organization to restore itself or thrive following a disruption that substantially compromises its ability to accomplish its mission. Five categories of attributes can help an organization be more resilient: robust emergency planning, flexible organizational assets that can be accessed during times of change, leadership capacity distributed through the organization, a committed and skilled workforce, and strong relationships with internal networks and outside organizations. Although each of these categories is important, the characteristics of whatever disruption an organization faces may make some attributes more valuable than others. In its emergency planning, IRS has learned from experiences requiring organizational resilience. For example, during the peak operations of the 2008 filing season, the economic stimulus legislation required that the IRS process stimulus payments totaling $94 billion. Through adjustments to the workforce, IRS was able to implement the change and delivered a generally successful filing season, while making key trade-offs. Although the IRS has learned from past events, its current test and exercise strategy is limited. Functional or full-scale exercises--which are not part of IRS's strategy-- provide more realistic conditions and a better experience to prepare the leadership and emergency personnel to contend with an actual event. Demonstrating the ways that IRS has flexible organizational assets that can be accessed during times of change, IRS strategically has made some operations redundant, which allows work to be shifted between offices when needed. The IRS has also exhibited the capability to use seasonal workers to increase its workforce after a disruption, as was the case in the support it provided to the Federal Emergency Management Agency after Hurricane Katrina. In building leadership and a committed workforce, the IRS has numerous formal training and development initiatives to build the leadership capability of both its management team as well as its non supervisory employees. While IRS employees understand how their work contributes to the IRS's goals and priorities, currently less than half of IRS employees believe that agency leaders and managers generate motivation and commitment in the workforce. A number of IRS initiatives are now in place to address this issue, including coaching of managers based on employee feedback survey data and outreach by managers to IRS employees. Lastly, IRS is highly networked both within and outside of IRS, which provides opportunities for accessing additional resources after a disruption. IRS has requirements for including internal stakeholders in tests and exercises. When IRS has involved external stakeholders in tests and exercises, it has proven useful, but this practice is neither formalized nor widespread.