Several federal legislative provisions support preparation for and response to disasters. The Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act) primarily establishes the programs and processes for the federal government to provide major disaster and emergency assistance to states, local governments, tribal nations, individuals, and qualified private nonprofit organizations. FEMA has responsibility for administering the provisions of the Stafford Act, and the Act provides the FEMA Administrator with the authority to prepare federal response plans and programs. In April 1992, FEMA issued a Federal Response Plan, which outlined how the federal government implements the Stafford Act. The Federal Response Plan described, among other things, the response and recovery responsibilities of each federal department and agency for saving lives and protecting public health and safety during an emergency or major disaster. After the events of September 11, 2001, and with the passage of the Homeland Security Act in November 2002, FEMA became part of the newly formed Department of Homeland Security (DHS). Under the Act, FEMA retained its authority to administer the provisions of the Stafford Act as well as its designation as the lead agency for the Federal Response Plan. The Homeland Security Act required DHS to consolidate existing federal government emergency response plans into a single, integrated, and coordinated national response plan. In December 2004, DHS issued the 2004 Plan to integrate the federal government’s domestic prevention, preparedness, response, and recovery plans into one plan that addressed all disaster situations, whether due to nature, terrorism, or other man- made activities. The 2004 Plan incorporated or superceded other federal interagency plans such as the Federal Response Plan and the Federal Radiological Emergency Response Plan. In August 2005, Hurricane Katrina and, shortly after, hurricanes Wilma and Rita revealed a number of limitations in the 2004 Plan. Beginning in February 2006, reports by the House Select Bipartisan Committee to Investigate the Preparation for and Response to Hurricane Katrina, the Senate Homeland Security and Governmental Affairs Committee, the White House Homeland Security Council, the DHS Inspector General, and DHS and FEMA all identified a variety of failures and some strengths in the preparations for, response to, and initial recovery from Hurricane Katrina. After reviewing these reports, DHS concluded that the 2004 Plan required revision. In May 2006, DHS released immediate modifications to the 2004 Plan pending a more comprehensive review. In June 2006, Congress passed the Emergency Supplemental Appropriations Act for Defense, the Global War on Terror, and Hurricane Recovery, 2006. In the conference report accompanying this act, the conferrees recommended that FEMA apply $3 million of its Preparedness, Mitigation, Response, and Recovery appropriation to immediately review and revise the 2004 Plan as well as its companion document, the National Incident Management System, which provides standard command and management structures that apply to response activities. On October 4, 2006, the Post-Katrina Act was enacted. This act, among other things, made certain organizational changes within DHS to consolidate emergency preparedness and emergency response functions within FEMA, required that DHS maintain FEMA as a distinct entity within the department, and designated the FEMA Administrator—the new title of the official who will lead the agency—as the principal advisor to the President, the Homeland Security Council, and the Secretary for all matters relating to emergency management. Most of the organizational changes, such as the transfer of various functions from DHS’s Directorate of Preparedness to FEMA, became effective as of March 31, 2007. Others, such as the increase in the organizational autonomy for FEMA and the establishment of the National Integration Center, became effective upon enactment. The Post-Katrina Act specified that the FEMA Administrator, acting through the Center, “shall ensure ongoing management and maintenance of the…National Response Plan,” including periodic review and revision. The Post-Katrina Act also directed the Secretary to establish a National Advisory Council (NAC) by December 2006 to, among other things, incorporate state, local, and tribal government and private sector input in the development and revision of the 2004 Plan. As established by the Post-Katrina Act, the NAC is intended to be an ongoing advisory council that draws upon individuals with a broad body of expertise and geographic and substantive diversity. The Act requires the NAC to advise the Administrator on a variety of emergency management issues across the national preparedness spectrum, including the 2004 Plan. In January 2008, DHS issued the 2008 NRF, the product of the revision of the 2004 Plan. The NRF became effective in March 2008 and retained the basic structure of the 2004 Plan. For example, like the 2004 Plan, the NRF’s core document describes the doctrine that guides national response actions and the roles and responsibilities of officials and entities involved in response efforts. Further, the NRF also includes Emergency Support and Incident Annexes. However, in contrast to the 2004 Plan, FEMA plans to include four partner guides to the NRF that describe key roles and actions for local, tribal, state, federal and private sector entities involved in response activities. While DHS included non-federal stakeholders at the initial and final stages in the process of revising the December 2004 Plan, it did not collaborate with them as fully as planned in its revision work plan or as required by the Post-Katrina Act. DHS based the work plan, which was approved by a White House Homeland Security Council–chaired policy committee, on a section in the 2004 Plan that provided procedural guidance for managing revisions of the document. DHS managed the initial stages of the revision process according to the work plan. However, DHS deviated from its work plan after the first draft was completed in April 2007. Instead of widely disseminating the first draft to all stakeholders, including non-federal stakeholders, for comment and modification, DHS retained the draft to make modifications that it felt were necessary and conducted an internal, federal review of the draft for a 5-month period. DHS delayed the release of the April 2007 draft and provided limited communication to state and local stakeholders on the status of the review until after releasing the draft for public comment in September 2007. In addition, DHS did not manage the revision process in accordance with the Post-Katrina Act’s provision that DHS establish FEMA’s NAC by December 2006 and incorporate the NAC’s non-federal input into the revision. Hurricane Katrina hit the Gulf Coast in August 2005 and the nation’s response prompted DHS to revise the 2004 Plan. In May 2006, DHS issued an official Notice of Change to the 2004 Plan to incorporate lessons learned from the response to hurricanes Katrina, Wilma, and Rita as well as to incorporate organizational changes within DHS. This Notice of Change—which was distributed to all signatories of the 2004 Plan, DHS headquarters and regional offices, and state emergency management and homeland security offices—noted that DHS intended to initiate a comprehensive stakeholder review of the 2004 Plan in the fall of 2006. Accordingly, DHS developed a work plan to manage the revision of the 2004 Plan that established (1) the issues that were to be the focus of the revision process, (2) the entities to be created to implement the process and the tasks involved, and (3) a timeline for completing the revision process and issuing the final document. DHS based its work plan for revising the 2004 Plan on guidance found in the Plan itself. Anticipating that modifications or updates would arise when needed, the 2004 Plan included a section specifying how DHS would conduct interim changes and full revisions, listing the time frames and circumstances—within the first year and every 4 years, or more frequently if the Secretary deems necessary, to incorporate new presidential directives, legislative changes, and procedural changes based on lessons learned from exercises and actual events. The Domestic Readiness Group, an interagency group that coordinates preparedness and response policy and is chaired by staff of the White House Homeland Security Council, approved DHS’s work plan in September 2006. For the revision process, the Domestic Readiness Group was to provide strategic policy coordination, be a mechanism for vetting the revision at the federal level, and was to resolve conflicting policy issues. The work plan contained an initial list of 14 revision issues. According to FEMA officials, they compiled these issues by reviewing Hurricane Katrina after-action and lessons-learned reports from the White House, Congress, GAO, and the DHS Inspector General and identifying common issues that were raised in multiple reports. According to the work plan, DHS was to conduct meetings with selected stakeholders to review the initial list and identify other issues to be considered during the revision process. The result of these meetings was to be a finalized list of revision issues that would serve as the starting point for revising the 2004 Plan. Based on the 2004 Plan, DHS created three entities to facilitate the revision process: the Steering Committee, the Writing Team, and 12 Work Groups. DHS provided a copy of the approved work plan to all participants. The Steering Committee was to conduct the day-to-day management and oversight of the 2004 Plan revision process, which included managing the Work Groups and overseeing the Writing Team. The work plan assigned overall management of the 2004 Plan rewrite to the Writing Team, which was to assign issues to the Work Groups and track the Work Groups’ progress on resolving the assigned issues. The Work Groups, which were chaired by designated co-leaders, were to examine the issues received from the Writing Team and determine if existing language in the 2004 Plan adequately addressed the issues. If the Work Groups determined that current language in the 2004 Plan did not adequately address the issue, they were required to provide recommendations to the Writing Team on how the issues should be addressed. Figure 2 shows the relationship between the entities involved in the revision process. The revision schedule in the work plan was to begin in December 2006 with a goal to complete the revision process by June 2007. As a first step in the plan, the Writing Team was to provide the Work Groups with writing assignments. Once the Work Groups completed their writing assignments, the Writing Team was to review their recommendations and submit a draft of the revised NRF to the Steering Committee for its review and approval. The Steering Committee was to release the first draft of the revised NRF for stakeholder comment by the end of January 2007 with an approximate 30-day review period. According to the work plan, the Steering Committee, Writing Team, and Work Groups would review comments on this first draft, make any needed modifications, and release a second draft at the end of March 2007 for the final of two 30-day comment periods. Per the work plan, these two comment periods would ensure wide dissemination of the product to all stakeholders, including federal agencies, state and local governments, and major professional associations. The work plan schedule also included a 2-month internal, federal review process to take place beginning in May 2007, after which DHS would provide the final draft for approval to the Domestic Readiness Group and the signatories of the 2004 Plan, with the final issuance of the revised 2004 Plan targeted for June 2007. See figure 3 for the proposed timeline for the revision process. DHS included non-federal stakeholders in the early stages of the 2004 Plan revision process in accordance with the work plan. For example, in October 2006, DHS hosted a meeting with approximately 90 non-federal stakeholders where DHS sought feedback on the 14 revision issues from participants using structured breakout groups. At this meeting, FEMA reported that non-federal stakeholders identified the need for enhancements to the 2004 Plan to further describe coordination processes with the private sector and volunteer organizations. DHS held a similar meeting with federal stakeholders in November 2006. According to DHS, it modified the scope of some of the 14 revision issues and added three additional issues. (See app. II for a listing of the 17 revision issues.) DHS assigned non-federal stakeholders to serve as members of the Steering Committee and the Work Groups. Although the work plan called for the engagement of all levels of stakeholders in the revision process and described the Steering Committee and Work Groups, it did not specify the composition of the Work Groups but stated that one non-federal stakeholder would serve on the Steering Committee. In the spirit of the plan, DHS selected non-federal officials to serve on the Steering Committee and Work Groups. Of the 32 members on the Steering Committee, six members or 19 percent were non-federal officials, including representatives from state and local government emergency management associations as well as a local fire department and police associations. According to a FEMA official, the Steering Committee, led by FEMA and DHS co-chairs, generally met on a weekly basis via teleconferences throughout the revision process. Of the approximately 710 members who served on the 12 Work Groups, 224 officials, or 32 percent, were non-federal officials, including 3 of the 27 Work Group co-leaders. These non-federal officials included representatives from state and local emergency management agencies and tribal governments as well as officials from the fire, law enforcement, and public health sector. See figure 4 for the composition of the 12 Work Groups members by level of government, nongovernmental organization, and private sector. See appendix III for a listing of the 12 Work Groups and a table showing the occupational demographics of the non-federal stakeholders who served on the Work Group. The Writing Team, which consisted of 11 federal officials and private contractors for administrative support, did not include any non-federal stakeholders. DHS stated that they invited one non-federal stakeholder to be on the team but that they were not successful in their attempts to secure that person. The 12 Work Groups met in January and February 2007. During that time, and in accordance with the work plan, the Work Groups met to address the issues assigned to them by the Writing Team. Most Work Groups addressed their issues by submitting recommended language changes to the 2004 Plan, which generally consisted of inserting new language or clarifying existing language. The Work Groups supported a recommended language change by providing the rationale for such a change. For example, the Writing Team tasked the Roles and Responsibilities Work Group with clarifying and strengthening the role of state governments in the 2004 Plan. One recommended language change suggested by this Work Group was to describe the state government’s role in the coordination of resources through the Emergency Management Assistance Compact, an interstate mutual aid compact that provides a legal structure through which affected states may request assistance from other states during a disaster. All Work Group recommendations were due to the Writing Team by the middle of February 2007. Although the work plan provided for the Work Groups’ continued involvement after submitting their recommendations, this did not occur. On March 13, 2007, DHS officials e-mailed stakeholders that the release of the first revision draft for the first 30-day comment period was being delayed. According to the message, DHS still planned to release the draft within the next several weeks and issue a final document by June 1, 2007. The message noted that once an updated timeline was approved, DHS would share the dates with the stakeholders. According to FEMA officials, the first draft of the revised 2004 Plan was completed in April 2007 and incorporated many of the Work Groups’ recommendations. However, rather than sending this first draft to stakeholders for comment, DHS conducted its internal, federal review of the draft document for approximately 5 months until September 2007. FEMA officials said that DHS did not release this April 2007 draft for comment because the draft required further modifications DHS considered necessary. An April 11, 2007, notice subsequently posted on DHS’s Web site described the status of the process and its plans to further revise the draft for comment. “As the NRP revision process unfolded, it became apparent that some important issues were more complex than we originally thought and require national-level policy decisions. We also came to the realization that creating a more user-friendly document that clearly addressed the roles and responsibilities of stakeholders and incident management structures would require substantial format changes to the NRP… An updated timeline has not been determined but we will share one with you quickly.” FEMA officials said that the length of time for the review and approval process, about 3 months longer than planned, was unpredictable and that it took longer than they had expected. DHS did not modify or update the work plan to reflect this deviation from the approved revision process or propose how the revision process would now be completed. Certain non-federal stakeholders we interviewed who served on the Steering Committee and as co-leaders on the Work Groups reported receiving occasional or no communication from DHS on the decision not to release the first draft for comment or how the revision process would be completed during this internal, federal review process. FEMA’s Deputy Administrator acknowledged that the federal government should have done a better job in communicating the status of the draft and the revision process to non-federal stakeholders while the document was undergoing the internal, federal review. During this internal, federal review, DHS and FEMA officials continued to revise the April 2007 draft. For example, FEMA officials said that they added a chapter to explain the need for all levels of government to plan for preparedness and response actions and additional language to clarify the role of state and local governments during disaster response. At this point in the process, around August 2007, DHS’s Office of the Deputy Secretary decided to release a revised draft just to the Steering Committee and the Domestic Readiness Group for comment. Writing Team officials assumed that the Deputy Secretary would make the final decision on whether to incorporate the comments received while staff from his office would be responsible for completing any further edits. A draft of this document, dated July 2007, was leaked to the press in August 2007. During a September 11, 2007, hearing before the House Transportation and Infrastructure Committee, officials representing state and local emergency management associations expressed their concerns that the July 2007 leaked draft had changed significantly from the April 2007 draft. The government affairs committee chair of the International Association of Emergency Managers testified, “The document we saw bore no resemblance to what we had discussed so extensively with FEMA and other stakeholders in the December 2006 through February 2007 timeline.” Additionally, the National Emergency Management Association representative, who served on the Steering Committee, expressed his concern that its association had been effectively shut out of the process, testifying that the collaborative process in rewriting the 2004 Plan “broke down…with no stakeholder input, working group involvement, or steering committee visibility.” After the approximate 5-month internal, federal review period, DHS released a draft of the newly renamed National Response Framework for public comment on September 10, 2007. However, as we stated earlier, the original work plan called for DHS to provide stakeholders with two 30-day public comment periods before the internal, federal review; after the review, DHS was to publish the revised document without further comment by stakeholders. The public comment period starting on September 10 allowed for both federal and non-federal stakeholders to provide their reactions to the changes made during the internal federal review process. FEMA officials said they conducted this unplanned public comment period to address the work plan’s requirement that the draft NRF be widely disseminated for all stakeholders to review. FEMA provided a 40-day public comment period for the NRF core document. FEMA received 3,318 comments on the core NRF. The Writing Team led the adjudication—review, analysis, and resolution— of the comments received during the public comment period. The Writing Team examined each comment, made an initial disposition recommendation—accepted, modified, rejected, or noted—and forwarded that recommendation to the FEMA leadership and the Domestic Readiness Group for review. In addition, FEMA posted a spreadsheet on www.regulations.gov that included, among other things, the comments made by non-federal stakeholders and the final disposition FEMA assigned to each of those comments. This allowed these stakeholders to see how FEMA did or did not incorporate their comments into the final NRF document. The Work Groups and Steering Committee, both of which contained non-federal stakeholders, were not involved in adjudicating the public comments, although this was called for by the work plan. A FEMA official said that the agency tried to recruit a non-federal stakeholder to serve on the Writing Team, but that its efforts were unsuccessful. The Post-Katrina Act required the DHS Secretary to establish a National Advisory Council (NAC) by December 2006 to advise the FEMA Administrator on all aspects of emergency management. Among its specific responsibilities, the NAC was to incorporate input from state, local, and tribal governments as well as the private sector in the revision of the 2004 Plan. The Act stated that the membership of the NAC should represent a geographic and substantive cross-section of officials, emergency managers, and emergency response providers, such as law enforcement, fire service, health scientists, and elected officials. However, DHS did not incorporate the NAC by amending its approved September 2006 work plan for revising the 2004 Plan or establish the NAC in time for the Council to incorporate non-federal stakeholder input into the revision of the 2004 Plan, as directed by the October 2006 Post-Katrina Act. According to a FEMA official, DHS did not amend the work plan to incorporate the NAC because of the uncertainty surrounding the time it would take to establish the NAC. The official said FEMA expected that establishing the NAC would take more time than the Post-Katrina Act allowed because FEMA wanted to ensure that the NAC’s membership complied with the requirements contained in the Post-Katrina Act while also providing adequate time to announce the NAC’s creation, solicit applications for membership, and review and select applicants for membership. FEMA announced the membership of the NAC in June 2007, 6 months after the Post-Katrina Act deadline, and the NAC did not hold its inaugural meeting until October 22, 2007, the last day of the public comment period for the base NRF. According to the FEMA Administrator, it was more important for the agency to invest the time needed to review hundreds of applications and create a high quality body of advisors than to rush the process to meet the 60-day statutory deadline for establishing the NAC. As a result, the NAC’s only involvement in the NRF revision process occurred when FEMA provided it with a copy of a draft in December 2007, 2 months after the public comment period closed. According to the NAC chairman, the NAC gathered and consolidated comments from individual members and provided these comments to the FEMA Administrator approximately one month before FEMA published the NRF in January 2008. The chairman noted that these comments were from individual members and did not reflect the official comments of the NAC as a whole. For the next NRF revision, the chairman stated that he expected the NAC to be actively involved with FEMA throughout the entire revision process. For example, he suggested that the NAC could have a role in the adjudication of public comments by representing non-federal stakeholders during the adjudication process to ensure FEMA is aware of issues that are critically important to state and local governments. The NAC is currently exploring its role in reviewing and implementing the 2008 NRF. For example, at the NAC’s February 2008 meeting the NAC Chairman approved a standing committee on the NRF that may focus on actions that can help FEMA implement and train stakeholders on the NRF. While the NAC filed a charter on February 6, 2007, the charter reflects the NAC’s broad array of statutory responsibilities, but does not detail any specific responsibilities the NAC would undertake relative to the NRF revision process. See figure 5 for a comparison of DHS’s actual revision process with its proposed process. The late establishment of the NAC also hindered FEMA from fully collaborating with non-federal stakeholders who were involved in the revision process established by the approved work plan. In particular, two non-federal Steering Committee members stated that after the August 2007 leak of the draft NRF, FEMA stopped sharing drafts with non-federal officials. FEMA officials said that the reason for this decision was because FEMA had yet to establish the NAC, its official advisory committee. FEMA officials said that the absence of an official advisory committee raised fairness concerns about which members of the non-federal community should be allowed to provide input before the public comment period. As a result, FEMA stopped sharing pre-decisional drafts with non-federal members of the Steering Committee because FEMA did not plan to provide the same opportunity to other non-federal stakeholders until the public comment period. While FEMA has recognized the importance of partnering with non-federal stakeholders to achieve the nation’s emergency management goals, both in congressional testimonies as well as in its January 2008 strategic plan, FEMA has not yet developed guidance and procedures for how future revisions of the NRF will be managed or how the newly established National Advisory Council will be integrated into the revision process in accordance with the Post-Katrina Act. Standards for Internal Control in the Federal Government state that management guidance, policies, and procedures are an integral part of any agency’s planning for, and achieving, effective results. Developing such policies and procedures for how the NRF will be revised in the future and how FEMA will integrate the NAC and other non-federal stakeholders in the process is essential for helping to ensure that FEMA attains its goal of partnering with nonfederal stakeholders to help achieve the nation’s emergency management goals. FEMA has recognized the importance of including the input of non-federal stakeholders to help achieve the nation’s emergency management goals. For example, in November 2006, the FEMA Administrator outlined his vision for a “New FEMA,” asserting FEMA’s dedication to partnering with all states and the private sector because of FEMA’s reliance on its partners to accomplish the national emergency response objectives. More recently, in congressional testimonies the FEMA Administrator has reaffirmed the need for FEMA to partner with both federal and non-federal stakeholders. In addition, one objective in FEMA’s Strategic Plan for 2008-2013 is to engage public and private stakeholders in developing and communicating clear national doctrine and policy. To achieve this objective, the Strategic Plan identifies the need to engage stakeholders early and often in the process of developing national doctrine. This is in accordance with internal control standards for the federal government that state that information should be communicated to those who need it and in a form and within a time frame that enables them to carry out their responsibility for an agency to achieve its objectives. For example, management should ensure there are adequate means of communicating with and obtaining information from external stakeholders who may have a significant impact on the agency’s achieving its goals. In October 2005, we also reported that frequent communication among collaborating organizations and stakeholders is a means to facilitate working across boundaries, prevent misunderstanding, and achieve agency objectives. Frequent communication is one of a number of practices that enhance and sustain collaboration. Recognizing the importance of collaboration, the Post-Katrina Act requires that the FEMA Administrator partner with non-federal stakeholders from state, local, and tribal governments, the private sector, and nongovernmental organizations to build a national system of emergency management that can effectively and efficiently utilize the full measure of the nation’s resources to respond to all disasters, including catastrophic incidents, and acts of terrorism. Specifically, the Post-Katrina Act directs the FEMA Administrator, through the National Integration Center, to periodically review and revise the National Response Plan and any successor to such plan and, as discussed above, to establish the NAC to incorporate non-federal stakeholder input in the revision and development of the Plan, among other things. The Post-Katrina Act further directs the FEMA Administrator to appoint council members who represent a geographic and substantive cross section of officials, emergency managers, and emergency response providers from the non-federal community. The FEMA Administrator’s statements, the agency’s latest strategic plan, and the Post-Katrina Act also reflect a key precept related to government performance and results—that stakeholders can have a significant effect in determining whether a federal agency’s program or action will succeed or fail, and as such, stakeholders need to be involved in major planning efforts conducted by the agency. Such involvement is important to help agencies ensure that their efforts and resources are targeted at the highest priorities and is particularly important in instances where federal agencies face a complex political environment, such as emergency management in which FEMA’s successes depend on the actions of non-federal partners at the state and local levels. While FEMA officials and the National Response Framework acknowledge that the NRF will need to be revised in the future, FEMA has not developed guidance or policies on how it will manage future revisions or described how the NAC will be incorporated into the next NRF revision process. FEMA officials said that the agency has not yet developed guidance and procedures for any future NRF revisions because of the need to focus federal resources on creating training materials to assist all stakeholders in implementing the current NRF in anticipation of the pending 2008 hurricane season. As mentioned earlier in this report, the 2004 Plan included a section specifying the circumstances, such as lessons learned from exercises and actual events, and time frames under which it would need to be reviewed and revised. This section is in accordance with the federal internal control standard of monitoring operations to assess the quality of performance over time and ensure that the findings of reviews and evaluations are resolved. The 2008 NRF, while it states that it merits periodic review and revision, does not contain such language regarding the circumstances and time frames for its review and revision. In addition, FEMA officials said that the process established for the last revision (the 2006-approved work plan) would not be applicable for any future revisions because it did not consider the role of the NAC. The NAC has also not yet determined how it would like to be involved in the next NRF revision process. The NAC’s charter, approved in February 2007, does not provide specific procedures on how it is to be involved and, according to the chairman, the NAC’s NRF subcommittee expects to focus its efforts on helping FEMA train non-federal stakeholders. Having such guidance and procedures in place is an important internal control, and we have identified this need for other agencies in similar circumstances to FEMA’s management of future NRF revisions. As we discussed earlier in this report, control activities—such as guidance, policies, and procedures—are an integral part of an agency’s planning for and achieving effective results. In addition, while internal controls should be flexible to meet an agency’s needs, they should also be clearly documented, readily available, and properly maintained. We have also previously reported on the need to include state and local jurisdictions in the development of national response plans because they are key stakeholders and would be on the front lines if an incident occurs. In April 2008, we reported on the need for the Department of Defense’s Northern Command to collaborate and communicate with non-federal stakeholders and establish a process to guide such collaboration in accessing information on state emergency response plans and capabilities, noting that the absence of effective collaboration could impede intergovernmental planning for catastrophic incidents and overall coordination. Specifically, we reported that federal officials involved the states only minimally in the development of the Department of Defense’s major homeland defense and civil support plans and that defense officials were generally not familiar with state emergency response plans and capabilities and had not established a process for gaining access to this information. We also reported that each agency’s roles and responsibilities for planning for homeland defense and civil support during a catastrophic disaster were not clearly defined. We recommended, among other things, that the Department of Defense develop a thorough process to guide its coordination with the states. The department generally agreed with the recommendation and stated that it was coordinating with DHS to develop synchronized plans of integrated federal, state, and local operational capabilities to affect a coordinated national response. It is essential for both the Department of Defense and DHS to have such guidance in place, as both DHS’s National Response Framework and the Northern Command’s Concept of Operations emphasize coordination with non- federal stakeholders in order to prevent, prepare for, respond to, and recover from catastrophic natural and manmade disasters. In August 2007, we reported on the administration’s approach to preparing for a pandemic influenza by issuing, among other things, a National Strategy for Pandemic Influenza (Strategy) in November 2005, and a National Strategy for Pandemic Influenza Implementation Plan (Plan) in May 2006. We reported, among other things, that state and local jurisdictions were not directly involved in developing the Strategy and Plan. Neither the Strategy nor Plan described the involvement of key stakeholders, such as state, local, and tribal entities, in their development, even though these stakeholders would be on the front lines in a pandemic and the Plan identifies actions they should complete. Officials told us that while the drafters of the Plan were generally aware of their concerns, state, local, and tribal entities were not directly involved in reviewing and commenting on the Plan. We concluded that opportunities existed to improve the usefulness of the Plan because it was viewed as an evolving document and was intended to be updated on a regular basis to reflect ongoing policy decisions as well as improvements in domestic preparedness. However, time frames or mechanisms for updating the Plan were undefined. We recommended that the White House Homeland Security Council establish a specific process and time frame for updating the Plan and that the update process should involve key non-federal stakeholders and incorporate lessons learned from exercises and other sources, but the Homeland Security Council did not provide comments on this recommendation. Without similar policies and procedures documenting the circumstances and time frames under which it would review and revise the NRF and its process for collaborating with non-federal stakeholders, FEMA cannot ensure that future revision processes will be conducted in accordance with management’s directives. All disasters occur locally, and the initial post-disaster response is local. However, large-scale disasters usually exceed local response capabilities. Effective preparation and response for major and catastrophic disasters require well-planned and well-coordinated actions among all those who would have a role in the response to such disasters. The 2008 NRF is a guide for the myriad of entities and personnel involved in response efforts at all levels. The NRF recognizes the need for collaboration among these stakeholders to collectively respond to and recover from all disasters, particularly catastrophic disasters such as Hurricane Katrina, regardless of their cause. To help ensure that the NRF meets the needs of all stakeholders who have a role in its effective implementation, it is essential that DHS fully collaborate with non-federal stakeholders in its development and revision. DHS initially involved non-federal stakeholders in the revision of the 2004 Plan but omitted a key step in its work plan by not obtaining and incorporating their comments on the first full draft. Instead, DHS undertook a closed, internal federal review of the draft that lasted about 5 months with little communication with the non-federal partners. The result was a breach of trust with DHS’s non-federal partners in the drafting process. The Post-Katrina Act gives responsibility for maintaining and updating the NRF to FEMA and charges the Administrator’s National Advisory Council with incorporating non-federal stakeholder input into the NRF’s development and revision. Established too late to fulfill this role in the creation of the current NRF, the NAC is now functioning, and it is important that there be compatible policies and procedures for how the NAC will fulfill its statutory charge. Contrary to effective government internal control and management principles, FEMA has not yet developed policies and procedures for guiding future revisions of the NRF, including specifying the conditions and time frames under which FEMA would review and revise the NRF and how FEMA will involve the NAC and collaborate with other non-federal stakeholders. Especially in view of a new administration, non-federal stakeholder participation and ownership is essential in any revision of the NRF, and the lessons learned from the process for revising the 2004 Plan will apply in the future to FEMA’s and DHS’s efforts to develop and revise other national plans and policies that make up the national preparedness system. While the NRF is published by DHS, it belongs to the nation’s emergency response community that is collectively responsible for effectively implementing the NRF’s provisions should another catastrophic disaster like Hurricane Katrina occur. We recommend that the FEMA Administrator develop and disseminate policies and procedures that describe (1) the circumstances and time frames under which the next NRF revision will occur and (2) how FEMA will conduct the next NRF revision, including how its National Advisory Council and other non-federal stakeholders—state, local, and tribal governments; the private sector; and nongovernmental organizations—will be integrated into the revision process and the methods for communicating with these stakeholders. We requested comments on a draft of this report from DHS and FEMA. They concurred with our recommendations and had no other comments. We are sending copies of this report to the Secretary of Homeland Security, FEMA Administrator, and interested congressional committees. We will also provide copies to others on request. If you or your staff have any questions about this report or wish to discuss the matter further, please contact me at (202) 512-8777 or jenkinswo@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. See appendix IV for a list of key contributors to this report. This report addresses the following questions: (1) To what extent did the Department of Homeland Security (DHS) collaborate with non-federal stakeholders in revising and updating the December 2004 National Response Plan into the January 2008 National Response Framework (NRF)? (2) To what extent has FEMA developed policies and procedures for managing future revisions of the NRF? To address these questions, we interviewed DHS, FEMA, and non-federal stakeholders who were directly involved in the revision and update of the 2004 Plan into the 2008 NRF, and we reviewed DHS and FEMA documents on the revision process. Because there were over 700 federal and non- federal officials who participated in the Steering Committee and Work Groups, we interviewed those who held key positions. The FEMA officials and non-federal stakeholders we interviewed held key positions in the revision process, such as the FEMA Administrator and Deputy Administrator and the two FEMA co-chairs of the Steering Committee. The non-federal stakeholders we interviewed included four of the five non- federal officials who served as Steering Committee members and all three of the non-federal officials who served as co-leaders of Work Groups; these non-federal stakeholders also held positions in state, county, and city governments and non-governmental organizations. To determine the extent to which DHS collaborated with non-federal stakeholders, we first determined the revision process that DHS had planned to follow to revise the 2004 Plan. We reviewed DHS’s September 2006 revision work plan that had been approved by the Domestic Readiness Group of White House’s Homeland Security Council and interviewed FEMA and non-federal officials who served in key positions in the revision process. We also reviewed applicable statutes, primarily the October 2006 Post-Katrina Emergency Management Reform Act, for statutory requirements related to the revision process. To determine what happened during the revision process and the extent to which DHS involved non-federal stakeholders in that process, we interviewed FEMA officials and non-federal stakeholders who served in key positions in the revision process and the chairman of FEMA’s National Advisory Council (NAC). Further, we reviewed DHS documentation citing the roles provided to non-federal stakeholders in the revision process and explaining how the actual revision process was conducted, FEMA documentation on the process and time frames related to the NAC’s establishment, NAC documentation regarding its role in the revision process, and congressional testimony from non-federal stakeholders on how DHS conducted and included them in the revision process. To determine the extent to which FEMA had policies and procedures in place for future revisions of the NRF, we interviewed FEMA officials. The non-federal officials we interviewed represented state and local levels of government, emergency management associations, and other non- federal entities. While the statements and views of the stakeholders we interviewed are not generalizable to the some 230 non-federal stakeholders involved in the revision process, we chose to speak to them because of their assigned key roles. There is some uncertainty in our determination of the total number of non- federal members in the 12 Work Groups, and thus the total number of Work Group members, due to duplication or the lack of adequate information identifying a member as federal in the data provided by FEMA. However, because DHS’s inclusion of non-federal members in the revision process is the focus of this report, we took steps to correctly determine the number and composition of the 224 non-federal members. Based on our analysis of FEMA’s data for federal members, we believe the total of 486 federal members is a reasonable approximation, and therefore, the grand total of 710 Work Group members is also a reasonable approximation. In the 2004 National Response Plan revision work plan approved by the Domestic Readiness Group, a White House Homeland Security Council– chaired policy committee, in September 2006, DHS identified 14 key issues that it wanted the revision process to address. According to FEMA officials, these issues were compiled by reviewing Hurricane Katrina after- action and lessons-learned reports from the White House, Congress, GAO, and DHS’s Inspector General and identifying common issues that were raised in multiple reports. The work plan directed DHS to conduct meetings with stakeholders to review the initial list and identify other issues to be considered during the revision process. These issues were to serve as the starting point from which the 2004 Plan revision would be conducted. DHS held meetings with non-federal stakeholder and federal stakeholders in October and November 2006 respectively. After these meetings, DHS identified three additional revision issues to its initial list contained in the approved work plan. The 17 key revision issues are listed below—the 3 issues added after the stakeholder meetings are indicated with a note. The revision issues are categorized by whether they were to be addressed in either the 2004 Plan base document or its annexes. The 2004 Plan comprised four major components: the Base Plan, Emergency Support Function Annexes, Support Annexes, and Incident Annexes. The Base Plan provided an overview of the structure and processes comprising a national approach to domestic response actions. The 15 Emergency Support Function Annexes detailed the missions, policies, structures, and responsibilities of federal agencies for coordinating resource and programmatic support, such as mass care and shelter, to states, tribes, and other federal agencies or other jurisdictions and entities. The nine Support Annexes provided guidance and described the functional processes and administrative requirements necessary to ensure the 2004 Plan’s efficient and effective implementation. The seven Incident Annexes addressed contingency or hazard situations requiring specialized application of the 2004 Plan, such as biological, catastrophic, and nuclear/radiological incidents. The key revision issues identified for the 2004 National Response Plan base document were clarify roles and responsibilities of key structures, and positions, and strengthen role of states and private sector; integrate National Incident Management System concepts, principles, terminology, systems, and organizational processes into the revised National Response Plan; review Joint Field Office structure and operations, to include Unified Command; and incorporate proactive planning for incidents that render state and local governments incapable of an effective response. The key revision issues identified for the annexes to the 2004 National Response Plan base document were examine all existing National Response Plan annexes and proposed new strengthen External Affairs and Public Affairs Annexes; review logistics management issues, examine evacuation and sheltering issues, ensure the integration of all search and rescue assets, review the scope of public safety and security missions, incorporate companion animal issues, improve process for identifying and accepting donated goods and the integration of volunteers, clarify international support mechanisms, ensure consistency with National Emergency Communication Strategy, refine the Catastrophic Incident Supplement to include the review of a possible increased Department of Defense responsibility, and review federal incident management plans and determine their appropriate linkage to the National Response Plan. The 2004 National Response Plan revision work plan approved by the Domestic Readiness Group in September 2006 directed DHS to establish Work Groups to rewrite portions of the 2004 Plan. While the work plan did not specify the number of Work Groups that should be established, DHS formed 12 Work Groups that were co-led by federal officials or a combination of federal and non-federal officials. The 12 Work Groups were Catastrophic Planning, Communications, Companion Animals, Evacuations and Sheltering (co-led by non-federal stakeholder), Functions, Incident Management and Coordination, International Support, National Incident Management System, Roles and Responsibilities (co-led by non-federal stakeholder), Special Needs, Training and Implementation, and Volunteer and Donation Management (co-led by non-federal stakeholder). Of the 709 members who served on the 12 Work Groups, 224 officials, or 32 percent, were non-federal. These non-federal stakeholders included representatives from state, tribal, and local government as well as the private sector and nongovernmental organizations. Further, the non- federal stakeholders came from various occupational sectors. See table 1 for a description of these 224 non-federal stakeholders. The following teams and individuals made key contributions to this report: Pille Anvelt, Patrick Bernard, Sam Hinojosa, Christopher Keisling, David Lysy, Sally Williamson, and Candice Wright, Homeland Security & Justice Team; Michele Fejfar, Applied Research & Methods; and Christine Davis, Jan Montgomery, and Janet Temko, General Counsel.

Summary: Hurricane Katrina illustrated that effective preparation and response to a catastrophe requires a joint effort between federal, state, and local government. The Department of Homeland Security (DHS), through the Federal Emergency Management Agency (FEMA), is responsible for heading the joint effort. In January 2008, DHS released the National Response Framework (NRF), a revision of the 2004 National Response Plan (2004 Plan), the national preparation plan for all hazards. In response to the explanatory statement to the Consolidated Appropriations Act of 2008 and as discussed with congressional committees, this report evaluates the extent to which (1) DHS collaborated with non-federal stakeholders in revising and updating the 2004 Plan into the 2008 NRF and (2) FEMA has developed policies and procedures for managing future NRF revisions. To accomplish these objectives, GAO reviewed DHS and FEMA documents related to the revision process, analyzed the relevant statutes, and interviewed federal and non-federal officials who held key positions in the revision process. While DHS included non-federal stakeholders--state, local, and tribal governments, nongovernmental organizations, and the private sector--in the initial and final stages of revising the 2004 Plan into the NRF, it did not collaborate with these stakeholders as fully as it originally planned or as required by the October 2006 Post-Katrina Emergency Management Reform Act (Post-Katrina Act). As the revision process began in 2006, DHS involved both federal and non-federal stakeholders by soliciting and incorporating their input in determining the key revision issues and developing the first draft in April 2007. However, after this first draft was completed, DHS deviated from its revision work plan by conducting a closed, internal federal review of the draft rather than releasing it for stakeholder comment because the draft required further modifications DHS considered necessary. DHS limited communication with non-federal stakeholders until it released a draft for public comment 5 months later on September 10, 2007. The following day, non-federal stakeholders testified at a congressional hearing that DHS had shut them out during that 5-month period. In addition, the Post-Katrina Act required that DHS establish a National Advisory Council (NAC) for the FEMA Administrator by December 2006 to, among other things, incorporate nonfederal stakeholders' input in the revision process. However, FEMA stated the necessary time to select quality NAC members required additional time, and FEMA did not announce the NAC's membership until June 2007. The NAC did not provide comments on a revision draft until one month before DHS publicly released the final NRF in January 2008. FEMA anticipates that the NRF will be revised in the future; however, FEMA does not have policies or procedures in place to guide this process or ensure a collaborative partnership with stakeholders. FEMA has emphasized the importance of partnering with relevant stakeholders to effectively prepare for and respond to major and catastrophic disasters, and the Congress, through the Post-Katrina Act, requires such partnership. In addition, the Standards for Internal Controls in the Federal Government calls for policies and procedures that establish regular communication with stakeholders and monitor performance over time as essential for achieving desired program goals. Furthermore, previous GAO work on the Department of Defense's civil support plans and the administration's national pandemic influenza implementation plan has shown the need for participation of state and local jurisdictions in emergency planning. Especially in view of a new administration, the experience of the previous revision process illustrates the importance of collaborating with stakeholders in revising a plan that relies on them for its successful implementation. While the NRF is published by DHS, it belongs to the nation's emergency response community. Developing such policies and procedures is essential for ensuring that FEMA attains the Post- Katrina Act's goal of partnering with non-federal stakeholders in building the nation's emergency management system, including the periodic review and revision of the NRF.