The Homeland Security Act established the Office of National Capital Region Coordination within the Department of Homeland Security. The ONCRC is responsible for overseeing and coordinating federal programs for and relationships with state, local, and regional authorities in the NCR and for assessing and advocating for the resources needed by state, local, and regional authorities in the NCR to implement efforts to secure the homeland. One of the ONCRC mandates is to coordinate with federal, state, local, and regional agencies and the private sector in NCR on terrorism preparedness to ensure adequate planning, information sharing, training, and execution of domestic preparedness activities among these agencies and entities. In our earlier work, we reported that the ONCRC and the NCR faced interrelated challenges in managing federal funds in a way that maximizes the increase in first responder capacities and preparedness while minimizing inefficiency and unnecessary duplication of expenditures. One of these challenges included a coordinated regionwide plan for establishing first responder performance goals, needs, and priorities, and assessing the benefits of expenditures in enhancing first responder capabilities. All states and urban areas are to align existing preparedness strategies within the National Preparedness Goal’s eight national priorities. An overarching national priority for the National Preparedness Goal is the embracing of regional approaches to building, sustaining, and sharing capabilities at all levels of government. DHS required states and urban areas, including the NCR, to assess their preparedness needs by reviewing their existing programs and capabilities and using those findings to develop a plan and formal investment justification outlining major statewide, sub-state, or interstate initiatives for which they will seek federal funding under the Homeland Security Grant Program. The target capabilities are intended to serve as a benchmark against which states, regions, and localities can measure their own capabilities. According to DHS, the funding initiatives are to focus efforts on how to build and sustain programs and capabilities within and across state boundaries while aligning with the National Preparedness Goal and national priorities. In fiscal year 2006 DHS funding guidance, regional collaboration included specific implementation benchmarks. These benchmarks included (1) formalizing mutual aid agreements with surrounding communities and states to share equipment, personnel, and facilities during emergencies; (2) conducting exercises of the execution of mutual aid agreements to identify the challenges and familiarize officials with resources that are available in the region; and (3) coordinating homeland security preparedness assistance expenditures and planning efforts on a regional basis to avoid duplicative or inconsistent investments. In earlier work on effective regional coordination for emergency preparedness, we defined regional coordination as the use of governmental resources in a complementary way toward goals and objectives that are mutually agreed upon by various stakeholders in a region. In later work for this Committee on federal agency collaboration, we defined collaboration in a similar manner, defining it as any joint activity by two or more organizations intended to produce more public value than could be produced when the organizations act alone. Successful coordination or collaboration occurs not only vertically among federal, state, and local governments, but also across jurisdictions within regions. In the coordination or collaborative effort, strategic plans can be effective tools to focus resources and efforts to address problems through features such as goals and objectives that are measurable and quantifiable. By specifying goals and objectives, plans can also give planners and decision makers a structure for allocating funding to those goals and objectives. A well-defined, comprehensive homeland security strategic plan for the NCR is essential for assuring that the region is prepared for the risks it faces. In advance of our March 2006 testimony, Office of the National Capital Region Coordination officials provided us with several documents that they said when taken as a whole constituted the basic elements of NCR’s strategic plan, such as a November 2005 document containing information on NCR strategic goals, objectives, and initiatives and February and March 2006 documents related to homeland security grant program funding. In our testimony, we outlined desirable characteristics for a strategic plan based on past work. The desirable characteristics, adjusted for a regional strategy, are Purpose, scope, and methodology that address why the strategy was produced, the scope of its coverage, and the process by which it was developed. Problem definition and risk assessment that address the particular regional problems and threats the strategy is directed towards. Goals, subordinate objectives, activities, and performance measures that address what the strategy is trying to achieve, steps to achieve those results, as well as the priorities, milestones, and performance measures to gauge results. Resources, investments, and risk management that address what the strategy will cost, the sources and types of resources and investments needed, and where resources and investments should be targeted by balancing risk reductions and costs. Organizational roles, responsibilities, and coordination that address who will be implementing the strategy, what their roles will be compared to those of others, and mechanisms for them to coordinate their efforts. Integration and implementation that address how a regional strategy relates to other strategies’ goals, objectives and activities, and to state and local governments within their region and their plans to implement the strategy. The plan’s structure contains the six characteristics and related elements that we identified in earlier work as desirable in a national strategy that would also be useful for a regional approach to homeland security strategic planning. Instead of the multiple documents provided in advance of our March 2006 testimony, the plan is now one document with three parts—an overview, a core plan, and appendices with more detailed information. The core plan includes information on purpose, scope, and methodology; goals and objectives; problem definition and risk assessment; implementation and sustainment of the strategic plan, including organizational roles, responsibilities, and coordination; and alignment with other strategies and planning efforts. The appendix document provides extensive information on initiatives, including priorities, rationale, key tasks and programs, estimates of costs and cost assumptions, types of resources and investments, time frame, the lead organization responsible for each initiative, and performance assessment information, including measures, baselines, and targets. The plan will be reviewed and updated on a 3-year cycle. However, the substance of the information within several of the six characteristics could be further strengthened as the plan is reviewed and revised to enable the NCR jurisdictions set clear priorities and sustain their collaborative efforts. As I will point out, several of our observations regarding improvements are the same as those we provided in our March 2006 testimony. The first desirable characteristic is purpose, scope, and methodology— addressing why the strategy was produced, the scope of its coverage, and the process by which it was developed. Elements of this characteristic include, for example, what major functions, mission areas, or activities it covers; principles or theories that guided its development; and the process to produce the strategy. The plan includes a section on purpose, scope, and methodology. For example, according to the strategic plan document, the plan is intended to provide a framework and guidance for programming, budgeting, and execution of homeland security programs in the NCR over the next 3 years and serve as the basis for planning for the next 5 years. Scope information discusses regionwide mission areas and initiatives and notes that the strategic plan is not an operational plan and is not a replacement for local and state emergency operations plan. Its purpose is not to be an investment plan and, therefore, does not allocate funding to any initiatives or change the funding, budgeting, and resource allocation processes for individual funding sources. The plan describes its development by the NCR Partners—a group consisting of the NCR’s local, state, regional, and federal entities; citizen community groups; private-sector organizations; non-profit organizations; and non-governmental organizations. The plan describes the consensus- based process guided by the NCR’s Homeland Security Senior Policy Group (SPG). The second desirable characteristic is problem definition and risk assessment—addressing the particular regional problems and threats the strategy is directed toward. Elements of this characteristic include, for example, a discussion or definition of problems, their causes, and operating environment, and risk assessment, including an analysis of threats and vulnerabilities. The plan describes the approach used to identify threats, vulnerabilities, and consequences of the risks facing the region. The plan focuses attention and resources on initiatives that address the highest risks for the region. The document states that numerous gap and shortfall analyses, conducted by the NCR’s homeland security senior leaders and independent analysts, helped define the plan’s four goals. Further, it is stated that each state jurisdiction also completed an extensive hazard analysis. Although the plan states that a combined risk- and capabilities-based approach was used, it also recognizes the need for a more formal, in-depth risk assessment based on a common framework and includes a major priority initiative to meet this need. The plan states that over the past few years, several vulnerability assessments have been completed for the NCR and its member institutions, but our assessment of the plan indicates that information from past assessments may not have been fully utilized. According to the plan, one initiative calls for the development of a NCR risk assessment methodology and a regionwide threat analysis, leveraging assessments and analyses to date conducted by the states, local jurisdictions, and federal partners. Another initiative is to create a high priority list of recommended critical infrastructure protective actions based on security assessment findings already completed and shared with the NCR. It is unfortunate that the strategic plan’s goals do not yet reflect the completion and maintenance of a comprehensive, integrated risk assessment for the region. We noted in our March 2006 testimony that in the aftermath of the September 11, 2001, terrorist attacks and the creation of the ONCRC in 2003, we would have expected that the vast majority of risk assessment work should have been completed. An ongoing risk assessment methodology should be in place to identify emerging risks. Until the new risk assessment is completed, the plan states the NCR is utilizing a compilation of regional gaps in capabilities, some the same as those identified in the EMAP assessment, considered alongside threat and impact factors, in developing strategic plan goals, objectives and prioritization of initiatives. These regional capability gaps included (1) standardized alert notification procedures; (2) regional mitigation plan; (3) regionwide strategic communications plan; (4) public information dissemination during all phases of emergencies; (5) inclusion of the private sector information in planning; (6) public–private coordination; (7) analysis of threats, vulnerabilities and consequences; (8) resource management and prioritization; (9) understanding of long-term recovery issues; (10) special needs considerations for response and recovery; (11) mass care; and (12) infrastructure. The document states that the plan addresses the EMAP assessment recommendations and 54 of the 58 EMAP national standards. In addition, the National Preparedness Goal’s 37 capabilities that federal, state, local, and tribal entities must achieve to perform critical tasks for homeland security missions served as a target in developing the plan’s initiatives. In the plan, each regional initiative rationale identifies whether it addresses a national capability from the national target capabilities list, an EMAP standard, and/or an identified regional gap. Further, the plan states that it addresses all of the Nationwide Plan Review’s overall emergency and catastrophic planning conclusions for all states and urban areas. in the nation. Other sources of information for the strategic planning included the National Capital Region Program and Capability Enhancement Plan, the Nationwide Plan Review, and the National Preparedness Goal and related target capabilities. We are encouraged that the NCR plan emphasizes enhancing capabilities consistent with currently known regional capability shortfalls and others based on a variety of information sources. It is clear that a great deal of work has gone into identifying needed capabilities as part of the planning approach. In revising the plan, NCR officials might consider two observations. First, although the plan recognized the importance of the Nationwide Plan Review’s specific phase 2 findings for the NCR emergency plans and the status of catastrophic and evacuation planning, it did not reflect specific NCR findings. As you know, the review was conducted in response to the shortfalls in preparedness identified during Hurricane Katrina. A brief scorecard presenting Review NCR findings provided to us said that, overall, the DHS review found the NCR plan’s adequacy, feasibility, and acceptability not sufficient to meet the requirements of a catastrophic incident. While the assessment found the NCR’s resource management annex and communications annex sufficient to meet the requirements of a catastrophic incident, others were only partially sufficient or not sufficient, including the basic plan, direction and control annex, warning annex, emergency public information annex, evacuation annex, mass care annex, and the health and medical annex. According to NCR officials, the assessment tools of the Review and the EMAP assessment were flawed because they focus on a single jurisdiction, not a multi-jurisdictional approach. In addition, the assessments assume that the entity under review is an operational jurisdiction which the NCR is not. NCR officials told us they found the reviews of limited usefulness because of this flaw. The officials said NCR states have individual state plan reviews that are more valid. However, they said the NCR addressed findings they thought were appropriate and useful and did focus on the national findings, which are included in the NCR strategic plan. If the plan was to include all sources of capability gaps, to guide problem definition and risk assessment, NCR officials should consider if it would be useful to describe the specific Review’s findings for the NCR that the officials did accept, and align plan objectives and specific initiatives to those accepted findings. Also, instead of referencing preparedness capabilities from different sources, it might be more useful for the plan to have one set of capabilities for action. This would integrate all sources of necessary capabilities (and their varying definitions) into a common set on which the region agrees, whether the source of the needed capability is national goal directives, assessment standards, or individual regional gap analysis. This integration might also include remarks on the progress in developing a capability. While all of the capabilities may be important, it is unclear from the plan those capabilities are fully or partially developed and those that remain to be developed. Milestones and the priority designations at the initiative level provide an indication of progress, but it is difficult for the reader to understand what is the complete picture of the status of individual capability implementation. The third desirable characteristic is goals, subordinate objectives, activities, and performance measures—addressing what the strategy is trying to achieve, steps to achieve those results, as well as the priorities, milestones, and performance measures to gauge results. Elements of this characteristic include, for example, a hierarchy of strategic goals and subordinate objectives and priorities, milestones, and outcome-related performance measures. The NCR homeland security strategic plan includes the region’s four long- term homeland security strategic goals and related objectives for the next 3 to 5 years. Specific initiatives are described for each objective, with cost estimates and performance measures for fiscal years 2007 through 2009. The NCR’s strategic plan vision, mission, goals, and objectives are shown in table 1. According to the document, each goal has equal standing. The four NCR strategic goals are defined as broadly stated long-term outcomes that, if reached, collectively enable the NCR jurisdictions to realize the NCR’s vision. The objectives in the strategic plan are defined as key, measurable milestones along the path toward reaching each goal. Similar to performance goals under the Government Performance and Results Act, the objectives should be based on the strategic goals and help to determine the achievement of strategic goals. For future plan assessments, NCR officials might consider developing strategic performance expectations where substantive action is needed and describe the full set of objectives needed to achieve planned goals. The plan describes an evolution of the strategic plan beginning with consensus building for close to a year (August 2004 to June 2005), initiative development for several months (June 2005 to November 2005), and program management and implementation for another 7 months (January 2006 to July 2006). However, Goal 1—covering planning and decisionmaking—has objectives to strengthen regional planning and decisionmaking, establish a process to identify and close preparedness gaps, and enhance oversight and accountability. It is unclear why these efforts over this amount of time have not produced well-established planning and decision-making processes and responsibilities. NCR officials should assess if future plans might focus on the remaining three goals that emphasize preparedness, prevention, protection, response, and recovery. Further, the plan states that the 12 objectives presented in the plan are essential, but not necessarily sufficient to attain these goals. This raises the question of what is missing and what is the potential impact of the missing elements on achieving the plan’s goals. The plan states that additional objectives will emerge to take the place of those already accomplished, but provides no further details of what might be sufficient now to meet the plan’s goal. While any strategic plan is considered a “living” document, at the point of its initial issuance or revision, it should strive to be as complete as possible, particularly when the objectives are considered milestones toward the accomplishment of each goal. In addition to the plan’s goals and objectives, initiatives to achieve the objectives complete the core of the NCR strategic plan. The plan identifies 30 initiatives, with 14 prioritized based on their alignment with and support of national priorities, DHS target capabilities, and regional gaps. The 14 priority initiatives, according to the plan, are to be considered first in line for implementation and funding, with the other initiatives considered secondary in terms of execution. In our March 2006 testimony, we noted that any future NCR strategic plan should include a review of initiatives to determine if the initiatives will fully meet the results expected of the objectives. The initiatives appear overall to reflect the objectives’ general intent. However, NCR officials might consider clarifying the plan’s distinction between priority and non-priority initiatives in achieving the objectives. For example, goal 1 has four of its six initiatives labeled as priorities. These include initiatives such as developing and periodically updating the strategic plan and related processes and establishing regional oversight and accountability. The initiative under this goal to develop an investment life-cycle planning approach to ensure infrastructure and resources are available to support multi-year operational capabilities was seen as a secondary initiative. The plan does not present a rationale for making this a secondary initiative when it can be argued that a functioning life-cycle investment process is essential to identifying and managing the resources needed to sustain key preparedness and response capabilities, once established. The NCR strategic plan contains a measure for each goal, measure(s) for each objective, and an initiative performance assessment consisting of a measure (performance indicator), current baseline performance, and performance targets. For example, the measure for goal 1 (planning and decisionmaking) is support for NCR plans and decisions among NCR partners and stakeholders, measured by a survey. The first objective’s (strengthen the regional approach to planning and decision making) measures include (1) stakeholder satisfaction with the strategic plan as determined by survey and (2) NCR Partners’ satisfaction with program plans as determined by survey. One initiative’s (developing and updating the plan and related processes) measure under this objective is the time to develop and adopt a strategic plan with the baseline performance of 2 years and a target to be adopted by September 2006. The NCR plan defines objectives as being key, measurable milestones along the path toward reaching each goal. Many objectives include language such as “strengthen,” “enhance,” “increase,” “improve,” and “expand.” These objective statements have their own measures to define performance. For example, one current objective is “strengthen the exchange and analysis of information across disciplines for improved situational awareness.” Its measure is “participants’ after-the-fact informed ratings of their situational awareness during test and real events.” In our March testimony, we only addressed measurement at the initiative level. With three levels of measurement—goal, objective, and initiative, the NCR might further refine the measures for full measurement coverage and yet not duplicate measurement. For example, the goal 1 measure is virtually the same as the measures for objective 1.1 under the goal. The other two objectives’ measures address implementation of countermeasures and satisfied performance commitments, which do not appear to be measured by the goal measure. Further, measurement at the initiative level is very important as these serve as the means to achieve the objectives and, in turn, the strategic goals. In our March testimony, we stated that a NCR strategic plan could more fully measure initiative expectations by improving performance measures and targets. The performance measures should readily lend themselves to actual quantitative or qualitative measurement through a tabulation, a calculation, a recording of activity or effort, or an assessment of results that is compared to an intended purpose. In our work on results management practices, we have found that leading organizations said they used a diversity of performance comparisons, depending on the goal, to set performance targets. The comparisons included (1) predefined performance specifications, (2) future performance levels or changes in levels to be achieved at a later date, (3) best practice benchmarks from other organizations, and (4) program implementation milestones. Our earlier testimony also stated that a strategic plan could be improved by (1) expanding the use of outcome measures and targets in the plan to reflect the results of its activities and (2) limiting the use of other types of measures. The NCR strategic plan uses a variety of measures and comparisons at the initiative level, and I see this as a valuable approach for future strategic plans. The current strategic plan also has emphasized outcome measures. The NCR might consider reviewing the many output measures that remain, such as “regional emergency messaging tests per year,” “number of registered volunteers,” and “average hours of training per volunteer” to see if they might become more outcome-oriented. While the new NCR strategic plan has markedly improved its initiative measures over those presented in documents in advance of the final plan, further attention may be warranted. For example, a few measures are not clearly defined or will be difficult to measure, such as “improvement in performance- and risk-based assessment results,” “utilization rates for collaboration and information-sharing systems,” and “proportion of desired information exchanges occurring.” In addition, some measures do not assess the initiative. For example, one initiative is to “design and conduct a risk-based threat analysis to identify gaps in regional preparedness.” The measure is “ rating on the usefulness of threat analysis in decision-making.” This measure is essentially a general satisfaction survey. Two measures for the initiative for establishing a regional oversight and accountability function with appropriate tools and resources for performance accountability are “utilization rates for collaboration and information-sharing systems” and “Partners’ awareness of NCR activity status.” Neither of these two measures directly assess establishing an oversight and accountability system. In March, we said that a future NCR strategic plan could also be strengthened by including more complete time frames for initiative accomplishment, including specific milestones and having time frames matching the initiative. The new strategic plan has identified milestones for all key tasks and programs under each initiative, as well as overall timeframe within the strategic planning cycle. The specification of the milestone information helps the reader to better understand the sequencing of actions. However, NCR officials may want to review the distribution of the milestones. The strategic plan’s implementation time frame is for the period fiscal year 2007-fiscal year 2009. However, the strategic plan’s initiatives are heavily weighted for completion by the end of fiscal year 2007. Based on the milestone dates provided in the plan, 18 of the 30 initiatives are planned to be complete by that time and another 9 by the end of fiscal year 2008. A few initiatives appear to be close to completion based on completed milestones or those that will soon be completed. Their inclusion may reflect a desire to record accomplishments to date. For example, initiative milestones for objective 1 under goal 1 (planning and decisionmaking) reflect actions to be taken before September 2006 when the new plan was approved. The fourth desirable characteristic is resources, investments, and risk management—addressing what the strategy will cost, the sources and types of resources and investments needed, and where resources and investments should be targeted by balancing risk reductions and costs. Examples of elements for this characteristic include resources and investments associated with the strategy, sources of resources, and risk management principles. In March, we testified that a future NCR strategic plan could provide fuller information on the resources and investments associated with each initiative. More specific cost information by initiative, such as funded and unfunded grant information, would facilitate decision making in comparing trade-offs as options are considered. As mentioned earlier, the NCR strategic plan includes costs for each initiative. Cost estimates are stated in a rough order of magnitude, providing an estimate of the scale range of cost to inform the launch of individual initiative operational planning. The costs of the initiatives range from over $100 million to nearly $150 million, with some initiative cost data still in development. Data are also provided on resource investment and projects for each initiative. The plan states that funding source identification, investment justification, and allocation decisions will be made as a part of the implementation planning process. Funding source analysis and allocation is not part of the NCR strategic planning effort. Building and sustaining the needed capabilities in the NCR will require the effective use of federal, state, and local funds. Identifying resource and investment information, including types and sources of resources—at least at a high level—would better define how initiatives will be funded and when. In the absence of such information, it is difficult to judge if the 30 initiatives, including those considered priorities, are likely to be implemented within the planned time frames. This is particularly important as the plan notes that due to recent action by the administration in allocating Urban Area Strategic Initiative fiscal year 2006 funds for the NCR ($46.5 million, rather than the requested $188 million), when and to what extent the NCR can implement the initiatives remains uncertain. The UASI funding decision was made several months prior to the approval of the strategic plan. Therefore, the plan should recognize that if the plan’s initiatives are to be implemented on schedule, especially those with milestones in the coming year, NCR jurisdictions will need to contribute more than originally anticipated toward their completion. The fifth desirable characteristic is organizational roles, responsibilities, and coordination—addressing who will be implementing the strategy, what their roles will be compared to others, and mechanisms for them to coordinate their efforts. Examples of elements for this characteristic include lead, support, and partner roles and responsibilities; an accountability and oversight framework; and specific processes for coordination and collaboration. Our March testimony noted that any future NCR strategic plan could expand on organizational roles, responsibilities, coordination, and integration and implementation plans. Organizational roles, responsibilities, and coordination for each initiative would clarify accountability and leadership for completion of the initiative. I also said the plan might include information on how the plan will be integrated with the strategic plans of NCR jurisdictions and that of the ONCRC and plans to implement the regional strategy. The new plan’s description of organizational roles, responsibilities, and coordination provides detailed information concerning NCR governance. The plan states that at the strategic level, NCR Partners review assessments of regional capabilities and develop a long-term homeland security strategy for enhancing prioritized capabilities. Additional overarching guidance, such as budget and policy documents, is also issued at this level to facilitate activities at the levels below. Regional priorities are formulated at the strategic level through an iterative process of consensus-building among representatives from the key stakeholders of the NCR, represented by three key governance groups: the Senior Policy Group (SPG), representing state-level interests; the Chief Administrative Officers Committee (CAO), representing local government level interests; and the Regional Emergency Preparedness Council (EPC), representing broader NCR stakeholder interests. The plan states SPG membership consists of senior officials from Maryland, Virginia, the District of Columbia, and DHS and the Director for the ONCRC. The group exercises oversight of the implementation and funding process and determines priority actions for both increasing regional preparedness and response capabilities and reducing vulnerability to terrorist attacks. According to the plan, the SPG ensures full integration of NCR activities by providing final approval for programs within the NCR as well all projects within a program. The SPG oversees directors of the regional working groups in guiding the execution of their work on approved homeland security initiatives, programs, and projects. The SPG, it is said, is ultimately accountable for the impact of the work at the program level of the NCR. The Chief Administrative Officers are city and county-level administrators who serve on the CAO Committee on Homeland Security. They work in partnership with the SPG members on all strategic matters, operating more as a single unit. The CAO Committee, along with the SPG members, served as key architects of the strategic plan. The plan describes the Regional Emergency Preparedness Council (EPC) as an advisory body established by the Metropolitan Washington Council of Government (MWCOG) Board of Directors and includes a broad array of representatives from each of the NCR’s stakeholder categories. According to the plan, the EPC makes policy, procedural, and other recommendations to the MWCOG Board or through the MWCOG Board to various regional agencies with emergency preparedness responsibilities or operational response authority. In addition, the plan notes representatives of the private sector have a critical advisory role in the region’s strategic planning process. The private sector is represented on the Regional Emergency Preparedness Council, Regional Emergency Support Function Committees, and Regional Program Working Groups. One element of the characteristic regarding roles, responsibilities, and coordination we recommended for a strategic plan is specifying who has lead, support, and partner roles and responsibilities. In the plan, a lead organization is identified for each initiative. According to the plan, the initiative leads are responsible for the definition, development, and enhancement of the initiatives. They are to provide oversight for the performance of the initiative against the goals and objectives. In our view, the lead organizations are extremely important to the success of the strategic plan. However, the leads for the 30 initiatives are dispersed across multiple organizations, many of which are emergency support function groups, regional working groups, or the NCR’s Homeland Security Grants and Program Office. It is not clear if these organizations have the authority, resources, or mechanisms to carry out all of their roles, responsibilities, and coordination duties in implementing the plan. For example, the plan describes the regional working groups as consisting of practitioners, policymakers, and representatives from both the civic and private sectors who have many duties, including filling gaps not covered by any of the existing regional emergency support functions. The Grants and Program Office manages grant performance, provides staff support for various working groups, and manages NCR processes relating to implementation and grant deadlines. These organizations may not be able to establish policies, procedures, and other means to direct initiative implementation. As the strategic plan is implemented, it may be useful for the NCR to carefully assess initiative leadership and make adjustments as necessary to ensure implementation of the plan. The final desirable characteristic is integration and implementation— addressing how a regional strategy relates to other strategies’ goals, objectives, and activities, and to state and local governments within their region and their plans to implement the strategy. Examples of elements include, for example, horizontal and vertical integration; details on specific federal, state, local or private strategies and plans; and implementation guidance. The document states that the strategic plan is but one part of a family of plans at the strategic, programmatic, budget, and operational levels existing within the NCR. The plan is intended to align jurisdictional strategy planning efforts with national efforts and provide a mechanism for NCR Partner input and guidance into jurisdiction programmatic and budgetary planning processes. The plan is intended to identify common goals, objectives, and initiatives implemented over the 3 to 5 years of the plan. One initiative is designed to align and integrate response plans across the jurisdictions, with emphasis on continuity of government, operations, and evacuation. The plan document states that the plan does not (1) dictate how the NCR should spend its homeland security funds and (2) address operational level issues or require operational plans at the regional level. Although the plan does not directly affect the jurisdictional and emergency function operational plans (e.g., local hazard mitigation plans, emergency response) or address operational level issues, the plan is intended to influence specific capabilities resourced by the jurisdictions that support operational plans. According to the plan, detailed operational plans, where necessary, will be updated by initiative leads as the strategic initiatives are implemented. The plan also states that the state homeland security investments made in the jurisdictions comprising the NCR must take into account their own regional considerations. The plan itself notes that the priorities for preparedness in the homeland security plans for Virginia, Maryland, and the District of Columbia reflect unique assessments of the threats and vulnerabilities across each jurisdiction and have varying strategic plan priorities. The annual review of the strategic plan is timed to correspond with the federal, Maryland, Virginia, and District of Columbia budget cycles, which should, according to the plan, facilitate the acquisition of funding for initiative projects. As the plan is implemented, the jurisdictions should, according to the plan, be able to determine their level of contribution and commitment to the achievement of the plan’s goals and initiatives. The plan describes the commitment of District of Columbia, Virginia, and Maryland officials to a collaborative approach in eight specific areas, which the plan states are addressed by at least one of the NCR strategic plan goals. For all initiatives, the plan document notes that the Emergency Preparedness Council will convene a quarterly performance review. In these sessions, each initiative lead will present the performance results of their initiative. Initiative leads will present their results compared with the pre-defined targets; analysis of results, trends, and root causes; and recommended actions to maximize performance. The Emergency Preparedness Council will discuss this information, make decisions, and issue direction to improve project performance as necessary. While an initiative is in the implementation stage, the review session is to serve as a project management aid, reviewing schedule and budget status versus milestones and exercising implementation management actions. When a plan initiative is completed, the document states its review will transition to an outcome-oriented performance discussion. One of the plan’s initiatives is to establish a regional oversight and accountability function with appropriate tools and resources for performance transparency. According to the milestones, NCR entities will report against the measures in January 2007 and performance reviews will be in March 2007. As we testified in March, implementation of regional initiatives not covered by Homeland Security Grant Program funding likely would require NCR jurisdictions acting individually or in combination with others. If the plan is intended to align regional with state and local efforts through identification of common goals, objectives, and initiatives implemented by the jurisdictions over the 3 to 5 years of the plan, it is critical that jurisdictional plans reflect the regional goals, objectives, and initiatives. Although the plan notes that the District of Columbia, Virginia, and Maryland have a commitment to the eight critical areas previously mentioned, it is not known what the actual commitment is to all of the goals, objectives, and initiatives in the NCR plan. Our work to date has not included an assessment of individual jurisdictional commitment or planned efforts to implement the NCR strategic plan goals, objectives, and initiatives to determine if unfunded initiatives, particularly those considered priority initiatives, might be addressed by one or more of the NCR jurisdictions. While the NCR strategic plan might guide or influence implementation of the initiatives, there is no guarantee state and local plans and related investments will respond to the initiatives. Even if the NCR jurisdictions initially commit to the plan’s initiatives, with performance monitored by the Emergency Preparedness Council, there is no vehicle or central responsible organization with the authority to ensure implementation. Further work would be required to determine to what extent, if any, the NCR initiatives are addressed in other federal funding applications or individual NCR jurisdictional homeland security initiatives. A major organizational and functional challenge noted in the plan is that the NCR is not organized as an operational entity and does not have the authority to execute operations as an independent body. The NCR’s authority only exists, the plan notes, to the extent the member jurisdictions are willing to extend decision-making rights to the NCR. Under the plan, the SPG is to exercise oversight of the implementation and funding process and determine priority actions and the EPC is to do quarterly performance reviews. However, if regional collaboration and building capabilities in line with the NCR goals are to become a reality, operational commitment is necessary. As I stated earlier, the Office of National Capital Region Coordination was created as a means of coordinating emergency preparedness and response efforts across the region. The ONCRC is to oversee and coordinate federal programs for and relationships with NCR state, local, and regional authorities. One ONCRC mandate is to coordinate with NCR federal, state, local, and regional agencies and the private sector on terrorism preparedness to ensure adequate planning, information sharing, training, and execution of domestic preparedness activities among these agencies and entities. A challenge for the ONCRC is to work with the NCR jurisdictions to provide effective oversight, accountability, and overall leadership and management of the various NCR governance entities such as the Senior Policy Group and Emergency Preparedness Council to continually assess the strategic plan’s implementation and steps needed to keep implementation on track. In addition, the Department of Homeland Security beyond the ONCRC has a role to play. As we noted in our work on regional coordination, the federal government can encourage regional coordination through its grant programs. As DHS emphasizes regional coordination and capability building through implementation of the National Preparedness Goal, it can provide additional oversight to determine if regional strategic plans have specific and measurable goals and that resources are aligned to the goals. As I stated when last before this Committee, there is no more important element in results-oriented management than the effort of strategic planning. Strategic planning defines what an organization seeks to accomplish, identifies strategies it will use to achieve desired results, and then determines success in reaching results-oriented goals and achieving objectives. The NCR has made considerable progress in developing its first strategic plan. Although we have noted some remaining limitations and areas of potential improvement, the NCR strategic plan provides the basic foundation for regional preparedness, including what is in case of a catastrophic event. Now, the challenge is ensuring that initiatives to implement the goals and objectives are funded, completed, and appropriately assessed to determine if they have achieved the NCR’s strategic goals while continually monitor the plan’s implementation to determine what adjustments are needed for continuing improvement. - - - - - That concludes my statement, Mr. Chairman. I would be pleased to respond to any questions you or other Members of the Committee may have. For questions regarding this testimony, please contact William O. Jenkins, Jr. at (202) 512-8757, email jenkinswo@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Sharon L. Caudle also made key contributions to this testimony. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Among other things, the Office of National Capital Region Coordination is to coordinate efforts within the National Capital Region (NCR) to ensure execution of domestic preparedness activities. In our May 2004 report and June 2004 testimony before the House Government Reform Committee, GAO recommended that the NCR develop a strategic plan to establish and monitor the achievement of regional goals and priorities for emergency preparedness and response. GAO subsequently testified on the status of the NCR's strategic planning efforts before the Subcommittee on Oversight of Government Management, the Federal Workforce, and the District of Columbia in July 2005 and March 2006. The Subcommittee asked GAO to provide comments on the NCR's strategic plan, which the NCR partners approved in September 2006. In this testimony, GAO discusses its assessment of the recently completed NCR homeland security strategic plan and the extent to which the new plan includes desirable strategic plan characteristics and how the substance of the plan might be further strengthened when the plan is reviewed and possibly revised. A coordinated strategic plan to establish and monitor the achievement of regional goals and priorities is fundamental to implementing a coordinated approach to enhancing emergency preparedness and response capacities in the NCR. In March 2006, GAO observed that the NCR's strategic plan could benefit from addressing all six characteristics GAO considers to be desirable for a regional homeland security strategy. These characteristics were used to evaluate the final plan. These include, for example, goals, subordinate objectives, activities, and performance measures; resources, investments, and risk management; and organizational roles, responsibilities, and coordination. The NCR approved its strategic plan in September 2006. The NCR homeland security strategic plan includes all six characteristics we consider desirable for a regional homeland security strategy. To illustrate, the plan includes regional priorities and presents the rationale for the goals and related objectives and initiatives. This includes information on how the plan addresses national priorities and targeted capabilities from the National Preparedness Goal, an Emergency Management Accreditation Program assessment of local and regional preparedness and emergency management capabilities against recognized national standards, and the Department of Homeland Security's Nationwide Plan Review of emergency plans. The plan structure is more streamlined, containing an overview, core plan, and detailed appendix with information on factors such as risks, costs, and roles and responsibilities. However, the substance of the information within these six characteristics could be improved to guide decision makers. Two examples: (1) the plan does not reflect a comprehensive risk assessment for the region, which, when completed, may result in changes in some of the priorities in the current plan; and (2) although the NCR plan defines objectives as being key, measurable milestones for reaching each goal, many objectives include language such as "strengthen," "enhance," "increase," "improve," and "expand" rather than more specific performance measures and targets. Several of our observations regarding potential plan substance are the same as those we provided in our March 2006 testimony. The NCR has made considerable progress in developing its first strategic plan. Although GAO has noted some remaining limitations and areas of potential improvement, the NCR strategic plan provides the basic foundation for regional preparedness, including what is needed in case of a catastrophic event. Now, the challenge is ensuring that initiatives to implement the goals and objectives are funded, completed, and appropriately assessed to determine if they have achieved the NCR's strategic goals while continually monitor the plan's implementation to determine what adjustments are needed for continuing improvement.