Overseas posts that undergo evacuations in response to threats to post staff, family members, or facilities generally experience phased changes to their operational status, such as an authorized or ordered departure, potentially leading to suspended operations. Under an authorized departure, specific overseas post staff under chief-of-mission authority and family members may voluntarily choose to leave the post for a designated safe haven. Under an ordered departure, specific overseas post staff and family members are ordered to leave for a designated safe haven. Some staff designated by the Chief of Mission to be critical for ongoing operations must remain at the post. Under suspended operations, all remaining overseas post staff under chief-of-mission authority are ordered to leave for a designated safe haven. An overseas post on authorized or ordered departure status goes through a monthly review to determine if the threats to the post have since abated. According to State officials, if the threats have abated, the post can be taken off of departure status and placed on normal status or on modified operating status. Figure 1 shows authorized departures, ordered departures, and suspended operations that have occurred at overseas posts during fiscal years 2013–2016. While overseas posts are primarily responsible for initiating evacuations of post staff and family members, other parts of State—and in some cases DOD—have supporting roles. State’s Office of Crisis Management and Strategy (CMS) provides posts with crisis management and evacuation expertise and support. DS is responsible for security services related to the protection of life, information, and property at overseas posts and coordinates with posts’ DS agents—the Regional Security Officers (RSO)—to respond to posts’ security needs. DS falls under the Under Secretary for Management, who is the State headquarters official responsible for approval of a number of evacuation-related decisions. State has developed processes and requirements for overseas posts to prepare EAPs and conduct drills in order to prepare for crises and evacuations. It also has established processes for overseas posts to follow when considering or implementing a drawdown of post personnel, including evacuations under an authorized departure or an ordered departure. In addition, State also has established a process for determining whether U.S. presence in posts designated by State as high threat and high risk should continue, discontinue, or restart operations. The FAH assists posts in establishing processes and requirements to create and annually update comprehensive, effective, and readily usable plans to handle emergency situations at overseas posts. In particular, checklists within a post’s EAP are to specify procedures for responding to particular types of emergencies at overseas posts, such as civil disorder. In addition, the FAH directs DS to review EAPs submitted annually by overseas posts to ensure that EAPs include updated information needed by State headquarters and other agencies to monitor or assist in responding to emergency situations at posts. The FAH also requires the EAP to identify decision points, which CMS officials indicate help a post’s Emergency Action Committee (EAC) determine when to authorize or order post staff and family members to leave for a designated safe haven, when to initiate the evacuation of American citizens, and when to suspend operations. The EAC is a group of subject-matter experts designated by the Chief of Mission to provide guidance in preparing for and responding to potential changes in risk that might impact the safety and security of the post and the American citizens in country. The FAH lays out several important responsibilities for a post’s EAC, including drafting and updating the post’s EAP and conducting drills and other crisis preparedness functions at the post. The FAH also establishes requirements for overseas posts to regularly conduct nine types of drills to prepare for crises and evacuations. These drills are shown in figure 2. The required frequency of drills is determined by a post’s threat ratings in the two Security Environment Threat List categories: political violence and terrorism. Posts rated high or critical in either political violence or terrorism are required to conduct each of the drills at least twice every fiscal year. All other posts are required to conduct these drills at least once every fiscal year. Overseas post staff we visited reported that in addition to maintaining EAPs and conducting required drills, other activities and training help their posts prepare for crises and evacuations. For instance, staff at one overseas post we visited reported that the Foreign Affairs Counter Threat (FACT) training course and new arrival briefings help them prepare for crises and evacuations. State established FACT to help safeguard and prepare personnel serving in high threat countries by providing instruction in personal security skills necessary for recognizing, avoiding, and responding to potential terrorist and other threat situations. FACT training will be required for all overseas post foreign affairs personnel and certain family members by 2019. New arrival briefings—which the FAM requires each post’s RSO to provide—are helpful because they acquaint new post staff and family members with the post’s current security situation and threat environment. The FAH establishes processes for overseas posts to follow when considering or implementing a drawdown of post personnel, including evacuations under an authorized departure or an ordered departure. When a post determines that there is imminent danger to the lives of post staff or their family members, the post’s Chief of Mission is to cable a request for either an authorized or an ordered departure to State’s Under Secretary for Management. Under an authorized departure, certain post staff and all family members can voluntarily choose to depart the post by submitting a request through the post’s EAC, which forwards it to the Chief of Mission for a final decision. Under an ordered departure, certain post staff and family members are ordered to depart the post. Authorized and ordered departures can be tailored to fit the posts’ particular circumstances. For instance, a Chief of Mission could recommend an (1) authorized departure for certain family members only, such as children of a certain age or spouses; (2) ordered departure of certain family members only; or (3) ordered departure of certain family members coupled with authorized departure of certain post staff. The FAH also outlines how authorized and ordered departures are to be coordinated among various sections at an overseas post, the relevant regional bureau, and with others in State headquarters. State guidance establishes that authorized and ordered departures are approved for an initial period of 30 days, which may be extended in 30- day increments for a maximum of 180 days. Prior to the expiration of each 30-day period, posts are to submit a recommendation to State headquarters as to whether the authorized or ordered departure status should be continued. To that end, the EAC at a post on departure status is to meet to evaluate the security environment and determine if the crisis situation leading to the evacuation has abated. If the EAC decides that the crisis situation has abated, it can recommend that the Chief of Mission submit a cable to State’s Under Secretary for Management requesting approval to terminate the authorized or ordered departure. If an overseas post continues on ordered departure status for 180 continuous days, State headquarters can automatically change that post’s classification status to unaccompanied. At unaccompanied posts, only post staff and their post-employed family members may be present; other family members are prohibited. According to DS officials, if the crisis situation in-country deteriorates and an overseas post requires U.S. military support to bolster its defensive capabilities, the post can coordinate with DOD to receive such assistance, depending on the location of the overseas post and the availability of DOD assets. Overseas posts also can coordinate with DOD in situations requiring U.S. military evacuation assistance from an overseas post. Such DOD-assisted evacuations are known as “noncombatant evacuation operations” and involve post personnel as well as American citizens in country. According to the FAM, under State’s “no double standard” policy, an overseas post is required to share the same relevant threat information with private U.S. citizens in that country as the post communicates to the official U.S. government community. In cases where the evacuation of private U.S. citizens is necessary, the policy also requires that private U.S. citizens be given the same evacuation opportunities and assistance as the official U.S. government community, when appropriate and feasible. According to State officials, the costs associated with evacuations of State staff and their family members from overseas posts are covered by the appropriation for Emergencies in the Diplomatic and Consular Service, also known as the K Fund. Other agencies with staff and family members at overseas posts, such as the U.S. Agency for International Development, are responsible for covering the costs associated with the evacuation of their staff and family members. In fiscal years 2010 through 2016, State’s reported costs associated with evacuating from posts on 53 occasions were roughly $25.5 million. According to State officials, costs associated with evacuations varied due to several factors, including the number of post staff and family members evacuated. In fiscal year 2014, costs associated with evacuating Embassy Maseru in Lesotho were roughly $20,000, while in the same year, costs associated with evacuating Embassy Sana’a in Yemen were roughly $1.9 million. Figure 3 displays the K Fund expenditures for post evacuations during fiscal years 2010–2016. After an authorized or ordered departure has been terminated at an overseas post, State guidance recommends that posts engage in a lessons learned discussion. CMS at headquarters is to work with the overseas post, the relevant regional bureau, and State’s Management Bureau to facilitate a lessons learned discussion for the record. State guidance also requires post staff to transmit an after-action report listing lessons learned to State headquarters. According to State officials, because of the attacks in Benghazi, Libya, and other overseas posts in 2012, State developed and implemented a risk assessment process called the Vital Presence Validation Process (VP2). State officials indicated that VP2 is an annual assessment by senior management at State headquarters—in consultation with affected posts and respective regional bureaus—to determine whether the U.S. presence in the approximately 30 posts designated by State as high threat and high risk should continue, discontinue, or restart operations. According to State officials, State also conducts VP2 reviews for opening or reopening overseas posts categorized as critical threat, or high threat, high risk. VP2 is not meant for determining short-term evacuations from a post, such as authorized or ordered departures. State’s Office of Management, Policy, Rightsizing, and Innovation is responsible for coordinating VP2 assessments. During these assessments, the affected overseas post and respective regional bureau are to complete a document detailing, among other things, threats to a post and any mitigating factors; the post’s staffing, mission, and programs; program implementation; and program benefits. The Core High Threat Post Review Board, which includes representatives from various State offices, is to review and endorse each VP2 assessment before sending it for approval to the Under Secretary for Political Affairs and the Under Secretary for Management. The VP2 assessment is then sent to the Deputy Secretary of State and the Deputy Secretary for Management and Resources for consideration and final approval. State’s implementation of preparedness processes for crises and evacuations at overseas posts has multiple gaps: Overseas posts have not updated EAPs annually within required time frames. When EAPs are submitted to DS for annual certification, DS does not fully review key EAP sections that should be updated each year. EAPs are lengthy and cumbersome documents that are not readily usable in emergency situations, according to State officials. Although overseas posts are required to conduct drills intended to prepare for crises and evacuations, for fiscal years 2013–2016, posts reported completing about half of their required drills. Overseas posts have not submitted required lessons learned reports following evacuations. The gaps in State’s implementation of preparedness processes for crises and evacuations at overseas posts increase the risk that post staff are not sufficiently prepared to handle crisis and emergency situations. Although the FAH requires each overseas post to comprehensively review and update its EAP annually, from fiscal year 2013 to 2016, almost a quarter of overseas posts, on average, did not complete required annual EAP updates within specified time frames. During the comprehensive review, each post must update any out-of-date information and certify that all other information remains current. Overseas posts have made considerable improvements in their timeliness in completing EAP updates during fiscal years 2015-2016 compared to fiscal years 2013-2014. State headquarters officials noted that, following the attack in Benghazi, Libya, in September 2012, State took actions to encourage overseas posts to improve their timeliness in completing annual EAP updates. These actions included State headquarters becoming more involved in annually reviewing decision points in posts’ EAPs as well as State headquarters issuing cables emphasizing that posts need to update their EAPs annually. In fiscal year 2016, about 1 in 12 overseas posts were late in completing required annual updates. On average, these posts were about 6 months late in completing their EAP updates. For fiscal year 2016, the list of posts that were late in completing their annual EAP updates included 7 posts rated high or critical in political violence or terrorism. Table 1 shows, for fiscal years 2013 to 2016, the percentage of overseas posts that did not complete required annual updates of EAPs within the 1-year deadline and the average number of months these EAP updates were late. See appendix II for additional details on posts that were late in completing their EAP updates for fiscal year 2016. Officials at all six overseas posts we met with reported some difficulties using the current electronic system to update their EAPs. Difficulties in using the current system, as well as challenges in reviewing and updating a relatively large document, may impact posts’ timely completion of EAP updates. Overseas posts with EAPs that have not been annually reviewed and updated as required could leave post staff insufficiently prepared to handle emergency situations, placing them and others with them at increased risk of harm. According to DS officials, in response to our ongoing work, in December 2016 DS developed new guidance and policy to encourage posts to complete their annual EAP updates on time. In particular, DS developed a standardized 60-day notice e-mail and established policy to send these standardized notices to all posts 60 days before the deadline for posts’ annual EAP update submissions. While implementation of this action may assist in reminding all posts of the relevant requirements, further steps, such as focusing follow-up efforts on the posts that are late in their submission, could result in improved timeliness. The FAH directs DS to review each EAP submitted by an overseas post during the annual EAP review cycle to ensure that EAPs include updated information needed by State headquarters and other agencies to monitor or assist in responding to emergency situations at posts. To conduct these annual reviews, DS Emergency Plans Review Officers in Washington use a list of 27 key EAP sections that the Emergency Plans Review Office has determined should be updated each year. According to DS officials, Emergency Plans Review Officers spot check these 27 key EAP sections to review and approve each EAP. In addition, DS officials told us that Review Officers consider forms included in key EAP sections that they spot check to meet the annual update requirement if the forms were updated up to 3 years prior to the check. DS does not document its annual EAP review process. We requested the results of the Emergency Plans Review Officer reviews, including data on who conducted them and what deficiencies, if any, were found. Federal internal control standards call for agency management to evaluate performance and hold individuals accountable for their internal control responsibilities. However, DS was unable to provide copies of the reviews completed because the Emergency Plans Review Officers do not document these results. Our analysis of a nongeneralizable sample of EAPs for 20 posts that DS had reviewed and approved showed that only 2 of the 20 posts’ EAPs included evidence that posts had updated all 27 key sections. In the remaining 18 of 20 posts’ EAPs, we found at least 1 key EAP section that had not been updated. The extent to which each post had not updated its EAP varied. For example, one post had not updated almost 90 percent of the 27 key EAP sections that we reviewed, while another post had not updated about 20 percent of the 27 key EAP sections that we reviewed. For all 20 EAPs we reviewed, on average, posts had not updated over 50 percent of the key EAP sections we reviewed. In addition, in several EAPs we reviewed, we found emergency supplies listed that were a year or more past their expiration dates. Because DS Emergency Plans Review Officers do not check all 27 key EAP sections, EAPs submitted to DS have not been fully reviewed. Overseas posts with EAPs that have not been fully reviewed may leave post staff—especially new staff— insufficiently prepared to respond to emergencies and leave State and other agencies without accurate information to assist an affected post during an emergency. According to the FAH, EAPs should be readily usable plans to handle emergency situations and should contain information to assist post staff in responding to emergencies. In addition, federal internal control standards call for an agency to internally communicate necessary quality information to achieve the agency’s objectives. However, at both State headquarters and at all six posts we met with, officials told us that EAPs are lengthy and cumbersome documents that are not readily usable in emergency situations. Officials at all six posts also said that EAPs are voluminous documents that contain large amounts of boilerplate content, and officials at four of six posts we met with noted that this includes especially explicit instructions on how to fill out each of the plan’s sections and subsections. The boilerplate content in EAPs is automatically generated by the electronic system that all posts use to draft and update their EAPs; this content focuses on information about how posts should update their plans rather than information on how to handle emergency situations. In addition, none of the nongeneralizable sample of 20 EAPs that we reviewed had a single, comprehensive table of contents or index, potentially making it challenging for post staff to search for and find a particular section quickly, especially during an emergency. While officials from State headquarters and all six posts we met with told us that EAPs are not readily usable in emergency situations, officials at five of the six posts we met with also said there is value for post staff to participate in the process of updating EAPs to prepare for emergencies. The process of updating the EAP, they noted, includes reviewing applicable checklists and contact lists before an emergency occurs, which can help post staff be better prepared in the event of an emergency. Officials at two of the six posts we met with also observed that EAPs contain large amounts of guidance because it is easier for responsible staff at post to complete required updates to their specific sections if all the guidance they need is directly written into each EAP. However, officials at five of the six posts we met with suggested that having a streamlined version of the EAP—such as a shorter EAP with just checklists and contact lists—in addition to the full EAP could make the EAP more readily usable in emergency situations. Officials at five of the six posts we met with also suggested that making a streamlined EAP that is not marked as sensitive or classified and could be stored on a mobile device could also be helpful in an emergency situation. This could allow staff at post who do not have security clearances—such as locally employed security personnel—to more readily access the EAP. While the FAH requires posts to maintain full copies of their EAPs—in printed hard copy and CD-ROM forms—it does not contain a provision for preparing or maintaining alternate streamlined versions of the posts’ EAPs. Absent such a change in State’s relevant policy and procedures, officials may not have readily usable important information during a crisis. State is in the process of developing a new electronic system for overseas posts to draft and update their EAPs to address issues with the current system, according to State headquarters officials. For example, officials told us that post staff have complained that the current system is cumbersome to work with, difficult to search and navigate, and makes drafting and updating their EAPs difficult and time consuming. State headquarters officials also said they hope the new system will allow staff to more quickly and easily draft and update their EAPs. They also said they hope the new system will result in more streamlined EAPs. State plans to launch the new system in the second half of 2017. As State develops its system, officials could consider turning their hopes for streamlined EAPs into specific requirements for the planned system. Although the FAH establishes requirements for overseas posts to annually conduct nine types of drills to prepare for crises and evacuations, we found that, on average for fiscal years 2013–2016, overseas posts reported completing 52 percent of required drills. Officials at headquarters and at all six overseas posts we met with told us that regularly conducting required annual drills is one of the most important steps to help prepare post staff for crises and evacuations and to keep them safe during crisis events. The required frequency of required drills is determined by ratings in the two Security Environment Threat List categories of political violence and terrorism. Posts that are not rated high or critical in political violence or terrorism are required to conduct nine types of drills at least once per fiscal year. Posts that are rated high or critical in political violence or terrorism are required to conduct the same nine types of drills at least twice per fiscal year. Relevant incident commanders at posts, including RSOs, are tasked with organizing and conducting required drills under their respective areas of expertise or responsibilities. RSOs record their posts’ completion of drills into DS’s Security Management Console, which logs the drill records into a drilling database maintained by DS. While DS collects the information submitted by RSOs in the database, DS does not independently verify the data to ensure its accuracy or validity. State officials told us that when posts are identified as being noncompliant with drilling reporting during post security program reviews, DS works with posts either to retroactively input data on completed drills or conduct remaining drills in a timely manner. DS officials also told us that, partly in response to our ongoing work, the bureau has recently developed a standard operating procedure to review drilling data quarterly. However, the results of the first analysis of these data were unavailable at the time of our review. As shown in table 2, for fiscal years 2013 through 2016, overseas posts reported completing an average of 52 percent of required annual drills. For fiscal years 2013 through 2016, overseas posts rated high or critical in political violence or terrorism reported completing an average of 44 percent of required annual drills. Figure 4 provides a breakdown by drill type of the percentage of overseas posts reporting completion of each type of required annual drill, on average, for fiscal years 2013 through 2016. Completion rates for the drills ranged from a high of 78 percent to a low of 22 percent, depending on the type of drill. For example, in fiscal years 2013 through 2016, an average of 78 percent of posts reported completing required duck and cover drills; an average of 58 percent of posts reported completing required employee warden system drills; an average of 36 percent of posts reported completing required evacuation/drawdown training drills; and an average of 22 percent of posts reported completing the required consular warden system drills. For fiscal years 2013 through 2016, we found that, on average, 3.4 percent of posts reported completing all required annual drills (see table 3). For those posts rated high or critical in political violence or terrorism, we found that, on average for fiscal years 2013 through 2016, 2.3 percent of posts reported completing all drills at least twice per fiscal year as required (see table 4). State headquarters officials told us that, while posts are aware of the requirements to report completed drills, posts may be underreporting drills completed. They said that post RSOs have significant workloads and that this may result in RSOs failing to report a post’s completion of some required drills. When RSOs report completion of drills in the DS Security Management Console, the FAH also requires that they record information about how the drill was conducted, including post participation, deficiencies identified, and corrective actions. These additional reporting requirements further add to RSO workloads and may contribute to underreporting, according to State headquarters officials. Moreover, State officials told us that incident commanders responsible for conducting certain types of drills may not notify RSOs about completed drills. Absent more complete drill reporting, State headquarters and post leadership lack information on posts’ preparedness for responding to crises and conducting evacuations. DS officials told us that—partly in response to our ongoing work—the bureau recently has established a DS Drills Working Group to clarify RSO roles and requirements for reporting drills and to address some of the challenges leading to underreporting the completion of required drills. DS officials also told us that they plan to modify the new electronic system for drafting and updating EAPs to include a post drills reporting feature. This feature, projected by DS to be incorporated into the new system in 2018, would allow incident commanders to report completion of drills for which they are responsible. DS officials said that they hope this new feature will improve the reporting of completed required drills. Nevertheless, officials at three posts we met with told us that posts may not be completing required drills because compliance with annual drilling requirements is not a priority in State’s organizational culture. For example, officials at one post rated high in political violence and terrorism told us that the previous RSO had not adhered to the post’s drilling schedule for meeting annual drilling requirements. The new RSO at this post told us that the previous RSO had completed less than 40 percent of required drills in fiscal year 2016. Another official at the same post told us that the Ambassador had denied requests for additional drills that the new RSO deemed necessary, saying that the post was too busy to hold such drills. If drills are not conducted as required, overseas post staff may lack the preparation to respond to a crisis, which could endanger post staff and family members. During fiscal years 2013 through 2016, there were 31 evacuations from overseas posts; however, according to CMS, none of the posts submitted required lessons learned reports to State headquarters following the termination of their authorized or ordered departures. We requested that State headquarters provide us with any documents—produced by overseas posts—containing lessons learned or any challenges encountered by posts that experienced an evacuation during fiscal years 2013 through 2016. State was unable to provide any documents responsive to our request. CMS officials told us that State currently does not have an established process for centrally collecting and assessing lessons learned documents, but that CMS is taking steps to develop and implement such a process. In September 2016, CMS formed a new unit to work on, among other tasks, lessons learned projects to ease the burden on posts and to develop a collection and assessment process for lessons learned. Separately from CMS, DS provided us with two classified reports containing some lessons learned about overseas posts that had experienced evacuations. However, neither of these documents was produced by the overseas posts themselves and, according to DS and CMS officials, DS is not the entity within State that is responsible for collecting and assessing lessons learned reports from posts following evacuations. As previously discussed, State guidance recommends that posts engage in a lessons learned discussion after an authorized or ordered departure has been terminated. State’s CMS team at headquarters is to work with the overseas post, the relevant regional bureau, and State’s Management Bureau to facilitate a lessons learned discussion for the record. Additionally, the FAH requires post staff to transmit an after-action report listing any lessons learned from their experience to State headquarters. In addition, federal internal control standards call for agency management to hold individuals accountable for their internal control responsibilities and to establish and operate monitoring activities to monitor the internal control system and evaluate the results. CMS officials told us that overseas posts often lack sufficient resources to produce lessons learned reports following termination of the post’s authorized or ordered departure. CMS officials also told us that even after the crisis leading to an evacuation has abated and staff have returned to post, there is often a backlog of tasks to be completed. They also said completing these tasks is a priority for post staff, which limits their ability to develop and submit lessons learned reports. Moreover, CMS officials said that post staff curtailments also can challenge a post’s ability to develop and submit lessons learned reports following an evacuation, as staff present during the evacuation may no longer be present when the post resumes normal operations. We learned of several challenges that posts faced in different evacuations in discussions with officials from the six posts with whom we met. Different posts mentioned various challenges, including disorganized evacuation logistics and transportation, unclear communication with local staff, confusion surrounding the policy for evacuating pets, problems with shipment and delivery of personal effects, difficulty tracking the destination of staff who were relocated, poor communication with senior State leadership regarding the post’s evacuation status, difficulties getting reimbursement for lodging or personal expenses related to the evacuation, and other similar challenges. Absent a functioning lessons learned process, State’s ability to identify lessons learned and to share best practices from staff that have experienced evacuations may be constrained. According to CMS officials, holding lessons learned exercises can help to identify challenges that a post faced during an evacuation within a reasonable time frame. The subsequent after-action reports could be used to modify guidance for posts on how to best respond to emergency situations. According to CMS officials, these reports also can help staff at other overseas posts learn about the challenges the evacuated posts faced, identify relevant insights and best practices, and prepare for potential future evacuations. U.S. personnel working at overseas posts, along with the family members who accompany them, face a range of threats to their safety and security—such as terrorism, civil unrest, and natural disasters. To help protect them, State has established processes to prepare overseas posts for crises and to conduct evacuations. However, State has significant gaps in implementation of its preparedness processes for crises and evacuations at overseas posts. Overseas posts are not completing required annual EAP updates, DS is not identifying incomplete updates in its EAP reviews, and the EAPs themselves are not readily usable during emergency situations. In addition, although regular drilling is a critical crisis preparedness task, very few overseas posts have completed all required annual drills. Finally, because overseas posts are not submitting required after-action reports containing lessons learned following evacuations, State is missing important opportunities to identify challenges and best practices and to make changes to prepare for future evacuations from overseas posts. While State has taken initial actions— including some actions in response to our ongoing work—to improve implementation of its preparedness processes for crises and evacuations, significant shortcomings exist. While each of these gaps is of concern, taken together, they increase the risk that post staff are not sufficiently prepared to handle crisis and emergency situations. To address gaps in State’s crisis and evacuation preparedness, we recommend that the Secretary of State take the following five actions: 1. Take additional steps to ensure that overseas posts complete annual updates of their EAPs within required time frames, such as identifying posts that are late in completing their annual updates and continuing to follow up with those posts until they complete their annual EAP updates. 2. Establish a monitoring and tracking process to ensure that DS fully reviews and documents the review of key sections of EAPs submitted to it during the annual EAP review cycle. 3. Take steps to make the EAP more readily usable during emergency situations. For example, State could develop a more streamlined version of the EAP—consisting of key sections, checklists, and contact lists—that could be used by overseas post staff, in addition to the full EAP. In addition, for its new system planned for later this year, State could consider including requirements for streamlined EAPs. 4. Take steps to ensure that overseas posts complete and report completion of required drills within mandated time frames. 5. Take steps to ensure that overseas posts complete required lessons learned reports following authorized or ordered departures and submit the reports to State headquarters for analysis. We provided a draft of the sensitive but unclassified report to State and DOD for comment. State’s comments on the sensitive but unclassified report are reprinted in appendix IV. In its comments, State concurred with all five recommendations and described actions planned or under way to address them. For example, State concurred with our recommendation that the department take steps to make the EAP more readily usable during emergency situations. State further said that it is developing a redesigned EAP that minimizes redundancy, groups content according to posts’ planning and response needs, and makes the EAP organized and user-friendly for all EAC members and other users. State also provided technical comments on the draft of the sensitive but unclassified report, which we incorporated as appropriate. DOD did not provide comments on the draft of the sensitive but unclassified report. We are sending copies of this report to the appropriate congressional committees, the Secretary of State, and the Secretary of Defense. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. This report examines (1) the processes the Department of State (State) has established to prepare overseas posts for crises and to conduct evacuations and (2) State’s implementation of preparedness processes for crises and evacuations at overseas posts. This report is a public version of a sensitive but unclassified report that was issued on June 28, 2017, copies of which are available upon request for official use only by those with the appropriate need to know. State deemed some of the information in our June report to be sensitive, which must be protected from public disclosure. Therefore, this report omits information identified by State as sensitive. Although the information provided in this report is more limited, the report addresses the same objectives as the sensitive report and uses the same methodology. To conduct this review, we obtained and analyzed guidance from State’s Foreign Affairs Manual (FAM) and Foreign Affairs Handbooks (FAH), including a portion called the Emergency Planning Handbook. We analyzed information from State’s Emergency Action Plans (EAP) drilling database, Security Environment Threat List, and the State account for Emergencies in the Diplomatic and Consular Service known as the K fund. In addition, we interviewed officials from State’s Bureau of Diplomatic Security (DS); Office of Management Policy, Rightsizing, and Innovation; Crisis Management Support; Africa Regional Bureau; Western Hemisphere Regional Bureau; Near Eastern Affairs Regional Bureau; and European Regional Bureau. We reviewed GAO’s most recent work regarding evacuations and the Department of Defense’s (DOD) support for State in crisis situations. We also interviewed representatives from DOD’s Under Secretary of Defense for Policy. We conducted fieldwork at four overseas posts in the Africa and the Near East geographic regions. We are not naming the specific posts we visited for this review due to security concerns. In addition, we conducted interviews—via secure video conference—with two additional posts in the Near East and Africa geographic regions, and with a DOD combatant command to gather their perspectives on State’s implementation of crisis and evacuation preparedness processes for overseas posts. This sample of countries was designed to account for geographic diversity and to include posts that have experienced authorized departure, ordered departure, and suspended operations since September 2012; had a mix of posts where family members or members of household were authorized or not authorized to reside; and a mix of both high-risk posts and posts where a Vital Presence Validation Process (VP2) assessment had been conducted. At posts we visited, we met with a variety of post staff including Emergency Action Committee members, Ambassadors, Deputy Chiefs of Mission, Regional Security Officers (RSO), Management Counselors, Community Liaison Office Coordinators, and U.S. staff and locally employed staff who had experienced previous evacuations. To examine the processes State has established to prepare overseas posts for crises and to conduct evacuations, we reviewed State’s policies and procedures in the FAM and associated FAH requiring posts to prepare EAPs and to conduct crisis-situation and evacuation drills, as well as policies and procedures to conduct evacuations at overseas posts. We also reviewed memoranda of agreement between State and DOD regarding coordination of U.S. military support to posts during evacuations. We interviewed State officials at headquarters, including from relevant regional bureaus and other offices and groups that assist posts during crises and evacuations, and at four overseas posts. Further, we interviewed officials via secure video conferences at two additional posts and a DOD combatant command to discuss State policies and procedures that define their roles in crisis and evacuation preparedness. To determine the amount State had spent on evacuation-related expenses, we assessed State-provided expenditure data from the K Fund by totaling the amounts reported for overseas post evacuations that took place in fiscal years 2010–2016; we did not conduct a financial audit of the expenditure data. The K Fund is used to cover post evacuation- related expenditures. State provided K Fund data on overseas post evacuations that it collects and tracks through its Global Financial Management System for these years. We assessed the reliability of these data by querying knowledgeable State officials about them. We determined that the data were sufficiently reliable to present State’s expenditures on evacuations in fiscal years 2010 through 2016. To assess State’s implementation of preparedness processes for crises and evacuations at overseas posts, we conducted several analyses. First, to assess the extent to which overseas posts annually updated EAPs within required time frames, we reviewed DS data to identify the dates when overseas posts completed the required annual updates of their EAPs for fiscal years 2013–2016. To assess the reliability of DS data on when posts completed their annual EAP updates, we performed basic logic checks on the data provided and reviewed DS’s responses to a series of data reliability questions. We concluded that the DS data on EAP annual updates were sufficiently reliable for the purposes of our report. Second, to determine the extent to which DS met requirements to fully review key sections of EAPs submitted by overseas posts, we requested documentation from DS on the reviews completed, including who conducted them and what deficiencies, if any, were found. Third, we analyzed a nongeneralizable, judgmental sample of 20 post EAPs that DS had reviewed and approved to assess whether this sample of EAPs contained evidence that key EAP sections, as identified by DS, had been updated. We selected the sample of post EAPs to ensure that we examined EAPs from posts that had experienced evacuations or suspended operations since September 2012, whose evacuations or suspended operations that had occurred for a variety of reasons (e.g., natural disasters as well as security threats), with different statuses regarding accompaniment of family members, and from different geographic regions. For all 20 EAPs, we examined the dates indicating each key section’s most recent update to determine if the overseas post had reviewed and updated the information within required time frames. The dates we reviewed are updated by State’s current electronic system for generating and updating EAPs whenever a section of the EAP is edited and put through the approval process for republication. We reviewed available unclassified and classified portions of the 20 EAPs requested. However, the classified and unclassified portions of these EAPs were not current as of the same date; therefore, we restricted our analysis to the unclassified portions. By reviewing the available unclassified portions of these EAPs, we were able to assess an average of over 70 percent of the 27 key EAP sections for the 20 EAPs in our nongeneralizable sample. State officials explained that each overseas post determines which portions of its EAP should be classified. The portions of EAPs that were classified varied by post—both the number of portions that were classified and which ones—due to the differing situations and risks faced by each post. To assess the degree to which the EAPs are readily usable in emergency situations, we interviewed staff at overseas posts and State headquarters about the utility of EAPs in emergency situations. In addition, for the sample of 20 EAPs we reviewed, we determined the average number of pages of those documents. Fourth, to understand the extent to which posts have complied with requirements to conduct drills intended to prepare them for crises and evacuations, we reviewed DS’s drilling database for overseas posts for fiscal years 2013–2016. RSOs report completion of their post’s drills into DS’s RSO Security Management Console, which logs the drill records into a drilling database maintained by DS. The data elements we assessed from the drilling database were for overseas posts that reported completing required drills for fiscal years 2013–2016. DS officials indicated that some posts may be underreporting completion of their required drills. In addition, DS is unable to confirm that all drills completed by posts for fiscal years 2013–2016 were reported in DS’s RSO Security Management Console. Consequently, the data elements we assessed from the drilling database do not fully capture the extent to which drills might have been completed at posts for fiscal years 2013–2016. In analyzing the data, we also requested and received from DS information on those posts that were rated high or critical for terrorism or political violence on its Security Environment Threat List for fiscal years 2013– 2016, as those posts have more frequent annual drilling requirements. Upon reviewing the Security Environment Threat List data along with the data on posts from the drilling database, we found 23 posts with potential data anomalies. We sent DS follow-up questions to clarify these anomalies and received responses from DS. To assess the reliability of the drilling database, we performed basic logic checks on the database and reviewed State’s responses to a series of data reliability questions. We concluded that, although State does not independently verify the accuracy of data reported within DS’s RSO Security Management Console to ensure its accuracy or validity, the data are sufficiently reliable for the purposes of reviewing which overseas posts reported completing required annual drills for fiscal years 2013-2016. Fifth, to determine the extent to which overseas posts that had experienced evacuations complied with requirements to submit lessons learned reports to State headquarters following the termination of an authorized or ordered departure, we requested from State officials at headquarters any required lessons learned reports submitted by posts following evacuations for fiscal years 2013–2016. State was unable to provide us with any lessons learned reports. The performance audit upon which this report is based was conducted from March 2016 to June 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate, evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with State from June 2017 to July 2017 to prepare this version of the original sensitive but unclassified report for public release. This public version was also prepared in accordance with these standards. For fiscal year 2016, 203 overseas posts were required to complete annual updates of their Emergency Action Plans (EAP). Of these, the 17 posts listed below were late in completing their required annual updates. The Foreign Affairs Handbook directs the Department of State’s (State) Bureau of Diplomatic Security (DS) to review the Emergency Action Plans (EAP) annually submitted by overseas posts to ensure that it contains the necessary information. Each EAP for an overseas post includes the main sections, annexes, and appendixes listed below. To conduct the annual reviews, DS Emergency Plans Review Officers in Washington, D.C., use a list of 27 key EAP sections that the program office has determined should be updated each year. The 27 key EAP sections reviewed by DS are also listed below, indicated with a  (key) symbol. Several of the key EAP sections contain related checklists or forms. In addition to the contact named above, Thomas Costa (Assistant Director), Ian Ferguson (Analyst-in-Charge), Mason Thorpe Calhoun, David Dayton, Neil Doherty, Ming Chen, Martin de Alteriis, and Mark Dowling made key contributions to this report.

Summary: From October 2012 to September 2016, State evacuated overseas post staff and family members from 23 overseas posts in response to various threats, such as terrorism, civil unrest, and natural disasters. Overseas posts undergoing evacuations generally experience authorized departure or ordered departure of specific post staff or family members, potentially leading to suspended operations. GAO was asked to review State policies and procedures for evacuating overseas posts. This report examines (1) the processes State has established to prepare posts for crises and to conduct evacuations and (2) State's implementation of preparedness processes for crises and evacuations. GAO reviewed State guidance and documents related to crisis and evacuation preparedness, including a sample of EAPs and State databases on EAP updates and post drills. GAO also interviewed U.S. officials in Washington, D.C., and in six countries selected because of posts' experiences with evacuations. This is the public version of a sensitive report that GAO issued in June 2017. Information that State deemed sensitive has been omitted. The Department of State (State) has established processes to prepare overseas posts for crises and to conduct evacuations. In particular, posts prepare by developing and updating Emergency Action Plans (EAP) and conducting drills. EAPs are to contain information to assist posts in responding to emergencies, such as checklists of response procedures and decision points to help determine when to evacuate post staff or family members. Posts are required to conduct nine types of drills each fiscal year to prepare for crises and evacuations. State also has established processes for conducting post evacuations. Following an evacuation, post staff are required to transmit an after-action report identifying lessons learned to State headquarters. State has gaps in its crisis and evacuation preparedness for overseas posts. In fiscal years 2013–2016, almost a quarter of posts, on average, were late completing required annual EAP updates. While the completion rate improved from 46 percent to 92 percent of posts completing updates on time in fiscal years 2013 and 2016, respectively, GAO's review of a nongeneralizable sample of EAPs from 20 posts that had been approved by State's Bureau of Diplomatic Security showed that only 2 of 20 had updated all key EAP sections. GAO also found that EAPs are viewed as lengthy and cumbersome documents that are not readily usable in emergency situations, as required. In addition, GAO found that, on average for fiscal years 2013–2016, posts worldwide reported completing 52 percent of required annual drills; posts rated high or critical in political violence or terrorism reported completing 44 percent of these drills. As shown in the figure below, 78 percent of posts reported completing duck and cover drills, but only 36 percent of posts reported completing evacuation training drills. Overall, less than 4 percent of posts reported completing all required drills during fiscal years 2013-2016. In addition, although posts are required to transmit an after-action report listing lessons learned to State headquarters following evacuations, no such reports were submitted in fiscal years 2013–2016. Taken together, the gaps in State's crisis and evacuation preparedness increase the risk that post staff are not sufficiently prepared to handle crisis and emergency situations. In GAO's sensitive report, GAO made five recommendations to State focused on strengthening accountability for completion and review of posts' annual EAP updates and required emergency drills, enhancing the usability of EAPs, and ensuring that lessons learned reports are completed. State concurred with all five recommendations and described actions planned or under way to address them.