IRS’s mission is to provide America’s taxpayers top-quality service by helping them understand and meet their tax responsibilities and by applying the tax law with integrity and fairness to all. To fulfill this mission, IRS has more than 100,000 employees deployed among more than 600 offices nationwide and in select international cities. Some of these offices are part of eight IRS campuses, which have the physical facilities for processing tax forms and some of the facilities to respond to customer inquiries. In response to the increased electronic filing of taxes, IRS is consolidating the physical facilities it uses for processing tax forms, also called processing centers. The rest of IRS’s work is completed in noncampus offices and on-site at taxpayer offices, such as large corporations. Following the IRS Restructuring and Reform Act of 1998, IRS organized itself into four business units to serve different types of taxpayers. The Wage and Investment (W&I) business unit works with individual taxpayers; the Small Business/Self-Employed (SB/SE) business unit works with full or partially self employed individuals and small businesses; the Large and Mid-Size Business (LMSB) works with corporations and partnerships with assets greater than $10 million; and the Tax Exempt and Government Entities (TE/GE) business unit works with employee plans, tax exempt organizations, and governments. The concept of resilience has gained particular importance and application in a number of areas of federal planning. Both the Congress and executive branch agencies have addressed resilience in relation to the importance of the recovery of the nation’s critical infrastructure from damage. Accordingly, most of the current focus is on assets, systems, and networks rather than agencies or organizations. In February 2006, the Task Force of the Homeland Security Advisory Council defined resiliency as “the capability of a system to maintain its functions and structure in the face of internal and external change and to degrade gracefully when it must.” Later in 2006, the Department of Homeland Security’s National Infrastructure Protection Plan—again focusing on critical infrastructure, not agencies—defined resilience as “the capability of an asset, system, or network to maintain its function during or to recover from a terrorist attack or other incident.” In May 2008, the House Committee on Homeland Security held a series of hearings focusing on resilience at which government and private sector representatives, while agreeing on the importance of the concept, presented a variety of definitions and interpretations of resilience. For the purposes of this report, when we discuss resilience, we will be referring to organizational resilience. At the agency level, the current focus is primarily on continuity of operations and the recently issued Federal Continuity Directives. According to the Federal Continuity Directive 1, “an organization’s continuity capability—its ability to perform its essential functions continuously—rests upon key components and pillars, which are in turn built on the foundation of continuity planning and program management.” The Federal Continuity Directive states that an organization’s resilience is directly related to the effectiveness of its continuity capability. In contrast to continuity of operations, organizational resilience looks at more than just essential functions, and accordingly, we have developed the five categories described below. Because there is no widely accepted definition, we defined organizational resilience for the purposes of our report and developed a framework to assess a federal agency’s resilience. Organizational resilience is the quality that would enable an organization to restore itself or thrive following a disruption that has the potential to substantially compromise the organization’s ability to accomplish its mission. A highly resilient organization is identified by the speed and agility it demonstrates in achieving a return to its normal state (or new normal state) and its resulting enhanced ability to respond to future disruptions. To make our definition of organizational resilience more practical and observable, we identified 21 attributes particularly associated with resilience and assigned them to five related categories. These categories provide a useful assessment framework. (See figure 1.) These related categories are networked organizations. However, whatever assessments are undertaken, it is important to note that the severity or circumstance of a particular disruption to an organization may be so severe or unusual as to make recovery not attainable even if the organization has evidenced attributes of resilience prior to the disruption. Similarly, given the specific nature of the disruption or the specific circumstances of the disruption, perhaps one attribute relative to others may prove particularly useful in helping the organization to recover successfully. The attributes associated with organizational resilience are discussed in summary below and each attribute is discussed in greater detail in appendix II. Emergency planning identifies disruptions that could potentially affect an organization and defines and tests strategies to face those disruptions or similar challenges. For example, in 2004, the Federal Emergency Management Agency’s (FEMA) Hurricane Pam exercise simulated a category 3 hurricane. In the exercise scenario, 15 to 20 feet of water inundated New Orleans. This scenario was similar to the actual conditions of Hurricane Katrina. Based on this exercise, FEMA was able to implement some strategies which proved helpful during Hurricane Katrina, such as FEMA’s working with hospital and university officials to create temporary medical operations around the state. However, FEMA’s exercise also identified other problems that it did not address, such as the need to plan for evacuating those with special needs. A resilient organization has a workforce that can respond to a range of disruptions with appropriate purpose, initiative, and comfort with change. One aspect of organizational flexibility is an ability to accept change as a learning opportunity. For example, the 9/11 Commission report criticized the Federal Aviation Administration for failing to consider in its planning the possibility of certain types of terrorist attacks. Specifically, the commission determined that if the agency had examined a possible suicide hijacking and reviewed existing security provisions, they could have identified vulnerabilities. According to the commission, agencies tend to accept the status quo, and accept that efforts to identify or fix certain vulnerabilities are too costly, controversial, or disruptive to fix. This inability to tackle necessary change can leave an organization with unaddressed vulnerabilities, as was the case with the Federal Aviation Administration. Additionally, knowing when to change rules helped give federal agencies access to additional resources during the Year 2000 (Y2K) Computing Challenge. Specifically, increased latitude with human capital practices in the federal government allowed agencies to access a larger pool of skilled employees that could be allocated as needs arose. The Office of Personnel Management recognized that personnel would need to be increased to meet Y2K compliance and provided additional, more flexible hiring authorities for agencies who needed employees to work on the conversion. This included changing some authorities for re-hiring federal retirees, exceptions on limitations on premium pay, and providing retention allowances. Prior GAO work credited creative human capital decisions and an adequate pool of human resources as contributing to the federal government’s ability to meet the Y2K challenge. Leaders who demonstrate respect for their employees and are accountable for results are more likely to garner the employee commitment that will be needed after a disruption that substantially compromises the organization’s ability to accomplish its mission. Additionally, when leadership abilities are distributed broadly through the workforce, an organization is more likely to be resilient. For example, the Senate Homeland Security and Governmental Affairs Committee found that, after Hurricane Katrina, the Coast Guard had empowered front-line leaders to make decisions when they needed to be made, which it found was perhaps more important to their resilience than their regular training. Also, once it was known that the September 11 hijackers entered the United States on valid visas, the Department of State devolved leadership authority by empowering consular staff to distinguish legitimate visitors from potential terrorists through antiterrorism training, access to databases with names of potential terrorists, foreign language training, and more staff to handle the workload. Within a workforce that is committed to the organization, individuals are motivated to make significant personal investments and provide the knowledge that may be necessary for organizational success following a disruption. One aspect of employee commitment is understanding the ways that the organization works. One expert referred to this attribute as the ability to “have the organization in your head.” For example, a bipartisan House of Representatives committee reported after Hurricane Katrina that a lack of understanding of the command and control structure among employees slowed and complicated the response effort after the hurricanes. Another key aspect of this category is a workforce with the needed skills to meet the organization’s mission. The committee report also noted that, after Hurricanes Katrina and Rita, the Department of Homeland Security and FEMA were not prepared, in part, due to a lack of experienced and trained staff. Solid internal and external networks can facilitate and strengthen other resilience attributes. For example, having dependable connections will likely expand and expedite an organization’s access to resources when the organization is faced with a disruption. Specifically, being aware of interdependencies, knowing when reinforcement is needed, and being able to communicate among interdependent units can give an organization an extended reach for information, resources, and advice. Furthermore, an organization’s knowledge of its supply chain interdependencies can help identify vulnerabilities, which can inform risk assessments and emergency planning. For example, after the terrorist attacks of September 11, 2001, many companies in the financial sector found that they relied on the same electronic data system backup sites, which were also affected by the attacks. As a result, key institutions realized that their individual plans for preparedness for disasters or other crises significantly affected others, both directly and indirectly. Accordingly, the Securities and Exchange Commission recommended that financial institutions explore the usefulness of coordinated testing of plans. Additionally, the Y2K challenge was met through the collaborative efforts of the Congress, the administration, federal agencies, state and local governments, and the private sector. Had any of these sectors failed to take the Y2K problem seriously, neglected to remedy computer systems, or failed to work together with partners on common issues such as contingency planning, critical services could have been disrupted. Although these five categories of attributes contribute to organizational resilience, all disruptions are individual situations and even a relatively resilient organization may not be able to restore operations under certain circumstances.