Summary
To ensure that essential government services are available in emergencies--such as terrorist attacks, severe weather, or building-level emergencies-- federal agencies are required to develop continuity of operations (COOP) plans. Responsibility for formulating guidance on these plans and for assessing executive branch COOP capabilities lies with the Federal Emergency Management Agency (FEMA), under the Department of Homeland Security. FEMA guidance, Federal Preparedness Circular (FPC) 65 (July 1999), provides elements of a viable COOP capability, including the requirement that agencies identify their essential functions. GAO was asked to determine the extent to which (1) major civilian executive branch agencies have identified their essential functions and (2) these agencies' COOP plans follow FEMA guidance.
From an assessment of 34 COOP plans against FEMA guidance, GAO found that most agencies' plans identified at least one function as essential. However, the functions identified in each plan varied widely in number-- ranging from 3 to 399--and included functions that appeared to be of secondary importance, while at the same time omitting programs that had been previously defined as high-impact programs. (Examples of these highimpact programs are Medicare, food stamps, and border inspections.) For example, one department included "provide speeches and articles for the Secretary and Deputy Secretary," among its essential functions, but did not include 9 of 10 high-impact programs for which it is responsible. Several factors contributed to these shortcomings: FPC 65 did not provide specific criteria for identifying essential functions; FEMA did not review the essential functions identified when it assessed COOP planning; and it did not conduct tests or exercises to confirm that the essential functions were correctly identified. Unless agencies' essential functions are correctly and completely identified, their COOP plans may not effectively ensure that the most vital government services can be maintained in an emergency. Although all but three of the agencies reviewed had developed and documented some of the elements of a viable COOP plan, none of the agencies could demonstrate that they were following all the guidance in FPC 65. There is a wide variation in the number of agencies that addressed various elements identified in the guidance. A contributing cause for the deficiencies in agency COOP plans is the level of FEMA oversight. In 1999, FEMA conducted an assessment of agency compliance with FPC 65, but it has not conducted oversight that is sufficiently regular and extensive to ensure that agencies correct the deficiencies identified. Because the resulting COOP plans do not include all the elements of a viable plan as defined by FPC 65, agency efforts to provide services during an emergency could be impaired.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
Linda D. Koontz
Government Accountability Office: Information Technology
(202) 512-7487
Recommendations for Executive Action
Recommendation: To ensure that agencies can continue operations in emergencies and are prepared for the governmentwide exercise planned for May 2004, the Secretary of Homeland Security should direct the Under Secretary for Emergency Preparedness and Response to take steps to ensure that agencies that do not have COOP plans develop them by May 1, 2004.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Implemented
Comments: DHS/FEMA required agencies participating in a 2006 interagency continuity exercise to have current continuity plans in place. Two of the three Agencies identified in our recommendation--the Department of Energy and National Science Foundation--completed their plans in preparation for the 2006 exercise. The third agency (NASA) did not participate in the exercise. However, it completed its plan in early 2008.
Recommendation: The Secretary should direct the Under Secretary to take steps to improve the oversight of COOP planning by ensuring that agencies correct the deficiencies in individual COOP plans identified here, as well as those identified in previous assessments.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Not Implemented
Comments: DHS continues development of a system to track the status of individual agency COOP capabilities. However, this system has again been delayed. DHS/FEMA currently plans for the system to be functional early in calendar 2009.
Recommendation: The Secretary should direct the Under Secretary to take steps to improve the oversight of COOP planning by conducting assessments of agency continuity plans that include independent verification of agency-provided information, as well as an assessment of the essential functions identified and their interdependencies with other activities.
Agency Affected: Department of Homeland Security: Directorate of Emergency Preparedness and Response
Status: Implemented
Comments: In June 2007, the president issued Homeland Security Presidential Directive 20, which, among other things, assigned the Secretary of Homeland Security responsibility for coordinating continuity efforts, including biennial assessments of individual agency continuity capabilities. Also, in February 2008, the Secretary of Homeland Security published a Federal Continuity Directive that outlined an inter-agency process for validating agency-proposed essential functions. FEMA also included assessments of individual agency plans in a 2006 interagency continuity exercise. Together, the implementation of these policies should help improve oversight of agency continuity capabilities and enhance agencies' abilities to continue providing essential services during emergencies.
