This is the accessible text file for GAO report number GAO-08-185 
entitled 'Continuity Of Operations: Selected Agencies Tested Various 
Capabilities during 2006 Governmentwide Exercise' which was released on 
December 19, 2007.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately.

United States Government Accountability Office: 
GAO: 

Report to the Ranking Member, Committee on Oversight and Government 
Reform, House of Representatives:

November 2007:

Continuity Of Operations:

Selected Agencies Tested Various Capabilities during 2006 
Governmentwide Exercise:

GAO-08-185: 

GAO Highlights:

Highlights of GAO-08-185, a report to the Ranking Member, Committee on 
Oversight and Government Reform, House of Representatives. 

Why GAO Did This Study:

To ensure the availability of essential government services in 
emergencies, federal agencies are required to develop continuity of 
operations (COOP) plans. The Federal Emergency Management Agency 
(FEMA), under the Department of Homeland Security (DHS), is responsible 
for disseminating guidance to federal agencies on developing plans, as 
well as conducting government-wide exercises every other year to assess 
federal continuity readiness. In June 2006, FEMA conducted an exercise 
called Forward Challenge 06, to allow agencies to activate COOP plans, 
deploy essential personnel to alternate facilities, and perform 
essential functions. GAO was asked to describe the extent to which 
agencies tested continuity plans and procedures, personnel, and 
resources during the June 2006 exercise. To do this, GAO selected the 
eight civilian agencies with significant responsibilities during 
national disasters, analyzed agency exercise documentation, and 
interviewed officials to determine which test and exercise activities 
each agency included in its participation.

What GAO Found: 

During Forward Challenge 06, the eight agencies GAO reviewed performed 
various test and exercise activities related to COOP plans and 
procedures, personnel, and resources. In many cases, agencies provided 
documentation to substantiate the specific test and exercise activities 
performed. However, in other cases, agencies reported conducting such 
activities but did not provide supporting documentation. Finally, 
agencies also reported not testing or exercising certain capabilities 
during the exercise. In these cases, participating agencies may have 
addressed these capabilities in other tests and exercises conducted 
during the year, which were outside the scope of GAO’s review. The 
table below presents a summary of the extent to which agencies 
conducted various test and exercise activities during the 
governmentwide exercise.

Agencies’ inability to substantiate many of the test and exercise 
activities that they reported performing during Forward Challenge 06 
was due in part to the absence of specific guidance on what should be 
documented in such exercises. While FEMA directed participating 
agencies to document issues and requirements for corrective action, 
significant findings, and important observations during the Forward 
Challenge 06 exercise, it did not require participating agencies to 
document the specific activities from their test and exercise programs 
that they conducted during the exercise. Without adequate records of 
what has been tested during a major governmentwide exercise, agencies 
lack assurance that they have adequately tested their continuity 
capabilities at the frequency outlined in FEMA guidance, which may 
limit their ability to fully evaluate their readiness to respond to a 
disruption. In addition, adequate records can reduce the potential 
negative impact of turnover in key personnel due to attrition or change 
in administration, and strengthen agency internal control capabilities. 

What GAO Recommends:

GAO recommends that FEMA require agencies participating in future 
governmentwide exercises to document the specific test and exercise 
activities conducted. In commenting on a draft of this report, DHS 
agreed with GAO’s recommendation and stated that it intends to refine 
its assessment program and improve the level of evaluation 
documentation. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://GAO-08-185]. For more information, contact Linda 
Koontz at (202) 512-6240 or koontzl@gao.gov. 

[End of section] 

Contents: 

Letter: 

Recommendation for Executive Action: 

Agency Comments and Our Evaluation: 

Appendixes: 

Appendix I: October 4, 2007, Briefing to Staff of the Ranking Member, 
House Committee on Oversight and Government Reform: 

Appendix II: Comments from the Department of Homeland Security

Abbreviations: 

COOP: continuity of operations: 

DHS: Department of Homeland Security: 

FEMA: Federal Emergency Management Agency: 

[End of section] 

United States Government Accountability Office: Washington, D.C. 20548: 

November 19, 2007:

The Honorable Tom Davis: Ranking Member: 
Committee on Oversight and Government Reform: House of Representatives: 

Dear Mr. Davis,

As you know, essential government services can be interrupted by a 
range of events, including terrorist attacks, severe weather, or 
building-level emergencies. To ensure that these services are available 
in emergencies, federal agencies are required to develop continuity of 
operations (COOP) plans. The Federal Emergency Management Agency 
(FEMA), under the Department of Homeland Security (DHS), is responsible 
for disseminating guidance to federal agencies on developing COOP plans 
as well as conducting governmentwide exercises every other year as an 
assessment of federal continuity readiness. In June 2006, FEMA 
conducted an exercise, called Forward Challenge 06, designed to allow 
agencies to activate their plans, deploy essential personnel to 
alternate facilities, and perform essential functions.

We previously reported on COOP test, training, and exercise 
requirements at your request,[Footnote 1] and determined that agency 
plans did not generally comply with FEMA's guidance. We reported that 
although a governmentwide continuity exercise hosted by FEMA in May 
2004 helped agencies comply with test, training, and exercise 
requirements, few agencies had documented that they conducted internal 
tests, training, and exercises at the recommended frequency.

You requested that we evaluate agency participation in Forward 
Challenge 06. Specifically, we agreed to describe the extent to which 
selected agencies tested their continuity plans and procedures, 
personnel, and resources during the governmentwide exercise. For 
purposes of our review, we selected eight civilian agencies because of 
their significant responsibilities under the National Response Plan, 
which outlines the roles of federal agencies in response to national 
disasters. Specifically, these eight agencies were designated as 
coordinators of emergency support functions and as such, have 
responsibilities for coordinating federal interagency support to states 
and other federal agencies during emergencies of national significance. 
For example, DHS is responsible for coordinating urban search and 
rescue efforts.[Footnote 2]

To address our objective, we obtained and reviewed documentation 
regarding test and exercise activities during Forward Challenge 06 from 
the selected agencies. We analyzed the documentation and interviewed 
agency officials to determine which of the test and exercise activities 
each agency included in its participation in Forward Challenge 06.

We conducted our review from May 2006 through September 2007 in 
accordance with generally accepted government auditing standards. The 
extended period of time for our analysis was due to a delay in 
receiving documentation from DHS. First, 2 days before the exercise, we 
were informed by DHS that we would not be able to observe agencies' 
participation, despite a previous agreement to do so. Subsequently, we 
requested documentation on agencies' participation. As we testified in 
April 2007, this documentation was not provided until March of this 
year.[Footnote 3] Based on our review of the documentation, we were 
able to address the objective.

On October 4, 2007, we provided your office with a briefing on the 
results of this review. This report provides the briefing slides to you 
and officially transmits our recommendation to the Secretary of 
Homeland Security. The slides from the briefing are included as 
appendix I.

In summary, we determined that during Forward Challenge 06, the eight 
agencies performed various test and exercise activities related to COOP 
plans and procedures, personnel, and resources. In many cases, agencies 
provided documentation to substantiate the specific test and exercise 
activities performed. However, in other cases, agencies reported 
conducting such activities but did not provide supporting 
documentation. Finally, agencies also reported not testing or 
exercising certain capabilities during the exercise. In these cases, 
participating agencies may have addressed these capabilities in other 
tests and exercises conducted during the year, which were outside the 
scope of our review.

Agencies' inability to substantiate many of the test and exercise 
activities that they reported performing during Forward Challenge 06 
was due in part to the absence of specific guidance on what should be 
documented in such exercises. While FEMA directed participating 
agencies to document issues and requirements for corrective action, 
significant findings, and important observations during the Forward 
Challenge 06 exercise, it did not require participating agencies to 
document the specific activities from their test and exercise programs 
that they conducted during the exercise. Without adequate records of 
what has been tested during a major governmentwide exercise, agencies 
lack assurance that they have adequately tested their continuity 
capabilities at the frequency outlined in FEMA guidance, which may 
limit their ability to fully evaluate their readiness to respond to a 
disruption. In addition, adequate records can reduce the potential 
negative impact of turnover in key personnel due to attrition or change 
in administration, and strengthen agency internal control capabilities.

Recommendation for Executive Action:

To better assist agencies in assessing their readiness to respond to 
disruptions, we recommend that the Secretary of Homeland Security 
direct the FEMA Director to require agencies participating in future 
governmentwide exercises to document the specific test and exercise 
activities conducted.

Agency Comments and Our Evaluation:

We received written comments on a draft of our report from the Director 
of the Department of Homeland Security's GAO/OIG Liaison office. (These 
comments are reproduced in app. II) In commenting on the report, the 
Director stated that the department agreed with our recommendation. In 
addition, the Director stated that the department had already complied 
with the recommendation during Forward Challenge 06, citing the general 
guidance provided in Federal Preparedness Circular 65[Footnote 4] as 
well as evaluations compiled by internal and external evaluators during 
the exercise. The Director stated further that the level of 
documentation was higher than we reported as demonstrated by external 
evaluations that he said did not meet GAO audit standards.

We disagree that FEMA provided adequate guidance on documentation and 
that the level of documentation was higher than we reported. While the 
guidance provided general direction to agencies to document their test, 
training, and exercise programs, it did not specify that agencies were 
to document the extent to which each essential function and supporting 
capability was tested during this exercise. In addition, we considered 
the results of the exercise evaluations in our analysis; but in many 
cases, these evaluations did not specify which essential functions and 
supporting capabilities were tested during the exercise. The value of 
such documentation is not to meet GAO audit standards, as the Director 
asserts. Instead, as noted in our briefing, agencies need to fully 
document their exercise activities to ensure that they are following 
FEMA guidance, to mitigate the effects of potential staff turnover, and 
to ensure appropriate internal controls. Nevertheless, the Director 
stated that FEMA intends to refine its assessment program, giving 
specific attention to improving the level of evaluation documentation. 
The Director also included technical comments that we have addressed, 
as appropriate.

As agreed with your staff, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days 
after its date. At that time, we will send copies of this report to the 
Secretary of Homeland Security, and other interested parties. This 
report will also be available at no charge on the GAO Web site at 
[hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-6240 or koontzl@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. Key contributions to this report were 
made by James R. Sweetman, Jr., Assistant Director; Lorne Cammack; Alma 
Cole; Barbara Collier; Matthew Grote; Sairah Ijaz; Nick Marinos; Morgan 
Walts; and Kim Zelonis.

Sincerely yours, 

Signed by: 

Linda D. Koontz: 
Director, Information Management Issues:

[End of section]

Appendix I (Slides): October 4, 2007, Briefing to Staff of the Ranking 
Member, House Committee on Oversight and Government Reform:

Continuity of Operations: Selected Agencies Tested Various
Capabilities During 2006 Governmentwide Exercise: 

Briefing for the Staff of the Ranking Member: 
Committee on Oversight and Government Reform: 
House of Representatives: 
October 4, 2007: 

Outline of Briefing: 

Introduction: 

Objective, Scope, and Methodology: 

Results in Brief: 

Background: 

Agencies Tested Various Capabilities: 
* Plans and Procedures; 
* Personnel; 
* Resources. 

Conclusions: 

Recommendation: 

Agency Comments and our Evaluation: 

Attachment 1: Agencies Reviewed: 

Attachments 2 to 9: Individual Agency Results: 

[End of outline] 

Introduction: 

Events in recent years have underscored the need for federal agencies 
to be prepared to respond effectively to a variety of emergency 
situations. Specifically, federal operations and facilities have
been disrupted by a range of events, including: 

* the terrorist attacks on September 11, 2001, and at Oklahoma City on 
April 19, 1995; 

* severe weather events, such as hurricanes Katrina, Rita, and Wilma in 
2005; and; 

* building-level events, such as asbestos contamination at the 
Department of the Interior’s headquarters. 

Such disruptions, particularly if prolonged, can lead to interruptions 
in essential government services. Prudent management, therefore, 
requires that federal agencies develop plans for ensuring the
continuity of such services in emergency situations. These are referred 
to as continuity of operations (COOP) plans. These plans lay out an 
agency’s approach to maintaining services, ensuring proper authority 
for government actions, and protecting vital assets. 

Presidential Decision Directive 67 established the Federal Emergency 
Management Agency (FEMA) as the lead agency for COOP planning across 
the executive branch. FEMA's Federal Preparedness Circular (FPC) 65 
provides guidance to federal agencies on developing COOP plans and 
carrying out test, training, and exercise programs to ensure their 
effectiveness. The guidance states that agencies are to test and 
exercise plans and procedures, personnel, and resources at specific
frequencies during each year. These tests and exercises should include 
the following capabilities: 

Plans and Procedures: Each agency is to exercise the capability to 
continue its essential functions—those functions that enable it to 
provide vital services, exercise civil authority, maintain safety, and 
sustain the economy during an emergency—on an annual basis. In 
addition, each agency should test its continuity plan’s activation and 
notification procedures on a quarterly basis, including notifying COOP 
personnel (that is, staff needed to perform essential functions, as
designated by the agency), non-COOP agency employees, the alternate 
facility, and the FEMA Operations Center.[Footnote 5] For each exercise 
performed, a debriefing should be conducted for participants to 
identify weaknesses in plans and procedures and recommend plan 
revisions. 

Personnel: Each agency should conduct an annual exercise that involves 
the movement of COOP personnel to the agency alternate facility 
[Footnote 6] to ensure the agency’s ability to perform essential 
functions during an emergency. 

Resources: Each agency should conduct tests of resources required to 
perform essential functions. These tests should include quarterly tests 
of its communications capabilities, such as secure and non-secure 
voice, video, fax, and data connectivity, Internet access, and email; 
as well as annual exercises of its ability to communicate with internal 
and external key contacts. Each agency should also test access to vital 
records and critical information systems (electronic and hard-copy 
records and information systems needed to support essential functions) 
semi-annually, and backup power annually. 

FPC 65 further requires FEMA to conduct a governmentwide continuity 
exercise every other year as a tool to assess and validate federal 
continuity readiness. In June 2006, FEMA conducted Forward Challenge 
06, a governmentwide continuity exercise designed to allow agencies to 
activate their COOP plans, deploy essential personnel to alternate 
facilities, and perform essential functions as a means of assessing 
their mission readiness. FEMA guidance for this exercise required 
agencies to respond appropriately to the exercise scenarios using their 
existing plans. Agencies also had the option to test additional 
capabilities or address internal scenarios if they did not interfere 
with the overall exercise or the activities of other agencies. 

Objective, Scope, and Methodology: 

As agreed with your office, our objective was to describe the extent to 
which selected agencies tested their continuity plans and procedures, 
personnel, and resources during the Forward Challenge 06 governmentwide 
exercise. 

For purposes of our review, we selected eight civilian agencies because 
of their significant responsibilities under the National Response Plan, 
which outlines the roles of federal agencies in response to national 
disasters.[Footnote 7] Specifically, these eight agencies were 
designated as coordinators of emergency support functions and as such, 
have responsibilities for coordinating federal interagency support to 
states and other federal agencies during emergencies of national 
significance. For example, DHS is responsible for coordinating urban 
search and rescue efforts. The eight selected agencies and their 
respective responsibilities for emergency support functions are listed 
in attachment 1. 

To address our objective, we obtained and reviewed documentation 
regarding test and exercise activities during Forward Challenge 06 from 
the agencies. Documentation included internal and external agency after 
action reports and results of external evaluations conducted during the
exercise. We analyzed the documentation to determine which of the test 
and exercise activities each agency included in its participation in 
Forward Challenge 06 and interviewed officials about gaps in their 
documentation. We then created summary tables outlining activities that 
were supported by documentation (identified as “tested and 
documented”), and activities that agencies reported as having conducted 
during the exercise but for which they did not provide documentation 
(identified as “tested but not documented”). 

We did not identify and assess other tests and exercises that agencies 
may have conducted during the year and thus, did not assess their 
compliance with the requirements in FPC 65. As a result, we are 
providing only a description of the capabilities tested during Forward 
Challenge 06. 

We conducted our review from May 2006 through September 2007 in 
accordance with generally accepted government auditing standards. The 
extended period of time for our analysis is due to a delay in receiving 
documentation from DHS. First, we were informed by DHS two days before 
the exercise that we would not be able to observe agencies’ 
participation, despite a previous agreement to do so. Subsequently, we 
requested documentation on agencies’ participation. As we testified in
April 2007, this documentation was not provided until March of this 
year.[Footnote 8] Based on our review of the documentation, we were 
able to address the objective. 

Results in Brief: 

During Forward Challenge 06, the eight agencies performed various test 
and exercise activities related to COOP plans and procedures, 
personnel, and resources. In many cases, agencies provided 
documentation to substantiate the specific test and exercise activities 
performed. However, in other cases, agencies reported conducting such 
activities but did not provide supporting documentation. Finally, 
agencies also reported not testing or exercising certain capabilities 
during the exercise. In these cases, participating agencies may have 
addressed these capabilities in other tests and exercises conducted 
during the year, which were outside the scope of our review. The
following table presents a summary of the extent to which agencies 
conducted various test and exercise activities during the 
governmentwide exercise. 

Agency Testing and Exercising of COOP Plans and Procedures, Personnel, 
and Resources: 

Category: Plans and Procedures; 
Test and exercise activities: Essential Functions; 
Tested and documented: 4; 
Tested but not documented: 4; 
Not tested during exercise[Footnote 9]: 0. 

Category: Plans and Procedures; 
Test and exercise activities: Activation and Notification: Activation; 
Tested and documented: 4; 
Tested but not documented: 3; 
Not tested during exercise[Footnote 9]: 1. 

Category: Plans and Procedures; 
Test and exercise activities: Activation and Notification: 
Notification—COOP Personnel; 
Tested and documented: 3; 
Tested but not documented: 4; 
Not tested during exercise[Footnote 9]: 1. 

Category: Plans and Procedures; 
Test and exercise activities: Activation and Notification: 
Notification—Non-COOP Personnel; 
Tested and documented: 1; 
Tested but not documented: 5; 
Not tested during exercise[Footnote 9]: 2. 

Category: Plans and Procedures; 
Test and exercise activities: Activation and Notification: 
Notification—Alternate Facility; 
Tested and documented: 2; 
Tested but not documented: 2; 
Not tested during exercise[Footnote 9]: 4. 

Category: Plans and Procedures; 
Test and exercise activities: Activation and Notification: 
Notification—FEMA Operations Center; 
Tested and documented: 6; 
Tested but not documented: 1; 
Not tested during exercise[Footnote 9]: 1. 

Category: Plans and Procedures; 
Test and exercise activities: Debriefing; 
Tested and documented: 8; 
Tested but not documented: 0; 
Not tested during exercise[Footnote 9]: 0. 

Category: Personnel; 
Test and exercise activities: COOP Personnel Participation; 
Tested and documented: 5; 
Tested but not documented: 3; 
Not tested during exercise[Footnote 9]: 0. 

Category: Resources: 
Test and exercise activities: Interoperable Communications: 
Communications Capabilities; 
Tested and documented: 8; 
Tested but not documented: 0; 
Not tested during exercise[Footnote 9]: 0. 

Category: Resources: 
Test and exercise activities: Interoperable Communications: 
Communication with Internal Contacts; 
Tested and documented: 6; 
Tested but not documented: 2; 
Not tested during exercise[Footnote 9]: 1; 

Category: Resources: 
Test and exercise activities: Interoperable Communications: 
Communication with External Contacts; 
Tested and documented: 4; 
Tested but not documented: 4; 
Not tested during exercise[Footnote 9]: 0. 

Category: Resources: 
Test and exercise activities: Vital Records; 
Tested and documented: 6; 
Tested but not documented: 2; 
Not tested during exercise[Footnote 9]: 0. 

Category: Resources: 
Test and exercise activities: Backup Power; 
Tested and documented: 1; 
Tested but not documented: 1; 
Not tested during exercise[Footnote 9]: 6. 

Source: GAO. 

[End of table] 

While FEMA directed participating agencies to document issues and 
requirements for corrective action, significant findings, and important 
observations during the Forward Challenge 06 exercise, it did not 
require participating agencies to document the specific activities from 
their test and exercise programs that they conducted during the 
exercise. The absence of specific guidance on what agencies should 
document contributed to the lack of documentation to support many of 
the test and exercise activities agencies described undertaking during 
Forward Challenge 06. Without adequate records of what has been tested 
during a major governmentwide exercise, agencies lack assurance that 
they have adequately tested their continuity capabilities at the 
frequency outlined in FEMA guidance, which may limit their ability to 
fully evaluate their readiness to respond to a disruption. In addition, 
adequate records can reduce the potential negative impact of turnover 
in key personnel due to attrition or change in administration, and 
strengthen agency internal control capabilities. 

Results in Brief: Recommendation and Agency Comments; 

We are making a recommendation to the Secretary of Homeland Security 
aimed at improving the ability for agencies to fully assess their 
readiness to respond to disruptions by documenting the specific test 
and exercise activities they conduct during future governmentwide 
exercises. 

In written comments on a draft of this briefing, the Director of the 
Department of Homeland Security’s GAO/OIG Liaison office stated that 
the Department agreed with our recommendation but has already provided 
adequate guidance on documentation requirements. Among other things, 
the Director also stated that that the level of documentation was 
higher than we reported as demonstrated by external evaluations that 
the Director said did not meet GAO audit standards. We disagree that 
FEMA provided adequate guidance on documentation and that the level of 
documentation was higher than we reported. FEMA’s guidance did not 
specify that agencies were to document the extent to which each 
essential function and supporting capability was tested. Similarly, the 
results of the evaluations did not document the extent to which 
agencies tested these functions and capabilities. The value of such 
documentation is not to meet GAO audit standards, as the Director 
asserts. Instead, as described in our briefing, agencies need to fully 
document their exercise activities to ensure that they are following 
FEMA guidance, mitigate the effects of potential staff turnover, and 
ensure appropriate internal controls. Nevertheless, the Director stated 
that FEMA intends to refine its assessment program, giving specific 
attention to improving the level of evaluation documentation. In 
addition, the Director provided technical comments, which we 
incorporated as appropriate. 

Background: Guidance; 

Testing and exercising continuity capabilities are essential to 
demonstrating, assessing, and improving the ability of agencies to 
execute their COOP plans. Tests and exercises serve to assess,
validate, or identify for subsequent correction specific aspects of 
COOP plans, procedures, and resources. FPC 65 outlines various tests 
and exercises of continuity capabilities (including plans and
procedures, personnel, and resources) that agencies are to conduct 
throughout the year; they are not required to perform these activities 
during a governmentwide exercise. These activities include the 
following: 

Plans and Procedures: 
* Essential functions. On an annual basis, agency personnel must 
exercise the agency’s capability to continue its essential functions. 

* Activation and notification. In order to ensure proper activation of 
COOP plans, agencies must have a decision-making process for activating 
their plans, as well as procedures for notifying personnel designated 
as being on the COOP team (COOP personnel), non-COOP agency employees, 
the alternate facility, and the FEMA Operations Center. The guidance
calls for each agency to test such procedures on a quarterly basis. 

* Debriefing. For each exercise performed by an agency, a comprehensive 
debriefing for participants should be conducted to identify systemic 
weaknesses in plans and procedures and recommend COOP plan revisions. 

Personnel: 

* COOP personnel participation. Each agency should conduct an annual 
exercise that involves the movement of COOP personnel to the agency 
alternate facility to ensure the agency’s ability to perform essential 
functions during an emergency. 

Resources: 

* Interoperable communications. Each agency should conduct quarterly 
tests of its communications capabilities and annually exercise its 
ability to communicate with internal and external key contacts. 

* Vital records and critical information systems.[Footnote 10] Each 
agency should perform semi-annual tests of plans for the recovery of 
vital records and critical information systems at alternate facilities. 

* Backup power. Each agency should ensure that its alternate facility 
has the ability to run emergency power to allow essential functions to 
continue in any environment. The guidance states that such 
infrastructure systems are to be tested on an annual basis. 

Background: Forward Challenge 06; 

FPC 65 requires FEMA to conduct a governmentwide exercise every other 
year as a tool to assess and validate federal continuity readiness. 
From June 19 to 22, 2006, FEMA conducted Forward Challenge 06, a 
governmentwide continuity exercise designed to allow agencies to 
activate their COOP plans, deploy essential personnel to alternate 
facilities, and perform essential functions as a means of assessing 
their mission readiness. FEMA guidance for this exercise required 
agencies to respond appropriately to the exercise scenarios using their 
existing plans. Agencies also had the option to test additional 
capabilities or address internal scenarios if they did not interfere 
with the overall exercise or the activities of other agencies. 

The scenario for the exercise involved the simulation of agency 
continuity response to heightened alert conditions involving weapons of 
mass destruction within the United States. During the exercise, each 
participating agency’s activities were observed by an official from 
another agency. These external evaluators provided the agency they 
observed with a checklist indicating which activities it included 
during its participation in the exercise. Forward Challenge 06 was 
conducted as a component of TOPOFF 4, a national homeland security 
preparedness exercise sponsored by DHS designed to, among other things, 
exercise the national ability to prevent, respond to, and recover from 
a weapon of mass destruction incident. 

Background: Previous GAO Reports; 

We previously reported on COOP test, training, and exercise 
requirements at the request of the Chairman, House Committee on 
Government Reform,[Footnote 11] and determined that agency plans did not
generally comply with FEMA’s guidance regarding tests, training, and 
exercises. We reported that although a governmentwide COOP exercise 
hosted by FEMA in May 2004 helped agencies comply with test, training, 
and exercise requirements, few agencies had documented that they 
conducted internal tests, training, and exercises at the recommended 
frequency. We recommended that FEMA develop a methodology for 
individual COOP assessments that independently evaluates executive
branch agencies’ compliance with FPC 65, including the extent to which 
agencies plan, conduct, and document the necessary tests and exercises 
at the appropriate scope and frequency. 

In response to this recommendation, before Forward Challenge 06 FEMA 
coordinated independent evaluations of participating agency COOP plans 
in an effort to review the extent to which elements of a viable COOP 
capability were addressed. These assessments included a review of 
whether agency plans called for test, training, and exercise activities 
at the frequencies outlined in FEMA’s guidance. FEMA included the 
results of these assessments in the individual agency after-action 
reports it prepared following the governmentwide exercise. 

Background: 2008 Continuity Exercise; 

FEMA is currently planning for a governmentwide continuity exercise for 
2008. According to FEMA officials, the continuity exercise will take 
place over 3 days in late April 2008 and will include objectives 
similar to those of Forward Challenge 06. 

Agencies Tested Various Capabilities: 

During Forward Challenge 06, the eight agencies performed various test 
and exercise activities related to COOP plans and procedures, 
personnel, and resources. In many cases, agencies provided 
documentation to substantiate the specific test and exercise activities 
performed. However, in other cases, agencies reported conducting such 
activities but did not provide supporting documentation. Finally, 
agencies also reported not testing or exercising certain capabilities 
during the exercise. In these cases, participating agencies may have 
addressed these capabilities in other test and exercises conducted 
during the year, which were outside the scope of our review. The
following slides summarize the test and exercise activities agencies 
conducted during the governmentwide exercise. 

Agencies Tested Various Capabilities: Plans and Procedures; 

Essential Functions: 

Essential functions are those functions that enable agencies to provide 
vital services, exercise civil authority, maintain the safety and well 
being of the general populace, and sustain the industrial/economic base 
in an emergency. 

* Four of the agencies performed at least one essential function during 
the exercise. Some of the essential functions performed included 
ensuring command and control of the organization and providing 
information to the public. 

* The remaining four agencies reported exercising their essential 
functions but did not provide documentation substantiating which 
essential functions were exercised. 

Agencies Tested Various Capabilities: Plans and Procedures; 

Activation and Notification Procedures: 

Each agency develops a decision process for determining when to 
activate its COOP plans and procedures and, following activation, must 
notify appropriate points of contact: COOP and non-COOP employees, its 
alternate facility, and the FEMA Operations Center. 

Activation: 
* Four agencies exercised activation procedures. For example, three 
agencies activated their plans as result of a change in exercise threat 
level conditions. 

* Of the remaining four agencies, three reported exercising their 
activation procedures, but did not provide documentation substantiating 
the reported activity. 

Notification—COOP Personnel: 
* Three agencies exercised notification procedures for COOP personnel. 
For example, one agency used an automated notification system to 
contact personnel by phone and email upon COOP activation. 

* Of the remaining five agencies, four reported exercising the 
notification of their COOP personnel, but did not provide documentation 
substantiating the reported activity. 

Notification—Non-COOP Personnel: 
* One agency exercised notification procedures for non-COOP personnel 
by sending a mass e-mail notifying nonessential personnel of the 
exercise and activation of its COOP plan. 

* Of the remaining seven agencies, five reported exercising the 
notification of their non-COOP personnel, but did not provide 
documentation substantiating the reported activity. 

Notification—Alternate Facility: 
* Two agencies exercised notification procedures for their alternate 
facilities by notifying personnel present at the alternate facility of 
COOP activation, triggering preparations. 

* Of the remaining six agencies, two reported exercising the 
notification of their alternate facility, but did not provide 
documentation substantiating the reported activity. 

Notification—FEMA Operations Center: 
* Six agencies exercised notification procedures for the FEMA 
Operations Center. For example, one agency notified FEMA of COOP 
activation by e-mail one morning during the exercise. 

* Of the remaining two agencies, one reported exercising the 
notification of the FEMA Operations Center, but did not provide 
documentation substantiating the reported activity. 

Comprehensive Debriefing: 

A comprehensive debriefing after agency COOP exercises allows 
participants to identify systemic weaknesses in plans and procedures 
and recommend plan revisions. 

* All eight agencies identified strengths in their continuity 
capabilities and areas for improvement using questionnaires completed 
by participants or meetings with participants following the exercise. 
Each of the agencies outlined their results in bullets identifying the 
top three strengths and top three areas for improvement. For example, 
strengths identified by the agencies included conducting essential 
functions and the performance of alternate facility support staff; 
areas for improvement included notification procedures and communication
with external contacts. 

Agencies Tested Various Capabilities: Personnel; 

COOP Personnel Participation: 

COOP personnel are agency officials assigned responsibility to report 
to an alternate site, as required, to perform agency essential 
functions. 

* Five agencies moved COOP personnel to alternate facilities to 
participate in the exercise. For example, one agency participated with 
13 percent of its COOP personnel, while another agency participated 
with 89 percent. 

* The remaining three agencies reported exercising with their COOP 
personnel, but did not provide documentation substantiating the extent 
of COOP personnel participating in the exercise. 

Agencies Tested Various Capabilities: Resources; 

Interoperable Communications: 

The success of agency operations at an alternate facility depends on 
available and redundant communications with internal organizations, 
other agencies, critical customers, and the public. 

Communications Capabilities: 
* All eight agencies tested communications capabilities during the 
exercise. Equipment tested by the agencies included secure video 
teleconference, phone, e-mail, and an online emergency collaboration 
system. 

Communication with Internal Contacts: 
* Six agencies exercised communication with internal contacts, such as 
field offices, during the exercise. 

* The remaining two agencies reported exercising communication with 
internal contacts, but did not provide documentation substantiating the 
reported contacts. 

Communication with External Contacts: 
* In addition, four agencies exercised communication with external 
contacts, such as the White House. 

* The remaining four agencies reported exercising communication with 
external contacts, but did not provide documentation substantiating the 
reported contacts. 

Vital Records and Critical Information Systems: 

Vital records are electronic and hardcopy documents, references, 
records and information systems needed to support essential functions 
during an emergency. 

* Six agencies tested access to vital records during the exercise. 

* The remaining two agencies reported testing access to vital records 
but neither provided documentation substantiating the reported 
activities. 

Emergency Backup Power: 

Emergency backup power ensures that an agency’s alternate facility can 
allow essential functions to continue in any environment. 

* One agency’s primary power source unintentionally went out during the 
exercise, triggering the use of backup power for several hours. 

* Of the remaining seven agencies, one agency reported testing its 
backup power, but did not provide documentation substantiating the 
reported test. 

Agencies Tested Various Capabilities: FEMA Provided Limited Guidance on 
Documentation; 

FEMA published and disseminated an exercise plan prior to the start of 
Forward Challenge 06, outlining information regarding the scope and 
methodology of the exercise as well as the responsibilities of 
officials from participating agencies. Within the plan, FEMA stated 
that participating agency officials were to document issues and 
requirements for corrective action, significant findings and important 
observations during the Forward Challenge 06 exercise. In response, 
each agency we reviewed documented the main strengths and weaknesses of 
its exercise participation. 

In contrast, FEMA did not direct participating agencies to document the 
specific activities from their test and exercise programs that they 
conducted during Forward Challenge 06. The absence of guidance in this 
area contributed to the lack of documentation to support many of the 
test and exercise activities agencies described undertaking during 
Forward Challenge 06. Without adequate records of what has been tested 
during a major governmentwide exercise, agencies lack assurance that 
they have adequately tested their continuity capabilities at the 
frequency outlined in FEMA guidance, which, in turn, can limit the 
agencies’ assurance that the procedures, people, and resources they 
need to respond to a disruption will be available when needed. 
Developing and maintaining such documentation can also reduce the 
potential negative impact of turnover in key personnel—for example, 
turnover caused by attrition or a change in administration—by providing
new staff with information regarding the status of their agency’s test 
and exercise program and overall continuity capability. Finally, such 
documentation can strengthen an agency’s internal control capability, 
by ensuring that relevant, reliable, and timely information is 
available for management decision-making and for external reporting 
purposes such as congressional oversight. 

Conclusions: 

Agencies took advantage of the opportunity to test a number of their 
continuity capabilities during FEMA’s Forward Challenge 06 
governmentwide exercise. The strengths and weaknesses each agency 
identified as a result of its participation can provide the basis for 
improvements in their continuity programs. However, in many cases, 
agencies reported conducting test and exercise activities but had not 
documented their efforts, due in part to FEMA’s guidance not requiring 
them to do so. Without adequate records of what has been tested during 
a major governmentwide exercise, agencies may lack assurance that they 
have adequately tested their continuity capabilities at the frequency 
outlined in FEMA guidance, which may limit their ability to fully 
evaluate their readiness to respond to a disruption. 

Recommendation: 

To better assist agencies in assessing their readiness to respond to 
disruptions, we recommend that the Secretary of Homeland Security 
direct the FEMA Director to require agencies participating in future 
governmentwide exercises to document the specific test and exercise 
activities conducted. 

Agency Comments and Our Evaluation: 

In written comments on a draft of this briefing, the Director of the 
Department of Homeland Security’s GAO/OIG Liaison office stated that 
the Department agreed with our recommendation. In addition, the
Director stated that the Department had already complied with the 
recommendation during Forward Challenge 06, citing the general guidance 
provided in FPC 65 as well as evaluations compiled by internal and 
external evaluators during the exercise. The Director stated further 
that the level of documentation was higher than we reported as 
demonstrated by external evaluations that he said did not meet GAO 
audit standards. Finally, the Director stated, with respect to our 
assertion that FEMA did not specify which aspect of an agency’s test 
and exercise program should be included in the exercise, that FEMA 
provided guidance to departments and agencies for the overarching
objectives of the exercise. 

We disagree that FEMA provided adequate guidance on documentation and 
that the level of documentation was higher than we reported. While the 
guidance provided general direction to agencies to document their test, 
training, and exercise programs, it did not specify that agencies were 
to document the extent to which each essential function and supporting 
capability was tested. In addition, we considered the results of the 
exercise evaluations in our analysis, but in many cases these 
evaluations did not specify which essential functions and supporting 
capabilities were tested during the exercise. The value of such 
documentation is not to meet GAO audit standards, as the Director 
asserts. Instead, as noted in our briefing, agencies need to fully 
document their exercise activities to ensure that they are following 
FEMA guidance, to mitigate the effects of potential staff turnover, and 
to ensure appropriate internal controls. Nevertheless, the Director 
stated that FEMA intends to refine its assessment program, giving 
specific attention to improving the level of evaluation documentation. 

Regarding the Director’s statement that FEMA provided guidance to 
departments and agencies through the exercise objectives and FPC 65, we 
agree that FEMA provided guidance that required agencies to respond to 
exercise scenarios using their continuity plans. As a result, we have 
revised the introduction and background sections of the briefing to 
clarify the scope of FEMA’s guidance. 

The Director also provided technical comments, which we incorporated as 
appropriate. [The Director’s comments are reproduced as appendix II]. 

Attachment 1: Agencies Reviewed; 

The National Response Plan designates the following eight civilian 
agencies as coordinators of emergency support functions identified to 
provide support to states and other federal entities during
national disasters. 

Agency/Coordinator: Department of Agriculture; 
Emergency Support Function Responsibilities: Firefighting; Agriculture 
and Natural Resources. 

Agency/Coordinator: Department of Energy; 
Emergency Support Function Responsibilities: Energy. 

Agency/Coordinator: Department of Health and Human Services; 
Emergency Support Function Responsibilities: Public Health and Medical 
Services. 

Agency/Coordinator: Department of Homeland Security; 
Emergency Support Function Responsibilities: Communications; Emergency 
Management; Mass Care, Housing, and Human Services; Urban Search and 
Rescue; Public Safety and Security; Long-Term Community Recovery and 
Mitigation; and External Affairs. 

Agency/Coordinator: Department of Justice; 
Emergency Support Function Responsibilities: Public Safety and 
Security. 

Agency/Coordinator: Department of Transportation; 
Emergency Support Function Responsibilities: Transportation. 

Agency/Coordinator: Environmental Protection Agency; 
Emergency Support Function Responsibilities: Oil and Hazardous 
Materials Response. 

Agency/Coordinator: General Services Administration; 
Emergency Support Function Responsibilities: Resource Support. 

Source: DHS, National Response Plan (Washington, D.C.: December 2004). 

[End of table] 

[End of attachment] 

Attachment 2: U. S. Department of Agriculture; 

U.S. Department of Agriculture (USDA): Forward Challenge 06 Test and 
Exercise Activities; 

Test and Exercise Activity: Plans and Procedures: 
1. Essential Functions; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Exercised all 43 of its essential functions during the 
exercise. 

Test and Exercise Activity: Plans and Procedures: 
2. Activation and Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Exercised its COOP activation procedures one morning during
the exercise. 

Test and Exercise Activity: Plans and Procedures: 
2. Activation and Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
USDA Action: Reported exercising the notification of its COOP personnel 
but did not provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures: 
2. Activation and Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
USDA Action: Reported exercising the notification of its non-COOP
personnel, but did not provide documentation substantiating
this activity. 

Test and Exercise Activity: Plans and Procedures: 
2. Activation and Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
USDA Action: Did not exercise the notification of its alternate 
facility during the exercise. According to USDA officials, personnel 
deployed to the alternate facility prior to the exercise. 

Test and Exercise Activity: Plans and Procedures: 
2. Activation and Notification Procedures; 
e. FEMA Operations Center Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Exercised the notification of the FEMA Operations Center 
one morning during the exercise. 

Test and Exercise Activity: Plans and Procedures: 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Conducted a debriefing identifying strengths and areas of
improvement from the exercise. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Exercised with 67 of its 75 COOP personnel. This is an 89
percent participation rate. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Tested multiple forms of communication capabilities, 
including telephone, fax, and e-mail. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Exercised communication with internal entities, including 
the Animal and Plant Health Inspection Service. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Exercised communication with external contacts, including 
the White House. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
USDA Action: Tested access to vital records pre-positioned at the 
alternate facility. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
USDA Action: Reported that the backup power at its alternate facility 
was tested during the exercise by the facility’s host, but did not
provide documentation substantiating this testing. 

[End of attachment] 

Attachment 3: Department of Energy; 

Department of Energy (DOE): 
Forward Challenge 06 Test and Exercise Activities: 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOE Action: Reported exercising its essential functions but did not 
provide documentation substantiating which essential functions were
performed during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Activation and Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Exercised its COOP activation procedures one morning during
the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Activation and Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOE Action: Reported exercising the notification of its COOP personnel 
but did not provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Activation and Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOE Action: Reported exercising the notification of its non-COOP 
personnel but did not provide documentation substantiating this 
activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Activation and Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOE Action: Did not exercise the notification of its alternate 
facility. 

Test and Exercise Activity: Plans and Procedures; 
2. Activation and Notification Procedures; 
e. FEMA Operations Center Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Exercised notification of the FEMA Operations Center one
morning during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Used questionnaires completed by exercise participants that
identified main strengths and areas for improvement. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOE Action: Reported exercising with over 220 personnel during the 
course of the exercise, but did not provide documentation
substantiating a level of participation by COOP personnel. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Tested communications capabilities, including satellite 
phones and secure video teleconferencing. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Exercised communication with internal contacts, including
agency personnel using a web-based communication tool. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Exercised communication with external contacts, including
other agencies such as the Nuclear Regulatory Commission. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOE Action: Tested access to vital records during the exercise. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOE Action: Did not test backup power during the exercise. 

[End of attachment] 

Attachment 4: Department of Health and Human Services: 

Department of Health and Human Services (HHS): 
Forward Challenge 06 Test and Exercise Activities: 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Exercised one of its essential functions during the 
exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
HHS Action: Reported exercising activation procedures but did not 
provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
HHS Action: Reported exercising notification procedures for COOP
personnel but did not provide documentation substantiating this
activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
HHS Action: Reported exercising non-COOP personnel notification
procedures, but did not provide documentation substantiating
this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
HHS Action: Reported exercising notification procedures for the 
alternate facility but did not provide documentation substantiating this
activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
e. FEMA Operations Center; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Exercised the notification of the FEMA Operations Center
during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Conducted a debriefing and provided a summary list of
strengths and areas for improvement. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Deployed 105 COOP personnel for the exercise. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Tested several communications capabilities, including
telephone and fax. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Exercised communication with internal entities, such as the
Centers for Disease Control and Prevention. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Exercised communication with external contacts, such as the
Homeland Security Operations Center. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
HHS Action: Tested access to vital records during the exercise. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
HHS Action: Did not test backup power during the exercise. HHS reported
that backup power is tested on a monthly basis at the alternate
facility. 

[End of attachment] 

Attachment 5: Department of Homeland Security; 

Department of Homeland Security (DHS); 
Forward Challenge 06 Test and Exercise Activities; 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported exercising its essential functions, but did not 
provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported exercising its activation procedures, but did not
provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DHS Action: Exercised the notification of its COOP personnel. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported that DHS headquarters COOP team personnel
provided notification and individual instructions to non-COOP
personnel within their respective organizations. DHS did not
provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DHS Action: Exercised the notification of its alternate facility. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
e. FEMA Operations Center; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported exercising the notification of the FEMA Operations
Center, but did not provide documentation substantiating this
activity. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DHS Action: Conducted a debriefing identifying strengths and areas of
improvement from the exercise. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DHS Action: Exercised with 24 of its 184 COOP personnel. This is a 13
percent participation rate. DHS officials stated that additional
COOP personnel participated in the exercise, but did not sign in. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DHS Action: Tested its communications capabilities, including secure 
video teleconferencing. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported exercising communication with internal contacts as 
it exercised essential functions, but did not provide documentation 
substantiating the communication. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported exercising communication with external contacts as 
it exercised essential functions, but did not provide documentation 
substantiating the communication. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DHS Action: Reported testing access to its vital records, but did not 
provide documentation substantiating this testing. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DHS Action: Did not test its backup power during the exercise. DHS
reported that the host of the alternate facility conducts regular
tests of the backup power. 

[End of attachment] 

Attachment 6: Department of Justice; 

Department of Justice (DOJ); 
Forward Challenge 06 Test and Exercise Activities; 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOJ Action: Reported exercising its essential functions as if 
conducting a usual work day but did not provide documentation
substantiating which essential functions were performed. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOJ Action: Reported that exercising activation procedures was not part 
of the agency’s exercise plan. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Reported that exercising activation procedures was not part 
of the agency’s exercise plan. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Reported that exercising activation procedures was not part 
of the agency’s exercise plan. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Reported that exercising activation procedures was not part 
of the agency’s exercise plan. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
e. FEMA Operations Center; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Reported that exercising activation procedures was not part 
of the agency’s exercise plan. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOJ Action: Conducted a debriefing and provided a summary list of
strengths and areas for improvement. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOJ Action: Reported exercising with COOP personnel but did not provide
documentation substantiating this activity. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Tested multiple communication capabilities including cell
phones, and a secure radio system. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Exercised communication with internal entities, including 
the U.S. Marshals Service. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOJ Action: Reported exercising communication with external contacts as 
it exercised essential functions, but did not provide documentation 
substantiating the communication. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOJ Action: Tested access to vital records during the exercise. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOJ Action: Did not test its backup power capabilities during the 
exercise. DOJ stated that the alternate facility’s backup power is 
tested regularly by the site host. 

[End of attachment] 

Attachment 7: Department of Transportation; 

Department of Transportation (DOT); 
Forward Challenge 06 Test and Exercise Activities; 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported exercising its essential functions, but did not 
provide documentation substantiating which functions were performed
during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported exercising its activation procedures, but did not
provide documentation substantiating this activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported notifying 90 percent of its COOP personnel through
its alert system, but did not provide documentation substantiating the 
notification. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOT Action: Did not test the notification of its non-COOP personnel 
during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOT Action: Did not exercise the notification of its alternate 
facility. DOT officials reported that the notification of the alternate 
facility was not applicable to the exercise because the facility 
managers were the leaders of the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
e. FEMA Operations Center; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOT Action: Exercised the notification of the FEMA Operations Center
during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOT Action: Conducted a debriefing identifying strengths and areas of
improvement from the exercise. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported that it exercised with 90 percent of its COOP
personnel, but did not provide documentation substantiating this level 
of participation. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
DOT Action: Tested its communications capabilities. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported exercising communication with internal contacts but
did not provide documentation substantiating this communication. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported exercising communication with external contacts but
did not provide documentation substantiating this communication. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
DOT Action: Reported testing access to its vital records, but did not 
provide documentation substantiating the testing. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
DOT Action: Did not test its backup power during the exercise. 
According to DOT officials, testing backup power is the responsibility 
of the host of the alternate facility. 

[End of attachment] 

Attachment 8: Environmental Protection Agency; 

Environmental Protection Agency (EPA); 
Forward Challenge 06 Test and Exercise Activities; 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised seven of its eight essential functions during the
exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised its COOP activation procedures. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised the notification of its COOP personnel by 
telephone and e-mail. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised notification of its non-COOP personnel by sending
an e-mail out to all EPA employees during the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised the notification of its alternate facility by 
notifying personnel at the facility prior to COOP personnel deployment. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
e. FEMA Operations Center; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised the notification of the FEMA Operations Center. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Used questionnaires completed by exercise participants to
identify main strengths and areas for improvement. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised with 77 of its 109 COOP personnel. This is a 71
percent participation rate. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Tested its communications capabilities, including secure 
fax. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised communication with internal contacts, including
agency field offices. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Exercised communication with external contacts, including 
the Nuclear Regulatory Commission. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Tested access to vital records during the exercise. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
EPA Action: Tested its backup power capabilities when its primary power
source unintentionally went out, triggering the use of backup
power for several hours. 

[End of attachment] 

Attachment 9: General Services Administration; 

General Services Administration (GSA); 
Forward Challenge 06 Test and Exercise Activities; 

Test and Exercise Activity: Plans and Procedures; 
1. Essential Functions; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Exercised all six of its essential functions. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
a. Activation Procedures; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Exercised its activation procedures on one morning of the
exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
b. COOP Personnel Notification; 
Tested and Documented: [Check];
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Exercised the notification of its COOP personnel through an
email sent on one morning of the exercise. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
c. Non-COOP Personnel Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check];
Not Tested: [Empty]; 
GSA Action: Reported exercising the notification of its non-COOP 
personnel but did not provide documentation substantiating this 
activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
d. Alternate Facility Notification; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check];
Not Tested: [Empty]; 
GSA Action: Reported exercising the notification of its alternate 
facility personnel but did not provide documentation substantiating this
activity. 

Test and Exercise Activity: Plans and Procedures; 
2. Notification Procedures; 
e. FEMA Operations Center; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Exercised the notification of the FEMA Operations Center on
one morning of the exercise. 

Test and Exercise Activity: Plans and Procedures; 
3. Debriefing; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Used questionnaires completed by exercise participants to
identify main strengths and areas for improvement. 

Test and Exercise Activity: Personnel; 
4. COOP Personnel Participation; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Exercised with 92 of its 153 COOP personnel. This is a 60
percent participation rate. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
a. Communications Capabilities; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Tested multiple forms of communication capabilities, 
including cell phones and email. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
b. Communication with Internal Contacts; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Exercised communication with internal contacts, including 
non-COOP personnel. 

Test and Exercise Activity: Resources; 
5. Interoperable Communications; 
c. Communication with External Contacts; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Check]; 
Not Tested: [Empty]; 
GSA Action: Reported exercising communication with external contacts, 
but did not provide documentation substantiating this communication. 

Test and Exercise Activity: Resources; 
6. Vital Records; 
Tested and Documented: [Check]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Empty]; 
GSA Action: Tested access to vital records during the exercise. 

Test and Exercise Activity: Resources; 
7. Backup Power; 
Tested and Documented: [Empty]; 
Tested but Not Documented: [Empty]; 
Not Tested: [Check]; 
GSA Action: Did not test its backup power during the exercise. 

[End of attachment] 

[End of Appendix I] 

Appendix II: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 
[hyperlink, http://www.dhs.gov]: 
November 2, 2007: 

Ms. Linda D. Koontz: 
Director: 
Information Management Issues: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, D.C. 20548: 

Dear Ms. Koontz: 

Thank you for the opportunity to review and comment on the Government 
Accountability Office's (GAO's) draft report GAO 08-185SU entitled 
Continuity of Operations: Selected Agencies Tested Various Capabilities 
During 2006 Governmentwide Exercise. Technical comments have been 
provided under separate cover. We appreciate GAO's review of our 
previous comments on GAO's briefing slides and the changes made in this 
draft report in response to our comments. 

The Department of Homeland Security agrees with GAO's one 
recommendation "to require agencies participating in future government 
wide exercises to document the specific test and exercise activities 
conducted." Further, the Department believes that the Federal Emergency 
Management Agency (FEMA) has complied with this recommendation with 
respect to Forward Challenge 2006 (FC 06) and will continue to do so in 
future exercises. 

Federal Preparedness Circular 65 (FPC-65), dated June 15, 2004, is very 
specific on Federal Executive Branch Test, Training, and Exercise 
(TT&E) requirements. The FC 06 exercise was specifically designed to 
allow Departments and Agencies (D/As) to conduct their continuity of 
operations tests, training, and exercise activities in this internally 
and externally evaluated exercise. FPC 65 states on page 8 that, "All 
agencies must plan, conduct, and document periodic tests, training, and 
exercises to demonstrate the plan 's viability and identify 
deficiencies. Deficiencies and actions taken to correct them must be 
documented. " FPC 65 states on page I-1 that, "Agencies must develop 
and maintain a COOP test, training and exercise program for conducting 
and documenting TT&E." FPC 65 provides an entire annex (Annex I) 
directing comprehensive components of an agency Test, Training and 
Exercise programs. All agencies were provided FPC 65 prior to the 
exercise. The Evaluation Plan (EVALPLAN) provided guidance to 
organizations to test and evaluate FC 06 in accordance with the 
standardized published Exercise Evaluation Guides (EEG) and the self-
assessment checklist. The Exercise Evaluation Guide/self-assessment 
checklist, included specific requirements for a department and agency's 
COOP program. This Guide/checklist is very specific and included Green, 
Yellow, and Red evaluation ratings for performance of these 
requirements. Exercise guidance was very clear that the checklist was 
to be used to assist the departments and agencies in their exercise 
planning/development to meet the continuity requirements, and that the 
assessment would document to the President their ability to conduct 
these requirements. FPC 65 further requires all departments and 
agencies to document performance of continuity of operations exercise 
activities and include corrective actions in their Corrective Action 
Program (CAP). The FC 06 exercise was designed with the departments and 
agencies to facilitate the performance of their required essential 
functions and other supporting continuity of operations requirements. 

The eight departments/agencies reviewed by GAO for this exercise are 
all Level 1 and 2 organizations and all were required to participate in 
the exercise, participate in the required assessments, with reports on 
their capabilities to be submitted to the President. Again, FPC 65 
requires all organizations that participate in COOP exercises to 
document their performance of exercise objectives in a Corrective 
Action Plan (CAP) and to develop and document corrective actions. 

Each agency evaluation team was made up of external and internal 
evaluators. The external evaluators were responsible for providing 
feedback to FEMA's National Continuity Programs (NCP) to develop the 
external After Action Reports (AARs); and the internal evaluators were 
provided the same forms/training to conduct their internal portion of 
the evaluation to include self-assessments on Primary Mission Essential 
Functions and internally developed Master Scenario Events Lists. They 
were also directed to prepare an internal AAR, which was to be provided 
to NCP. 

GAO indicated that D/As tested, but did not document, many components 
of their continuity exercises. GAO however, also acknowledged during 
their exit conference that many components were documented by external 
evaluators but not to GAO auditing standards. Thus, the level of 
documentation for Forward Challenge 06 was higher than reported by GAO, 
sufficient to evaluate performance and general lessons learned, but 
perhaps not uniformly at the level sufficient to meet GAO standards. 

FEMA intends to continue to refine upon its assessment program that was 
initiated during the Forward Challenge 2004 exercise, giving specific 
attention to improving the level of evaluation documentation. 

DHS welcomes the opportunity to provide GAO with appropriate and 
meaningful access so that GAO may effectively assess emergency 
preparedness and response activities. As an example, GAO observers were 
provided access to the recent TOPOFF 4 exercises which were held 
October 15-20, 2007. 

Thank you again for the opportunity to comment on this draft report and 
we look forward to working with you on future homeland security issues. 

Sincerely, 

Signed by: 

Steven J. Pecinovsky: 
Director: 
Departmental GAO/OIG Liaison Office: 

[End of Appendix II] 

Footnotes: 

[1] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of 
Operations: Selected Agencies Could Improve Planning for Use of 
Alternate Facilities and Telework during Disruptions, GAO-06-713 
(Washington, D.C.: May 11, 2006). 

[2] DHS, National Response Plan (Washington, D.C.: December 2004). 

[3] GAO, Department of Homeland Security: Observations on GAO Access to 
Information on Programs and Activities, GAO-07-700T (Washington, D.C.: 
Apr. 25, 2007). 

[4] Federal Preparedness Circular 65 is guidance to the federal 
executive branch for use in developing viable and executable 
contingency plans that facilitate the performance of essential 
functions during any emergency. 

[5] The FEMA Operations Center is responsible for, among other things, 
facilitating information sharing between FEMA and non-FEMA
entities, and providing a status of on-going incidents, responses or 
potential events, during an emergency. 

[6] An alternate facility provides a physical location from which to 
conduct essential functions if the agency’s usual facilities are
unavailable. 

[7] DHS, National Response Plan (Washington, D.C.: December 2004). 

[8] GAO, Department of Homeland Security: Observations on GAO Access to 
Information on Programs and Activities, GAO-07-700T (Washington, D.C.: 
Apr. 25, 2007). 

[9] Participating agencies may have addressed these capabilities in 
other tests and exercises conducted during the year, which were outside 
the scope of our review. 

[10] FPC 65 states that agency personnel must have access to and be 
able to use electronic and hard-copy records and information systems 
needed to perform their essential functions. 

[11] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of 
Operations: Selected Agencies Could Improve Planning for Use of 
Alternate Facilities and Telework during Disruptions, GAO-06-713 
(Washington, D.C.: May 11, 2006). 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548: 

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: