In October 1998, Presidential  Decision Directive (PDD) 67 identified the Federal Emergency  Management Agency (FEMA)—which is responsible for responding  to, planning for, recovering from, and mitigating against disasters— as the executive agent for federal COOP planning across the federal  executive branch. At your request, we previously reported on federal agency  headquarters contingency plans in place in October 2002. In response to these recommendations, DHS reported in  July 2004 that it (1) was developing an online system to collect data  from agencies on the readiness of their continuity plans that would  evaluate compliance with the guidance, (2) had conducted an  interagency exercise, and (3) had developed a training program for  agency continuity planning managers. Many Agencies Reported Using Sound Continuity Practices, but Few Provided Adequate Supporting Documentation

Based on an analysis of published literature and in consultation with  experts on continuity planning, we identified eight sound practices  related to essential functions that organizations should use when  developing their COOP plans. With regard to COOP plans in place on May 1, 2004, many of the 23  agencies reported using some of the sound practices in developing  plans, included identifying and validating essential functions, but  few provided documentation sufficient for us to validate their  responses. This indicates that agencies—although aware of these  practices—may not have followed them thoroughly or effectively. Further, the essential functions identified by agencies varied widely:  the number of functions identified in each plan ranged from 3 to 538. For example, a number of essential functions were of  clear importance, such as  ●  “conduct payments to security holders” and  ●  “carry out a rapid and effective response to all hazards,  emergencies, and disasters.”
Other identified functions appeared vague or of questionable  importance:  ●  “champion decision-making decisions” and  ●  “provide advice to the Under Secretary.”

		New Guidance and Review Process Could Result in More Consistent Identification of Essential Functions

The high level of generality in FEMA’s guidance on essential  functions contributed to the inconsistencies in agencies’  identification of these functions. Agency COOP Plans Have Improved, but None Address All of FEMA’s Guidance

When compared with our prior assessment, agency continuity plans  in place on May 1, 2004, showed improved compliance with FEMA’s  guidance in two ways:  ●  One agency and nine component agencies that did not have  documented continuity plans in place at the time of our 2002 had put such plans in place by May 1. ●  Tests, training, and exercises. In response, DHS reported that it was developing a  readiness reporting system to assist it in assessing agency plans and  planned to verify the information reported by the agencies. Although neither of these planned actions was completed by May 1,  2004, FEMA has made subsequent efforts to improve its oversight. They added that once the system becomes fully  operational, agencies will be required to periodically provide  updated information on their compliance with FEMA’s guidance. Both FEMA’s revision to this  guidance and a recently initiated White House effort have the  potential, if effectively implemented, to help agencies better identify  their essential functions and thus develop better continuity plans. Finally, even though FEMA’s continuity planning guidance in place  in May 2004 did not address telework, one agency’s continuity plan  at that time included plans to use telework in response to an  emergency. In addition, 10 agencies reported that they planned to  use telework following a COOP event, but their plans were not  clearly documented. We also recommended that the Secretary of Homeland  Security direct the Under Secretary for Emergency Preparedness  and Response to  ●  develop a strategy for short-term oversight that ensures that  agencies are prepared for a disruption in essential functions while  the current effort to identify essential functions and develop new  guidance is ongoing;  ●  develop and implement procedures that verify the agency-reported  data used in oversight of agency continuity of operations planning;  and  ●  develop, in consultation with OPM, guidance on the steps that  agencies should take to adequately prepare for the use of telework  during a COOP event.
Why GAO Did This Study

To ensure that essential government services are available in emergencies, federal agencies are required to develop continuity of operations plans. According to guidance from the Federal Emergency Management Agency (FEMA), which is responsible for providing guidance for and assessing agency continuity plans, a key element of a viable capability is the proper identification of essential functions. GAO previously reported on agency continuity plan compliance, and determined that a number of agencies and their components did not have continuity plans in place on October 1, 2002, and those that were in place did not generally comply with FEMA's guidance. GAO was asked to testify on its most recent work in continuity planning, which is discussed in a separate report, being released today (GAO-05-577). In this report, GAO reviewed to what extent (1) major federal agencies used sound practices to identify and validate their essential functions, (2) agencies had made progress since 2002 in improving compliance with FEMA guidance, and (3) agency continuity of operations plans addressed the use of telework arrangements (in which work is performed at an employee's home or at a work location other than a traditional office) during emergencies.

What GAO Found

Many of the 23 agencies that GAO reviewed reported using sound practices for identifying and validating essential functions, but few provided documentation sufficient for GAO to confirm their responses. (GAO identified these sound practices based on published literature and in consultation with experts on continuity planning.) Agency responses indicate that--although aware of the practices--agencies may not have followed them thoroughly or effectively. Further, the essential functions identified by agencies varied widely: the number of functions identified in each plan ranged from 3 to 538 and included ones that appeared to be of secondary importance. The absence in FEMA's guidance of specific criteria for identifying essential functions contributed to this condition. Subsequent guidance significantly addresses the sound practices that GAO identified. Also, the White House has begun a process to improve continuity planning. If this guidance and process are implemented effectively, they could lead to improved identification of essential functions in the executive branch. As of May 1, 2004, agencies had made progress in improving compliance with FEMA guidance, but significant weaknesses remained. Agencies that had plans in place in both years showed significant improvement in the area of tests, training, and exercises. However, although some improvement occurred for other planning areas, important weaknesses remained: for example, 31 of 45 plans did not fully identify mission-critical systems and data necessary to conduct essential functions. Inadequate oversight by FEMA contributed to the level of weaknesses in agency continuity plans. FEMA plans to improve oversight using an online readiness reporting system, which it plans to have fully operational later this year, and it has already taken other steps to help agencies improve their plans, such as conducting an interagency exercise. However, FEMA does not plan to verify the readiness information that agencies will report in the system. Finally, even though FEMA's continuity planning guidance in place in May 2004 did not address telework, one agency's continuity plan at that time included plans to use telework in response to an emergency. In addition, 10 agencies reported that they planned to use telework following a COOP event, but their plans were not clearly documented. In its report, GAO made recommendations aimed at helping to improve continuity planning. These included establishing a schedule for the completion of recently initiated efforts, developing a strategy for short-term oversight in the meantime, and developing and implementing procedures that verify the agency-reported data used in oversight of agency continuity of operations planning. The report includes comments from FEMA. In commenting, FEMA agreed that there has been improvement in COOP plans and that additional oversight is needed.