Senior ISCD Leaders Developed the ISCD Memorandum to Highlight Various Challenges Hindering CFATS Implementation

		ISCD’s Memorandum Based Largely on Observations of Senior ISCD Managers

Our review of the ISCD memorandum and discussions with ISCD officials  showed that the memorandum was developed during the latter part of  2011 and was developed primarily based on discussions with ISCD staff  and the observations of the ISCD Director in consultation with the Deputy  Director. She  confirmed that the memo was intended to begin a dialog about the  program and challenges it faced. ISCD Director Was Concerned That Challenges Place the CFATS Program at Risk

The ISCD memorandum discussed numerous challenges that, according  to the Director, pose a risk to the program. A second group focused on mission  issues, including what the author found to be the slow pace of the site  security plan approval process, the lack of an established inspection  process, and the ISCD’s inability to perform compliance inspections 5 1/2  years after enactment of the CFATS statute, and the lack of an  established records management system to document key decisions. Additional details on the human capital, mission, and administrative  issues identified in the ISCD memorandum are considered “for official use  only.”

	ISCD Has Begun to Take Various Actions Intended to Address Challenges Identified

		ISCD’s Action Plan Includes Time Frames for Completing Action Items and Appears to Be a Catalyst for Addressing Some Legacy Issues

ISCD is using an action plan to track its progress addressing the  challenges identified in the memorandum, and, according to senior  division officials, the plan may be helping them address some legacy  issues that staff were attempting to deal with before the memorandum  was developed. The remaining 60 percent (56 of 94) were in progress. Another completed human capital action item— categorized by ISCD as a cultural issue—called for ISCD management to  hold a series of meetings with employees to involve them in addressing  program challenges, clarify program priorities related to its mission, and  implement changes in ISCD culture. For the remaining 56 items that were in progress, 40 involved human  capital management and administrative issues. The development of a new security plan review process may be critical to  the effective implementation of the CFATS program. Action Plan Performance Measures Could Help Gauge Progress

ISCD, through its action plan, appears to be heading in the right direction  toward addressing the challenges identified, but it is too early to tell if the  action plan is having the desired effect because (1) the division has only  recently completed some action items and continues to work on  completing more than half of the others, some of which entail long-term  changes, and (2) ISCD has not developed an approach for measuring the  results of its efforts. ISCD Officials Stated That Almost Half of the Action Items Require Collaboration with or Action by NPPD or IP

According to ISCD officials, almost half of the action items included in the  June 2012 action plan either require ISCD to collaborate with NPPD and  IP or require NPPD and IP to take action to address the challenges  identified in the ISCD memorandum. By developing  performance measures, where practical, ISCD, IP, and NPPD would be  better equipped to identify any gaps between actual and planned or  expected results and take corrective action, where necessary, consistent  with Standards for Internal Control in the Federal Government. Recommendation for Executive Action

To better ensure that DHS can better understand the effect of its actions  as it moves forward with its efforts to address the challenges facing ISCD  as it implements the CFATS program, we recommend that the Secretary  of Homeland Security direct the Under Secretary for NPPD, the Assistant  Secretary for IP, and the Director of ISCD, in conjunction with the  development of ISCD’s strategic plan, to look for opportunities, where  practical, to measure results of their efforts to implement particular action  items, and where performance measures can be developed, periodically  monitor these measures and indicators to identify where corrective  actions, if any, are needed. This will include ISCD efforts to determine chemical facility risk;  manage the process used to assess vulnerabilities, review security plans,  and perform inspections; and work with owners and operators of high-risk  chemical facilities. Appendix I: Objectives, Scope and Methodology

This statement discusses how the internal Infrastructure Security  Compliance Division’s (ISCD) memorandum (the ISCD memorandum)  was developed and what challenges were identified, what actions are  being taken to address the challenges identified, and the extent to which  ISCD’s planned actions and proposed solutions require collaboration with  National Protection and Programs Directorate (NPPD) or the Office of  Infrastructure Protection (IP). Appendix II: ISCD Organizational Structure within NPPD and IP as of June 2012

This appendix provides the organizational structure used to manage the  Chemical Facility Anti-Terrorism Standards program within the  Infrastructure Security Compliance Division. GAO-11-537R. The Department of Homeland Security’s (DHS) Critical Infrastructure  Protection Cost-Benefit Report.
Why GAO Did This Study

The events of September 11, 2001, triggered a national re-examination of the security of facilities that use or store hazardous chemicals in quantities that, in the event of a terrorist attack, could put large numbers of Americans at risk of serious injury or death. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, a component of IP, manages the program. A November 2011 internal ISCD memorandum, prepared by ISCD senior managers, has raised concerns about the management of the program. This testimony focuses on (1) how the memorandum was developed and any challenges identified, (2) what actions are being taken in response to any challenges identified, and (3) the extent to which ISCDs proposed solutions require collaboration with NPPD or IP. GAOs comments are based on recently completed work analyzing the memorandum and related actions. GAO reviewed laws, regulations, DHSs internal memorandum and action plans, and related documents, and interviewed DHS officials.

What GAO Found

The November 2011 memorandum that discussed the management of the Chemical Facility Anti-Terrorism Standards (CFATS) program was prepared based primarily on the observations of the Director of the Department of Homeland Securitys (DHS) Infrastructure Compliance Security Division (ISCD), a component of the Office of Infrastructure Protection (IP) within the National Protection and Programs Directorate (NPPD). The memorandum was intended to highlight various challenges that have hindered ISCD efforts to implement the CFATS program. According to the Director, the challenges facing ISCD included not having a fully developed direction and plan for implementing the program, hiring staff without establishing need, and inconsistent ISCD leadershipfactors that the Director believed place the CFATS program at risk. These challenges centered on human capital issues, including problems hiring, training, and managing ISCD staff; mission issues, including overcoming problems reviewing facility plans to mitigate security vulnerabilities and performing compliance inspections; and administrative issues, including concerns about NPPD and IP not supporting ISCDs management and administrative functions.
ISCD has begun to take various actions intended to address the human capital management, mission, and administrative issues identified in the ISCD memorandum and has developed a 94-item action plan to track its progress. According to ISCD managers, the plan appears to be a catalyst for addressing some of the long-standing issues the memorandum identified. As of June 2012, ISCD reported that 40 percent (38 of 94) of the items in the plan had been completed. These include (1) requiring ISCD managers to meet with staff to involve them in addressing challenges, clarifying priorities, and changing ISCDs culture and (2) developing a proposal to establish a quality control function over compliance activities. The remaining 60 percent (56 of 94) that were in progress include those requiring longer-term efforts--i.e., streamlining the process for reviewing facility security plans and developing facility inspection processes; those requiring completion of other items in the plan; or those awaiting action by others, such as approvals by ISCD leadership. ISCD appears to be heading in the right direction, but it is too early to tell if individual items are having their desired effect because ISCD is in the early stages of implementing corrective actions and has not established performance measures to assess results. Moving forward, exploring opportunities to develop measures, where practical, to determine where actual performance deviates from expected results, consistent with internal control standards could help ISCD better identify any gaps between actual and expected results so that it can take further action, where needed. For example, as ISCD develops a new security plan review process, it could look for ways to measure the extent to which the time to do these reviews has been reduced as compared with the time needed under the current review process.
According to ISCD officials, almost half of the action items included in the June 2012 action plan require ISCD collaboration with or action by NPPD and IP. The ISCD memorandum stated that IP and NPPD did not provide the support needed to manage the CFATS program when the program was first under development. ISCD, IP, and NPPD officials confirmed that IP and NPPD are providing needed support and stated that the action plan prompted them to work together to address the various human capital and administrative issues identified.

What GAO Recommends

GAO recommends that DHS look for opportunities, where practical, to measure its performance implementing actions items. DHS concurred with the recommendation.