FEMA Faces IT Management and Workforce Challenges

FEMA faces a number of challenges in ensuring that its IT systems  adequately support the agency’s ability to respond to major disasters. Specifically, the agency has not (1) established a sufficient framework for  providing governance and oversight of its IT investments, (2) developed  adequate plans for modernizing its IT environment to reduce its reliance  on duplicative and outdated systems, and (3) taken sufficient steps to  address gaps in its IT workforce. Establishing and implementing policies and procedures for selecting  and reselecting IT investments that meet the agency’s needs, and  integrate these with funding and selection decisions. Without clearly defined roles and  responsibilities, FEMA has less assurance that investments will be  reviewed by those with the appropriate authority and aligned with  agency goals. Establishing policies and procedures for providing investment  oversight. FEMA has strategic planning efforts under way to guide its IT  modernization, but the plans are not current and not yet complete. For  example, the IT strategic plan describes the CIO’s mission, goals, and  objectives for fiscal year 2013 through 2016, but has not been updated  since 2013, even though the plan calls for an annual update. While the CIO has begun to develop a draft IT modernization plan that  includes the scope of its efforts, an implementation strategy, and  schedule of its overall modernization effort, it is not yet complete. Without  complete and up-to-date planning documents, including the strategic and  modernization plans, FEMA will be unable to move toward its ultimate  goal of modernizing and eliminating duplicative IT investments. Similarly, while the agency has taken initial steps to assess the needs of  its IT workforce, it has not yet established time frames for completing  workforce planning efforts and it lacks an understanding of its regional IT  workforce. For example, as discussed earlier, the agency has  not yet established time frames for completing key IT strategic planning  activities, such as updating the strategic plan or workforce gap reviews. None of the Three Selected Emergency Management Programs Had Fully Implemented Key IT Management Controls

The three selected major emergency management programs that we  reviewed had not consistently implemented IT management controls in  four key areas: (1) risk management, (2) requirements development, (3)  project planning, and (4) systems integration and testing. These weaknesses stemmed in part from gaps in FEMA  policy for implementing these controls. However, the program office’s mitigation plans for identified risks were  not adequate. According to all three program offices and OCIO officials, FEMA policy  guidance for requirements management does not exist. The three selected programs varied in the extent to which they  implemented these practices. Recommendations for Executive Action

To ensure that FEMA’s IT systems can adequately support its ability to  respond to major disasters, we are recommending that the Secretary of  DHS direct the FEMA Administrator to take the following actions:
Ensure that the IT Governance Board has fully defined and  implemented its roles and responsibilities for key boards, working  groups, and individuals, and procedures for selecting and overseeing  IT investments. In the comments, DHS concurred with our recommendations. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify challenges associated with ensuring  the Federal Emergency Management Agency’s (FEMA) information  technology (IT) systems adequately support the agency’s ability to  respond to major disasters and (2) assess the extent to which FEMA has  implemented key IT management controls for selected emergency  management systems. To address our first objective, we obtained and analyzed FEMA  documentation (e.g., FEMA’s Hurricane Sandy After-Action Report), prior  GAO reports, and Department of Homeland Security (DHS) inspector  general (IG) reports. We selected these key IT  management control areas because they are consistent with the  requirements of the Post-Katrina Act for FEMA to take steps to improve  its IT systems, including: ensuring that the information technology systems of the agency have  the capacity to track disaster response personnel, mission  assignments task orders, commodities, and supplies used in response  to a natural disaster, act of terrorism, or other man-made disaster; ensuring that the multiple IT systems of the agency are, to the extent  practicable, fully compatible and can share and access information, as  appropriate, from each other; ensuring technology enhancements reach the headquarters and  regional offices of the agency in a timely fashion, to allow seamless  integration; and developing and maintaining a testing environment that ensures that all  system components are properly and thoroughly tested before their  release.
Why GAO Did This Study

FEMA, a component agency of the Department of Homeland Security (DHS), leads federal efforts to mitigate, respond to, and recover from disasters. In the wake of Hurricane Katrina, the largest natural disaster in U.S. history, Congress passed the Post-Katrina Emergency Management Reform Act of 2006. This act required FEMA to address shortcomings identified in the preparation for and response to Katrina, including improving the agency's IT programs, which are critical to its ability to respond to natural disasters and other emergencies.
GAO was asked to review FEMA's IT system improvement efforts. This report (1) identifies challenges to ensuring the agency's IT systems adequately support its disaster response efforts and (2) assesses the extent to which FEMA has implemented key IT management controls for selected emergency management programs. GAO analyzed FEMA documentation (e.g., FEMA's Hurricane Sandy After-Action Report), interviewed officials, and assessed its implementation of IT management best practices for three selected programs.

What GAO Found

The Federal Emergency Management Agency (FEMA) faces the following challenges in ensuring that its information technology (IT) programs adequately support the agency's ability to respond to major disasters:
Governance and oversight: FEMA established an investment review board to select and oversee IT investments, as called for by leading practices. But the board has not fully defined roles and responsibilities of key members, working groups, and individuals, and it does not have clearly defined procedures for selecting and overseeing investments. As a result, the agency lacks adequate visibility into and oversight of IT investment decisions and activities.
IT modernization: FEMA has begun to take steps to modernize its IT environment, but key planning documents are not current and complete. For example, the agency has an IT strategic plan and is currently drafting its modernization plan; however, the plans do not reflect the agency's current goals and objectives. Further, the IT strategic plan describes the Chief Information Officer's (CIO) mission, goals, and objectives through fiscal year 2016, but has not been updated since 2013. In addition, while the Office of the CIO is currently drafting the agency's IT modernization plan, including an implementation strategy and an overall schedule, it is not yet final. As a result, the agency is limited in its ability to move toward its goal to modernize its systems and eliminate duplicative IT investments.
Workforce planning: The agency has not yet established time frames to address long-standing workforce management challenges. For example, while it conducted a workforce assessment to identify skill levels of employees in the agency's Office of the CIO, it has not completed recommended actions called for by this assessment. In addition, its workforce planning efforts have not included an assessment of the many IT staff located in the agency's regions and other offices. Consequently, FEMA has less assurance that its IT workforce will have the skills needed to successfully manage its programs.
None of the three emergency management programs GAO selected for this review had fully implemented key IT management controls in the areas of risk management, requirements development, project planning, and systems testing and integration. Specifically, the three selected emergency management programs inconsistently implemented these practices by, for example, not always developing adequate risk mitigation plans, establishing processes for requirements management, developing and updating schedules and cost estimates, and ensuring complete and adequate system testing along with systems integration plans. These weaknesses were due, in part, to a lack of FEMA policies to guide programs in implementing these key IT management controls. Until FEMA fully establishes and implements such policies and controls, it has limited assurance that these programs will cost-effectively support its disaster response efforts.

What GAO Recommends

GAO recommends that FEMA fully define its investment board's roles and responsibilities and procedures for selecting and overseeing investments, update its strategic plan and complete plans for IT modernization, and establish time frames for completing workforce planning efforts. FEMA should also establish policies and guidance for implementing key IT management controls. DHS concurred with the recommendations.