Facilities preliminarily placed in any one of these tiers are  considered to be high risk, with tier 1 facilities considered to be the  highest risk. ISCD Has Assigned Thousands of Facilities to Tiers, but ISCD’s Approach to Risk Assessment Does Not Reflect All Risk Elements

Since 2007, ISCD has assigned about 3,500 high-risk chemical facilities  to final tiers and has taken action to identify and address problems with its  risk-tiering approach. Moving forward, ISCD intends to measure the time it takes to complete  parts of the new process and has recently implemented a plan to  measure various aspects of the process. Security Plan Reviews Could Take Years to Complete, but ISCD is Examining How it Can Accelerate the Review Process

ISCD actions to revise its security plan reviews may result in  improvements over the prior processes, but it could take years to review  plans for thousands of facilities that have been assigned a final tier—a  factor which ISCD hopes to address by examining how it can accelerate  the review process. ISCD officials estimate that the  first compliance inspections would commence in September 2013, which  means that the CFATS regulatory regime would likely be fully  implemented for currently tiered facilities (to include compliance  inspections) in 8 to 10 years. ISCD Has Increased its Efforts to Communicate and Work with Facilities and May Have an Opportunity to Systematically Gather Feedback on Its Outreach Efforts

ISCD’s efforts to communicate and work with owners and operators to  help them enhance security at their facilities have increased since the  CFATS program’s inception in 2007, particularly in recent years. ISCD is currently developing a strategic  communication plan which may create an opportunity for ISCD to explore  how it can obtain systematic feedback on its outreach. Our query of selected trade associations also showed that they generally  had mixed views about ISCD’s outreach on data collection requirements. They said that  these discussions are intended to obtain input from industry officials on  how CSAT can be improved. ISCD Does Not Seek Systematic Feedback on the Effectiveness of Its Outreach Efforts

ISCD seeks informal feedback on its outreach efforts but does not  systematically solicit feedback to assess the effectiveness of outreach  activities, and it does not have a mechanism to measure the  effectiveness of ISCD’s outreach activities. After ISCD has developed and  completed its efforts to enhance its risk assessment approach by  using the results of the current expert panel’s efforts as well as  incorporating the issues we identified along with the Sandia National  Laboratories’ work on economic consequences, an independent peer  review would provide better assurance that ISCD can appropriately  identify and tier chemical facilities, better inform CFATS planning and  resource decisions; and provide the greatest return on investment  consistent with the NIPP and CFATS rule. While it  could take years before ISCD can review and approve the site  security plans currently in its queue, ISCD intends to explore ways  that it can accelerate the process. Thus, we are not making  recommendations at this time. Recommendations for Executive Action

To better assess risk associated with facilities that use, process, or store  chemicals of interest consistent with the NIPP and the CFATS rule, we  recommend the Secretary of Homeland Security direct the Under  Secretary for NPPD, the Assistant Secretary for IP, and Director of ISCD  to take the following two actions: develop a plan, with timeframes and milestones, that incorporates the  results of the various efforts to fully address each of the components  of risk and take associated actions where appropriate to enhance  ISCD’s risk assessment approach consistent with the NIPP and the  CFATS rule, and conduct an independent peer review, after ISCD completes  enhancements to its risk assessment approach, that fully validates  and verifies ISCD’s risk assessment approach consistent with the  recommendations of the National Research Council of the National  Academies. This  report discusses the extent to which DHS has assigned chemical facilities to risk-based tiers and assessed its  approach for doing so,  revised the process to review security plans, and communicated and worked with facilities to help improve security. To determine the extent to which DHS has assigned chemical facilities to  risk-based tiers and assessed its approach for doing so, we reviewed  ISCD applications and documents including web-based Chemical  Security Assessment Tools (CSAT) applications—such as the Top- Screen and security vulnerability assessment—used to collect security  information from facilities, the ISCD risk assessment approach used to  determine a facility’s risk tier, policies and procedures on tiering, as well  as a sample copy of a facility’s Top Screen and security vulnerability  assessment. The  Chemical Sector Coordinating Council represents a significant majority of  the owners and operators in the chemical sector. The  information we obtained from the 11 trade associations that responded is  not generalizable to the universe of chemical facilities covered by CFATS;  however, it does provide insights into DHS efforts to perform outreach  and seek feedback on the implementation of the CFATS rule. Critical Infrastructure Protection: Update to National Infrastructure  Protection Plan Includes Increased Emphasis on Risk Management and  Resilience.
Why GAO Did This Study

Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, which manages the program, places high risk facilities in risk-based tiers and is to conduct inspections after it approves facility security plans. A November 2011 ISCD internal memorandum raised concerns about ISCD's ability to fulfill its mission.
GAO assessed the extent to which DHS has (1) assigned chemical facilities to tiers and assessed its approach for doing so, (2) revised its process to review facility security plans, and (3) communicated and worked with owners and operators to improve security. GAO reviewed DHS reports and plans on risk assessments, security plan reviews, and facility outreach and interviewed DHS officials. GAO also received input from 11 trade associations representing chemical facilities, about ISCD outreach. The results of this input are not generalizable but provide insights.

What GAO Found

Since 2007, the Department of Homeland Security's (DHS) Infrastructure Security Compliance Division (ISCD) has assigned about 3,500 high-risk chemical facilities to risk-based tiers under its Chemical Facility Anti-Terrorism Standards (CFATS) program, but it has not fully assessed its approach for doing so. The approach ISCD used to assess risk and make decisions to place facilities in final tiers does not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. For example, the risk assessment approach is based primarily on consequences arising from human casualties, but does not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation, nor does it consider vulnerability, consistent with the NIPP. ISCD has begun to take some actions to examine how its risk assessment approach can be enhanced, including commissioning a panel of experts to assess the current approach, identify strengths and weaknesses, and recommend improvements. ISCD will need to incorporate the various results of these efforts to help them ensure that the revised risk assessment approach includes all elements of risk. After ISCD has incorporated all elements of risk into its assessment approach, an independent peer review would provide better assurance that ISCD can appropriately identify and tier chemical facilities, better inform CFATS planning and resource decisions, and provide the greatest return on investment consistent with the NIPP.
DHS's ISCD has revised its process for reviewing facilities' site security plans--which are to be approved by ISCD before it performs compliance inspections--but it did not track data on the prior process to measure differences. The past process was considered by ISCD to be difficult to implement and caused bottlenecks in approving plans. ISCD views its revised process to be a significant improvement because, among other things, teams of experts review parts of the plans simultaneously rather than sequentially, as occurred in the past. Moving forward ISCD intends to measure the time it takes to complete reviews, but will not be able to do so until the process matures. GAO estimated that it could take another 7 to 9 years before ISCD is able to complete reviews on the approximately 3,120 plans in its queue which means that the CFATS regulatory regime, including compliance inspections, would likely be implemented in 8 to 10 years. ISCD officials said that they are exploring ways to expedite the process such as reprioritizing resources and streamlining inspection requirements.
DHS's ISCD has also taken various actions to work with owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but trade associations that responded to GAO's query had mixed views on the effectiveness of ISCD's outreach. ISCD solicits informal feedback from facility owners and operators on its efforts to communicate and work with them, but it does not have an approach for obtaining systematic feedback on its outreach activities. ISCD's ongoing efforts to develop a strategic communication plan may provide opportunities to explore how ISCD can obtain systematic feedback on these activities. A systematic approach for gathering feedback and measuring the results of its outreach efforts could help ISCD focus greater attention on targeting potential problems and areas needing improvement.

What GAO Recommends

GAO recommends that DHS enhance its risk assessment approach to incorporate all elements of risk, conduct a peer review after doing so, and explore opportunities to gather systematic feedback on facility outreach. DHS concurred with the recommendations.