However, the various presidential directives note that while the TRAs may  be used to inform decision making, they are not specific as to when or  how these risk assessments should be used by DHS officials to inform  CBRN response planning or capability investments. DHS’s CBRN Response Plans and Capabilities

(U) We identified CBRN-specific interagency response plans among three  families of interagency plans developed by DHS that are designed for  responding to CBRN incidents. DHS Used Its CBRN Risk Assessments to Directly or Indirectly Inform 9 of 12 of Its CBRN Response Plans

Since the first DHS CBRN risk assessments were developed in 2004,  DHS used the risk assessments to varying degrees to directly or indirectly  inform development of 9 of the 12 CBRN-specific response plans we  identified. However, we  could not independently verify this for these 7 plans because DHS  officials could not document how the risk assessments influenced  information contained in the plans. Our  analysis of a limited set of planning assumptions in the plans compared to  information contained in the risk assessments showed general  consistency between the plans and the risk assessments. DHS Used Its CBRN Risk Assessments to Directly or Partially Inform Six of Seven of Its CBRN Capabilities

Since 2004, DHS’s use of its CBRN risk assessments to inform its CBRN- specific capability investments has varied, from directly impacting its  capabilities to not being used at all. Six of the seven CBRN capabilities  we examined were informed by DHS’s CBRN risk assessments to some  extent, according to program officials, DHS documents, and our analysis  (see table 4).was directly informed by the risk assessments, while our analysis showed  or DHS officials told us that five of the seven capabilities were partially   Our analysis showed that one of the seven capabilities  informed by the risk assessments. However, we could not independently  verify this for three of these five capabilities because DHS officials could  not document how the risk assessments influenced the capabilities. The DHS Strategic Plan for 2008-2013 states that  resource decisions should be informed by relevant risk assessments, but  does not provide specific guidance on when or how such decisions  should be informed by the department’s CBRN risk assessments. The official said that based on this initial  assessment, the RDCDS was generally aligned with the chemical agents  of greatest concern. We found that the BioWatch program was generally  consistent with the biological agents of significant concern identified in the  BTRA. DHS S&T’s Chief Medical and Science  Advisor, the official who oversees the development of DHS’s CBRN risk  assessments, agreed that NTNFC’s capabilities need to be able to  identify all radiological and nuclear materials, and that therefore the  CBRN risk assessments were not relevant for NTNFC’s efforts. Specific Guidance Not Established to Help Ensure DHS’s CBRN Risk Assessments Are Used to Inform Its Response Plans and Capabilities

DHS policy states that DHS components should use risk assessment  information to inform planning and capability investment decisions, but  DHS has not established specific guidance, such as written procedures,  that details when and how DHS components should consider using the  department’s CBRN-specific risk assessments to inform such activities. DHS officials told us that while DHS policy calls for the use of risk  information to inform the department’s activities, no DHS guidance  specifically requires DHS officials to use the TRAs and MTAs for CBRN  planning and capability investments or explains how officials should use  the risk assessments to inform their decision making. DHS officials said that they considered the risk assessments but chose  not to use them to inform one of the plans and one of the capabilities we  reviewed because they were not useful for the plan or the capability. Since 2001, DHS has  developed a range of CBRN risk assessments, response plans, and  related capabilities to prepare for such attacks. DHS has spent at least  $70 million developing these risk assessments. More specific guidance on when and how DHS officials  should consider using the department’s CBRN risk assessments to inform  planning and investments could better help to ensure their consistent use  and that this use is sustained beyond the tenure of any given agency  official. Recommendation for Executive Action

To better ensure the consistent use of DHS’s CBRN risk assessments at  the department’s components and agencies, we recommend that the  Secretary of Homeland Security:
Establish more specific guidance, including written procedures, that  details when and how DHS components should consider using the  department’s CBRN risk assessments to inform related response plan  and capability investment decision making. Internal Control: Standards for Internal Control in the Federal  Government.
Why GAO Did This Study

The 2001 anthrax attacks in the United States highlighted the need to develop response plans and capabilities to protect U.S. citizens from chemical, biological, radiological, and nuclear (CBRN) agents. Since 2004, the Department of Homeland Security (DHS) has spent at least $70 million developing more than 20 CBRN risk assessments. GAO was requested to assess, from fiscal year 2004 to the present, the extent to which DHS has used its CBRN risk assessments to inform CBRN response plans and CBRN capabilities, and has institutionalized their use. GAO examined relevant laws, Homeland Security Presidential Directives, an Executive Order, DHS guidance, and all 12 relevant interagency CBRN response plans developed by DHS. Based on a review of a United States governmentwide CBRN database and DHS interviews, among other things, GAO selected a nongeneralizable set of seven DHS capabilities used specifically for detecting or responding to CBRN incidents to identify examples of DHSs use of its CBRN risk assessments. GAO also interviewed relevant DHS officials. This is a public version of a classified report that GAO issued in October 2011. Information DHS deemed sensitive or classified has been redacted.

What GAO Found

Since 2004, DHSs use of its CBRN risk assessments to inform its CBRN response plans has varied, from directly influencing information in the plans to not being used at all. DHS guidance states that response planning and resource decisions should be informed by risk information. GAOs analysis showed that DHS used its CBRN risk assessments to directly inform 2 of 12 CBRN response plans GAO identified because planners considered the risk assessments to be more accurate than earlier DHS planning assumptions. For another 7 of the 12 plans, DHS officials said that the assessments indirectly informed the plans by providing background information prior to plan development. However, GAO could not independently verify this because DHS officials could not document how the risk assessments influenced the information contained in the plans. GAOs analysis found general consistency between the risk assessments and the plans. For the remaining 3 plans, DHS officials did not use the risk assessments to inform the plans; for 2 of the 3 plans DHS officials told GAO they were not aware of the assessments. DHS officials also noted that there was no departmental guidance on when or how the CBRN risk assessments should be used when developing such plans.
Since 2004, DHSs use of its CBRN risk assessments to inform its CBRN-specific capabilities has varied, from directly impacting its capabilities to not being used at all. Of the 7 capabilities GAO reviewed, one was directly informed by the risk assessments; DHS used its biological agent risk assessments to confirm that its BioWatch program could generally detect the biological agents posing the greatest risk. For 5 of the 7 capabilities, DHS officials said they used the risk assessments along with other information sources to partially inform these capabilities. For example, DHS used its chemical agent risk assessments to determine whether its chemical detectors and the risk assessments were generally aligned for the highest risk agents. For 3 of these 5 capabilities, GAO could not independently verify that they were partially informed by the risk assessments because DHS officials could not document how the risk assessments influenced the capabilities. DHS did not use its CBRN risk assessments to inform the remaining CBRN capability because the assessments were not needed to meet the capabilitys mission.
DHS and its components do not have written procedures to institutionalize their use of DHSs CBRN risk assessments for CBRN response planning and capability investment decisions. Standards for internal control in the federal government call for written procedures to better ensure managements directives are enforced. DHS does not have procedures that stipulate when and how DHS officials should use the departments CBRN risk assessments to inform CBRN response planning and capability investment decisions, and GAO found variation in the extent to which they were used. DHS officials agree with GAO that without written procedures, the consistent use of the departments CBRN risk assessments by DHS officials may not be ensured beyond the tenure of any given agency official. DHS could better help to ensure that its CBRN response plans and capabilities are consistently informed by the departments CBRN risk assessments by establishing written procedures detailing when and how DHS officials should consider using the risk assessments to inform their activities.

What GAO Recommends

GAO recommends that DHS develop more specific guidance, including written procedures, that details when and how DHS components should consider using the departments CBRN risk assessments to inform related response planning efforts and capability investment decision making. DHS agreed with the recommendation.