This is the accessible text file for GAO report number GAO-06-713 
entitled 'Continuity Of Operations: Selected Agencies Could Improve 
Planning for Use of Alternate Facilities and Telework during 
Disruptions' which was released on May 11, 2006.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office:

GAO:

Report to the Chairman, Committee on Government Reform, House of 
Representatives:

May 2006:

Continuity Of Operations:

Selected Agencies Could Improve Planning for Use of Alternate 
Facilities and Telework during Disruptions:

GAO-06-713:

GAO Highlights:  

Highlights of GAO-06-713, a report to the Chairman, Committee on 
Government Reform, House of Representatives.

Why GAO Did This Study: 

To ensure that essential government services are available in 
emergencies, federal agencies are required to develop continuity of 
operations (COOP) plans. The Federal Emergency Management Agency 
(FEMA), within the Department of Homeland Security (DHS), is 
responsible for overseeing and assessing the status of COOP 
capabilities of federal executive branch agencies. It has developed 
guidance stating that agency COOP plans must designate alternate 
facilities and prepare personnel for unannounced relocation to these 
facilities. The guidance also states that agencies should consider the 
use of telework in their continuity plans.

GAO was asked to follow up on its previous work on COOP planning and 
determine, among other things, to what extent (1) 6 selected agencies 
prepared their alternate facilities and (2) 23 major agencies made 
preparations necessary to effectively use telework in emergency 
situations.

What GAO Found: 

All six agencies GAO reviewed took steps to prepare their alternate 
facilities for use in emergencies. However, none of the agencies 
followed all of FEMA’s guidance. For example, none conducted all the 
applicable tests and exercises, such as annual exercises that involve 
moving COOP personnel to alternate facilities. Further, agencies did 
not fully identify the resources necessary to support their essential 
functions, which reduces assurance that their facilities are adequately 
prepared. 

Although individual agencies are ultimately responsible for preparing 
their plans and alternate facilities, FEMA’s limited efforts to oversee 
and assess agency COOP capabilities contributed to agencies’ incomplete 
compliance with its guidance. According to an official from the 
Department of Homeland Security, FEMA recently developed a schedule of 
oversight activities that includes conducting assessments of agency 
continuity plans starting in July 2006. However, the assessment’s 
methodology is not yet finalized. If FEMA does not develop an 
assessment methodology that effectively evaluates agencies’ compliance, 
it will have limited assurance that agencies have taken the steps 
necessary to ensure that they will be able to perform essential 
government operations following a disruption. 

Although agencies are not required to use telework in continuity 
planning, 9 of the 23 agencies surveyed reported plans for essential 
team members to telework during a COOP event, compared with 3 in GAO’s 
previous survey. However, few documented that they made the necessary 
preparations to effectively use telework during such an event (see 
table). For example, only one agency documented that it had notified 
its team members of their expectation to telework during a COOP event. 
The lack of specific guidance on preparations for telework during such 
an event contributed to the low levels of preparation that agencies 
reported. If agencies do not make adequate preparations, they may not 
be able to use telework effectively to ensure the continuity of their 
essential functions in emergencies. 

Figure: Agency Responses to Selected Questions on Telework in COOP 
Plans: 

[See PDF for Image] 

Source: GAO. 

[a] Agencies responded positively but did not provide adequate 
documentation in support.
[b] In 2004, one agency did not respond, resulting in a total of 22 
responses. 

[End of table] 

What GAO Recommends: 

GAO is making recommendations to DHS aimed at improving the assessment 
and oversight of agency continuity planning and developing guidance on 
including telework in such planning. In commenting on a draft of this 
report, DHS partially agreed with GAO’s recommendations and described 
actions to implement them. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-713]

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Linda Koontz at (202) 512-
6240 or koontzl@gao.gov.

[End of section]

Contents:

Letter:

Recommendations for Executive Action:

Agency Comments and Our Evaluation:

Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff 
of the House Committee on Government Reform:

Appendix II: Comments from the Department of Homeland Security:

Abbreviations:

COOP: continuity of operations: 
DHS: Department of Homeland Security: 
FEMA: Federal Emergency Management Agency: 
FPC: Federal Preparedness Circular: 
OPM: Office of Personnel Management: 
PDD: Presidential Decision Directive:

United States Government Accountability Office:
Washington, DC 20548:

May 11, 2006:

The Honorable Tom Davis: 
Chairman: 
Committee on Government Reform: 
House of Representatives:

Dear Mr. Chairman:

As you know, essential government services can be interrupted by a 
range of events, including terrorist attacks, severe weather, or 
building-level emergencies. Federal agencies are required by 
Presidential Decision Directive (PDD) 67 to develop plans for ensuring 
the continuity of such services in emergency situations. This directive 
also designated the Federal Emergency Management Agency (FEMA) as lead 
agent for executive branch continuity of operations (COOP) planning, 
which includes the responsibility for formulating guidance on such 
planning and for assessing the status of executive branch COOP 
capabilities.[Footnote 1]

In response, FEMA issued COOP guidance to agencies in July 1999: 
Federal Preparedness Circular (FPC) 65. The circular states that, in 
order to have a viable COOP capability, agencies should identify their 
essential functions, which then provide the basis for subsequent 
planning steps. The circular further states that agencies must 
designate alternate facilities as part of their continuity plans and 
prepare their personnel for the possibility of unannounced relocation 
of essential functions to these facilities.

In June 2004, FEMA released an updated version of FPC 65, providing 
additional guidance to agencies on each of the topics covered in the 
original guidance, including an annex on alternate facilities. 
According to the guidance, an agency must identify an alternate 
facility that provides sufficient space for relocated personnel to 
perform essential agency functions during a COOP event. The guidance 
also directs agencies to identify the levels of staff and resources 
required at the alternate facility to support the performance of these 
functions. The identification of staff and resources--including 
equipment, critical information systems and data, and vital records-- 
establishes the preparation requirements for an alternate facility. For 
example, in order for an agency to determine that it has an adequate 
number of computers present at the alternate facility, it must first 
establish how many are required to support personnel in the performance 
of essential functions. Once critical resources are identified, pre- 
positioning them is necessary to preparing an alternate facility.

The 2004 version of FPC 65 also states that agencies should consider 
telework (also known as work-at-home or flexiplace) as an option in 
their COOP planning. Although FPC 65 does not require agency plans to 
incorporate telework, using this option can allow employees to 
contribute to the performance of agency essential functions without 
having to physically relocate to an alternate operating facility. As we 
reported in April 2004, telework is an important and viable option for 
federal agencies in continuity planning and implementation efforts, 
especially as the duration of an emergency event is extended[Footnote 
2]. We recommended in that report that the Secretary of Homeland 
Security direct the Under Secretary for Emergency Preparedness and 
Response to complete efforts to revise federal COOP guidance to more 
fully address human capital considerations by incorporating six 
organizational actions, the scope of which included telework.

In 2002 and 2004, we reviewed the extent to which agency COOP plans 
complied with FEMA's continuity guidance at the request of the 
Chairman, House Committee on Government Reform. In both reviews, we 
reported that agency plans did not generally comply with FEMA's 
guidance. In 2004, we also surveyed agencies to determine how they 
planned to use telework during COOP events and reported that, although 
agencies were not required to address telework in their continuity 
plans, 2 of the 22 responding agencies did so in the plans that were in 
place on May 1, 2004.[Footnote 3]

For the current review, as agreed with the committee, our objectives 
were to determine to what extent agencies have:

* prepared alternate facilities where they can perform their essential 
functions in emergencies and:

* made preparations necessary to effectively use telework in emergency 
situations.

To achieve our first objective, we obtained and reviewed headquarters 
contingency plans from 23 of the largest civilian departments and 
agencies to identify the population of alternate facilities; verified 
alternate facilities information with each agency; and selected, from 
the population of alternate facilities, six alternate facilities 
illustrating variations in several attributes, including agency budget 
size, distance from respective primary work facility, and facility 
type. For the selected alternate facilities, we evaluated compliance 
with FPC 65 criteria by analyzing agency COOP plans and other 
documentation and by visiting alternate facilities. Finally, we 
obtained and analyzed FEMA's COOP guidance and documents describing its 
efforts to provide oversight and assessments of federal planning 
efforts, and conducted interviews with FEMA officials to clarify the 
activities described in these documents.

For our second objective, we reviewed prior GAO work on telework to 
determine key practices for the development of an effective telework 
program; developed a series of questions regarding agency plans and 
preparations to use telework during a COOP event; surveyed agency 
officials responsible for continuity planning at 23 of the largest 
civilian departments and agencies to determine to what extent key 
telework practices were used in making continuity preparations; 
reviewed supporting documentation submitted by agency officials to 
support their responses; and created tables that compared this year's 
survey responses with those from our previous survey in 2004.

We conducted our review between July 2005 and February 2006 in the 
Washington, D.C., area and at several agency alternate facilities in 
accordance with generally accepted government auditing standards.

On April 13, we provided your office with a classified briefing on the 
results of this review. The purpose of this letter is to provide you 
with the unclassified material from our briefing. (See app. I.)

In summary, all six agencies we reviewed had identified alternate 
facilities and took steps to prepare their alternate facilities for use 
in emergencies. For example, most agencies documented plans and 
procedures related to these facilities, including site preparation and 
activation plans. However, none of the agencies followed all of FEMA's 
guidance. For example, none conducted all of the applicable tests and 
exercises outlined in FPC 65, including annual exercises that 
incorporate the deliberate and preplanned movement of COOP personnel to 
the agencies' alternate facilities. Further, agencies did not fully 
identify the levels of resources necessary to support their essential 
functions (e.g., the number of computers to support the performance of 
essential functions), creating a lack of assurance that the agencies' 
facilities are adequately prepared.

Although each agency is responsible for developing a viable COOP plan 
and ensuring that its alternate facilities are adequately prepared, 
FEMA's limited efforts to oversee and assess agency COOP capabilities 
contributed to the agencies' lack of compliance with all of the FPC 65 
guidance. For example, FEMA has continued to rely on agency-reported 
information as the basis for its assessments. In addition, two planned 
oversight efforts--a readiness reporting system operated by FEMA and a 
review of agency essential functions by the White House--have been 
delayed.

According to an official from the Department of Homeland Security 
(DHS)--the parent agency of FEMA--FEMA plans to expand its oversight 
activities to include the evaluation and assessment of individual 
agency COOP capabilities. As part of the methodology for an upcoming 
interagency exercise, known as Forward Challenge 06, FEMA officials 
anticipate using independent observers to evaluate agency plans and 
their implementation during the exercise. In addition, officials plan 
to conduct individual agency COOP assessments starting in July 2006. 
However, details regarding the assessment's methodology have yet to be 
finalized. If FEMA does not develop an assessment methodology that 
evaluates agencies' compliance with FPC 65--including the extent to 
which agencies (1) identify essential functions; (2) identify the 
levels of staff and resources required at their alternate facilities; 
and (3) plan, conduct, and document the necessary tests and exercises 
at the appropriate scope and frequency--it will have limited assurance 
that agencies have taken the steps necessary to ensure that they will 
be able to perform essential government operations following a 
disruption.

Finally, more agencies reported plans for essential team members to 
telework during a COOP event than in our previous survey, but few 
documented that they made the necessary preparations to effectively use 
telework during an emergency. Nine of the 23 agencies reported that 
some of their essential team members are expected to telework during 
such an event. However, only 1 agency documented that it had 
communicated this expectation to its emergency team members. In 
addition, only 3 of the 23 agencies documented testing the ability of 
staff to telework during a COOP event.

The lack of specific guidance on the steps that agencies should take to 
ensure that they are fully prepared to use telework during a COOP event 
contributed to the low levels of preparation that agencies reported. 
FEMA recently disseminated guidance to agencies regarding the 
incorporation of pandemic influenza considerations into COOP planning. 
However, while the guidance does suggest the use of telework during 
such an event, it does not address the steps agencies should take when 
preparing to use telework during a COOP event. If agencies do not make 
adequate preparations, they may not be able to use telework effectively 
to ensure the continuity of their essential functions in emergencies.

Recommendations for Executive Action:

To ensure that agencies are adequately prepared to continue performing 
essential functions following an emergency, we recommend that the 
Secretary of Homeland Security direct the FEMA Director to improve the 
oversight of agency COOP planning by taking the following three actions:

* Before the upcoming interagency exercise, conduct an assessment of 
the COOP plans of the six agencies whose alternate facilities were 
included in our review and report any deficiencies to the head of the 
agency for correction.

* Develop a methodology for individual agency COOP assessments that 
independently evaluates executive branch agencies' compliance with FPC 
65, including the extent to which agencies (1) identify essential 
functions; (2) identify the levels of staff and resources required at 
their alternate facilities; and (3) plan, conduct, and document the 
necessary tests and exercises at the appropriate scope and frequency. 
The methodology should include a mechanism for reporting any 
deficiencies to the head of the agency for correction.

* Establish a time line for developing, in consultation with the Office 
of Personnel Management (OPM), guidance on the steps that agencies 
should take to adequately prepare for the use of telework during a COOP 
event.

Agency Comments and Our Evaluation:

We received written comments on a draft of our report from the Director 
of the Department of Homeland Security's GAO/OIG Liaison Office. (These 
comments are reproduced in app. II.) In commenting on the report, the 
Director stated that DHS partially agreed with our recommendations.

In commenting on oversight of COOP planning, the Director wrote that 
PDD 67 directed that an interagency advisory group shall provide 
coordination, oversight, and management for COOP-related activities of 
executive branch agencies. He added that although FEMA is designated as 
chair of this group, participating agency coordinators are designated 
with the authority to represent and commit their agencies in COOP- 
related matters. However, as we point out in our report, according to 
FPC 65, the presidential directive also established FEMA as the lead 
agency for executive branch continuity planning. Included in this 
responsibility is the specific requirement for FEMA to oversee and 
assess the status of COOP capabilities of executive branch agencies.

In responding to our first recommendation, the Director stated that DHS 
partially agreed and that FEMA will be conducting assessments of the 
six agencies in conjunction with its upcoming interagency exercise.

Regarding our recommendation on developing an assessment methodology, 
the Director wrote that FEMA currently has an assessment program and a 
methodology that includes (1) a self-assessment tool to assist senior 
leaders in performing internal assessments, (2) the governmentwide 
exercise planned for June 2006, and (3) a plan for an expanded 
comprehensive department and agency assessment program. He added that 
FEMA plans to continually refine this methodology and expand the 
program through additional funding and resources. In addition, the 
Director stated that the agency's efforts are constrained by resources. 
He stated that to improve the readiness of the federal government's 
COOP program, additional resources are required to support the large 
number of federal offices and facilities that could benefit from 
recurring COOP assessments.

However, while these steps outline an overall approach to assessing 
agency plans, they do not constitute a methodology for assessing agency 
compliance with FPC 65--including the extent to which agencies (1) 
identify essential functions; (2) identify levels of staff and 
resources required at their alternate facilities; and (3) plan, 
conduct, and document the necessary tests and exercise at the 
appropriate scope and frequency, as we have recommended. Without such a 
methodology, the agency will have limited assurance that agencies have 
taken the necessary steps to prepare for an emergency. While we did not 
review the adequacy of FEMA's resources for conducting oversight of 
agency planning, DHS should review how FEMA prioritizes its currently 
available funding for COOP activities and to the extent it agrees that 
additional funding is needed, pursue justifying increases.

In responding to our recommendation on developing guidance on agencies' 
use of telework, the Director partially agreed and stated that FEMA 
will coordinate with OPM in the development of a timeline for further 
telework guidance. In addition, he stated that both FEMA and OPM have 
provided guidance on the use of telework. However, as stated in our 
report, present guidance does not address the preparations agencies 
should make for using telework during emergencies and it is unclear 
whether and when FEMA will release such guidance.

The Director also included technical comments that we have addressed, 
as appropriate.

We are sending copies of this report to the appropriate congressional 
committees, the Secretary of Homeland Security, and the Director of the 
Office of Personnel Management, and will make copies available to 
others on request. In addition, the report will be available at no 
charge on the GAO Web site at [Hyperlink, http://www.gao.gov].

If you or your staff have any questions about this report, please 
contact me at (202) 512-6240 or koontzl@gao.gov. Key contributions to 
this report were made by James R. Sweetman Jr., Assistant Director; 
Barbara Collier; Nick Marinos; and Kim Zelonis.

Sincerely yours, 

Signed By:

Linda D. Koontz: 
Director: 
Information Management Issues:

[End of section]

Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff 
of the House Committee on Government Reform: 

Continuity of Operations: Selected Agencies Could Improve Planning for 
Use of Alternate Facilities and Telework During Disruptions:

Briefing for the Staff of the Committee on Government Reform, House of 
Representatives:

April 13, 2006: 

Outline of Briefing:

Introduction:

Objectives, Scope, and Methodology: 

Results in Brief:

Background: 

Results:

* Alternate Facilities Compliance; 

* Telework:

Conclusions: 

Recommendations: 

Agency Comments and Our Evaluation:

Attachment 1: Agencies Participating in Telework Survey: 

Introduction:

Federal operations and facilities have been disrupted by a range of 
events, including:

* the terrorist attacks on September 11, 2001, and at Oklahoma City;

* severe weather events, such as hurricanes Katrina, Rita, and Wilma in 
2005; and:

* building-level events, such as asbestos contamination at the 
Department of the Interior's headquarters.

Such disruptions, particularly if prolonged, can lead to interruptions 
in essential government services. Prudent management, therefore, 
requires that federal agencies develop plans for ensuring the 
continuity of such services in emergency situations. These are referred 
to as continuity of operations (COOP) plans. These plans lay out an 
agency's approach to maintaining services, ensuring proper authority 
for government actions, and protecting vital assets.

In October 1998, Presidential Decision Directive (PDD) 67 identified 
the Federal Emergency Management Agency (FEMA) as the executive agent 
for federal COOP planning across the federal executive branch.

FEMA's responsibilities include:

* formulating guidance for agencies to use in developing viable plans;

* coordinating interagency exercises and facilitating interagency 
coordination as appropriate, and:

* overseeing and assessing the status of COOP capabilities across the 
executive branch.

In July 1999, FEMA first issued Federal Preparedness Circular (FPC) 65. 
FPC 65 is guidance to the federal executive branch for use in 
developing viable and executable contingency plans that facilitate the 
performance of essential functions during any emergency. Some of the 
elements of a viable continuity of operations capability, according to 
the guidance, include the identification of essential functions; 
provision for alternate facilities; provision of interoperable 
communications; availability of vital records; and conduct of regular 
tests, training, and exercises.

FEMA released an updated version of FPC 65 in June 2004, providing 
additional guidance to agencies on each of the topics covered in the 
original guidance, including an annex on alternate facilities. The 
annex states that all agencies must designate alternate operating 
facilities as part of their COOP plans and prepare their personnel for 
the possibility of an unannounced relocation to these facilities. When 
agencies identify and prepare their alternate facilities, they should 
consider a number of items, including geographical location of the 
facility, the availability of necessary logistics and infrastructure, 
and the safety and security of relocated personnel, in an effort to 
ensure that essential operations can be performed during an emergency.

Telework can allow employees to contribute to the performance of agency 
essential functions without having to physically relocate to an 
alternate operating facility. Although the 2004 version of FPC 65 does 
not require agencies to use telework (also known as work-at-home or 
flexiplace) as an element of their COOP planning, it states that 
agencies should consider telework as an option. According to the Office 
of Personnel Management's (OPM) guidance on Washington, D.C., area 
closures, one of the major benefits of a telework program is the 
ability of employees to continue working at their alternative work 
sites during a disruption to operations.[Footnote 1] In recognition of 
the growing importance of teleworkers to the continuity of agency 
operations, OPM states that agencies may require personnel to telework 
when the agency is closed.

Objectives, Scope, and Methodology:

Objectives:

In 2002 and 2004, we reviewed agency COOP plan compliance with FEMA's 
guidance at the request of the Chairman, House Committee on Government 
Reform. In both reviews we reported that agency plans did not generally 
comply with FEMA's guidance. In 2004, we also conducted a survey of 
agency planned use of telework during COOP events and reported that, 
although not required to do so, 2 of the 22 responding agencies 
addressed telework in the continuity plans that were in place on May 1, 
2004.

For the current review, as agreed with the Committee, our objectives 
were to determine to what extent agencies have:

* prepared alternate facilities where they can perform their essential 
functions in emergencies and:

* made preparations necessary to effectively use telework in emergency 
situations.

To assess the preparation of agency alternate facilities, we:

* obtained and reviewed headquarters contingency plans from 23 of the 
largest civilian departments and agencies to identify the population of 
alternate facilities;

* verified alternate facilities information with each agency;

* selected, from the population of alternate facilities, six alternate 
facilities illustrating variations in several attributes, including 
agency budget size, distance from respective primary work facility, and 
facility type;[Footnote 2]

* for the selected alternate facilities, evaluated compliance with FPC 
65 guidance through analysis of agency COOP plans, other documentation, 
and through observation during alternate facility visits; and:

* obtained and analyzed FEMA's COOP guidance and documents describing 
its efforts to provide oversight and assessments of federal planning 
efforts, and conducted interviews with FEMA officials to clarify the 
activities described in these documents.

For each of the six selected agency alternate facilities, we assessed 
compliance with FPC 65 guidance using questions based on the guidance. 
These questions address topics related to the preparation of an 
alternate operating facility:

* site selection;

* facility plans and procedures;

* employee health, safety, security, and emotional well-being;

* space;

* equipment;

* vital records;

* voice and data communications; and:

* tests and exercises.

These eight areas are our categorization of topics covered in the FEMA 
guidance on alternate facilities. Each topic area included two to seven 
questions.

We used the following steps to evaluate each agency alternate 
facility's compliance and assign answers to each of the questions:

* Documents were reviewed and compared independently by two analysts. A 
third analyst reviewed documentation where the initial two could not 
reach consensus;

* Initial assessments were shared with each agency during structured 
interviews;

* Agency officials had the opportunity to provide additional 
documentation to demonstrate compliance;

* Analysts then visited alternate facilities to measure compliance with 
agency plans and continuity guidance (e.g., identify the pre- 
positioning of equipment at the facilities);

* Any supplemental information provided by the agencies was again 
reviewed by multiple analysts.

Based on the agency contingency plans, other related documents, and 
physical observation during facility visits, we used content analysis 
to assign answers to the FPC 65-based questions. Answers were assigned 
as follows:

* yes (compliant with all of the guidance related to that question);

* no (not compliant with any of the guidance related to that question);

* partial (compliant with some, but not all of the guidance).

Based on this analysis, we created tables that summarized the results 
of the six assessments. In some cases, agencies had not established 
clear requirements (for example, they did not fully identify the 
necessary equipment, vital records, or number of personnel needed to 
perform essential functions from their alternate facilities). In those 
cases, we were unable to determine compliance; these are indicated by 
footnotes in our summary tables.

To accomplish our objective on the use of telework, we:

* reviewed prior GAO work on telework[Footnote 3] to determine key 
practices for the development of an effective telework program;

* developed a series of questions regarding agency plans to use 
telework during a COOP event;

* surveyed agency officials responsible for continuity planning at 23 
of the largest civilian departments and agencies[Footnote 4] to 
determine to what extent telework key practices were used in making 
continuity preparations;

* reviewed supporting documentation submitted by agency officials to 
support their responses; and:

* created tables that compared this year's survey responses with those 
from our previous survey in 2004.[Footnote 5]:

We conducted our review between July 2005 and February 2006 in the 
Washington, D.C., area and at several agency alternate facilities, in 
accordance with generally accepted government auditing standards. 

Results in Brief: Objective 1:

All six agencies we reviewed took steps to prepare their alternate 
facilities for use in emergencies. For example, most agencies 
documented plans and procedures related to these facilities, including 
site preparation and activation plans. However, none of the agencies 
followed all of FEMA's guidance. For example, none conducted all the 
applicable tests and exercises required by FPC 65, including annual 
exercises that incorporate the deliberate and preplanned movement of 
COOP personnel to an alternate facility. Further, agencies did not 
fully identify the levels of resources necessary to support their 
essential functions, creating a lack of assurance that their facilities 
are adequately prepared.

While individual agencies are responsible for developing a viable COOP 
plan and ensuring that their alternate facilities are adequately 
prepared, FEMA's limited efforts to oversee and assess agency COOP 
capabilities contributed to agencies' lack of compliance with all of 
the FPC 65 guidance. For example, FEMA has continued to rely on agency- 
reported information as the basis for its assessments. In addition, two 
planned oversight efforts-a readiness reporting system operated by FEMA 
and a review of agency essential functions by the White House-have been 
delayed.

FEMA recently developed a schedule of COOP oversight activities that 
includes conducting individual agency COOP assessments starting in July 
2006. However, details regarding the assessment's methodology have yet 
to be finalized. If FEMA does not develop an assessment methodology 
that evaluates agencies' compliance with FPC 65-including the extent to 
which agencies (1) identify essential functions, (2) identify the 
levels of staff and resources required at their alternate facilities, 
and (3) plan, conduct, and document the necessary tests and exercises 
at the appropriate scope and frequency-it will lack assurance that 
agencies have taken the steps necessary to ensure that they will be 
able to perform essential government operations following a disruption.

Results in Brief: Objective 2:

More agencies reported plans for essential team members to telework 
during a COOP event than in our previous survey, but few documented 
that they made the necessary preparations to effectively use telework 
during an emergency. While FPC 65 does not require agencies to telework 
during a COOP event, it does state that they should consider the use of 
telework in their continuity plans and procedures. All of the 23 
agencies that we surveyed indicated that they considered telework as an 
option during COOP planning. In addition:

* 9 of the 23 agencies reported that some of their COOP essential team 
members are expected to telework during a COOP event. However, only 1 
agency documented that it had notified its team members of their 
expectation to telework during a COOP event.

* None of the 23 agencies demonstrated that they can ensure adequate 
technological capacity to allow designated personnel to telework during 
a COOP event.

* Only 3 of the 23 agencies documented testing the ability of staff to 
telework during a COOP event.

The lack of specific guidance from FEMA on the preparations necessary 
to ensure an effective telework program contributed to the low levels 
of preparation that agencies reported. If agencies do not make adequate 
preparations, they may not be able to use telework effectively to 
ensure the continuity of their essential functions in emergencies.

Results in Brief:

Recommendations and Agency Comments:

We are making recommendations to the Secretary of Homeland Security 
aimed at improving the assessment and oversight of agency continuity 
planning and developing guidance on including telework in such planning.

In written comments provided on a draft of this briefing, the Director 
of the Department of Homeland Security's GAO/OIG Liaison Office 
commented that departments and agencies are responsible for their own 
COOP plans. We agree and we clarified the briefing to reflect this 
point. The Director also commented on recent actions FEMA has taken to 
fulfill its responsibilities for executive branch continuity planning. 
The Director's comments, however, did not address FEMA's responsibility 
to oversee and assess the status of COOP capability across the federal 
executive branch, which is outlined in FPC 65. Finally, the Director 
identified recent guidance related to telework. However, none of the 
guidance addresses the preparations agencies should take to use 
telework effectively during an emergency.

Background Guidance:

In 1988, Executive Order 12656 established policy for preparedness to 
address emergencies that affect national security, including 
technological emergencies and natural disasters. The order identified 
the National Security Council as the agency responsible for developing 
and administering a national security emergency preparedness policy, 
with the assistance of FEMA.

In October 1998, according to FEMA officials, PDD 67 established a 
requirement that agencies have COOP plans in place by October 1999. It 
identified FEMA as the executive agent for federal COOP planning across 
the federal executive branch, responsible for formulating guidance for 
agencies to use in developing viable plans, coordinating interagency 
exercises and facilitating interagency coordination as appropriate, and 
overseeing and assessing the status of COOP capabilities across the 
executive branch. FEMA's Office of National Security Coordination 
executes these COOP responsibilities.

In July 1999, FEMA issued FPC 65 to assist agencies in meeting the 
deadline established by the directive. The guidance stated that COOP 
planning should address any emergency or situation that could disrupt 
normal operations, including localized emergencies; thus, it extended 
the scope of the required planning beyond the national emergencies 
described in the Executive Order. The guidance included topic areas 
such as plans and procedures; identification of essential functions; 
delegations of authority; orders of succession; alternate facilities; 
interoperable communications; vital records and databases; and tests, 
training, and exercises. In June 2004, FEMA released an updated version 
of FPC 65, providing additional guidance to agencies on each of the 
topics covered in the original guidance.

FPC 65 states that agencies must identify essential functions and 
develop plans that ensure that these functions will resume within 12 
hours of COOP activation and continue for up to 30 days. The guidance 
states that the identification and prioritization of essential 
functions are prerequisites for continuity planning because these 
establish the parameters that drive the agency's efforts in all other 
planning areas.

Furthermore, the guidance states that an agency must identify an 
alternate facility that provides sufficient space for relocated 
personnel to perform agency essential functions. The guidance also 
directs agencies to identify the levels of staff and resources required 
at the alternate facility to support the performance of these 
functions. The identification of staff and resources-including 
equipment, critical information systems and data, and vital records- 
establishes the preparation requirements for an alternate facility. For 
example, in order for an agency to determine that it has an adequate 
number of computers present at the alternate facility, it must first 
establish how many are required to support personnel in the performance 
of essential functions. Once critical resources are identified, pre- 
positioning them is necessary to preparing an alternate facility.

The guidance requires agencies to review their alternate facilities for 
suitability and functionality. Tests and exercises allow specific 
aspects of COOP plans, procedures, and facilities to be assessed, 
validated, or identified for subsequent correction. Periodic testing 
also ensures that equipment and procedures are maintained in a constant 
state of readiness.

The guidance states that an agency must select an alternate facility 
and develop site preparation and activation plans that provide the 
agency with the capability to perform its essential functions within 12 
hours of COOP activation. The following bullets categorize key areas 
identified in FPC 65 that an agency must consider when selecting and 
preparing its alternate facility:

* Site selection. Before an agency selects a location for its alternate 
facility, it should perform an all-hazard risk assessment for each 
facility considered to determine, among other things, any natural 
hazards that may affect the facility and the ability to secure the 
facility against crime, sabotage, and terrorist attacks. When selecting 
a location, an agency should consider access to essential resources- 
such as food, water, and fuel-from the alternate facility. Finally, the 
agency should be able to run emergency power at the facility.

* Facility plans and procedures. An agency must have detailed site 
preparation and activation plans in order to achieve full operational 
capability within 12 hours of notification. An agency must have plans 
(1) for notifying its alternate facility upon COOP activation of plans 
to relocate, (2) for reception and in processing of COOP personnel upon 
arrival, and (3) to address housing for the relocated personnel.

* Employee health, safety, security, and emotional well-being. An 
agency must provide consideration for the health, safety, and emotional 
well- being of its relocating COOP personnel, and ensure that physical 
security at the alternate facility meets all requirements established 
by annual threat assessments and physical security surveys.

* Space. An agency should ensure that space at its alternate facility 
is adequate for supporting the number of relocating COOP personnel 
identified in the agency's staffing plans.

* Equipment. An agency should identify the critical resources-including 
information technology (IT) and telecommunications equipment-needed to 
perform essential functions. An agency must pre-position critical 
resources at its alternate facility and have procedures for ordering 
equipment not already in place.

* Vital records. Agency personnel must have access to electronic and 
hard-copy vital records and databases needed to perform the agency's 
essential functions from the alternate facility. In order for an agency 
to establish access requirements for vital records and databases at the 
alternate facility, it must develop a vital records inventory with 
location and access information for each vital record.

* Voice and data communications. An agency must have redundant 
communications providing the capability to communicate with key 
contacts, including agency staff, critical customers, and the public. 
It must also provide access to a local area network, electronic vital 
records, critical information systems and data, and internal and 
external e-mail and archives.

* Tests and exercises. An agency must conduct and document tests and 
exercises of its COOP plans and procedures to ensure that, among other 
things, requirements at the alternate facility are adequate for 
performing essential functions.

Background Previous GAO Reports:

We previously reported on federal agency headquarters contingency plans 
in place in May 2004 at the request of the Chairman, House Committee on 
Government Reform.[Footnote 6] At that time, we determined that 
agencies had made progress in improving compliance with FPC 65, but 
significant weaknesses remained. For example, only 3 out of the 45 
agency COOP plans we reviewed documented that their alternate 
facilities could provide previously identified equipment and space for 
COOP personnel responsible for performing essential functions. In 
addition, only 8 out of 45 COOP plans we reviewed adequately documented 
that the agencies could provide interoperable communications from their 
alternate facilities with internal and external organizations, critical 
customers, and the public.

During our previous reviews of agency COOP plans, we reported that 
insufficient oversight by FEMA contributed to agencies' lack of 
compliance with the continuity guidance. Specifically, we noted that 
FEMA had not conducted an assessment of agency contingency plans since 
1999. In response, FEMA officials reported that they were developing a 
readiness reporting system-a system used to collect data from agencies 
on the readiness of their continuity plans that would evaluate 
compliance with the guidance-which was to be completed in March 2005. 
The system was expected to be operational and certified by October 
2005, at which time there would be seven locations (including two FEMA 
locations) using the system. 

Background Telework:

Telework, also referred to as telecommuting or flexiplace, has gained 
widespread attention over the past decade in both the public and 
private sectors as a human capital flexibility that offers a variety of 
potential benefits to employers, employees, and society. In a 2003 
report to Congress on the status of telework in the federal government, 
the Director of OPM described telework as "an invaluable management 
tool which not only allows employees greater flexibility to balance 
their personal and professional duties, but also allows both management 
and employees to cope with the uncertainties of potential disruptions 
in the workplace, including terrorist threats."[Footnote 7] The 2005 
OPM report on telework notes the importance of telework in responding 
flexibly to emergency situations, as demonstrated in the wake of the 
devastation caused by Hurricane Katrina, when telework served as a tool 
to help alleviate the issues caused by steeply rising fuel prices 
nationwide.[Footnote 8]:

According to OPM's guidance on Washington, D.C., area closures, one of 
the major benefits of a telework program is the ability of employees to 
continue working at their alternative work sites during a disruption to 
operations.[Footnote 9] In recognition of the growing importance of 
teleworkers to the continuity of agency operations, OPM states that 
agencies may require personnel to telework when the agency is closed. 
According to OPM guidance, telework enabled employees to continue 
working after being displaced during events such as the terrorist 
attacks and subsequent anthrax problems of 2001.[Footnote 10]:

In November 2005, the White House issued a national strategy to address 
the threat of pandemic influenza.[Footnote 11] The strategy states that 
social distancing measures may be appropriate public health 
interventions for infection control and containment during a pandemic 
outbreak. Telework is an example of social distancing. The strategy 
requires federal departments and agencies to develop and exercise 
preparedness and response plans that take into account the potential 
impact of a pandemic on the federal workforce. It also tasks the 
Department of Homeland Security (DHS)-the parent department of FEMA-
with developing plans to implement the strategy in regard to domestic 
incident management and federal coordination.

As we reported in April 2004, telework is an important and viable 
option for federal agencies in COOP planning and implementation 
efforts, especially as the duration of an emergency event is 
extended.[Footnote 12] In a July 2003 report, we defined 25 key 
telework practices for implementation of successful federal telework 
programs. [Footnote 13]:

In our April 2005 report on continuity of operations, we reported that 
although agencies were not required to use telework in their continuity 
plans, 1 of the 21 agency continuity plans in place on May 1, 2004, 
documented the agency's intention to address some essential functions 
through telework. [Footnote 14] In addition, 10 agencies reported that 
they intended to use telework following a COOP event, but those 
intentions were not documented in their continuity plans. The plans 
reviewed were created before the issuance of FEMA's revised continuity 
planning guidance, which includes the recommendation that agencies 
consider options such as work-at-home and virtual offices when 
establishing continuity plans.

Objective 1: Alternate Facilities Compliance:

All six agencies we reviewed took steps to prepare their alternate 
facilities using practices identified in the FPC 65 guidance. Agency 
use of these practices, which fall into the eight topic areas presented 
earlier, are presented in the following slides.

Among the eight areas, the extent to which agencies performed the 
practices varied. For example, most agencies documented plans and 
procedures related to their alternate facilities, including site 
preparation and activation plans. In contrast, none conducted all the 
applicable tests and exercises required by FPC 65, including annual 
exercises that incorporate the deliberate and preplanned movement of 
COOP personnel to an alternate facility. Furthermore, agencies did not 
fully identify the levels of resources necessary to support their 
essential functions.

Although individual agencies are responsible for developing a viable 
COOP plan and ensuring that their alternate facilities are adequately 
prepared, FEMA's limited efforts in overseeing and assessing agency 
COOP capabilities contributed to agencies' lack of compliance with all 
of the FPC 65 guidance.

Site Selection:

FPC 65 states that agencies must identify and prepare alternate 
facilities as part of their COOP plans. The guidance requires that if 
the selected facility is not owned or leased by the agency, a signed 
memorandum of agreement/understanding (MOA/MOU) must be prepared with 
the owner or occupant of the facility and reviewed annually. 
Furthermore, agencies should consider access from the alternate 
facility to essential resources-such as food, water, fuel, medical 
facilities, and municipal services. Agencies should also have the 
ability to run emergency power at their alternate facilities. When 
selecting their alternate facilities, agencies should perform an all- 
hazard risk assessment for any facility considered for COOP use. This 
assessment should consist of an analysis that includes identification 
of all natural hazards that may affect each facility.

All six agencies identified their alternate facilities, and the one 
agency that shares its alternate facility with its owners had a 
documented MOA. Most agencies considered access to essential resources 
and had the ability to run emergency power. However, only one of the 
agencies documented that it had performed the required all-hazard risk 
assessments when selecting the identified alternate facilities. If an 
agency does not conduct an all-hazard risk assessment before selecting 
a facility, it may select a site that is unduly susceptible to:

(1) natural hazards; (2) accidents, such as releases of hazardous 
materials; (3) crime, sabotage, and terrorist attacks; or (4) 
inadequate capabilities of on-site and/or local first responders to 
accommodate the needs of the relocating agency.

Table: Site Selection: Responses by Question:

Question: Does the agency identify an alternate facility as a part of 
its COOP plan? 
Yes: 6; 
Partial: 0; 
No: 0; 
N/A: 0.

Question: If an alternate facility is not owned or leased by the 
agency, does the agency have a signed Memorandum of 
Agreement/Understanding (MOA/MOU)? 
Yes: 1; 
Partial: 0; 
No: 0; 
N/A: 5.

Question: Did the agency consider access to essential resources such as 
food, water, fuel, medical facilities, and municipal services from the 
alternate facility? 
Yes: 5; 
Partial: 1; 
No: 0; 
N/A: 0.

Question: Does the agency have the ability to run emergency power at 
the alternate facility to allow essential functions and operations to 
continue? 
Yes: 4; 
Partial: 1; 
No: 0; 
N/A: 1[Footnote 15].

Question: Did the agency perform an all-hazard risk assessment for the 
alternate facility? 
Yes: 1; 
Partial: 2; 
No: 3; 
N/A: 0.

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Objective 1: Alternate Facilities Compliance Facility Plans and 
Procedures:

Facility Plans and Procedures:

FPC 65 states that agencies must have detailed site preparation and 
activation plans in order to achieve full operational capability within 
12 hours of notification. Additionally, the agency must plan for 
notifying the alternate facility upon COOP activation and provide 
instructions to COOP personnel for relocating to its alternate 
facility. Furthermore, an agency must have plans for in-processing of 
COOP personnel upon arrival at the alternate facility and plans to 
address the housing of COOP personnel, if applicable.

Most agencies documented site preparation and activation plans and 
procedures, documented plans to notify their alternate facilities upon 
COOP activation, and provided instructions for relocating to their 
alternate facilities. Most agencies also documented plans for reception 
and in-processing of COOP personnel. Three agencies reported that 
housing plans were not applicable because their alternate facilities 
were at a commutable distance for COOP personnel. Of the other three 
agencies, two documented plans to address housing for the relocated 
employees.

Table: Facility Plans and Procedures: Responses by Question:

Question: Does the agency have a site preparation and activation plan 
pre- positioned at the alternate facility? 
Yes: 5; 
Partial: 1; 
No: 0; 
N/A: 0.

Question: Does the agency have a plan for notifying alternate 
facilities at the time of COOP activation? 
Yes: 5; 
Partial: 0; 
No: 1; 
N/A: 0.

Question: Does the agency provide instructions for relocating to 
alternate facilities? 
Yes: 5; 
Partial: 1; 
No: 0; 
N/A: 0.

Question: Does the agency have procedures for the reception and in-
processing of personnel at the alternate facility? 
Yes: 4; 
Partial: 2; 
No: 0; 
N/A: 0.

Question: Does the agency have a plan to address housing for COOP 
personnel, if applicable? 
Yes: 2; 
Partial: 1; 
No: 0; 
N/A: 3. 

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Objective 1: Alternate Facilities Compliance Employee Health, Safety, 
Emotional Well-being, and Security:

Employee Health, Safety, Emotional Well-being, and Security:

FPC 65 states that alternate facilities must provide consideration for 
the health, safety, emotional well-being, and security of relocated 
employees. The guidance calls for agencies to have sufficient personnel 
and technology to provide perimeter and access control, internal 
security functions, and surveillance of the facility. Physical security 
at the alternate facility must meet the requirements established by 
annual threat assessments and physical security surveys by the agency's 
security office, the Federal Protective Service, or a qualified 
contractor.

All six agencies provided consideration for the health and safety of 
relocated COOP personnel. For example, one agency's alternate facility 
provided medical support on site while another was equipped with first 
aid supplies. In addition, the six agencies provided consideration for 
the emotional well-being of relocated COOP personnel. For example, one 
agency's facility included an employee assistance program office 
staffed with counselors, while another provided a recreation area for 
off-shift relaxation.

At all six agency alternate facilities that we visited, physical access 
to the facilities was controlled through the use of guards, 
identification badges, or entry devices such as key cards. Three 
agencies documented that they had conducted all of the required 
physical security surveys and threat assessments. If an agency does not 
conduct the necessary physical security assessments and surveys, it may 
be unaware of vulnerabilities at its alternate facility and, therefore, 
unable to address them.

Objective 1: Alternate Facilities Compliance Employee Health, Safety, 
Emotional Well-being, and Security:

Table: Employee Health, Safety, Emotional Well-being, and Security: 
Responses by Question: 

Question: Does the agency provide consideration for the health and 
safety of relocated COOP personnel? 
Yes: 6; 
Partial: 0; 
No: 0; 
N/A: 0.

Question: Does the agency provide consideration for the emotional well-
being of relocated COOP personnel? 
Yes: 6; 
Partial: 0; 
No: 0; 
N/A: 0.

Question: Is access to facilities controlled through the use of guards, 
identification badges, or entry devices such as key cards or 
biometrics? 
Yes: 3; 
Partial: 3; 
No: 0; 
N/A: 0.

Question: Does the agency provide physical security that meets all 
requirements established by annual threat assessments and physical 
security surveys? 
Yes: 6; 
Partial: 0; 
No: 0; 
N/A: 0.

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Alternate Facility Space:

FPC 65 requires agencies to establish staffing requirements needed to 
perform essential functions within 12 hours of COOP activation and for 
up to 30 days. In addition, the guidance states that agencies must 
ensure that alternate facilities have enough space to accommodate the 
maximum number of relocating personnel they require.

All six agencies identified the maximum number of COOP personnel that 
could relocate to their alternate facilities. Four of those agencies 
provided adequate space to accommodate the maximum number of staff 
indicated in their staffing plans. The other two agencies did not 
provide enough space at their alternate facilities to accommodate all 
of the relocating COOP personnel. Officials from those two agencies 
stated that the number of COOP personnel simultaneously relocating to 
their facilities would be less than the maximum number of personnel 
identified, although they were unable to provide documentation to 
support this.

If agencies do not establish clear staffing requirements for their 
alternate facilities, the allocated space at the facilities may be 
insufficient to accommodate COOP personnel needed to perform agency 
essential functions.

Table: Alternate Facility Space: Responses by Question:

Question: Does the agency identify the maximum number of personnel that 
could relocate to the alternate facility? 
Yes: 6; 
Partial: 0; 
No: 0; 
N/A: 0.

Question: Does the agency identify sufficient space at the alternate 
facility to accommodate the number of personnel4200 identified to 
relocate there? 
Yes: 4;
Partial: 2; 
No: 0;
N/A: 0.

Source: GAO analysis of agency alternate facilities and continuity 
planning documents. 

[End of table]

Equipment:

FPC 65 requires that agencies identify the critical resources-including 
IT and telecommunications equipment-needed to perform essential 
functions. Agencies must pre-position critical resources at the 
alternate facility to ensure the availability of services. In addition, 
agencies should (1) have procedures for ordering equipment and supplies 
not already in place at the alternate facility and (2) annually review 
their lists of resources required to perform essential functions and 
update them as necessary.

All six agencies identified types of equipment they would need to 
perform essential functions at their alternate facilities, but four 
agencies did not identify both types and quantities. For example, one 
agency required computers at its facility but did not specify how many. 
Because of the unclear requirements for the four agencies, we were 
unable to determine whether all necessary resources were pre-positioned 
at their facilities. In addition, four agencies had procedures for 
ordering equipment and supplies, and one agency demonstrated that it 
annually reviewed its lists of equipment. If an agency does not 
identify equipment requirements for the alternate facility, it cannot 
be assured that the current level of resources present at its alternate 
facility is adequate for performing the essential functions.

Table: Equipment: Responses by Question:

Question: Does the agency establish requirements for equipment 
(including IT and telecommunications hardware) needed to perform 
essential functions? 
Yes: 2; 
Partial: 4; 
No: 0; 
N/A: 0.

Question: Has the agency pre-positioned equipment, as identified, at 
the alternate facility[Footnote 16]? 
Yes: 2; 
Partial: N/A; 
No: N/A; 
N/A: N/A.

Question: Does the agency identify the office supplies needed to 
perform essential functions? 
Yes: 2; 
Partial: 3; 
No: 1; 
N/A: 0.

Question: Does the agency have procedures for ordering equipment and 
supplies not already in place at the alternate facility? 
Yes: 4; 
Partial: 2; 
No: 0; 
N/A: 0.

Question: Does the agency annually review its lists of equipment 
required to perform essential functions and update them as necessary? 
Yes: 1; 
Partial: 0; 
No: 5; 
N/A: 0.

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Vital Records:

FPC 65 states that agency personnel must have access to electronic and 
hard-copy vital records and databases needed to perform their essential 
functions from the agency alternate facility. In order for an agency to 
establish access requirements for vital records and databases at the 
alternate facility, it must develop a vital records inventory with 
location and access information for each vital record. The guidance 
also states that an agency must develop and maintain a vital records 
plan packet that includes-among other items-agency contact information, 
lists of records recovery experts and vendors, and its vital records 
inventory.

One of the six agencies maintained an inventory that included location 
and access information for each vital record and database required to 
perform essential functions at the alternate facility. For the 
remaining five agencies, which lacked complete inventories, we could 
not fully assess whether the necessary electronic and hard copy vital 
records would be available at the facilities. Furthermore, only one out 
of the six agencies had a complete vital records plan packet at its 
alternate facility. If an agency does not maintain a complete inventory 
of the vital records and databases needed to perform essential 
functions, it will be unable to determine whether the records necessary 
for performing agency essential functions will be available at the 
alternate facility.

Objective 1: Alternate Facilities Compliance Vital Records:

Vital Records: Responses by Question:

Question: Does the agency establish requirements for vital records and 
databases needed to support its essential functions in an inventory 
that includes location and access information? 
Yes: 1; 
Partial: 5; 
No: 0; 
N/A: 0.

Question: Does the agency provide the capability to access its 
classified and unclassified vital records and databases from the 
alternate facility?[Footnote 17]: 
Yes: 1; 
Partial: N/A; 
No: N/A; 
N/A: N/A.

Question: Does the agency have a vital records plan packet? 
Yes: 1; 
Partial: 4; 
No: 1; 
N/A: 0.

Question: Does the agency provide the procedures for moving non-pre-
positioned vital records from the primary to the alternate facility in 
event of COOP activation? 
Yes: 2; 
Partial: 1; 
No: 3; 
N/A: 0.

Question: Does the agency outline procedures for updating vital records 
to ensure that they always contain the most current information? 
Yes: 2; 
Partial: 3; 
No: 1; 
N/A: 0.

Question: Did the agency conduct a risk assessment for its vital 
records? 
Yes: 1; 
Partial: 0; 
No: 5; 
N/A: 0.

Question: Does the agency identify individuals that can assist with 
recovery from potential records damage? 
Yes: 3; 
Partial: 0; 
No: 3; 
N/A: 0.

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Voice and Data Communications:

The success of agency operations at an alternate facility depends on 
the availability of voice and data communication methods. FPC 65 states 
that an agency must have redundant communications systems at its 
alternate facility. Furthermore, an agency must have the ability to 
communicate with key contacts, including (1) agency staff-such as COOP 
personnel, agency leadership, and other employees operating from 
different locations-and (2) external entities, such as the FEMA 
Operations Center, the Homeland Security Operations Center, critical 
customers, and the public. The guidance also states that an agency must 
be able to access from its alternate facility its critical information 
systems and data, a local area network, and internal and external e- 
mail and archives.

Although most agencies provided redundant emergency communications 
methods at their alternate facilities, four agencies did not fully 
document procedures for how they would communicate with key internal 
and external entities using these methods. For example, two agencies 
provided information on how to contact others but did not have clear 
procedures demonstrating how they would receive incoming communications 
at their alternate facilities.

In addition, three out of the six agencies did not specifically 
document the data and critical information systems needed for essential 
functions. For example, one agency identified a general need for access 
to file servers, but did not identify the specific critical information 
systems and data within the servers. As a result, we were unable to 
determine whether all necessary systems and data would be accessible 
from the alternate facilities. Most agencies provided access to a local 
area network, and two provided access to internal and external e-mail 
and archives.

If the ability to communicate with internal and external entities is 
limited, essential agency operations may also be limited. Furthermore, 
if agencies do not identify the critical information systems and data 
needed to perform essential functions, they cannot ensure that 
personnel will be able to access the information resources necessary to 
perform these functions at the alternate facility.

Table: Voice and Data Communications: Responses by Question:

Question: Does the agency provide communications capabilities at the 
alternate facility of sufficient quantity and mode/media to effectively 
interface with key contacts? 
Yes: 2; 
Partial: 4; 
No: 0; 
N/A: 0.

Question: Does the agency provide redundant communications systems for 
use in COOP implementation within 12 hours of COOP activation and 
sustained for up to 30 days? 
Yes: 5; 
Partial: 1; 
No: 0; 
N/A: 0.

Question: Does the agency establish requirements for data and critical 
information systems needed to conduct essential functions and support 
activities? 
Yes: 3; 
Partial: 2; 
No: 1; 
N/A: 0.

Question: Does the agency provide access to critical information 
systems and data within 12 hours of COOP activation?[Footnote 18]: 
Yes: N/A; 
Partial: 1; 
No: 2; 
N/A: N/A.

Question: Does the agency provide access to a local area network within 
12 hours of COOP activation? 
Yes: 4; 
Partial: 2; 
No: 0; 
N/A: 0.

Question: Does the agency provide access to internal and external e-
mail and archives within 12 hours of COOP activation? 
Yes: 2; 
Partial: 2; 
No: 2; 
N/A: 0. 

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Tests and Exercises:

Tests and exercises of continuity of operations capabilities are 
essential to demonstrate and improve an agency's ability to execute its 
COOP plans and procedures. FPC 65 provides for multiple test and 
exercise requirements that directly impact the preparedness of agency 
alternate facilities, including (1) annual exercises that incorporate 
the deliberate and preplanned movement of the COOP personnel to an 
alternate facility; (2) quarterly validation of internal and external 
communications capabilities at an alternate facility; and (3) tests to 
ensure that vital records and data to support essential functions are 
sufficient, complete, current, and available at an alternate facility.

None of the agencies documented that they conducted all of the required 
tests and exercises related to the preparation of alternate facilities 
that are required by FPC 65, including annually testing primary backup 
infrastructure systems and services at the alternate facilities. If an 
agency does not plan, conduct, and document the necessary tests and 
exercises of its COOP plans and procedures, it will be unable to ensure 
that (1) agency personnel are familiar with alert, notification, and 
deployment procedures; (2) resource requirements at the alternate 
facility are adequate for performing essential functions; and (3) any 
deficiencies in their plans and procedures are identified and corrected.

Table: Tests and Exercises: Responses by Question:

Question: Does the agency test annually its primary and backup 
infrastructure systems and services at its alternate facility (e.g., 
power, water, fuel)? 
Yes: 0; 
Partial: 2; 
No: 4; 
N/A: 0.

Question: Does the agency conduct annual exercises that incorporate the 
deliberate and preplanned movement of the COOP personnel to an 
alternate facility? 
Yes: 0; 
Partial: 5; 
No: 1; 
N/A: 0.

Question: Does the agency annually test/exercise its required physical 
security capabilities? 
Yes: 3; 
Partial: 0; 
No: 3; 
N/A: 0.

Question: Does the agency test to ensure that vital records and data 
are sufficient, complete, current, and available? 
Yes: 0; 
Partial: 2; 
No: 4; 
N/A: 0.

Question: Has the agency documented the quarterly validation of its 
internal and external communications capabilities at its alternate 
facility? 
Yes: 0; 
Partial: 4; 
No: 2; 
N/A: 0.

Source: GAO analysis of agency alternate facilities and continuity 
planning documents.

[End of table]

Readiness Reporting System:

Although individual agencies are responsible for developing a viable 
COOP plan and ensuring that their alternate facilities are adequately 
prepared, FEMA's limited efforts in overseeing and assessing agency 
COOP capabilities contributed to agencies' lack of compliance with all 
of the FPC 65 guidance. For example, FEMA has continued to rely on 
agency-reported information as the basis for its assessments. According 
to DHS comments on a draft of this briefing, FEMA uses its Forward 
Challenge series of interagency COOP exercises, which occur every 2 
years, as its external assessment for all executive branch agencies. 
However, participating agencies completed assessments of their own COOP 
capabilities during the most recent exercise. In addition, FEMA 
collects COOP readiness status reports from agencies and provides 
consolidated reports to White House and DHS officials.

During our previous reviews of agency COOP plans in 2002 and 2004, we 
raised similar concerns. In response, FEMA officials reported that the 
agency was developing a readiness reporting system to assist it in 
assessing agency plans. FEMA officials reported that the online system 
was to be completed in March 2005 and to be operational and certified 
by October 2005.

However, FEMA recently terminated testing and development of its 
readiness reporting system, citing design issues and stating that the 
system could not be implemented at the required scale. According to 
Office of National Security Coordination officials, an internal working 
group was established to develop system requirements and a new 
statement of work, although no time line has been established for 
development of a new system.

Interagency Tests and Exercises:

FEMA officials previously identified the agency's coordination of 
interagency COOP exercises as an effort that helps in ensuring the COOP 
readiness and capabilities of executive branch agencies. According to 
officials from the Office of National Security Coordination, the agency 
coordinated Determined Challenge, an interagency table-top exercise 
conducted in November 2005 that included participants from 46 
departments and agencies. FEMA also continues its planning efforts for 
Forward Challenge 06, its upcoming interagency exercise in June 2006. 
Officials stated that about 60 departments and agencies will 
participate in the exercise from their alternate facilities. Officials 
anticipate using independent observers to evaluate agency plans and 
their implementation during the exercise.

Although participation in FEMA's interagency exercises can help 
agencies to assess and validate their COOP plans and procedures, it 
does not ensure that agencies meet all FPC 65 requirements for tests 
and exercises. For example, the guidance calls for agency exercises to 
incorporate the movement of COOP personnel to their alternate operating 
facilities, and for these exercises to be conducted annually. However, 
FEMA coordinates such exercises only every 2 years.[Footnote 19]:

Essential Function Review:

We previously reported that the White House initiated an effort-in 
coordination with FEMA-to identify and validate the mission essential 
functions of executive branch agencies. In a memorandum issued on 
January 10, 2005, the Assistant to the President for Homeland Security 
initiated the process, stating that once identified, mission essential 
functions would serve as key continuity planning factors for agencies' 
determination of the appropriate level of staffing, communications, and 
facilities. Initial plans were to use the validated functions to 
support, among other things, the development of new continuity policy 
and to develop and implement improved requirements.

However, officials from FEMA's Office of National Security Coordination 
stated that oversight efforts to review agency essential functions were 
postponed until the council develops and releases further continuity 
policy. One official stated that the council informally reviewed 
essential functions for four agencies before the postponement, but did 
not provide formal written comments or revisions of essential functions 
to the agencies. No time line has been set for resuming the essential 
function review.

Identification of essential functions is crucial to the development of 
continuity plans and preparation of alternate facilities. Thus, until 
essential functions are reviewed and validated against consistent 
criteria, FEMA and the Homeland Security Council will lack assurance 
that agencies have made adequate preparations for alternate facilities, 
including provisions for necessary resources and staffing levels.

FEMA COOP Oversight Plan:

In his comments on a draft of this briefing, the Director of the 
Department of Homeland Security's GAO/OIG Liaison Office stated that 
FEMA has plans to expand its COOP oversight activities to include the 
evaluation and assessment of individual agency COOP capabilities. He 
added that, as part of the methodology for the upcoming interagency 
exercise, Forward Challenge 06, agency COOP plans will be externally 
evaluated before the exercise. In addition, officials plan to conduct 
individual agency COOP assessments starting in July 2006. These 
assessments will include the evaluation of, among other things, agency 
COOP plans and procedures; essential functions; alternate facilities; 
and tests, training, and exercises. FEMA officials plan to conduct two 
agency assessments per month, with assessment reports to be provided 
beginning in late August 2006. However, according to an Office of 
National Security Coordination official, details regarding the 
assessment's methodology have yet to be finalized.

Conducting assessments of agency COOP capabilities can help agencies 
validate their plans and procedures and identify any deficiencies for 
correction. However, if FEMA does not develop a methodology for 
individual agency COOP assessments that evaluates agencies' compliance 
with FPC 65-including the extent to which they (1) identify essential 
functions, (2) identify the levels of staff and resources required at 
their alternate facilities, and (3) plan, conduct, and document the 
necessary tests and exercises at the appropriate scope and frequency-it 
will lack assurance that agencies have taken the steps necessary to 
ensure that they will be able to perform essential government 
operations following a disruption.

Objective 2: Telework:

More agencies reported plans for essential team members to telework 
during a COOP event than in our previous survey, but few documented 
that they had made the necessary preparations to effectively use 
telework during an emergency. Although FPC 65 does not require agencies 
to use telework during a COOP event, it does state that they should 
consider the use of telework in their continuity plans and procedures. 
All of the 23 agencies that we surveyed indicated that they considered 
telework as an option during COOP planning. In addition:

* Nine of the 23 agencies reported that some of their COOP essential 
team members are expected to telework during a COOP event. However, 
only one agency documented that it had notified its team members of 
their expectation to telework during a COOP event.

* None of the 23 agencies demonstrated that they can ensure adequate 
technological capacity to allow designated personnel to telework during 
a COOP event.

* Only 3 of the 23 agencies documented testing the ability of staff to 
telework during a COOP event.

Reasons cited for not planning to use telework during a COOP event 
included (1) the need to access classified information-which is not 
permitted outside of secured areas-in order to perform agency essential 
functions and (2) a lack of funding for the necessary equipment 
acquisition and network modifications.

Telework Practices:

Telework: Responses by Question:

The following tables summarize the most recent agency responses to 
questions on the use of telework in responding to disruptions to 
operations. For comparison, we also provide responses from the survey 
we conducted in 2004.

Question: Does the agency have a telework policy?;
Year: 2005;
Yes: 22; 
Yes[Footnote 20](no doc): 1; 
No: 0.

Question: Does the agency have a telework policy?;
Year: 2004[Footnote 21];
Yes: 19;
Yes[Footnote 20](no doc): 3; 
No: 0:

Question: If yes, does the policy specifically address COOP events?; 
Year: 2005;
Yes: 2;
Yes[Footnote 20](no doc): 6; 
No: 15.

Question: If yes, does the policy specifically address COOP events?; 
Year: 2004; 
Yes: 1; 
Yes[Footnote 20](no doc): 2; 
No: 19.

Question: Does the COOP plan specifically address telework?; 
Year: 2005;
Yes: 12; 
Yes[Footnote 20](no doc): 3; 
No: 8.

Question: Does the COOP plan specifically address telework?; 
Year: 2004;
Yes: 2;
Yes[Footnote 20](no doc): 1; 
No: 19.

Question: Does the agency coordinate its COOP and telework planning 
processes?; 
Year: 2005;
Yes: 4;
Yes[Footnote 20](no doc): 13; 
No: 6.

Question: Does the agency coordinate its COOP and telework planning 
processes?; 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 5; 
No: 17.

Question: Was the agency's telework coordinator involved in COOP 
planning?; 
Year: 2005;
Yes: 1;
Yes[Footnote 20](no doc): 14; 
No: 8.

Question: Was the agency's telework coordinator involved in COOP 
planning?; 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 6; 
No: 16. 

Question: Are any of the COOP essential team members expected to 
telework in a COOP event? 
Year: 2005;
Yes: 3;
Yes[Footnote 20](no doc): 6;  
No: 14.

Question: Are any of the COOP essential team members expected to 
telework in a COOP event? 
Year: 2004;
Yes: 1;
Yes[Footnote 20](no doc): 2; 
No: 19.

Question: Were staff informed of their responsibility to telework 
during a COOP event? 
Year: 2005;
Yes: 1;
Yes[Footnote 20](no doc): 10;  
No: 12.

Question: Were staff informed of their responsibility to telework 
during a COOP event? 
Year: 2004;
Yes: 1;
Yes[Footnote 20](no doc): 3;  
No: 18.

Question: Has the agency ensured that it has adequate technological 
capacity for staff to telework during a COOP event? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 14; 
No: 9.

Question: Has the agency ensured that it has adequate technological 
capacity for staff to telework during a COOP event? 
Year: 2004; 
Yes: 0;
Yes[Footnote 20](no doc): 5;  
No: 17.

Question: Will the agency provide technological assistance to staff 
during a COOP event? 
Year: 2005;
Yes: 3;
Yes[Footnote 20](no doc): 11;  
No: 9.

Question: Will the agency provide technological assistance to staff 
during a COOP event? 
Year: 2004; 
Yes: 0;
Yes[Footnote 20](no doc): 5;  
No: 17.

Question: Did the agency train staff how to telework during a COOP 
event? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 13; 
No: 10.

Question: Did the agency train staff how to telework during a COOP 
event? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 3;  
No: 19.

Question: Has the agency tested the ability of staff to telework during 
a COOP event? 
Year: 2005; 
Yes: 3;
Yes[Footnote 20](no doc): 7;  
No: 13.

Question: Has the agency tested the ability of staff to telework during 
a COOP event? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 2;  
No: 20.

Question: Are any personnel not designated essential for COOP purposes 
expected to telework during an emergency? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 11;   
No: 12.

Question: Are any personnel not designated essential for COOP purposes 
expected to telework during an emergency? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 7;   
No: 15.

Question: Were staff informed of their responsibility to telework 
during a COOP event? 
Year: 2005;
Yes: 1;
Yes[Footnote 20](no doc): 5;   
No: 17.

Question: Were staff informed of their responsibility to telework 
during a COOP event? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 3;   
No: 19. 

Question: Has the agency ensured that it has adequate technological 
capacity for staff to telework during a COOP event? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 8;   
No: 15.

Question: Has the agency ensured that it has adequate technological 
capacity for staff to telework during a COOP event? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 7;   
No: 15.

Question: Will the agency provide technological assistance to staff 
during a COOP event? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 7;   
No: 16.

Question: Will the agency provide technological assistance to staff 
during a COOP event? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 5;   
No: 17.

Question: Did the agency train staff how to telework during a COOP 
event? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 4;   
No: 19.

Question: Did the agency train staff how to telework during a COOP 
event? 
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 1;   
No: 21.

Question: Has the agency tested the ability of staff to telework during 
a COOP event? 
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 4;   
No: 19.

Question: Has the agency tested the ability of staff to telework during 
a COOP event? 
Year: 2004
Yes: 0;
Yes[Footnote 20](no doc): 3;   
No: 19. 

Source: Analysis of agency responses to GAO questions.

[End of table]

Telework Telework Guidance:

No guidance addresses the steps that agencies should take to ensure 
that they are fully prepared to use telework during a COOP event. When 
we reported the results of our 2004 survey, we recommended that the 
Secretary of Homeland Security direct the Under Secretary for Emergency 
Preparedness and Response to develop, in consultation with OPM, 
guidance on the steps that agencies should take to adequately prepare 
for the use of telework during a COOP event. However, to date, no such 
guidance has been created nor has a time line been established for its 
creation.

FEMA recently disseminated guidance to agencies regarding the 
incorporation of pandemic influenza considerations into COOP planning. 
While the guidance does suggest the use of telework during such an 
event, it does not address the steps agencies should take when 
preparing to use telework during an emergency.

Without guidance on what constitutes adequate preparation, including 
tests and training, agencies are unlikely to take all the steps 
necessary to ensure that employees will be able to effectively use 
telework to perform essential functions during any COOP event, 
including an influenza pandemic.

Conclusions:

All six agencies we reviewed took steps to prepare their alternate 
facilities for use in emergencies. However, none of the agencies 
followed all of FEMA's guidance. For example, none conducted all the 
applicable tests and exercises required by FPC 65, including annual 
exercises that incorporate the deliberate and preplanned movement of 
COOP personnel to an alternate facility. Furthermore, agencies did not 
fully identify the levels of resources necessary to support their 
essential functions, creating a lack of assurance that their facilities 
are adequately prepared to support agency essential functions.

Although individual agencies are responsible for developing viable COOP 
capabilities, FEMA's limited oversight contributed to the lack of 
agency compliance with all of the FPC 65 guidance for alternate 
facilities. FEMA recently announced plans to expand its assessments of 
individual agency COOP plans, but has not yet determined how these new 
assessments will take place. If FEMA does not conduct timely 
assessments of the plans developed by the six agencies included in our 
review, it will lack assurance that those agencies are fully prepared 
to use the upcoming interagency exercise to demonstrate their 
readiness. Also, until FEMA conducts independent assessments of all 
agencies' compliance with FPC 65-including the extent to which agencies 
(1) identify essential functions, (2) identify the levels of staff and 
resources required at their alternate facilities, and (3) plan, 
conduct, and document the necessary tests and exercises at the 
appropriate scope and frequency-it will lack assurance that agencies 
have taken the steps necessary to ensure that they will be able to 
perform essential government operations following a disruption.

After the 2004 version of FPC 65 was issued, which included a 
requirement to consider the use of telework, more agencies than in our 
previous survey reported plans to use telework to some extent during 
COOP events. However, although some of these agencies reported making 
related preparations, the general lack of documentation to support 
their responses indicates that few are likely to have fully implemented 
the telework preparations that we have previously found to be 
effective. Although FEMA recently provided additional guidance on the 
use of telework, it did not address the steps agencies should take to 
prepare to use telework during an emergency event, nor has a time line 
been established for when such guidance may be written. Without 
guidance on what constitutes adequate preparation for using telework 
during an emergency situation, it will be difficult for agencies to 
identify and perform the necessary steps to ensure that their 
teleworking staff will be able to perform essential functions during a 
COOP event.

Recommendations for Executive Action: 

To ensure that agencies are adequately prepared to continue performing 
essential functions following an emergency, we recommend that the 
Secretary of Homeland Security direct the FEMA Director to improve the 
oversight of agency COOP planning by taking the following actions:

* Before the upcoming interagency exercise, conduct an assessment of 
the COOP plans of the six agencies whose alternate facilities were 
included in our review and report any deficiencies found to the head of 
the agency for correction.

* Develop a methodology for individual agency COOP assessments that 
independently evaluates executive branch agencies' compliance with FPC 
65, including the extent to which agencies (1) identify essential 
functions; (2) identify the levels of staff and resources required at 
their alternate facilities; and (3) plan, conduct, and document the 
necessary tests and exercises at the appropriate scope and frequency. 
The methodology should include a mechanism for reporting any 
deficiencies found to the head of the agency for correction.

* Establish a time line for developing, in consultation with OPM, 
guidance on the steps that agencies should take to adequately prepare 
for the use of telework during a COOP event.

Agency Comments and Our Evaluation:

In written comments provided on a draft of this briefing, the Director 
of the Department of Homeland Security's GAO/OIG Liaison Office stated 
that continuity planning is the responsibility of individual 
departments and agencies. We agree and we clarified our draft to more 
clearly identify the responsibility of agencies for their own 
continuity planning. The Director also identified actions that FEMA had 
taken to fulfill its responsibilities for coordination, guidance and 
advice, support, and periodic assessment of agency continuity planning. 
However, the list of responsibilities provided by the Director excludes 
the responsibility to oversee and assess the status of COOP capability 
across the federal executive branch, which is outlined in FPC 65. We 
revised our briefing to emphasize our conclusion that FEMA's ongoing 
reliance on self-reported information from the departments and agencies 
constitutes a limited level of oversight that contributes to the lack 
of full compliance with FEMA's continuity planning guidance.

The Director also identified recently published guidance on telework, 
as well as FEMA's guidance to agencies regarding continuity 
considerations for pandemic influenza. We updated our briefing to 
include these recent developments. However, neither the guidance issued 
by FEMA nor the additional telework guidance addresses the preparations 
necessary for agencies to ensure that they are prepared to use telework 
following a COOP event.

Attachment 1: Agencies Participating in Telework Survey:

Department of Agriculture: 

Department of Commerce: 

Department of Education: 

Department of Energy: 

Department of Health and Human Services: 

Department of Homeland Security: 

Department of Housing and Urban Development: 

Department of Justice:

Department of Labor: 

Department of State: 

Department of the Interior: 

Department of the Treasury: 

Department of Transportation: 

Department of Veterans Affairs:

Agency for International Development: 

Environmental Protection Agency: 

General Services Administration: 

National Aeronautics and Space Administration: 

National Science Foundation:

Nuclear Regulatory Commission: 

Office of Personnel Management: 

Small Business Administration: 

Social Security Administration: 

Footnotes:

[1] OPM, Washington, DC, Area Dismissal or Closure Procedures 
(Washington, D.C.: November 2005). 

[2] Because of the method of selection for the six alternate facilities 
we reviewed, we cannot conclude that our results represent any larger 
group of alternate facilities. However, the six facilities we reviewed 
illustrate some of the ways in which agencies comply with FPC 65 
guidance related to alternate facility identification and preparation. 

[3] GAO, Human Capital: Further Guidance, Assistance, and Coordination 
Can Improve Federal Telework Efforts, GAO-03-679 (Washington, D.C.: 
July 18, 2003).

[4] The 23 agencies that participated in the survey are listed in 
attachment 1.

[5] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005). 

[6] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05- 577 (Washington, D.C.: Apr. 28, 2005) and Continuity of 
Operations: Agency Plans Have Improved, but Better Oversight Could 
Assist Agencies in Preparing for Emergencies, GAO-05-619T (Washington, 
D.C.: Apr. 28, 2005). 

[7] OPM, Report to the Congress: The Status of Telework in the Federal 
Government (Washington, D.C.: January 2003).  

[8] OPM, Report to the Congress: The Status of Telework in the Federal 
Government (Washington, D.C.: 2005). 

[9] OPM, Washington, DC, Area Dismissal or Closure Procedures 
(Washington, D.C.: November 2005).

[10] OPM, Telework: A Management Priority, A Guide for Managers, 
Supervisors, and Telework Coordinators (Washington, D.C.: May 2003).

[11] Homeland Security Council, National Strategy for Pandemic 
Influenza (Washington, D.C.: Nov. 1, 2005). 

[12] GAO, Human Capital: Opportunities to Improve Federal Continuity 
Planning Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).

[13] GAO, Human Capital: Further Guidance, Assistance, and Coordination 
Can Improve Federal Telework Efforts, GAO-03-679 (Washington, D.C.: 
July 18, 2003).

[14] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005). 

[15]  One agency documented that it would relocate to its alternate 
facility selected for this assessment only if the building is 
operational; otherwise it would relocate to one of its other alternate 
facilities. 

[16] 4 of the 6 agencies did not document specific requirements for 
pre- positioned equipment, so we could not assess their compliance for 
this question. 

[17] 5 of the 6 agencies did not adequately document requirements for 
vital records and databases, so we could not assess their compliance 
for this question.

[18] 3 of the 6 agencies did not adequately document requirements for 
critical information systems and data, so we could not assess their 
compliance for this question. 

[19] Forward Challenge 06 and its predecessor, Forward Challenge 04, 
are examples of exercises that can incorporate the movement of COOP 
personnel to agency alternate facilities. 

[20] Agencies provided a positive response but did not provide adequate 
documentation to support their response.

[21] In 2004, one agency did not respond, resulting in a total of 22 
responses for that year versus 23 responses for 2005.

[End of section]

Appendix II: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, D.C. 20472:

May 5, 2006:

Ms. Linda D. Koontz:
Director: 
Information Management Issues: 
U.S. Government Accountability Office: 
441 G Street, NW:
Washington, D.C. 20548:

Dear Ms. Koontz:

Thank you for the opportunity to review and comment on the Government 
Accountability Office's (GAO's) draft report GAO-06-713 entitled 
Continuity of Operations (COOP): Selected Agencies Could Improve 
Planning for Use of Alternate Facilities and Telework During 
Disruptions. The Department of Homeland Security (DHS) recommends the 
following changes be made to the report's recommendations and findings:

Comments on GAO Recommendations:

GAO Introduction: To ensure that agencies are adequately prepared to 
continue performing essential functions following an emergency, we 
recommend that the Secretary of Homeland Security direct the Federal 
Emergency Management Agency (FEMA) Director to improve the oversight of 
agency COOP planning by taking the following actions:

DHS Comment: Presidential Decision Directive 67 (PDD 67) directs that 
an Interagency Advisory Group (IAG) shall provide coordination, 
oversight, and management for COOP related activities of executive 
branch civil departments and agencies. Although FEMA is designated as 
chair of this group, principal members' departments and agency 
emergency coordinators are designated with the authority to represent 
and commit their departments and agencies in matters relating to COOP. 
Since departments and agencies have the ultimate authority to commit 
their organizations to the coordination, oversight, and management 
recommendations of the IAG, recommend the GAO recommendation be changed 
to read, ".FEMA Director to improve the readiness of agency COOP 
programs by taking the following actions:"

GAO Recommendation One: Before the upcoming interagency exercise, 
conduct an assessment of the COOP plans of the six different agencies 
whose alternate facilities were included in our review and report any 
deficiencies found to the head of the agency for correction.

DHS Comment: We partially concur with this recommendation. FEMA will 
conduct the assessment of the six agencies in conjunction with the 
upcoming Top Officials/Forward Challenge 06 Exercise.

GAO Recommendation Two: Develop a methodology for individual agency 
COOP assessments that independently evaluates executive branch 
agencies' compliance with Federal Preparedness Circular 65 (FPC 65), 
including the extent to which agencies (1) identify essential 
functions; (2) identify the levels of staff and resources required at 
their alternate functions; and (3) plan, conduct, and document the 
necessary tests and exercises at the appropriate scope and frequency. 
The methodology should include a mechanism for reporting any 
deficiencies found to the head of the agency for correction.

DHS Comment: We partially concur with this recommendation. FEMA 
currently has an assessment program and plans to continually refine its 
assessment methodology and expand the program through additional 
funding and resources. We believe the recommendation should reflect 
this reality by beginning, "Refine the methodology for individual 
agency COOP assessments.."

GAO Recommendation Three: Establish a timeline for developing, in 
consultation with the Office of Personnel Management (OPM), guidance on 
the steps that agencies should take to adequately prepare for the use 
of telework during a COOP event.

DHS Comment: We partially concur with this recommendation. FEMA will 
continue to work with the government lead agent for telework, OPM, to 
provide further guidance on telework, recognizing that this is a 
valuable tool for improving continuity preparedness. FEMA will 
coordinate with OPM in the development of the timeline for telework 
guidance. In FPC 65, FEMA provides guidance to departments and agencies 
to consider when identifying and preparing alternate operating 
facilities for continuity operations. Options include giving 
consideration to telecommuting locations, work at home agreements, 
virtual offices, and joint or shared facilities (FPC 65, page E-1). 
FEMA and OPM provided further guidance and instruction on the potential 
use of telework during a COOP event, along with other personnel 
management options, during several Interagency COOP Working Group 
meetings during the past two years. These meetings were well attended 
by the COOP community and the presentation material received high 
praise for its usefulness. Minutes and presentation material from all 
meetings were distributed to all Interagency COOP Working Group 
members, even if not in attendance at a particular meeting. This 
includes guidance and consideration for telework during this and other 
continuity events.

Comments on GAO Findings:

In addition to the Department's comments on the recommendations, we 
believe that a number of findings should be changed to more accurately 
reflect FEMA's actions in support of COOP preparedness, as well as our 
assigned responsibilities.

* Where GAO refers to 'FEMA'S limited efforts..." DHS believes this 
verbiage should be changed to "FEMA's limited resources..."

FEMA's efforts are constrained by resources. Notwithstanding this 
limitation, FEMA has provided extensive guidance and assistance and 
conducted numerous training and exercise activities across the country 
to assist the Federal executive branch in its COOP preparedness (see 
DHS's April 10, 2006 reply to the GAO's draft briefing entitled 
Continuity of Operations: Selected Agencies Could Improve Planning for 
Use of Alternate Facilities and Telework During Disruption). To improve 
the readiness of the Federal government's COOP program, additional FEMA 
resources are required to support the large number of Federal offices 
and facilities that could benefit from recurring COOP assessments 
throughout the nation.

* References to FEMA as "executive agent" should be changed to FEMA as 
"lead agent."

Presidential Decision Directive 67 identifies FEMA as the lead agent 
for COOP. Although previous indications have been made referencing FEMA 
as executive agent, Presidential direction specifies FEMA as lead 
coordinating agency for COOP activities.

* References to tests and exercises "required" by FPC 65 should be 
reworded to indicate that such efforts are "recommended" by FPC 65.

Federal Preparedness Circulars are guidance and coordination documents 
and not directives per guidance in FPC IA, Federal Preparedness 
Circular.

* DHS suggests that references to FEMA's assessment methodology utilize 
the following language: "If FEMA does not refine its current assessment 
methodology...it will diminish the capability to assure agencies have 
taken the steps..."

FEMA currently has an assessment methodology, which includes:

FEMA Assessment Methodology:

* FEMA developed a COOP Self-Assessment Tool in 2004 (updated in 2005) 
to assist senior leaders and their COOP coordinators in performing 
internal reviews/audits of their COOP plans and programs.

* FEMA will continue to use the Forward Challenge series of exercises 
as its biennial COOP external assessment for executive branch 
departments and agencies. Planning is well along on completing this 
during the June 2006 Top Official 4/Forward Challenge 06 (T4/FC06) 
exercise. In March 2006, FEMA completed development of its plan for an 
expanded comprehensive department and agency COOP assessment program. 
FEMA will provide further COOP assessment guidance to departments and 
agencies in addition to the requirements associated with the biennial 
full-scale COOP exercises. The table below outlines the major 
components of this program.

Table: 

Compile Department and Agency COOP Plans (Part of T4/FC06 exercise 
evaluation methodology); May 1, 2006.

Complete External COOP Plan Evaluation for each Department and Agency 
(T4/FC06 Assessments); May 31, 2006.

Schedule published for the expanded Department and Agency External 
Assessment Program (New External Assessment Program); June 15, 2006.

Conduct external COOP evaluations for Departments and Agencies during 
T4/FC06 Exercise; June 20 - 21, 2006.

Conduct Department and Agency COOP Assessments to include: Plans and 
Procedures; Essential Functions; Delegations of Authority; Orders of 
Succession; Alternate Operating Facilities; Interoperable 
Communications; Vital Records and Databases; Human Capital; Test, 
Training, and Exercises; Devolution of Control and Direction; 
Reconstitution; and Telework; July 30, 2006. Assess 2 Departments and 
Agencies per month.

Provide Assessment Reports; Beginning August 31, 2006.

[End of table]

Through this program, FEMA will continue to refine upon its assessment 
program that was initiated during the Forward Challenge 2004 exercise.

Thank you again for the opportunity to comment on this draft report and 
we look forward to working with you on future homeland security issues.

Sincerely, 

Signed By:

Steven J. Pecinovsky:
Director:
Departmental GAO/OIG Liaison Office: 

(310759):

[End of section] 

Contacts:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov 
Automated answering system: (800) 424-5454 or (202) 512-7470:

Congressional Relations:

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S. 
Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548:

Public Affairs:

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: 

[End of section]

FOOTNOTES:

[1] Although the 2004 version of FPC 65 refers to FEMA as the "lead 
agent" for federal executive branch continuity efforts, the 1999 
version used the term "executive agent."

[2] GAO, Human Capital: Opportunities to Improve Federal Continuity 
Planning Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).

[3] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005); and Continuity of 
Operations: Agency Plans Have Improved, but Better Oversight Could 
Assist Agencies in Preparing for Emergencies, GAO-05-619T (Washington, 
D.C.: Apr. 28, 2005).

GAO's Mission:

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony:

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics.

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading.

Order by Mail or Phone:

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548:

To order by Phone:

Voice: (202) 512-6000:

TDD: (202) 512-2537:

Fax: (202) 512-6061:

To Report Fraud, Waste, and Abuse in Federal Programs:

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470:

Public Affairs:

Jeff Nelligan, managing director,

NelliganJ@gao.gov

(202) 512-4800

U.S. Government Accountability Office,

441 G Street NW, Room 7149

Washington, D.C. 20548: