This is the accessible text file for GAO report number GAO-11-606 entitled 'National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments' which was released on June 21, 2011. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to the Committee on Homeland Security and Governmental Affairs, U.S. Senate: June 2011: National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments: GAO-11-606: GAO Highlights: Highlights of GAO-11-606, a report to the Committee on Homeland Security and Governmental Affairs, U.S. Senate. Why GAO Did This Study: The anthrax attacks of 2001 and more recent national reports have raised concerns that the United States is vulnerable to attacks with chemical, biological, radiological, and nuclear (CBRN) agents. Because of the potential consequences of such an attack, members of Congress have expressed the need for the Departments of Homeland Security (DHS) and Health and Human Services (HHS) to coordinate in assessing risks posed by CBRN agents. GAO was asked to examine how DHS and HHS coordinate on the development of CBRN risk assessments and the extent to which they have institutionalized such efforts. GAO examined relevant laws, presidential directives, collaboration best practices, and internal control standards; analyzed DHS and HHS CBRN risk assessments; and interviewed DHS and HHS officials. What GAO Found: DHS and HHS have coordinated with each other and with other federal departments to develop CBRN risk assessments, but neither department has written procedures for developing these assessments. GAO’s best practices for interagency collaboration and federal standards for internal control indicate that agencies can best enhance and sustain coordination by adopting key practices, such as defining desired common outcomes, agreeing on roles and responsibilities, and developing written policies and procedures to help ensure that management directives are enforced. Such practices and standards could help DHS and HHS institutionalize their agreements on these sensitive and technical issues to better ensure coordination, collaboration, and continuity beyond the tenure of any given official or individual office. * DHS develops two types of CBRN risk assessments—terrorism risk assessments (TRA) and material threat assessments (MTA). TRAs assess the relative risks posed by multiple CBRN agents based on variable threats, vulnerabilities, and consequences. MTAs assess the threat posed by given CBRN agents or classes of agents and potential human exposures in plausible, high-consequence scenarios. DHS develops TRAs through interagency workgroups and has developed some MTAs in this way, which allow partners, such as HHS and the Department of Defense, to assess risk models and review and comment on the assessments. However, DHS does not have interagency agreements or written procedures for TRA and MTA development. In addition, DHS’s processes and coordination with HHS for MTA development have varied, and HHS officials would like to be more involved. DHS officials told GAO they intend to develop procedures through interagency agreements with federal partners by June 2012 but have not yet established interim time frames or milestones for doing so. By establishing interim time frames and milestones for developing and obtaining interagency agreement on its CBRN risk assessments, DHS could better ensure that it completes its plans in the intended time frame. * HHS develops one type of CBRN risk assessment—modeling the public health consequences of attacks using information from DHS MTAs—through an interagency body that includes DHS and other departments, such as the Departments of Defense and Veterans Affairs. HHS signed an interagency agreement and charters with these partners, consistent with interagency coordination best practices. However, HHS does not have written procedures detailing the processes for developing the modeling reports, such as when and how its partners are to provide input and review and comment on the overall report. Written procedures for development and review of the modeling reports could provide HHS with standardized direction for obtaining, evaluating, and incorporating interagency input. In addition, the interagency agreement expires in June 2011, and HHS officials were not certain whether they would renew it based on ongoing revisions to the interagency charters. Renewing the interagency agreement or determining if the revised charters sufficiently outline key practices for working across agency boundaries could help ensure participating departments’ commitment to work collaboratively. What GAO Recommends: GAO recommends that DHS establish time frames and milestones to better ensure timely development and interagency agreement on written procedures for development of DHS’s CBRN risk assessments and that HHS develop written procedures for obtaining and incorporating interagency input into its modeling reports and determine whether to renew its interagency agreement. DHS and HHS generally agreed. HHS expressed concern that the report implied it does not vet its products through its interagency partners, but GAO believes that it appropriately credited HHS with having a process to do so in the report. View [hyperlink, http://www.gao.gov/products/GAO-11-606] or key components. For more information, contact William O. Jenkins, Jr. at (202) 512-8777 or jenkinswo@gao.gov or Marcia Crosse at (202) 512-7114 or crossem@gao.gov. [End of section] Contents: Letter: Background: DHS and HHS Coordinate on the Development of CBRN Risk Assessments but Do Not Have Written Procedures for Their Development: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: DHS and HHS Chemical, Biological, Radiological, and Nuclear Risk Assessments: Appendix II: Comments from the Department of Homeland Security: Appendix III: Comments from the Department of Health and Human Services: Appendix IV: GAO Contacts and Staff Acknowledgments: Related GAO Products: Table: Table 1: Diseases and Agents for Which HHS Has Developed Medical and Public Health Consequence Modeling Reports: Abbreviations: BTRA: biological terrorism risk assessment: CBRN: chemical, biological, radiological, and nuclear: CTRA: chemical terrorism risk assessment: DHS: Department of Homeland Security: HHS: Department of Health and Human Services: HSPD: Homeland Security Presidential Directive: ITRA: integrated CBRN terrorism risk assessment: MOU: memorandum of understanding: MTA: material threat assessment: PHEMCE: Public Health Emergency Medical Countermeasures Enterprise: R/NTRA: radiological and nuclear terrorism risk assessment: TRA: terrorism risk assessment: [End of section] United States Government Accountability Office: Washington, DC 20548: June 21, 2011: [End of section] The Honorable Joseph I. Lieberman: Chairman: The Honorable Susan M. Collins: Ranking Member: Committee on Homeland Security and Governmental Affairs: United States Senate: The anthrax attacks of 2001 raised concerns that the United States is vulnerable to threats from chemical, biological, radiological, and nuclear (CBRN) agents, and the 2007 National Strategy for Homeland Security stated that terrorists have declared their intention to acquire and use CBRN agents as weapons to inflict catastrophic attacks against the United States.[Footnote 1] More recently, the May 2010 National Security Strategy noted that the American people face no greater or more urgent danger than a terrorist attack with a nuclear weapon, as well as the concern that the effective dissemination of a lethal biological agent within a U.S. city would endanger the lives of hundreds of thousands of people and have unprecedented economic, societal, and political consequences.[Footnote 2] In addition, multiple groups have assessed the federal government's ability to protect the nation from CBRN agents and deemed it inadequate. For example, in January 2010, the congressionally mandated Commission on the Prevention of Weapons of Mass Destruction Proliferation and Terrorism reported that the federal government lacked the capability to rapidly recognize, respond to, and recover from a terrorist attack using biological agents. Because CBRN agents differ in their potential to be used to cause widespread illness and death, members of Congress have expressed the need for the Departments of Homeland Security (DHS) and Health and Human Services (HHS) to assess the risks posed by CBRN agents in order to identify the highest-risk agents, and use their assessments to guide development of response capabilities. Response capabilities include medical countermeasures such as drugs, vaccines, and devices to diagnose, treat, prevent, or mitigate the potential effects of exposure to these agents, and CBRN surveillance and detection equipment. Assessing the risks posed by CBRN agents requires analyzing and modeling areas of great uncertainty, including determining an adversary's capability to acquire these agents, develop them into weapons, and disseminate them to estimate the plausibility and consequences of such attacks. In order to prepare for and respond to potential attacks, effective assessment of the risks posed by CBRN agents to national security and public health requires successful and sustained coordination and collaboration between DHS, HHS, and other federal departments and agencies with responsibilities and expertise in this area.[Footnote 3] Federal agencies can enhance and sustain their collaboration on CBRN risk assessment efforts by engaging in key practices--including agreeing on roles, responsibilities, processes, and outcomes--and by establishing this collaboration in written agreements. Institutionalizing this information in writing can better ensure that these agreements continue beyond the tenure of any given agency official, enabling future officials to know how they should develop CBRN risk assessments collaboratively with their partner agencies. You asked us to examine interagency coordination between DHS and HHS for the development of their CBRN risk assessments. This report addresses how DHS and HHS coordinate on the development of CBRN risk assessments and the extent to which they have institutionalized such efforts through interagency agreements and written procedures. To determine how DHS and HHS coordinate on the development of CBRN risk assessments and the extent to which they have institutionalized such efforts, we reviewed relevant federal laws, presidential directives, executive orders, and national strategies. We reviewed these documents to identify requirements for DHS and HHS to develop and engage in interagency coordination during the development of their CBRN risk assessments and compared these requirements against DHS's and HHS's efforts. We obtained and reviewed the CBRN risk assessments DHS and HHS developed since 2004, the year initial legislative requirements were enacted for the departments to develop these assessments, to determine how these documents were developed and to identify DHS's and HHS's processes for their development. We examined coordination between DHS and HHS for the development of CBRN risk assessments and did not examine the coordination between other federal departments since DHS and HHS have primary responsibility for conducting and overseeing CBRN risk assessment activities. For the purposes of this report, we consider CBRN risk assessments to include DHS's terrorism risk assessments (TRA) and material threat assessments (MTA) and HHS's public health and medical consequence modeling reports. TRAs assess the risks posed by CBRN agents based on variable threats, vulnerabilities, and consequences.[Footnote 4] MTAs assess the threat posed by given CBRN agents and the potential number of human exposures in plausible high-consequence scenarios. Modeling reports assess the public health and medical consequences of attacks with CBRN agents for given scenarios. (See app. I for more information on the TRAs, MTAs, and modeling reports.) We reviewed our best practices to enhance and sustain agency collaboration, as well as Standards for Internal Control in the Federal Government, for guidelines on internal controls--an integral component of an organization's management that provides reasonable assurance that objectives including effectiveness and efficiency of operations are being achieved--and the Project Management Institute's Standard for Program Management for program management best practices.[Footnote 5] We compared these practices and standards to DHS's and HHS's CBRN risk assessment development activities and related documents. We also interviewed officials from multiple DHS and HHS offices, components, and agencies--including DHS's Science and Technology Directorate and HHS's Office of the Assistant Secretary for Preparedness and Response-- to obtain information on their interagency coordination processes for CBRN risk assessment development. We conducted this performance audit from January 2011 through June 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: DHS leads federal interagency coordination and planning for emergency response to catastrophic CBRN incidents in the United States. DHS is responsible for assessing the risks posed by various CBRN agents, as directed by the Project BioShield Act of 2004[Footnote 6] and Homeland Security Presidential Directives (HSPD) 10 (Biodefense for the 21st Century), 18 (Medical Countermeasures against Weapons of Mass Destruction), and 22 (National Domestic Chemical Defense). To this end, DHS's Science and Technology Directorate develops CBRN TRAs and MTAs. * Each TRA assesses the relative risks posed by multiple CBRN agents based on variable threats, vulnerabilities, and consequences. Since 2004, DHS has developed seven TRA reports, with additional TRAs to be published in 2011. * Each MTA assesses the threat posed by a given, individual CBRN agent or class of agents and the potential number of human exposures in plausible, high-consequence scenarios. Since 2004, DHS has developed 17 MTA reports. DHS uses the MTAs to determine which CBRN agents pose a material threat sufficient to affect national security.[Footnote 7] (See appendix I for more information on DHS's TRAs and MTAs.) HHS leads the federal public health and medical response to potential CBRN incidents. Under the Project BioShield Act, HHS is required to assess, on an ongoing basis, the potential public health consequences of those CBRN agents that DHS determines pose a material threat sufficient to affect national security. This law requires HHS to determine for which of these agents medical countermeasures are necessary to protect the public's health.[Footnote 8] HHS conducts these activities through the Public Health Emergency Medical Countermeasures Enterprise (PHEMCE), a federal interagency decision- making body HHS established in 2006.[Footnote 9] Officials from HHS, [Footnote 10] DHS,[Footnote 11] the Department of Defense,[Footnote 12] the Department of Veterans Affairs, the Department of Agriculture, and the Executive Office of the President participate in the PHEMCE working groups and senior council. The PHEMCE working groups and senior council serve as the primary means of communication between these federal departments on CBRN medical countermeasure issues. As part of their activities, PHEMCE working group members develop medical consequence modeling reports to help assess the potential public health and medical consequences of attacks with given CBRN agents, which is an interim step in determining what types and quantities of medical countermeasures may be required to respond. Since 2004, HHS has issued 19 modeling reports for various CBRN agents. HHS develops modeling reports using data from DHS's MTAs, such as the number of individuals exposed to a given agent, to calculate the number of individuals who may become ill, be hospitalized, or die based on the MTA scenarios. (See appendix I for more information on HHS's modeling reports.) DHS and HHS Coordinate on the Development of CBRN Risk Assessments but Do Not Have Written Procedures for Their Development: DHS and HHS have coordinated with each other and with other federal departments for the development of CBRN risk assessments, but neither has written procedures for developing these assessments. Such written procedures are important for enhancing and sustaining collaboration because they can help ensure that the departments institutionalize agreements on their respective roles and responsibilities, processes for developing the risk assessments, and desired outcomes. DHS and HHS officials are currently discussing DHS's processes for developing CBRN risk assessments because HHS officials said that they are concerned that they have not been consistently involved early or substantively enough in the process. DHS officials told us they intend to develop written procedures through interagency agreements with federal partners by June 2012, but DHS has not yet established interim time frames and milestones as part of a plan to ensure that it accomplishes these results by that time. HHS has signed a memorandum of understanding (MOU) and working group charters with DHS and other federal partners that participate in PHEMCE, but the department does not have written procedures that detail the interagency processes that PHEMCE working group members are to use to develop modeling reports. Also, agency officials were not certain whether HHS will renew the MOU, which expires in June 2011, based on ongoing revisions to the working group charters. DHS Coordination with HHS on the Development of Its CBRN Risk Assessments Has Varied, and DHS Has Not Yet Established Related Written Procedures: Starting with the first biological terrorism risk assessment (BTRA) in 2006, DHS coordinated with HHS and other federal partners prior to issuing the TRAs.[Footnote 13] For the 2006 BTRA, DHS consulted with interagency experts via an ad hoc process to solicit their input during the development of the risk assessment or to have them comment on the draft document. DHS did not have interagency agreements or written procedures to articulate roles, responsibilities, or processes for interagency development or review of the risk assessment. In addition, DHS did not have interagency working groups or other structures to regularly solicit and receive partner input. For example, according to HHS officials, DHS did not involve HHS as the 2006 BTRA was being developed but did ask HHS to comment on it after it was drafted. According to DHS officials, working groups were not established for the 2006 BTRA because of the limited time that DHS had to complete this task. Since the 2006 BTRA, interagency coordination for the development and review of the TRAs has become more structured and been strengthened, according to DHS officials. This strengthening of coordination was based in part on feedback received from its interagency partners. For example, DHS officials said that HHS officials wanted to be consistently involved earlier in the development of the TRAs to be able to raise issues prior to reviewing the draft reports. DHS established two types of federal interagency working groups designed to increase the structure for obtaining interagency input on developing and reviewing TRAs.[Footnote 14] First, DHS established a working group for each TRA composed of CBRN experts from a variety of federal agencies, including HHS. For example, the integrated CBRN terrorism risk assessment (ITRA) working group includes officials from HHS's Office of the Assistant Secretary for Preparedness and Response and the National Institutes of Health. These working groups meet monthly to quarterly on an ongoing basis and provide a forum for members to (1) assess TRA modeling results, (2) request specialized studies to be included, and (3) review and comment on draft TRA reports.[Footnote 15] Second, DHS established a working group composed of experts from the intelligence community so DHS can obtain their input into and review of threat analysis data for the TRAs. According to DHS officials, this working group meets on an as-needed basis. DHS does not have interagency agreements or written procedures to define the process for how the TRAs should be developed with DHS's interagency partners, the products that should be produced, or the roles and responsibilities of involved agencies. Not having agreements and procedures is not consistent with our best practices for interagency collaboration and federal standards for internal control. According to our best practices, federal agencies engaged in interagency coordination can enhance and sustain their collaboration by adopting key practices--including defining and articulating a common outcome, agreeing on roles and responsibilities, and establishing compatible policies and procedures for operating across agency boundaries. In addition, agencies can strengthen their commitment to work collaboratively by articulating their agreements on these key practices in documents, such as MOUs or interagency planning documents, signed by senior officials in the respective agencies. [Footnote 16] Further, federal standards for internal control call for agencies to develop written policies and procedures that enforce management's directives.[Footnote 17] DHS officials stated that interagency coordination to date has relied on the personal relationships established by involved officials, and that DHS was not required to develop interagency agreements or written procedures. However, DHS officials agree that such interagency agreements and written procedures should be developed, and they plan to develop them by June 2012, as directed by the Chief Medical and Science Advisor in the Chemical and Biological Division of DHS's Science and Technology Directorate in early 2011.[Footnote 18] DHS began an effort to develop written policies and procedures for the TRA working groups at the end of 2010. Specifically, DHS drafted a charter for the working group that developed the 2011 ITRA, and DHS officials told us in October 2010 that they planned to do the same for the three other TRA working groups by the end of fiscal year 2011. However, as of March 2011, DHS officials said they had ended their efforts to finalize the ITRA charter and develop charters for the other working groups. DHS officials told us that they have begun drafting a strategic plan for DHS's overall CBRN risk assessment efforts and implementation plans for each of the TRAs and for the MTAs. The strategic and implementation plans, according to DHS officials, will contain written procedures to define TRA and MTA (1) interagency development processes, (2) products, and (3) roles and responsibilities for involved agencies. In addition, DHS officials said they will seek to have these plans signed by senior leaders at each of DHS's partner agencies to demonstrate interagency agreement on these procedures. DHS officials emphasized the importance of having their partners sign the documents to establish their commitment to working collaboratively on DHS's CBRN risk assessments based on the agreements articulated within the plans. At the time of our review, DHS did not have documentation available for us to review related to this initiative. HHS officials said that they had not seen the draft plans and were not in a position to agree or disagree with DHS's approach but have told DHS they would like to collaborate on this effort. Moreover, DHS has not yet developed interim time frames and milestones as part of a plan--consistent with standard practices for program management--to develop, finalize, and obtain interagency agreement on the proposed strategic and implementation plans. According to DHS officials, such milestones include drafting the strategic and implementation plans with input from DHS's interagency partners, obtaining approval from DHS senior management and general counsel to distribute the drafts, receiving and incorporating any changes requested by the partners, and obtaining interagency signatures on the final documents to institutionalize the interagency agreements. The Chief Medical and Science Advisor in the Chemical and Biological Division of DHS's Science and Technology Directorate initially told us in March 2011 that DHS planned to complete this effort by the end of September 2011, but has since extended this estimated completion date to June 2012.[Footnote 19] Establishing interim time frames would identify targeted dates for completing these milestone activities, among others, by June 2012. DHS's coordination with HHS and other agencies, as well as its processes for developing MTAs, have varied. Based on our analysis of DHS's processes for developing 17 MTAs from 2004 to 2010, DHS used at least four different processes for interagency coordination. For most of the MTAs, DHS held a preliminary discussion with HHS on the need for a new MTA, as well as the scope and scenario to be assessed. In some of these cases, DHS followed the preliminary discussion with HHS by convening two interagency workshops, one to solicit input on the proposed approach to developing the MTA and the other to solicit interagency comments on the MTA once it was drafted. However, in other cases, DHS only held the preliminary discussion with HHS and the later workshop to review the draft document. For one MTA, DHS did not hold a preliminary discussion with HHS or convene any workshops during its development. A DHS official involved with the MTA coordination process said that while DHS had defined a general approach to developing MTAs, the actual processes followed for a given MTA varied over time, were ad hoc, and were not guided by interagency agreements or written procedures. As a result, the process for obtaining interagency input was inconsistent from 2004 to 2010. He said that in those instances that DHS did not solicit interagency input through the workshops, DHS officials worked to obtain such input by contacting the interagency experts directly. He also said that DHS sometimes did not convene interagency workshops to reduce travel and other costs associated with holding these workshops in person. HHS officials described DHS's processes for developing MTAs as ad hoc and varied and said that they wanted more substantive and consistent coordination with DHS. HHS officials also told us that, in general, they had not been involved in key MTA development decisions. HHS uses the MTAs to help assess the medical and public health consequences of attacks with CBRN agents and determine the amount and type of countermeasures to develop and buy to respond to potential CBRN incidents. HHS officials told us that their early and consistent involvement in the development of an MTA can affect how useful the MTA is to HHS for these decisions. HHS officials cited the development of the smallpox MTA, which DHS began developing in 2010 at HHS's request, as an example of improved coordination in which HHS was involved more substantively. For this MTA, DHS officials said they consulted with HHS on the development of the MTA prior to its development and are engaged in ongoing discussions with HHS throughout the development process.[Footnote 20] However, HHS officials told us that this modified process was also an ad hoc effort that has only been used to develop the smallpox MTA, and they had no assurance that DHS would necessarily use this process for developing future MTAs. DHS does not have interagency agreements or written procedures to define the process for how the MTAs should be developed with its interagency partners, the products that should be produced, or the roles and responsibilities of involved agencies. Not having this documentation is not consistent with our best practices for interagency collaboration and federal standards for internal control. DHS officials said they plan to develop them by June 2012. DHS tried to develop an interagency agreement related to MTA development in 2008. Specifically, DHS drafted an MOU for DHS and HHS for issuing statements related to particular CBRN agents that pose a material threat to the nation based on MTA results. HHS officials said they did not sign the draft MOU, which was sent to HHS in July 2008, because they disagreed with some of its principles. For example, HHS officials expressed concern about their level of involvement in providing input into the assumptions and data used to develop the MTAs. In January 2011, DHS considered renewing its effort to have a revised MOU signed by HHS. However, DHS and HHS officials told us that these efforts were superseded by their ongoing discussions related to DHS's proposed strategic and implementation plans. As of May 2011, HHS officials told us that their concerns had not yet been resolved with DHS. By establishing interim time frames and milestones for developing and obtaining interagency agreement on its CBRN risk assessment efforts, DHS management could be better positioned to ensure that the department's proposed strategic and implementation plans are completed in the intended time frame. Such interim time frames and milestones could better ensure that DHS completes the strategic and implementation plans by June 2012 by, for example, allowing DHS senior leadership to monitor the department's progress on meeting interim time frames for achieving milestones for completion of these plans. DHS officials told us that these strategic and implementation plans will help ensure that DHS and its interagency partners achieve agreement on TRA and MTA interagency development processes and outcomes and agency roles and responsibilities, as well as establish DHS's and its partners' commitment to work collaboratively on these risk assessments. The proposed strategic and implementation plans could better ensure that future interagency coordination for the development of the TRAs and MTAs does not depend solely on personal relationships among officials from DHS and its federal partners, but is instead institutionalized at the department and continues beyond the tenure of any given official. In addition, as new interagency officials join the TRA working groups or MTA workshops, the proposed plans could better ensure that these new officials understand DHS's CBRN risk assessment development and review processes, the status of current TRA or MTA development, and their respective roles and responsibilities for these efforts. HHS Signed an Interagency Agreement and Coordinates with DHS to Develop Modeling Reports but Does Not Have Written Procedures for Their Development: HHS has signed an interagency agreement with DHS and other federal partners to develop public health and medical consequence modeling reports but does not have written procedures that specifically outline how HHS and its federal partners, including DHS, are to develop and review these modeling reports. In 2008, HHS signed an MOU and working group charters with its PHEMCE partners--including DHS, the Department of Defense, and others--which support interagency coordination for PHEMCE activities, including developing public health and medical consequence modeling reports, among other activities.[Footnote 21] Together, the PHEMCE MOU and working group charters--which stipulate the overall responsibilities and minimum meeting frequencies of the interagency working groups--are consistent with best practices for collaboration and generally serve to enhance and sustain agency collaboration by defining common outcomes and providing interagency agreement on roles and responsibilities as called for in our previous work.[Footnote 22] However, the MOU and charters do not delineate how PHEMCE partners are to conduct medical consequence modeling, develop reports, and usher them through the interagency review process. [Footnote 23] Not having this documentation is not consistent with federal standards for internal control, which call for agencies to develop written policies and procedures that enforce management's directives.[Footnote 24] From 2004 through 2006, the Executive Office of the President led interagency coordination efforts to assess public health and medical consequences, develop CBRN modeling reports, and establish medical countermeasure requirements. In 2006, HHS began leading the assessment of public health and medical consequences of CBRN agents and setting strategies for developing and acquiring medical countermeasures through the interagency PHEMCE. According to HHS officials, the PHEMCE working groups provide HHS officials with a structure for coordinating and obtaining interagency input on the modeling reports, among other activities. For example, HHS officials told us that within the PHEMCE working groups, interagency participants discuss any assumptions inherent in data about the agent or in planned responses to attacks outlined in the MTA scenarios and the range of variables and their parameters to make informed decisions on the inputs used to develop the modeling reports. HHS officials told us that the contractors and HHS staff who run the mathematical models for the modeling reports also participate in all PHEMCE working group meetings. As part of assessing public health and medical consequences and developing the modeling reports, PHEMCE working group members assess and discuss each section of the modeling reports, including the background information about the agent and the availability of medical countermeasures. Although the PHEMCE MOU and charters do not contain specific procedures for how PHEMCE partners are to develop the modeling reports, they help ensure overall coordination with DHS and other federal partners for PHEMCE activities. The Assistant Secretary for Preparedness and Response noted that collaboration with DHS has improved greatly over the past several years under the PHEMCE structure. In addition, DHS officials told us that they regularly attend PHEMCE meetings and are satisfied with the level of coordination. However, HHS officials noted that there are only a limited number of experts within PHEMCE and the federal government who have worked with CBRN agents or with individuals infected with these agents. They added that bringing all of these experts together to provide input on the modeling reports and other PHEMCE activities can be challenging because these experts often have competing responsibilities. According to HHS officials, the department did not develop written procedures for the development of modeling reports because the processes for conducting medical consequence modeling and developing the reports are constantly evolving and improving. For example, officials stated that more recent reports incorporate more factors and information than earlier versions. In addition, HHS officials told us that they do not have guidance or templates for the modeling reports because each CBRN agent is unique in the way it is transmitted and causes illness or injury and may not fit into a predetermined template. However, written procedures for the development and review of the modeling reports could provide HHS with standardized direction for obtaining, evaluating, and incorporating interagency input on these reports, while still allowing HHS to improve the modeling reports based on new scientific factors or information or new modeling techniques, or to tailor the reports to the characteristics of specific agents or types of agents. Furthermore, written procedures could also better ensure that future interagency coordination for the development of the modeling reports does not depend on personal relationships between officials from HHS, DHS, and other federal agencies. Written procedures could also help ensure that PHEMCE participants approach the development and review of each report consistently. In addition, as new interagency officials join the PHEMCE working groups, written procedures could help these new officials better understand PHEMCE's processes for assessing public health consequences and conducting modeling, the status of current modeling report development, and their respective roles and responsibilities in this effort. The 2008 MOU is set to expire in June 2011. However, according to HHS, the structure, membership, and roles of some PHEMCE participants has changed. For example, PHEMCE now includes officials from the Department of Agriculture, while participants from the Executive Office of the President no longer participate at the senior council level. HHS is currently revising the PHEMCE senior council charter to reflect the new structure and will include clarification of roles and responsibilities of the PHEMCE senior council. HHS officials told us they will determine whether to renew the MOU once they revise the senior council charter. Best practices for collaboration suggest that federal agencies engaged in interagency coordination can enhance and sustain their collaboration by articulating these practices in written agreements, such as MOUs. It is not clear whether the revised senior council charter will define and articulate common outcomes or establish compatible policies and procedures for operating across agency boundaries. Revising the charter to include this information, or renewing the PHEMCE MOU and updating it to reflect current membership if it does not, could help demonstrate the commitment of all participating federal departments to working collaboratively and helping to ensure sustained interagency coordination for the development of modeling reports and other PHEMCE activities. Conclusions: In order to prepare for and respond to potentially catastrophic attacks with CBRN agents, effective assessment of the risks posed by these agents to national security and public health requires successful and sustained coordination and collaboration between DHS, HHS, and other responsible federal departments and agencies. DHS and HHS have been developing CBRN risk assessments--DHS's TRAs and MTAs and HHS's medical consequence modeling reports--since 2004, and their processes for coordinating risk assessment development have evolved over the past 7 years but have not been fully institutionalized in writing. Developing written agreements could help DHS and HHS reach concurrence on procedures acceptable to both departments on their expected levels of involvement in developing their respective risk assessments. Given the additional value incorporated into the CBRN risk assessments from DHS and HHS working collaboratively to harness all available expertise, DHS and HHS could enhance their risk assessment processes by establishing written procedures for developing and reviewing these assessments. Establishing written procedures also includes updating existing interagency agreements, such as the PHEMCE MOU, or determining whether other agreements HHS is developing may be sufficient. Written procedures would provide direction for interagency coordination. In addition, interagency agreements could help ensure that sustained coordination continues beyond the tenure of any given agency official, enabling future officials to know their respective roles and responsibilities. While DHS intends to develop such procedures by June 2012 in collaboration with its partners, establishing interim time frames and milestones for developing the strategic and implementation plans could allow DHS senior leadership to monitor departmental progress to better ensure completion of these efforts to institutionalize interagency coordination. Recommendations for Executive Action: To ensure that DHS senior officials are able to monitor progress on the development of the proposed strategic and implementation plans for DHS's CBRN risk assessment efforts, we recommend that the Secretary of Homeland Security develop and document interim time frames and milestones as part of a plan to develop, finalize, and obtain interagency agreement on the written procedures for interagency development of the TRAs and MTAs that DHS intends to issue as strategic and implementation plans. To ensure that HHS and its federal partners are fully aware of and agree with the processes for developing the public health and medical consequence modeling reports and that consistent and effective interagency coordination continues, we recommend that the Secretary of Health and Human Services take the following two actions: * develop written procedures for obtaining, evaluating, and incorporating interagency input into the development and review of the modeling reports, to supplement the PHEMCE MOU and working group charters, and: * determine whether to renew the MOU or whether alternate coordination mechanisms, such as the PHEMCE senior council charter, are sufficient to confirm federal departments' agreement to work collaboratively. Agency Comments and Our Evaluation: We provided a draft of this report to DHS and HHS for their review. Both departments provided written comments, which are summarized below and reprinted in appendixes II and III, respectively. The departments also provided technical comments, which we incorporated where appropriate. DHS concurred with, and HHS generally agreed with, the basis for the recommendations and discussed actions planned or under way to address them. With regard to the first recommendation, DHS stated that the department has begun efforts to develop milestones and time frames for its strategic and implementation plans for interagency TRA and MTA development. In addition, DHS stated that enhanced coordination with HHS and its other federal partners for the development of the TRAs and MTAs was important, especially as the MTAs support HHS's medical countermeasure decision making. With regard to the second recommendation, HHS stated that it conceptually agreed that institutionalizing agreements and procedures for the development of the modeling reports in writing is important. However, HHS expressed concern that the report implies that HHS does not vet its products through PHEMCE partners, including its modeling reports. We disagree. The report states, for example, that PHEMCE provides a means for HHS to coordinate and obtain interagency input on modeling reports, among other activities. With regard to the third recommendation, HHS stated that it concurs and had taken action to renew the PHEMCE interagency MOU. HHS also commented that our use of the term "risk" is not consistent with DHS's and HHS's use of this term. DHS defines risk as the potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences and risk assessment as a process to assign probabilities to such outcomes. HHS pointed out that while DHS's MTAs assess threat, they do not include an assessment of the probability that a particular agent will be used. We recognize that the MTAs and HHS's medical consequence modeling reports do not individually contain all three elements of threat, vulnerability, and consequence and an assessment of probability that make up DHS's definition of risk. However, for the purposes of this report we consider both the MTAs and the modeling reports to be CBRN risk assessments. The MTAs contain assessments of threat and vulnerability, and modeling reports contain assessments of consequence and vulnerability based on the MTAs. These two types of assessments, along with DHS's TRAs, provide measurements of risk consistent with the departments' use of the term. We modified the language in the report to appropriately clarify the use of this term. Finally, HHS stated that the report's focus on HHS's modeling reports creates an inaccurate perception of these documents as end products. This was not our intention. Specifically, the report states that these documents are not intended by HHS to be end products and represent an interim step of assessing potential public health and medical consequences and determining what types and quantities of medical countermeasures HHS may need to respond to a CBRN event. However, to address HHS's concerns, we modified text in appendix I discussing the modeling reports to clarify that these are interim products. We are sending copies of this report to the Secretary of Homeland Security, the Secretary of Health and Human Services, and interested congressional committees. The report is also available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your staffs have any questions about this report, please contact William O. Jenkins, Jr. at (202) 512-8777 or jenkinswo@gao.gov or Marcia Crosse at (202) 512-7114 or crossem@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV. Signed by: William O. Jenkins, Jr. Director, Homeland Security and Justice: Signed by: Marcia Crosse: Director, Health Care: [End of section] Appendix I: DHS and HHS Chemical, Biological, Radiological, and Nuclear Risk Assessments: [End of section] In response to provisions in the Project BioShield Act of 2004 [Footnote 25] and Homeland Security Presidential Directives (HSPD) 10 (Biodefense for the 21st Century), 18 (Medical Countermeasures against Weapons of Mass Destruction), and 22 (National Domestic Chemical Defense), the Department of Homeland Security (DHS) and the Department of Health and Human Services (HHS) develop three types of chemical, biological, radiological, and nuclear (CBRN) risk assessments--DHS's terrorism risk assessments (TRA) and material threat assessments (MTA) and HHS's public health and medical consequence modeling reports. Risk and Risk Assessment: The DHS Risk Lexicon defines risk as the potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences associated with an incident, event, or occurrence. [Footnote 26] Threats are defined as entities, actions, or natural or man-made occurrences that have or indicate the potential to harm life, information, operations, or property. Vulnerabilities are defined as the physical features or operational attributes that render an entity, asset, system, network, or geographic area susceptible or exposed to hazards. Consequences are defined as the potential or actual effects of an event, incident, or occurrence. The DHS Risk Lexicon defines risk assessment as the product or process that collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making. According to DHS, risk information is usually one of many factors--and not necessarily the sole factor--that decision makers consider when deciding which strategy to pursue to manage risk. DHS and HHS CBRN Risk Assessments: DHS Terrorism Risk Assessments: In response to provisions in HSPD-10, HSPD-18, and HSPD-22, DHS conducts CBRN risk assessments and coordinates with appropriate subject matter experts, including those in HHS, in developing these risk assessments. DHS has issued seven classified TRAs to date, and one is currently in development. DHS issued three successive biological TRAs (BTRA) in 2006, 2008, and 2010; two chemical TRAs (CTRA) in 2008 and 2010; and two integrated CBRN TRAs (ITRA) in 2008 and 2011.[Footnote 27] In addition, DHS also plans to issue the first radiological and nuclear TRA (R/NTRA) in 2011. The results of the individual BTRAs, CTRAs, and R/NTRAs are combined to develop the comprehensive ITRAs.[Footnote 28] Each TRA assesses the relative risks posed by multiple CBRN agents based on variable threats, vulnerabilities, and consequences. DHS updated these TRAs biennially in the past, and DHS officials said that they plan to update them quadrennially going forward, in part to reflect current terrorism event probabilities and accurately determine relative CBRN terrorism risk. TRA results are based on risk modeling that assesses the likelihood of a terrorist attack using a CBRN agent, combined with the consequences that would result from a successful attack. Modeling of the likelihood of an attack is based on an assessment of the actions that an adversary, such as a terrorist, is determined to be likely to pursue--based in part on intelligence community inputs--combined with an assessment of the vulnerability of U.S. population centers to such an attack. DHS uses risk modeling techniques and computer software to calculate TRA results based on millions of hypothetical CBRN terrorism attack scenarios that include variable likelihood figures and consequence parameters. DHS Material Threat Assessments: Under the Project BioShield Act of 2004, DHS is required, on an ongoing basis, to assess the threat posed by specific CBRN agents and to issue determinations for those CBRN agents that pose a material threat to the U.S. population sufficient to affect national security. [Footnote 29] In response to these requirements, DHS has issued 17 classified MTAs to date, each of which assesses the threat posed by a given CBRN agent or class of agents and the potential numbers of human exposures in plausible, high-consequence scenarios.[Footnote 30] DHS solicits intelligence community officials to define and articulate the plausible, high-consequence attack scenarios that might be pursued by terrorists seeking to maximize casualties. These scenarios are then analyzed to determine the results of an MTA to provide an estimate of the number of people exposed to different dose levels of an agent in the scenario. HHS uses the MTAs to inform medical consequence modeling to support defining requirements for medical countermeasures to mitigate the health effects of CBRN agents. HHS Public Health and Medical Consequence Modeling Reports: The Project BioShield Act of 2004 calls for HHS to assess the public health consequences of exposure to those CBRN agents that DHS determines are material threats to the nation.[Footnote 31] In response, HHS has issued 19 modeling reports for CBRN agents, using the data from the corresponding DHS MTA to calculate the number of individuals who may become ill, be hospitalized, or die based on the MTA scenario. To develop these estimates from the MTAs, HHS consults with experts and uses available scientific data, such as data on how much of an agent is needed to cause infection and how long it takes to develop symptoms of disease after exposure. In addition, HHS assesses the status of current countermeasure development and availability, including applicable countermeasures that the Department of Defense may be developing. HHS uses the modeling reports as an interim step to help assess public health and medical consequences and determine which medical countermeasures are needed, and in what quantity, and the optimal timing for treating the affected population following an attack.[Footnote 32] HHS modeling reports assess factors that may affect the number of individuals who may be infected with a given CBRN agent--such as the quantity of the agent released, the timing of the release, environmental conditions, population demographics, and the timing of medical countermeasure administration, among others--and may include multiple exposure scenarios as appropriate. For example, depending upon the agent, some modeling reports may account for differences in height, weight, and lung function among individuals of different genders and ages to model short-and long-term health effects for these populations because the course of disease caused by an agent can differ based on these characteristics. Other modeling reports may evaluate multiple exposure scenarios--such as inhalation of or skin contact with an agent--to determine the numbers of potentially infected individuals. Modeling reports may also evaluate potential health consequences resulting from different response strategies based on the time it takes to detect an attack by environmental sampling or by individuals presenting at hospitals, initiate a medical countermeasure prophylaxis campaign, and distribute and dispense medical countermeasures to the affected area and individuals. Modeling report results include analyses of the range of individuals who may die without treatment with medical countermeasures and optimal time frames for providing medical countermeasures to prevent significant numbers of deaths from infection with an agent. Modeling reports also identify gaps in knowledge, such as limited scientific information about the response of a particular CBRN agent to a countermeasure, and the extent to which HHS assesses short-and long-term medical countermeasures needs as a result of exposure to an agent. (See table 1 for the HHS modeling reports developed to date.) Table 1: Diseases and Agents for Which HHS Has Developed Medical and Public Health Consequence Modeling Reports: Biological: * Anthrax[A]; * Botulism; * Glanders and melioidosis (Burkholderia); * Junin virus; * Marburg virus[B]; * Plague; * Q fever, Rocky Mountain spotted fever, and typhus (Rickettsia); * Smallpox; * Tularemia. Chemical: * Blood agents; * Low volatility nerve agents; * Pulmonary agents; * Vesicants; * Volatile nerve agents. Radiological and nuclear: * Improvised nuclear device; * Radiological dispersal device. Source: HHS. [A] HHS has issued four separate modeling reports for anthrax to examine particular issues in addition to countermeasure needs, such as countermeasure cost and effectiveness and different strategies for using anthrax vaccine. [B] The Marburg modeling report includes considerations for Ebola virus. [End of table] [End of section] Appendix II: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: June 8, 2011: William O. Jenkins: Director, Homeland Security and Justice: U.S. Government Accountability Office: 441 G. Street NW: Washington, DC 20548: Re: Draft Report GA0-11-606, "National Preparedness: DHS and III-IS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments" Dear Mr. Jenkins: Thank you for the opportunity to review and comment on this draft report. The U.S. Department of Homeland Security (DHS) appreciates the U.S. Government Accountability Office's (GAO's) work in planning and conducting its review and issuing this report. The Department is pleased to note the report recognizes that DHS, the U.S. Department of Health and Human Services (HHS), and other key federal partners have been coordinating and developing Chemical, Biological, Radiological, and Nuclear (CBRN) risk assessments since 2004. These assessments are critical to supporting the Nation's CBRN preparedness and defense-related activities, including investments for prevention, protection, surveillance, detection, response, and recovery. DHS is fully committed to supporting the National CBRN Defense Strategies and all our federal partners to ensure key risk assessments are conducted in a collaborative and coordinated manner to yield quality products. These assessments are based on current, available science and knowledge and our best judgments to understand the risks inherent in CBRN agents. The inevitable degree of uncertainty associated with understanding these agents and their use is also a contributing factor. As such, it is critical for our federal, state, local, and tribal partners to utilize these assessments with the understanding of the assessments' intended uses, applications, and limitations when making decisions. The draft report contained one recommendation directed to DHS. Specifically, to ensure that DHS senior officials are able to monitor progress on the development of the proposed strategic and implementation plans for DHS's CBRN risk assessment efforts, GAO recommended that the Secretary of Homeland Security: Recommendation: Develop and document interim time frames and milestones as part of a plan to develop, finalize, and obtain interagency agreement on the written procedures for interagency development of the TRAs and MTAs that DHS intends to issue as strategic and implementation plans. Response: Concur. DHS agrees that the collaboration and coordination between DHS and HHS for conducting the CBRN risk assessments — terrorist risk assessments (TRAs) and material threat assessments (MTAs) can be enhanced and strengthened. For example, the MTAs encompass population exposure modeling for consensus scenarios and support HHS's public health modeling and medical countermeasures requirements development efforts resulting in the issuance of Material Threat Determinations to facilitate better preparations for and responses to potentially catastrophic attacks with CBRN agents. DHS has initiated efforts to map out the timeline and milestones to ensure timely development of a Strategic Implementation Plan for conducting these critically important assessments. Again, thank you for the opportunity to review and comment on this draft report. Sensitivity comments have been submitted under separate cover. We look forward to working with you on future Homeland Security issues. Sincerely, Signed by: Jim H. Crumpacker: Director: Departmental GAO/OIG Liaison Office: [End of section] Appendix III: Comments from the Department of Health and Human Services: Department Of Health & Human Services: Office Of The Secretary: Assistant Secretary for Legislation: Washington, DC 20201: June 2, 2011: Marcia Crosse: Director, Health Care: William 0. Jenkins: Director, Homeland Security and Justice: U.S. Government Accountability Office: 441 G Street N.W. Washington, DC 20548: Dear Ms. Crosse and Mr. Jenkins: Attached are comments on the U.S. Government Accountability Office's (GAO) draft report entitled: "National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments" (GAO-11606). The Department appreciates the opportunity to review this report before its publication. Sincerely, Signed by: Jim R. Esquea: Assistant Secretary for Legislation: Attachment: [End of letter] General Comments Of The Department Of Health And Human Services (HHS) On The Government Accountability Office'S (GAO) Draft Report Entitled, "National Preparedness: DHS And HHS Can Further Strengthen Coordination For Chemical, Biological, Radiological, And Nuclear Risk Assessments" (GA0-11-606): The Department appreciates the opportunity to review and comment on this draft report. Throughout this report, GAO's use of the term "risk" is not consistent with its use by HHS and the Department of Homeland Security (DHS). For example, a material threat assessment (MTA) evaluates threat, which is a component of risk, but not risk, because it does not include an assessment of the probability or likelihood of a particular agent being used. We have raised this issue with GAO previously and the response has been that GAO prefers to use the term "risk" in a more generic way. Nevertheless, the Department wants to make official note of this concern. Similarly, throughout this draft report there is a focus on the consequence modeling reports as if they are the end product of the Public Health Emergency Medical Countermeasures Enterprise (PHEMCE) working groups. This is not an accurate assessment. The modeling report feeds into the consequence assessment process within the working groups that develop the scenario-based requirements (SBRs) that discuss the agent, the disease characteristics, the types of consequences, the number of injuries by types, and other factors. The PHEMCE working group members develop SBRs for delivery, not modeling reports. The modeling is one input and documentation to support the SBRs and product-specific requirements (PSRs). GAO's focus on the modeling reports as representative of the medical consequence assessment and not including discussion of the SBR development process can be misleading as it does not accurately describe the entire process. Conceptually, we agree with GAO's emphasis in this report on memorializing agreements and institutionalizing best practices for development of the terrorism risk assessments (TRAs), MTAs, and consequence modeling reports in written documents, and the report makes many useful observations about current deficiencies in this regard. However, we are concerned that the language used in this report implies that HHS does not vet the PHEMCE work products (including modeling reports, SBRs, and PSRs), when in actuality there is a transparent process, albeit one that is not documented in a charter. HHS concurs with GAO that the PHEMCE interagency memorandum of understanding (MOU), which expires in June 2011, demonstrates the commitment of all participating federal departments to work collaboratively on PHEMCE issues. For this reason, HHS has undertaken efforts to renew this MOU with its interagency partners. [End of section] Appendix IV: GAO Contacts and Staff Acknowledgments: GAO Contacts: William O. Jenkins, Jr., (202) 512-8777 or jenkinswo@gao.gov: Marcia Crosse, (202) 512-7114 or crossem@gao.gov: Staff Acknowledgments: In addition to the contacts named above, Sheila K. Avruch, Assistant Director; Edward George, Assistant Director; David Alexander; Katherine Davis; Shana R. Deitch; Bonnie Doty; Tracey King; David Lysy; Carolina Morgan; Roseanne Price; and David Schneider made significant contributions to this report. [End of section] Related GAO Products: Public Health Preparedness: Developing and Acquiring Medical Countermeasures Against Chemical, Biological, Radiological, and Nuclear Agents. [hyperlink, http://www.gao.gov/products/GAO-11-567T]. Washington, D.C.: April 13, 2011. Measuring Disaster Preparedness: FEMA Has Made Limited Progress in Assessing National Capabilities. [hyperlink, http://www.gao.gov/products/GAO-11-260T]. Washington, D.C.: March 17, 2011. Biosurveillance: Efforts to Develop a National Biosurveillance Capability Need a National Strategy and a Designated Leader. [hyperlink, http://www.gao.gov/products/GAO-10-645]. Washington, D.C.: June 30, 2010. National Security: Key Challenges and Solutions to Strengthen Interagency Collaboration. [hyperlink, http://www.gao.gov/products/GAO-10-822T]. Washington, D.C.: June 9, 2010. Homeland Defense: DOD Can Enhance Efforts to Identify Capabilities to Support Civil Authorities during Disasters. [hyperlink, http://www.gao.gov/products/GAO-10-386]. Washington, D.C.: March 30, 2010. Homeland Defense: DOD Needs to Take Actions to Enhance Interagency Coordination for Its Homeland Defense and Civil Support Missions. [hyperlink, http://www.gao.gov/products/GAO-10-364]. Washington, D.C.: March 30, 2010. Combating Nuclear Terrorism: Actions Needed to Better Prepare to Recover from Possible Attacks Using Radiological or Nuclear Materials. [hyperlink, http://www.gao.gov/products/GAO-10-204]. Washington, D.C.: January 29, 2010. Biosurveillance: Developing a Collaboration Strategy Is Essential to Fostering Interagency Data and Resource Sharing. [hyperlink, http://www.gao.gov/products/GAO-10-171]. Washington, D.C.: December 18, 2009. Homeland Defense: Planning, Resourcing, and Training Issues Challenge DOD's Response to Domestic Chemical, Biological, Radiological, Nuclear, and High-Yield Explosive Incidents. [hyperlink, http://www.gao.gov/products/GAO-10-123]. Washington, D.C.: October 7, 2009. Interagency Collaboration: Key Issues for Congressional Oversight of National Security Strategies, Organizations, Workforce, and Information Sharing. [hyperlink, http://www.gao.gov/products/GAO-09-904SP]. Washington, D.C.: September 25, 2009. Project BioShield Act: HHS Has Supported Development, Procurement, and Emergency Use of Medical Countermeasures to Address Health Threats. [hyperlink, http://www.gao.gov/products/GAO-09-878R]. Washington, D.C.: July 24, 2009. Project BioShield: HHS Can Improve Agency Internal Controls for Its New Contracting Authorities. [hyperlink, http://www.gao.gov/products/GAO-09-820]. Washington, D.C.: July 21, 2009. National Preparedness: FEMA Has Made Progress, but Needs to Complete and Integrate Planning, Exercise, and Assessment Efforts. [hyperlink, http://www.gao.gov/products/GAO-09-369]. Washington, D.C.: April 30, 2009. Risk Management: Strengthening the Use of Risk Management Principles in Homeland Security. [hyperlink, http://www.gao.gov/products/GAO-08-904T]. Washington, D.C.: June 25, 2008. Emergency Management: Observations on DHS's Preparedness for Catastrophic Disasters. [hyperlink, http://www.gao.gov/products/GAO-08-868T]. Washington, D.C.: June 11, 2008. Highlights of a Forum: Strengthening the Use of Risk Management Principles in Homeland Security. [hyperlink, http://www.gao.gov/products/GAO-08-627SP]. Washington, D.C.: April 15, 2008. Project BioShield: Actions Needed to Avoid Repeating Past Problems with Procuring New Anthrax Vaccine and Managing the Stockpile of Licensed Vaccine. [hyperlink, http://www.gao.gov/products/GAO-08-88]. Washington, D.C.: October 23, 2007. Homeland Security: Applying Risk Management Principles to Guide Federal Investments. [hyperlink, http://www.gao.gov/products/GAO-07-386T]. Washington, D.C.: February 7, 2007. Risk Management: Further Refinements Needed to Assess Risk and Prioritize Protective Measures at Ports and Other Critical Infrastructure. [hyperlink, http://www.gao.gov/products/GAO-06-91]. Washington, D.C.: December 15, 2005. Results-Oriented Government: Practices That Can Help Enhance and Sustain Collaboration among Federal Agencies. [hyperlink, http://www.gao.gov/products/GAO-06-15]. Washington, D.C.: October 21, 2005. [End of section] Footnotes: [1] White House, National Strategy for Homeland Security (Washington, D.C., October 2007). [2] White House, National Security Strategy (Washington, D.C., May 2010). [3] Collaboration can be broadly defined as any joint activity that is intended to produce more public value than could be produced when organizations act alone. [4] According to the DHS Risk Lexicon, threats are entities, actions, or occurrences, whether natural or man-made, that have or indicate the potential to harm life, information, operations, and/or property; vulnerabilities are physical features or operational attributes that render an entity, asset, system, network, or geographic area susceptible or exposed to hazards; and consequences are potential or actual effects of an event, incident, or occurrence. DHS, DHS Risk Lexicon: 2010 Edition (Washington, D.C., September 2010). [5] GAO, Results-Oriented Government: Practices That Can Help Enhance and Sustain Collaboration among Federal Agencies, [hyperlink, http://www.gao.gov/products/GAO-06-15] (Washington, D.C.: Oct. 21, 2005); GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999); and Project Management Institute, The Standard for Program Management, 2nd ed. (Newton Square, Pa., 2008). The criteria in GAO/AIMD 00-21.3.1, dated November 1999, issued pursuant to the requirements of the Federal Managers' Financial Integrity Act of 1982 (FMFIA), provide the overall framework for establishing and maintaining internal control in the federal government. Also pursuant to FMFIA, the Office of Management and Budget issued Circular A-123, revised December 21, 2004, to provide the specific requirements for assessing the reporting on internal controls. Internal control standards and the definition of internal control in Circular A-123 are based on GAO's Standards for Internal Control in the Federal Government. See also the Related GAO Products section at the end of this report. [6] 42 U.S.C. § 247d-6b(c)(2)(A). [7] Since 2004, DHS determined that 14 of 17 CBRN agents that it assessed in MTAs pose a material threat to the nation and issued material threat determinations for those agents. The 14 material threat determinations that DHS has issued to date are for Bacillus anthracis (anthrax), Burkholderia mallei (glanders), Burkholderia pseudomallei (melioidosis), Clostridium botulinum (botulism toxin), Ebola virus (hemorrhagic fever), Francisella tularensis (tularemia), Junin virus (hemorrhagic fever), Marburg virus (hemorrhagic fever), multidrug-resistant Bacillus anthracis (MDR anthrax), Rickettsia prowazekii (typhus), Variola major (smallpox), Yersinia pestis (plague), radiological agents, and nuclear agents. [8] 42 U.S.C. § 247d-6b(c)(2)(B). The Project BioShield Act authorizes the federal government to use specific contracting authorities to procure certain medical countermeasures for these agents and established the Project BioShield Special Reserve Fund for the acquisition of certain medical countermeasures, some of which may not yet qualify for approval or licensing. [9] PHEMCE is responsible for providing recommendations to the Secretary of Health and Human Services on (1) prioritized requirements for CBRN medical countermeasures, (2) coordination of medical countermeasure development and acquisition activities to address the requirements, and (3) strategies for distributing medical countermeasures held in national stockpiles. In addition to these responsibilities, PHEMCE is also responsible for countermeasures for pandemic influenza and other emerging infectious diseases. [10] HHS officials from the Centers for Disease Control and Prevention, the Food and Drug Administration, the National Institutes of Health, and the Office of the Assistant Secretary for Preparedness and Response participate in PHEMCE, in addition to officials from other HHS offices. [11] DHS officials from DHS's Science and Technology Directorate and Office of Health Affairs participate in PHEMCE. [12] The Department of Defense has exclusive responsibility for research, development, acquisition, and deployment of medical countermeasures to prevent or mitigate the health effects of CBRN agents and naturally occurring diseases on armed forces personnel. Under the PHEMCE structure, the Department of Defense also coordinates with HHS to share information and resources for common CBRN medical countermeasure priorities to reduce duplication of effort. [13] DHS develops its TRAs by integrating information from the intelligence and law enforcement communities, as well as input from the scientific, medical, and public health communities, among others. [14] In addition to HHS, members of the TRA working groups include the Department of Defense, the Environmental Protection Agency, and the Nuclear Regulatory Commission, among others. [15] DHS convenes separate working groups for each of the TRAs that DHS produces. Each working group is responsible for development and review of its respective TRA, in conjunction with the contractors that DHS utilizes to develop TRA data inputs and perform related mathematical modeling. Separate working groups exist for the BTRA, the chemical TRA (CTRA), the radiological and nuclear TRA (R/NTRA), and the ITRA. [16] See [hyperlink, http://www.gao.gov/products/GAO-06-15]. Additional key practices include establishing mutually reinforcing or joint strategies to achieve the outcome; identifying and addressing needs by leveraging resources; developing mechanisms to monitor, evaluate, and report the results of collaborative efforts; reinforcing agency accountability for collaborative efforts through agency plans and reports; and reinforcing individual accountability for collaborative efforts through agency performance management systems. [17] See [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [18] The Chemical and Biological Division in DHS's Science and Technology Directorate is the DHS entity responsible for the development of the TRAs and MTAs. [19] The Project Management Institute, The Standard for Program Management. The Standard for Program Management calls for establishing time frames and milestones as part of a plan to ensure that intended results are achieved. [20] HHS officials said that as of May 2011, they had not reviewed the draft smallpox MTA because it had not yet been completed. [21] The PHEMCE MOU and charters support interagency coordination between HHS, the Department of Defense, and the Department of Veterans Affairs, in addition to DHS. [22] [hyperlink, http://www.gao.gov/products/GAO-06-15]. [23] According to HHS officials, the modeling reports are not intended to be end products but rather one step in the process of determining medical countermeasure needs in the event of an attack with a CBRN agent. [24] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [25] 42 U.S.C. § 247d-6b(c)(2)(A),(B). [26] DHS, DHS Risk Lexicon: 2010 Edition (Washington, D.C., September 2010). Developed by DHS's intradepartmental Risk Steering Committee, the purpose of the DHS Risk Lexicon is to establish and make available a comprehensive list of terms and meanings relevant to the practice of homeland security risk management and analysis. [27] DHS was originally scheduled to issue the second ITRA in 2010. However, DHS published it in 2011 and plans to issue future iterations quadrennially thereafter (e.g., 2015, 2019, etc.) so that the ITRA, which relies on data contained in the BTRA, CTRA, and radiological and nuclear TRA (R/NTRA), will be produced in the years following publication of these other assessments. The next iterations of the BTRA, CTRA, and R/NTRA are scheduled for 2014. [28] The 2008 ITRA was developed based on the results of the 2008 BTRA and CTRA, as well as a radiological and nuclear appendix to the 2008 ITRA report. The 2011 R/NTRA is the first standalone R/NTRA to be produced, and its results will be combined with those from the 2010 BTRA and CTRA to develop the 2011 ITRA. [29] 42 U.S.C. § 247d-6b(c)(2)(A). [30] Since 2004, DHS determined that 14 of 17 CBRN agents that it assessed in MTAs pose a material threat to the nation and issued material threat determinations for those agents. The 14 material threat determinations that DHS has issued to date are for Bacillus anthracis (anthrax), Burkholderia mallei (glanders), Burkholderia pseudomallei (melioidosis), Clostridium botulinum (botulism toxin), Ebola virus (hemorrhagic fever), Francisella tularensis (tularemia), Junin virus (hemorrhagic fever), Marburg virus (hemorrhagic fever), multidrug-resistant Bacillus anthracis (MDR anthrax), Rickettsia prowazekii (typhus), Variola major (smallpox), Yersinia pestis (plague), radiological agents, and nuclear agents. [31] 42 U.S.C. § 247d-6b(c)(2)(B). [32] Medical countermeasures include drugs, biologic products, and devices to identify, treat, prevent, or mitigate potential health effects from exposure to CBRN agents. HHS acquires CBRN medical countermeasures to treat the potentially exposed population after an attack in order to prevent the onset of disease as well as to treat individuals who have developed disease resulting from such an attack. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: