To ensure that essential government services are available in emergencies, federal agencies are required to develop continuity of operations plans. According to guidance from the Federal Emergency Management Agency (FEMA), which is responsible for providing guidance for and assessing agency continuity plans, a key element of a viable capability is the proper identification of essential functions. GAO previously reported on agency continuity plan compliance, and determined that a number of agencies and their components did not have continuity plans in place on October 1, 2002, and those that were in place did not generally comply with FEMA's guidance. GAO was asked to testify on its most recent work in continuity planning, which is discussed in a separate report, being released today (GAO-05-577). In this report, GAO reviewed to what extent (1) major federal agencies used sound practices to identify and validate their essential functions, (2) agencies had made progress since 2002 in improving compliance with FEMA guidance, and (3) agency continuity of operations plans addressed the use of telework arrangements (in which work is performed at an employee's home or at a work location other than a traditional office) during emergencies.

Many of the 23 agencies that GAO reviewed reported using sound practices for identifying and validating essential functions, but few provided documentation sufficient for GAO to confirm their responses. (GAO identified these sound practices based on published literature and in consultation with experts on continuity planning.) Agency responses indicate that--although aware of the practices--agencies may not have followed them thoroughly or effectively. Further, the essential functions identified by agencies varied widely: the number of functions identified in each plan ranged from 3 to 538 and included ones that appeared to be of secondary importance. The absence in FEMA's guidance of specific criteria for identifying essential functions contributed to this condition. Subsequent guidance significantly addresses the sound practices that GAO identified. Also, the White House has begun a process to improve continuity planning. If this guidance and process are implemented effectively, they could lead to improved identification of essential functions in the executive branch. As of May 1, 2004, agencies had made progress in improving compliance with FEMA guidance, but significant weaknesses remained. Agencies that had plans in place in both years showed significant improvement in the area of tests, training, and exercises. However, although some improvement occurred for other planning areas, important weaknesses remained: for example, 31 of 45 plans did not fully identify mission-critical systems and data necessary to conduct essential functions. Inadequate oversight by FEMA contributed to the level of weaknesses in agency continuity plans. FEMA plans to improve oversight using an online readiness reporting system, which it plans to have fully operational later this year, and it has already taken other steps to help agencies improve their plans, such as conducting an interagency exercise. However, FEMA does not plan to verify the readiness information that agencies will report in the system. Finally, even though FEMA's continuity planning guidance in place in May 2004 did not address telework, one agency's continuity plan at that time included plans to use telework in response to an emergency. In addition, 10 agencies reported that they planned to use telework following a COOP event, but their plans were not clearly documented. In its report, GAO made recommendations aimed at helping to improve continuity planning. These included establishing a schedule for the completion of recently initiated efforts, developing a strategy for short-term oversight in the meantime, and developing and implementing procedures that verify the agency-reported data used in oversight of agency continuity of operations planning. The report includes comments from FEMA. In commenting, FEMA agreed that there has been improvement in COOP plans and that additional oversight is needed.