This is the accessible text file for GAO report number GAO-07-579 
entitled 'IRS Emergency Planning: Headquarters Plans Supported Response 
to 2006 Flooding, but Additional Guidance Could Improve All Hazard 
Preparedness' which was released on May 17, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairman, Committee on Finance, U.S. Senate: 

United States Government Accountability Office: 

GAO: 

April 2007: 

IRS Emergency PLANNING: 

Headquarters Plans Supported Response to 2006 Flooding, but Additional 
Guidance Could Improve All Hazard Preparedness: 

GAO-07-579: 

GAO Highlights: 

Highlights of GAO-07-579, a report to the Chairman, Committee on 
Finance, U.S. Senate 

Why GAO Did This Study: 

On June 25, 2006, the Internal Revenue Service (IRS) headquarters 
building suffered flooding during a period of record rainfall and 
sustained extensive damage to its infrastructure. IRS officials ordered 
the closure of the building until December 2006 to allow for repairs to 
be completed. IRS headquarters officials reported activating several of 
the agency’s emergency operations plans. Within 1 month of the flood, 
over 2,000 employees normally assigned to the headquarters building 
were relocated to other facilities throughout the Washington, D.C., 
metropolitan area. 

GAO was asked to report on 
(1) how IRS emergency operations plans address federal guidance related 
to continuity planning and (2) the extent to which IRS emergency 
operations plans contributed to the actions taken by IRS officials in 
response to the flood. To address these objectives, GAO analyzed 
federal continuity guidance, reviewed IRS emergency plans, and 
interviewed IRS officials. 

What GAO Found: 

The IRS headquarters emergency operations plans that GAO reviewed—the 
headquarters Continuity of Operations (COOP) plan, Incident Management 
Plan, and three selected business resumption plans—collectively 
addressed several of the general elements identified within federal 
continuity guidance for all executive branch departments and agencies 
(see table below). For example, the plans adequately identified the 
people needed to continue performing essential functions. However, 
other elements were not addressed or were addressed only in part. 
Specifically, IRS had two separate lists of essential 
functions—critical business processes and essential functions for IRS 
leadership—within its plans, but prioritized only one of the lists. 
Furthermore, although the COOP plan outlined provisions for tests, 
training, and exercises, none of the other plans GAO reviewed outlined 
the need to conduct such activities. While IRS provided overall 
guidance to its business units on their business resumption plans, the 
guidance was inconsistent with the federal guidance on several 
elements, including the preparation of resources and facilities needed 
to support essential functions and requirements for regular tests, 
training, and exercises. 

The IRS Incident Management Plan was particularly useful in 
establishing clear lines of authority and communications in response to 
the flooding. Unit-level business resumption plans GAO reviewed 
contributed to a lesser extent, and the headquarters COOP plan was not 
activated because of conditions particular to the 2006 flood. 
Specifically, damage to the building was limited to the basement and 
subbasement levels, and employees were able to enter the building to 
retrieve equipment and assets. In addition, alternate work space was 
available for all employees within a relatively short period, reducing 
the importance of identifying critical personnel. 

While its plans helped guide IRS’s response to the conditions that 
resulted from the flood, in more severe emergency events, conditions 
could be less favorable to recovery. Consequently, unless IRS fills in 
gaps in its guidance and plans, it lacks assurance that the agency is 
adequately prepared to respond to the full range of potential 
disruptions. 

Table: Summary of General Elements Identified within Federal Continuity 
guidance: 

General element: Essential functions; 
Description of agency action: Determine what agency-specific functions 
must be continued under all circumstances. 

General element: People; 
Description of agency action: Identify and designate the personnel 
critical to agency operations. 

General element: Resources; 
Description of agency action: Identify and plan for the availability of 
resources needed. 

General element: Alternate facilities; 
Description of agency action: Identify and prepare alternate facilities 
for critical personnel. 

General element: Activation; 
Description of agency action: Determine which continuity plans should 
be activated. 

General element: Execution; 
Description of agency action: Document procedures that guide emergency 
operations personnel. 

General element: Resumption; 
Description of agency action: Outline a plan to return or transition to 
normal operations. 

General element: Tests, training, and exercises; 
Description of agency action: Perform tests, training, and exercises of 
continuity plans. 

Source: GAO analysis of Federal Preparedness Circular 65. 

[End of section] 

What GAO Recommends: 

GAO recommends that the Commissioner of Internal Revenue revise 
internal IRS guidance and emergency plans to fully reflect federal 
continuity guidance. The Commissioner agreed with our recommendations 
and stated that the agency will take the necessary steps to implement 
them and revise its emergency plans. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-579]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Bernice Steinhardt at 
(202) 512-6543 or steinhardtb@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

IRS Headquarters Emergency Operations Plans Partially Addressed 
Elements Outlined in Federal Guidance: 

IRS Emergency Plans Contributed to the Agency's Flood Response: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Comments from the Internal Revenue Service: 

Tables: 

Table 1: Time Line of Activities Following the Flood on June 25, 2006: 

Table 2: IRS Emergency Operations Plans and Purposes: 

Table 3: Summary of FPC 65 Guidance Related to Ensuring Continuity of 
Essential Agency Operations: 

Abbreviations: 

CI: Criminal Investigation: 
COOP: continuity of operations: 
FEMA: Federal Emergency Management Agency:
FPC: Federal Preparedness Circular: 
IRS: Internal Revenue Service: 
W&I: Wage and Investment: 

United States Government Accountability Office: 
Washington, DC 20548: 

April 16, 2007: 

The Honorable Max Baucus: 
Chairman: 
Committee on Finance: 
United States Senate: 

Dear Mr. Chairman: 

In June 2006, the Internal Revenue Service (IRS) headquarters building, 
1111 Constitution Avenue, NW, Washington, D.C., was flooded during a 
period of record rainfall. The building sustained extensive damage to 
its infrastructure, and critical parts of the building's electrical and 
mechanical equipment were destroyed or heavily damaged, requiring the 
headquarters building to be closed until December 2006 to allow for 
repairs. 

In response to the flood and the closure of the building, IRS 
headquarters officials reported activating several of the agency's 
emergency operations plans. Over 2,000 employees normally assigned to 
the headquarters building were relocated to 15 locations throughout the 
Washington, D.C., metropolitan area in an effort to ensure the 
continuity of headquarters essential operations. The headquarters 
building was reopened on December 8, 2006. 

The Federal Emergency Management Agency (FEMA) developed Federal 
Preparedness Circular (FPC) 65 to provide guidance to federal executive 
branch departments and agencies on developing contingency plans and 
programs to ensure that agencies can continue performing their 
essential government functions during any emergency or situation that 
may disrupt normal operations. All federal executive branch agencies 
are required to have such a capability in place to maintain essential 
government services across a wide range of all hazard emergencies. 

To determine whether IRS emergency operations plans were adequate to 
continue effective operations following the flood, you asked us to 
evaluate (1) how IRS emergency operations plans address federal 
guidance related to continuity planning and (2) the extent to which IRS 
emergency operations plans contributed to the actions taken by IRS 
officials in response to the flood. At your request, we worked closely 
with the Treasury Inspector General for Tax Administration, who 
examined information technology recovery efforts and the impact of the 
flood on tax administration. 

To address our first objective, we obtained the IRS headquarters 
emergency operations plans that were available to agency officials at 
the time of the June 2006 flood. We analyzed FPC 65 continuity guidance 
and identified eight general elements related to developing a viable 
continuity capability. We reviewed emergency operations plans that were 
available at the time of the flood--including the IRS headquarters 
Continuity of Operations (COOP) plan, Incident Management Plan, and 
three selected business resumption plans[Footnote 1]--and analyzed how 
they collectively addressed or did not address these eight general 
elements of guidance.[Footnote 2] We also reviewed IRS-defined criteria 
for emergency operations plans, including sections of the Internal 
Revenue Manual--which guides IRS officials in developing several of the 
agency's emergency operations plans--and an internal template provided 
by IRS's Office of Physical Security and Emergency Preparedness, which 
is responsible for agencywide emergency planning and policy, to guide 
plan development. 

To address our second objective, we interviewed IRS officials 
responsible for the development, oversight, and implementation of the 
headquarters emergency operations plans. In our interviews, we asked 
IRS officials responsible for each emergency operations plan how their 
plans contributed to their actions following the flood, if at all. To 
supplement the information gained from the interviews, we reviewed 
agency documentation related to emergency operations activities 
following the flood, including IRS status reports, employee relocation 
lists, and emergency operations team meeting minutes. In addition, we 
reviewed documentation regarding lessons learned from the flood, 
provided by various headquarters business units, and obtained any 
updates or changes to emergency operations plans following the flood. 

We conducted our review in accordance with generally accepted 
government auditing standards from July 2006 through March 2007. 
Detailed information on our objectives, scope, and methodology appears 
in appendix I. 

Results in Brief: 

The IRS headquarters emergency operations plans we reviewed--the 
headquarters COOP plan, Incident Management Plan, and selected business 
resumption plans--collectively addressed several of the general 
elements of a viable continuity capability identified within FPC 65. 
For example, the plans adequately identified the people needed to 
continue performing essential functions. However, other elements were 
not addressed or were addressed only in part. Specifically, IRS had two 
separate lists of essential functions--critical business processes and 
essential functions for IRS leadership--within its plans, but 
prioritized only one of the lists. Furthermore, although the COOP plan 
outlined provisions for tests, training, and exercises, none of the 
three business resumption plans we reviewed or the Incident Management 
Plan outlined the need to conduct such activities. While IRS's Office 
of Physical Security and Emergency Preparedness provided overall 
guidance to business units on their business resumption plans, the 
guidance was inconsistent with the federal guidance on several 
elements, including the preparation of resources and facilities needed 
to support essential functions and requirements for regular tests, 
training, and exercises. 

IRS officials largely relied upon the Incident Management Plan to 
direct their response to the emergency conditions created by the June 
2006 flooding. This plan guided officials in establishing roles and 
responsibilities for command and control of the overall resumption 
effort and a capability for the procurement of alternate facility space 
and equipment. Business unit officials were initially guided by their 
business resumption plans, but later response activities differed from 
those plans because of the circumstances resulting from the flooding. 
According to IRS headquarters officials, the headquarters COOP plan was 
not activated because local space availability made movement of 
executive leadership to the alternate COOP facility unnecessary and the 
safety of the leadership was not at risk. 

While IRS's plans helped guide its response to the flood, the 
conditions that prevailed then--space available to relocate all 
employees and the ability to retrieve equipment and assets--may not be 
present in other emergency events. Consequently, unless IRS fills in 
gaps in its guidance and plans, it will lack assurance that the agency 
is adequately prepared to respond to the full range of potential 
disruptions. 

We are recommending that the Commissioner of Internal Revenue (1) 
revise IRS internal emergency planning guidance to fully reflect 
federal guidance on the elements of a viable continuity capability, 
including the identification and prioritization of essential functions, 
the preparation of necessary resources and alternate facilities, and 
the regular completion of tests, training, and exercises of continuity 
capabilities, and (2) revise the IRS emergency plans in accordance with 
the new internal guidance. The Commissioner agreed with our 
recommendations and outlined steps the agency will take to improve its 
emergency plans and guidance. 

Background: 

IRS administers America's tax laws and collects the revenues that fund 
government operations and public services. In fiscal year 2006, IRS 
collected more than $2.5 trillion in revenue. IRS's Taxpayer Service 
and Enforcement programs generate more than 96 percent of the total 
federal revenue collected for the U.S. government. Total federal 
revenues have fluctuated from roughly 16 to 21 percent of gross 
domestic product between 1962 and 2004.[Footnote 3] Given the amount of 
federal revenue collected by IRS, a disruption of IRS operations could 
have great impact on the U.S. economy. 

The IRS headquarters building is located in Washington, D.C., and 
houses over 2,200 of the agency's estimated 104,000 employees. The 
headquarters building contains the offices of IRS executive leaders, 
such as the Commissioner and deputy commissioners, and headquarters 
personnel for 14 of the agency's 17 individual business units. 

Flood of IRS's Headquarters Building: 

On June 25, 2006, the IRS headquarters building suffered flooding 
during a period of record rainfall and sustained extensive damage to 
its infrastructure. The subbasement and basement were flooded, and 
critical parts of the facility's electrical and mechanical equipment 
were destroyed or heavily damaged. The subbasement--which contained 
equipment such as electrical transformers, electrical switchgears, and 
chillers--was submerged in more than 20 feet of water. In addition, the 
basement level--which housed the building's fitness center, food 
service canteens, computer equipment, and the basement garage--was 
flooded with 5 feet of water. As a result of the flood damage, the 
building was closed until December 8, 2006. In response to the flood 
and the closure of the building, IRS headquarters officials reported 
activating several of the agency's emergency operations plans. Over 
2,000 employees normally assigned to the headquarters building were 
relocated to other facilities throughout the Washington, D.C., 
metropolitan area. 

Although the flood severely damaged the building and necessitated the 
relocation of IRS employees to alternate office space, particular 
circumstances limited potential damage and made response and recovery 
activities easier: 

* No employees were injured, killed, or missing as a result of the 
flood. 

* Damage was limited to the basement and subbasement levels, and 
employees were able to enter the building to retrieve equipment and 
assets 5 days following the flood. 

* IRS and the General Services Administration were able to identify and 
allocate alternate work space to accommodate all displaced employees, 
not just those considered critical or essential. 

According to IRS status reports following the flood, facility space was 
provided for critical personnel within 10 days and for all headquarters 
employees within 29 days. Table 1 provides a time line of activities 
following the flood. 

Table 1: Time Line of Activities Following the Flood on June 25, 2006: 

Date: June 26, 
2006; Day: Day 1; 
Activity: Building closed. Employees notified to stay home. 

Date: June 28, 2006; 
Day: Day 3; 
Activity: Meeting held with IRS business units. Voice mail 
reestablished. Process established for employees to retrieve equipment 
and assets from the building. 

Date: June 30, 2006; 
Day: Day 5; 
Activity: Retrieval process for equipment and assets implemented. 

Date: July 3, 2006; 
Day: Day 8; 
Activity: Computer servers reestablished at alternate locations. 

Date: July 5, 2006; 
Day: Day 10; 
Activity: About 700 selected employees reported back to work at 
alternate office space throughout the Washington, D.C., metropolitan 
area. 

Date: July 7, 2006; 
Day: Day 12; 
Activity: Other employees moved in phases. 

Date: July 24, 2006; 
Day: Day 29; 
Activity: All employees reported back to work at alternate office space 
throughout the Washington, D.C., metropolitan area. 

Date: Dec. 8, 2006; 
Day: Day 166; 
Activity: Employees began the return to the headquarters building. 

Sources: IRS Senior Commissioner Representative status reports and 
IRS's news release regarding the flood. 

[End of table] 

The Treasury Inspector General for Tax Administration also reviewed the 
IRS response to the flooding.[Footnote 4] According to the Inspector 
General's reports, IRS adequately protected sensitive data and restored 
computer operations to all employees approximately 1 month following 
the flood. In addition, he reported that the flood caused no measurable 
impact on tax administration because of the nature of the work 
performed at this building and the contingency plans that IRS had in 
place. Finally, he reported that IRS paid $4.2 million in salary costs 
for 101,000 hours of administrative leave granted to IRS personnel 
following the flooding.[Footnote 5] While $3 million was paid for 
administrative leave during the first week following the flooding, the 
amount paid for administrative leave decreased in subsequent weeks. 

IRS Headquarters Emergency Operations Plans: 

IRS headquarters has multiple emergency operations plans that if 
activated, are intended to work in conjunction with each other during 
emergencies. These plans include a suite of business continuity plans 
comprised of, among others, a business resumption plan for each IRS 
business unit and an Incident Management Plan.[Footnote 6] In addition, 
IRS has a COOP plan for emergency events affecting IRS executive 
leadership and essential functions. Table 2 summarizes the IRS 
emergency operations plans and their purposes. 

Table 2: IRS Emergency Operations Plans and Purposes: 

Emergency operations plan: Business resumption plan; 
Description: Guides the resumption of the unit's critical business 
functions and return to normal operations after an emergency; Each 
business unit within IRS is responsible for establishing its own 
business resumption plan. 

Emergency operations plan: Incident Management Plan; 
Description: Provides a command and control structure to centrally 
coordinate and manage the agency's emergency response and recovery 
activities; Key activities include providing overall leadership, 
coordinating needs and priorities among business units, and securing 
the resources--such as office space and computers--necessary for 
business units to resume critical business functions. 

Emergency operations plan: COOP plan; 
Description: Prepares for the potential relocation of IRS's executive 
leadership--including the Commissioner and deputy commissioners--to an 
alternate facility in order to perform IRS essential functions. 

Source: GAO analysis of IRS emergency operations plans. 

[End of table] 

Federal Guidance for Continuity Planning: 

FEMA developed FPC 65 to provide guidance to federal executive branch 
departments and agencies in developing contingency plans and programs 
to ensure the continuity of essential agency operations. All federal 
executive branch agencies are required to have such a capability in 
place to maintain essential government services across a wide range of 
all hazard emergencies. This guidance defines the elements of a viable 
continuity capability for agencies to address in developing their 
continuity plans. 

Table 3 summarizes eight general elements of federal continuity 
guidance that agency plans should address. 

Table 3: Summary of FPC 65 Guidance Related to Ensuring Continuity of 
Essential Agency Operations: 

General element: Essential functions; 
Description of agency action: Determine what agency-specific functions 
must be continued under all circumstances and prioritize them based on 
criticality and time sensitivity. Consider those functions that must 
continue with minimal disruption or cannot be interrupted for more than 
12 hours and must continue operating up to 30 days. 

General element: People; 
Description of agency action: Identify and designate the personnel who 
would be critical to agency operations during an emergency, including 
staff directly responsible for relocating to an alternate location to 
perform agency essential functions. 

General element: Resources; 
Description of agency action: Identify and plan for the availability of 
resources needed to perform agency essential functions during an 
emergency, including vital records, critical systems and data, and 
equipment. 

General element: Alternate facilities; 
Description of agency action: Provide the capability for emergency 
operations personnel to continue performing agency essential functions 
from an alternate location by identifying and preparing alternate 
facilities. 

General element: Activation; 
Description of agency action: Develop a decision process that guides 
officials in determining when and which continuity plans and procedures 
should be activated in response to an emergency. 

General element: Execution; 
Description of agency action: Document procedures that guide emergency 
operations personnel in executing the agency's continuity plan. 

General element: Resumption; 
Description of agency action: Identify and outline a plan to return or 
transition to normal operations. 

General element: Tests, training, and exercises; 
Description of agency action: Perform tests, training, and exercises of 
continuity plans and procedures to ensure agency readiness for an 
emergency. 

Source: GAO analysis of FPC 65. 

[End of table] 

IRS supplemented federal guidance with sections of its Internal Revenue 
Manual--a document outlining the agency's organization, policies, and 
procedures--related to business resumption plans. Similar to the 
federal continuity guidance, the Internal Revenue Manual outlined 
minimum requirements for business resumption plans, including the need 
to identify people and resources to perform critical functions. 

IRS Headquarters Emergency Operations Plans Partially Addressed 
Elements Outlined in Federal Guidance: 

The IRS headquarters emergency operations plans we reviewed 
collectively addressed several of the general elements of guidance 
identified in FPC 65. For example, the plans adequately identified the 
people needed to continue performing essential functions and had 
established procedures for activation. However, other elements were not 
addressed or were addressed only in part. Specifically, IRS identified 
two separate lists of essential functions--critical business processes 
and essential functions for IRS leadership--within its plans but only 
prioritized one of the lists. Furthermore, although the COOP plan 
outlined provisions for tests, training, and exercises, neither the 
business resumption plans we reviewed--from Criminal Investigation 
(CI),[Footnote 7] Wage and Investment (W&I),[Footnote 8] and Chief 
Counsel[Footnote 9]--nor the Incident Management Plan outlined the need 
to conduct such activities. While IRS's Office of Physical Security and 
Emergency Preparedness provided overall guidance to business units on 
their business resumption plans, the guidance was inconsistent with the 
federal guidance on several elements, including the preparation of 
resources and facilities needed to support essential functions and 
requirements for regular tests, training, and exercises. Until IRS 
requires all of the plans that contribute to its ability to quickly 
resume essential functions to fully address federal guidance, it will 
lack assurance that it is adequately prepared to respond to the full 
range of potential disruptions. 

Essential Functions: 

FPC 65 states that agencies are to determine what agency-specific 
functions must be continued under all circumstances and prioritize them 
based on the criticality and time sensitivity of each 
function.[Footnote 10] The resulting prioritized list of functions 
establishes the planning parameters that drive the agency's efforts 
across all other planning topics. For example, the guidance directs 
agencies to identify alternate facilities, staff, and resources 
necessary to support continuation of essential functions. Therefore, 
the effectiveness of plans as a whole and the implementation of all 
other elements depend on the performance of this step. We previously 
reported on sound practices related to identifying and validating 
essential functions, including the need to prioritize essential 
functions and determine a recovery time objective for each function, 
establishing the maximum tolerable downtime for each.[Footnote 11] Such 
identification of time sensitivity is especially important during 
events that may result in constraints on facility space and resources, 
as it allows agency officials to prioritize the activities that are 
performed. 

The IRS emergency operations plans we reviewed identified a number of 
essential functions but did not consistently prioritize them. 
Specifically, the Incident Management Plan contained a list of 18 
functions called IRS critical business processes. These functions 
included processing remittances, user fees, and other related 
receivables; processing tax returns and refunds; and tax administration 
enforcement activities. The Incident Management Plan also identified 
the IRS business unit or units responsible for each critical business 
process, and outlined supporting activities for each unit. Although the 
Incident Management Plan listed the critical business processes in 
priority order but did not establish recovery time objectives for them, 
the three business resumption plans we reviewed included recovery time 
objectives for each of the subprocesses that make up that unit's 
contributions to the overall critical business processes. For example, 
the Chief Counsel plan indicated that the business unit contributes to 
the tax administration enforcement process through a subprocess called 
litigation and advice to staff. The plan assigned this subprocess a 
recovery time objective of 5 days. 

In contrast, the headquarters COOP plan did not include any type of 
prioritization. The plan established a list of essential functions for 
IRS executive leadership, ranging from executive-level activities-- 
such as providing leadership and accounting for personnel--to 
operational responsibilities--such as ensuring ongoing operation of 
specific IRS business units. However, this list was not prioritized 
with regard to importance or time. According to an official of the 
Office of Physical Security and Emergency Preparedness, the agency did 
not prioritize the essential functions in its COOP plan because it 
determined that all the essential functions had the same priority and 
time sensitivity.[Footnote 12] Without fully prioritizing agency 
essential functions based on both their criticality and time 
sensitivity, IRS could be inhibited in responding to the full range of 
potential emergencies, especially those where there are limited 
resources available for recovery and agency operations must be restored 
over a short period. 

People: 

According to FPC 65, agencies are to identify the personnel who would 
be critical to performing essential agency operations during an 
emergency, including staff directly responsible for relocating to an 
alternate location. All IRS headquarters plans we reviewed identified 
people critical to agency operations during an emergency by including 
rosters of personnel necessary to continue essential functions and to 
coordinate emergency efforts. 

In support of IRS critical business processes, all three business 
resumption plans we reviewed included rosters of personnel. The W&I and 
CI business resumption plans outlined team leaders and personnel 
necessary to carry out critical business processes. The Chief Counsel 
plan identified individuals responsible for coordinating business 
resumption efforts--including business resumption team leaders. 
According to a Chief Counsel business resumption official, each 
business resumption team leader is responsible for identifying critical 
people within his or her office following an emergency and for 
maintaining roster information on all of the employees within the 
office. 

In support of IRS essential functions, the COOP plan included lists of 
teams composed of executive leadership. For example, the COOP plan 
outlined a Commissioner Core COOP team responsible for immediately 
deploying to an alternate facility and coordinating the performance of 
IRS essential functions following an emergency. The team included the 
IRS Commissioner, Chief of Staff, and other executives. In addition, 
the plan identified a COOP standby team made up of additional 
executives, including commissioners of several business units, who have 
responsibilities for essential functions and can be called upon to 
relocate to the alternate facility. 

Resources: 

FPC 65 guides agencies in identifying and planning for the availability 
of resources needed to perform essential functions during an emergency, 
including vital records, critical systems and data, and equipment. The 
guidance states that agencies should pre-position critical resources 
and ensure that vital records and critical systems and data can be 
accessed from alternate locations. 

Although all IRS emergency operations plans we reviewed identified the 
resources necessary to support critical business processes and 
essential functions, they did not indicate how such resources would be 
made available following an emergency. All three business resumption 
plans we reviewed identified resources needed to support business 
resumption activities. For example, the CI plan identified necessary 
vital records, such as contact lists; critical information systems, 
such as its evidence tracking databases; and telecommunications 
equipment, such as telephones and fax machines. In addition, the 
headquarters COOP plan identified resources needed to support essential 
functions, including vital records, such as phone directories; critical 
information systems, such as the agency's travel reimbursement and 
accounting system; and telecommunications equipment, such as cell 
phones, satellite phones, and pagers. 

However, none of the plans we reviewed documented that the identified 
resources would be prepared and made ready for use following an 
emergency. For example, although the headquarters COOP plan and the W&I 
business resumption plan both outlined the vital records needed to 
support essential functions, neither identified where copies of the 
records would be located or how they would be accessed at an alternate 
work location. Similarly, the CI plan identified the number of 
computers needed by each of its offices, but did not outline where and 
how the computers would be made available at the time of an emergency. 
If such resources are not adequately prepared before a disruption 
occurs, the agency cannot ensure that they will be available when 
needed and its response could be delayed while the resources are 
acquired or moved to an alternate location. 

Alternate Facilities: 

FPC 65 states that agencies are to provide a capability for their 
emergency personnel to continue performing agency essential functions 
and emergency operations activities from alternate locations by 
identifying and preparing alternate facilities. For example, it directs 
that the facility have space adequate to accommodate the personnel 
listed in the continuity plan and communications capabilities adequate 
to maintain contact with the agency's personnel and key partners. It 
also directs that critical resources be pre-positioned at the site. 

The headquarters COOP plan identified specific alternate facilities for 
relocation of executive personnel to perform essential functions 
following an emergency. In addition, the three business resumption 
plans we reviewed identified alternate facilities where their essential 
functions could be performed following an emergency. For example, the 
CI plan identified an alternate facility that could accommodate 
approximately 80 employees. 

However, none of the plans we reviewed addressed site preparation. As a 
result, it is not clear whether the selected sites provide the agency 
with the capability for a timely response to a disruption. If the 
agency does not adequately prepare its alternate facilities before an 
emergency, its response could be delayed. 

Activation: 

FPC 65 states that agencies should develop a decision process that 
guides officials in determining when and which emergency operations 
plans and procedures should be activated in response to an emergency. 
The IRS headquarters emergency operations plans we reviewed identified 
both the officials responsible for activating each plan and the 
emergency conditions under which activation would occur. 

IRS addressed plan activation in its Incident Management and COOP 
plans. The Incident Management Plan established the authority of the 
Incident Commander to activate both the Incident Management Plan and 
the headquarters business resumption plans in response to incidents and 
disasters affecting critical business functions. Furthermore, the 
headquarters COOP plan identified a list of senior IRS officials-- 
including the IRS Commissioner and deputy commissioners--authorized to 
activate the COOP plan in response to federal emergencies, continuity 
of government events, and credible threats of actions that would 
preclude access to or use of the IRS headquarters building and 
surrounding areas. 

Execution: 

FPC 65 directs agencies to document procedures that guide personnel in 
executing the agency's emergency response capability. The COOP plan and 
Incident Management Plan outlined procedures that guide personnel in 
executing the agency's emergency response capability. However, the 
degree to which the selected business resumption plans provided such 
information varied. 

Specifically, two of the three business resumption plans--the CI and 
W&I plans--outlined instructions for officials to follow in executing 
their plans and procedures while Chief Counsel's plan did not. 
According to a Chief Counsel official responsible for business 
resumption planning, the business unit relies upon business resumption 
team leaders identified within the plan to determine appropriate 
courses of action following an emergency based on supporting the active 
caseload. 

Resumption: 

FPC 65 states that agencies are to identify and outline plans to return 
or transition to normal operations. IRS emergency operations plans we 
reviewed addressed the resumption of normal operations following an 
emergency through its business resumption plans and a reconstitution 
phase outlined in the headquarters COOP plan. 

According to the Internal Revenue Manual, business resumption plans are 
developed to guide the orderly reestablishment of operations after an 
emergency. All three selected business units developed individual 
business resumption plans. The COOP plan assumed that business 
continuity plans were to be activated to resume business operations. 
However, the plan also identified a reconstitution phase to transition 
COOP personnel back to normal operations. 

Tests, Training, and Exercises: 

Tests, training, and exercises are essential to demonstrating and 
improving an agency's ability to execute its continuity plans and 
procedures. The guidance established timetables for training that 
familiarizes agency personnel with the essential functions they may 
have to perform, as well as tests and exercises, which serve to assess, 
validate, or identify for subsequent correction specific aspects of 
agency plans, policies, procedures, systems, and facilities used in 
response to an emergency. These activities can also demonstrate the 
viability of agency plans and identify any deficiencies for correction. 

While the IRS COOP plan established requirements for regular tests, 
training, and exercises, the Incident Management plan and the business 
resumption plans we reviewed did not. The headquarters COOP plan 
outlined detailed descriptions for activities, including alert and 
notification drills, orientation sessions, and tabletop and deployment 
exercises. It also specified how often each activity should be 
conducted, such as quarterly for tests of alert and notification 
procedures, and semiannually for tabletop exercises. In contrast, 
neither the Incident Management Plan nor the business resumption plans 
we reviewed outlined any information regarding the types of tests, 
training, and exercises to conduct or at what frequency they should 
occur. The Incident Management teams did, however, conduct relevant 
training as recently as August 2005, and scheduled two exercises in 
2006 that they were forced to cancel because of actual incidents at the 
facility.[Footnote 13] If the agency does not conduct regular tests, 
training, and exercises, it cannot ensure that the people and resources 
it needs for a timely and effective response will be prepared for 
emergencies. 

IRS Internal Guidance Did Not Fully Address Elements of a Viable 
Continuity Capability: 

Inconsistencies between IRS's business resumption plans and federal 
guidance can be attributed in part to gaps in IRS internal guidance. 
IRS provided its business units with guidance on developing business 
resumption plans, including general guidance within IRS's Internal 
Revenue Manual and a business resumption plan template disseminated to 
the business units. The Internal Revenue Manual provided IRS business 
units with minimum requirements of elements to include in their plans, 
such as identifying critical personnel and resources. In addition, the 
Office of Physical Security and Emergency Preparedness disseminated a 
business resumption plan template to business units that included, 
among other things, sections for identifying the critical business 
processes and personnel to support the resumption of critical 
activities. 

IRS's internal guidance addressed several of the elements of a viable 
continuity capability. For example, the Internal Revenue Manual stated 
that business resumption plans should include a list of critical 
personnel, and the business resumption plan template asked each 
business unit to list its critical team leaders and members and their 
contact information. Similarly, the IRS guidance adequately addressed 
execution and resumption. 

For other continuity planning elements, however, IRS guidance on 
developing business resumption plans was inconsistent with federal 
guidance. Specifically, IRS guidance on resources directed business 
units to identify their need for vital records, systems, and equipment. 
However, rather than procuring those resources before an event occurs, 
as outlined in federal guidelines, IRS guidance assumed that business 
units will work with teams outlined within the Incident Management Plan 
to acquire those resources following a disruption. Similarly, IRS 
directed business units to identify alternate work space requirements 
for personnel, but not to prepare or acquire them until after a 
disruption occurs. Finally, IRS guidance did not address the need for 
tests, training, or exercises involving the critical personnel 
identified within business resumption plans. Officials from the Office 
of Physical Security and Emergency Preparedness stated that it was the 
responsibility of business units to conduct adequate tests, training, 
and exercises of their business resumption plans. 

Officials further stated that the IRS response to the June 2006 
flooding validated the use of its incident command structure outlined 
in its Incident Management Plan. Although the incident command 
structure can be effective at securing needed resources over time, IRS 
will be able to respond to a disruption more quickly if it prepares 
necessary resources and facilities before an event occurs. This is 
especially critical in the case of business processes that need to be 
restored within 24 to 36 hours. Similarly, if personnel are unfamiliar 
with emergency procedures because of inadequate training and exercises, 
the agency's response to a disruption could be delayed. 

IRS Emergency Plans Contributed to the Agency's Flood Response: 

IRS officials largely relied upon the Incident Management Plan to 
direct their response to the emergency conditions created by the June 
2006 flooding. This plan guided officials in establishing roles and 
responsibilities for command and control of the overall resumption 
effort and a capability for the procurement of alternate facility space 
and equipment. Business unit officials were initially guided by their 
business resumption plans, but later response activities differed from 
those plans because of the circumstances resulting from the event. 
According to IRS headquarters officials, the headquarters COOP plan was 
not activated because local space availability made moving the 
executive leadership to the alternate COOP facility unnecessary and the 
safety of the leadership was not at risk. 

The Incident Management Plan Contributed to Establishing a Command and 
Control Structure Immediately Following the Flood: 

We previously reported that in responding to emergencies, roles and 
responsibilities for leadership must be clearly defined and effectively 
communicated in order to facilitate rapid and effective decision 
making.[Footnote 14] The IRS Incident Management Plan provided agency 
officials with clear leadership roles and responsibilities for managing 
the response and recovery process, including the procurement of 
temporary facility space and equipment necessary to continue critical 
business processes. 

Consistent with the plan, the Incident Commander acted as the leader of 
IRS headquarters response and recovery activities immediately following 
the flood. To assist in managing the incident, the Incident Commander 
activated members of the IRS Incident Management Team and other 
supporting sections, whose roles and responsibilities were outlined in 
the plan. These individuals included business resumption team leaders 
from each of the IRS business units and personnel from the central 
service divisions, such as Real Estate and Facilities Management and 
Modernization and Information Technology Services. 

According to minutes from Incident Management Team meetings held in the 
days following the flood, the following Incident Management supporting 
teams were activated and provided the following contributions: 

1. The Operations Section, responsible for conducting response and 
recovery activities, gathered information regarding the facility space 
and equipment requests from the IRS business units, as well as 
preferences on alternate work location assignments. 

2. The Logistics Section, responsible for providing all nonfinancial 
logistical support, procured and allocated facility space and equipment 
to IRS business units. 

3. The Planning Section, responsible for providing documentation of the 
emergency, documented decisions and conducted reporting. For example, 
the Planning Section prepared documents for hearings and maintained 
relocation schedules and information. 

4. The Finance and Administrative Section, responsible for providing 
all financial support, provided assistance in monitoring agency costs 
and developing travel and leave policies. 

According to IRS status reports following the flood, facility space was 
provided for critical personnel within 10 days and for all headquarters 
employees within 29 days. The Incident Commander reported that the 
Incident Management Team and its supporting units stepped down 
approximately 2 months after the flood. 

Business Resumption Plans Guided Initial Business Unit Flood Responses: 

The three business units we reviewed reported that their business 
resumption plans guided their initial responses to the flood. In later 
phases of their responses, the business units differed from their plans 
to account for conditions at the time, such as current work priorities 
and the availability of alternate office space for more staff than the 
minimum necessary to perform the most critical functions. The following 
sections outline how selected business units relied on their business 
resumption plans when responding to the flood. 

Criminal Investigation: 

CI used its business resumption plan to (1) establish an internal 
command structure to coordinate emergency activities following the 
flood and (2) identify short-term facility space for selected 
employees. According to the CI business resumption executive, the 
business unit used alternate facilities previously identified within 
the CI business resumption plan to relocate personnel within the first 
2 days. CI leadership determined which personnel would be placed first 
and at what locations, since its business unit's resumption plan did 
not specify such information. According to the CI business resumption 
executive, after learning from the Incident Commander that relocation 
would be for a longer period and that alternate facility space was 
available to accommodate all displaced CI employees, CI officials 
submitted a request for facility space and equipment for all of their 
employees to the Incident Commander and Incident Management Team. 

In discussing lessons learned, the CI business resumption executive 
acknowledged that the unit's plan primarily addressed relocation to 
alternate facilities for short-term emergencies rather than longer-term 
events like the flood, and that CI should work with IRS's central 
organizations to better plan for relocation in such situations. 
Furthermore, the executive stated that better tests and exercises of 
the CI plan could assist in better preparing for a wider range of 
future emergencies. 

Wage and Investment: 

W&I officials used their plan to identify and prioritize critical 
tasks. W&I managers gathered at a previously scheduled off-site retreat 
the morning following the flood and conducted a review of the business 
unit's resumption plan, according to the new W&I business resumption 
executive. The executive stated that the activity was particularly 
useful in addressing identified knowledge gaps in the wake of the prior 
W&I business resumption leader's sudden death the day before the flood. 
Critical business processes and supporting tasks, initially prioritized 
within the plan, were adjusted to reflect the criticality of several 
tasks at that time of year. According to the business resumption 
executive, the revised list of critical business processes allowed W&I 
managers to identify critical personnel and resources, which were 
submitted to the Incident Management Team as facility space and 
resource requests. In addition, the executive stated that W&I managers 
established a system for placing employees in alternate work space 
based on their association with the prioritized tasks, although it was 
not reflected in the W&I business resumption plan. 

W&I created a document to capture lessons learned following the flood 
and established an internal business resumption working group to ensure 
a business resumption capability in all W&I field offices. As W&I 
officials did not anticipate the need to readjust tasks, one item 
discussed in the document addressed the need to create a rolling list 
of critical business processes and critical personnel, as processes and 
tasks will vary throughout the year. In addition, the W&I business 
resumption working group developed minimum requirements for all W&I 
plans and conducted a gap analysis of field office plans to identify 
areas for improvement. According to the W&I business resumption 
executive, the working group will conduct a training session for field 
office business resumption coordinators after the 2007 filing season. 

Chief Counsel: 

Although the Chief Counsel resumption efforts were led by people 
identified within its plan, the unit's business resumption officials 
reported that use of the plan was limited because of the high-level 
content of the document. According to the Chief Counsel's business 
resumption executive, the plan was written at a high level because it 
was expected that specific priorities would be determined by the active 
caseload at the time of the emergency. The executive stated that 
following the flood, Chief Counsel prioritized resumption activities 
based on the active caseload and the need to address emerging 
requirements, such as (1) ensuring that mail addressed to the business 
unit's processing division was rerouted and processed at another 
facility and (2) supporting a specific court case being conducted in 
New York City because of its level of criticality and time sensitivity. 
The executive further stated that officials identified alternate work 
space in Chief Counsel offices in the Washington, D.C., metropolitan 
area and placed approximately 180 employees prioritized based on the 
organizational hierarchy. Chief Counsel submitted requests to the 
Incident Commander and Incident Management Team for facility space and 
resources for over 500 remaining employees. 

Although Chief Counsel was able to identify tasks, such as tax 
litigation, that were consistent with responsibilities outlined in its 
plan and procured facility space and resources for personnel, it 
established a task force that identified recommendations to improve the 
business unit's plan in a report documenting lessons learned following 
the flood. Recommendations included measures to improve the 
prioritization of critical functions and people and outline provisions 
for mail processing. In addition, because Chief Counsel experienced 
delays in recovering a computer server that had not been identified in 
the business resumption plan but proved to be important following the 
flood, the task force addressed the need to ensure redundancy of 
information technology equipment. Chief Counsel is currently drafting 
an action plan to carry out the recommendations of the task force. In 
addition, a Chief Counsel business resumption official stated that 
agencywide tests and exercises of business resumption plans could 
assist in better integration of emergency efforts for a wider range of 
future emergencies. 

IRS Headquarters Continuity of Operations Plan Was Not Used in Flood 
Response: 

According to IRS headquarters officials, the headquarters COOP plan was 
not activated because local space availability made movement of 
executive leadership to the alternate COOP facility unnecessary and the 
safety of the leadership was not at risk. 

Conclusions: 

When the June 2006 flood occurred at the IRS headquarters building, the 
agency had in place a suite of emergency plans that helped guide its 
response. The agency's Incident Management Plan was particularly useful 
in establishing clear lines of authority and communications, conditions 
that we have previously reported to be critical to an effective 
emergency response. Unit-level business resumption plans we reviewed 
contributed to a lesser extent and the headquarters COOP plan was not 
activated because of conditions particular to the 2006 flood. 
Specifically, damage to the building was limited to the basement and 
subbasement levels, and employees were able to enter the building to 
retrieve equipment and assets. In addition, alternate work space was 
available for all employees within a relatively short period, reducing 
the importance of identifying critical personnel. Such conditions, 
however, may not be present during future disruptions. 

The plans IRS had in place at the time of the flood did not address all 
of the elements outlined in federal continuity guidance. In particular, 
the IRS plans did not (1) prioritize all essential functions and set 
targets for recovery times; (2) outline the preparation of resources 
and alternate facilities necessary to perform those functions; and (3) 
develop provisions for tests, training, and exercises of all of its 
plans. In discussions on lessons learned from the flood response, IRS 
business unit officials recognized the need to incorporate many of 
these elements. Unless IRS addresses these gaps, it will have limited 
assurance that it will be prepared to continue essential functions 
following a disruption more severe than the 2006 flood. 

Recommendations for Executive Action: 

To strengthen the ability of IRS to respond to the full range of 
potential disruptions to essential operations, we are making two 
recommendations to the Commissioner of Internal Revenue: 

* Revise IRS internal emergency planning guidance to fully reflect 
federal guidance on the elements of a viable continuity capability, 
including the identification and prioritization of essential functions; 
the preparation of necessary resources and alternate facilities; and 
the regular completion of tests, training, and exercises of continuity 
capabilities. 

* Revise IRS emergency plans in accordance with the new internal 
guidance. 

Agency Comments: 

The Commissioner of Internal Revenue provided comments on a draft of 
this report in a March 26, 2007, letter which is reprinted in appendix 
II. The Commissioner agreed with our recommendations. His letter notes 
that the agency is actively committed to improving its processes. 
Specifically the agency will (1) conduct a thorough gap analysis 
between FPC 65 elements and business continuity planning guidance; (2) 
update the Internal Revenue Manual guidance and business resumption 
plan templates to reflect areas of improvement resulting from the gap 
analysis; and (3) formally direct annual tests, training, and exercises 
of business resumption plans through the agency's Emergency Management 
and Preparedness Steering Committee. Finally, the Commissioner stated 
that the agency will revise and implement its emergency plans based on 
the results of the aforementioned activities. 

As agreed with your staff, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days 
after its date. At that time, we will send copies of this report to the 
Secretary of the Treasury, the Commissioner of Internal Revenue, and 
other interested parties. This report will also be available at no 
charge on the GAO Web site at http://www.gao.gov. 

Should you or your staff have questions on matters discussed in this 
report, please contact Bernice Steinhardt at (202) 512-6543 or 
steinhardtb@gao.gov, or Linda Koontz at (202) 512-6240 or 
koontzl@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. Key contributions to this report were made by William Doherty, 
Assistant Director; James R. Sweetman, Jr., Assistant Director; Thomas 
Beall; Michaela Brown; Terrell Dorn; Nick Marinos; and Nhi Nguyen. 

Sincerely yours, 

Signed by: 

Bernice Steinhardt: 
Director, Strategic Issues: 

Signed by: 

Linda D. Koontz: 
Director, Information Management Issues: 

[End of section] 

Appendix I Objectives, Scope, and Methodology: 

The objectives of this report were to: 

* evaluate how the Internal Revenue Service's (IRS) emergency 
operations plans address federal guidance related to continuity 
planning and: 

* evaluate the extent to which IRS emergency operations plans 
contributed to the actions taken by IRS officials in response to the 
flood. 

To address how IRS emergency operations plans address federal guidance 
related to continuity planning, we obtained the IRS headquarters 
emergency operations plans that were available to agency officials at 
the time of the June 2006 flood. These included the Continuity of 
Operations (COOP) plan and a suite of business continuity plans, 
including the Incident Management Plan and 13 business resumption plans 
from business units affected by the flood. Although we also obtained 
the headquarters Occupant Emergency Plan, we did not evaluate its 
contributions to addressing the elements because its purpose is limited 
to outlining procedures for building occupants and emergency personnel 
in responding to threats that require building evacuations or shelter 
in place. We did not obtain the Disaster Recovery Plan, a contingency 
plan for the recovery of information technology equipment, because 
recovery of information technology equipment was addressed in a report 
from the Treasury Inspector General for Tax Administration. 

To evaluate IRS's emergency operations plans in relation to federal 
guidance on continuity planning, we analyzed Federal Preparedness 
Circular (FPC) 65 to identify the elements needed to ensure the 
continuity of essential functions and compared IRS emergency operations 
plans to the resulting generalized list. Because FPC 65 covers all 
hazard emergencies, but provides continuity guidance specifically for 
agency COOP plans, we developed the general elements of guidance to be 
able to collectively evaluate all IRS emergency operations plans we 
obtained. From our analysis of FPC 65, we identified eight general 
elements of guidance related to developing a viable continuity 
capability. See table 3 for a listing and description of the elements. 
We reviewed IRS's plans and analyzed how they collectively addressed or 
did not address these eight general elements of guidance. 

We also reviewed IRS-defined criteria and guidance for emergency 
operations plans, including sections of the Internal Revenue Manual-- 
which provides guidance to IRS officials on developing several of the 
agency's emergency operations plans--and an internal template provided 
by IRS's Office of Physical Security and Emergency Preparedness, which 
is responsible for agencywide emergency planning and policy to guide 
plan development. 

Since each business unit within IRS headquarters has an individual plan 
for business resumption activities, we selected and examined 3 of 13 
business resumption plans available for use during the flood from the 3 
business units with the most employees affected by the flooding in the 
headquarters building. According to employee relocation lists from IRS 
following the flood, the 3 largest business units in the building are 
Criminal Investigation, Wage and Investment, and Chief Counsel, which 
collectively represent over 50 percent of the headquarters building 
employees. 

To address the extent to which IRS emergency operations plans 
contributed to the actions taken by IRS officials in response to the 
flood, we interviewed IRS officials responsible for the development, 
oversight, and implementation of the headquarters emergency operations 
plans. In our interviews, we asked IRS officials responsible for each 
emergency operations plan how the general elements identified in their 
respective plans guided their actions following the flood, if at all. 

To supplement the information gained from the interviews, we reviewed 
agency documentation related to emergency operations activities 
following the flood, including IRS status reports, employee relocation 
lists, and emergency operations team meeting minutes. In addition, we 
reviewed documentation regarding lessons learned from the flood, 
provided by various headquarters business units, and obtained any 
updates or changes to emergency operations plans following the flood. 

We conducted our review in accordance with generally accepted 
government auditing standards from July 2006 through March 2007. 

[End of section] 

Appendix II: Comments from the Internal Revenue Service: 

Department Of The Treasury: 
Internal Revenue Service: 
Washington, D.C. 20224: 
Commissioner: 

March 26, 2007: 

Ms. Linda D. Koontz: 
Director, Information Management Issues:
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Ms. Koontz: 

I am writing to provide the Internal Revenue Service's comments on the 
Government Accountability Office (GAO) draft report, "IRS Emergency 
Planning: Headquarters Plans Supported Response to 2006 Flooding, but 
Additional Guidance Could Improve All Hazard Preparedness" (GAO-07- 
579). 

We appreciate your comments regarding the IRS' response to the 
Headquarters Building Flood. Over the past several years, IRS has 
engaged in a service-wide strategy regarding emergency preparedness, 
business resumption, and incident response. Lessons learned from actual 
emergency incidents have resulted in significant enhancements to our 
incident management and business resumption processes. While 
significant progress has been advanced, we recognize that continued 
diligence is required. We fully understand the importance of ensuring 
that our efforts comply with federal requirements and guidelines. 

As you know, the Treasury Inspector General for Tax Administration 
(TIGTA) also reviewed IRS' efforts related to the Headquarters Building 
Flood. TIGTA's report endorsed our preparedness and performance in 
responding to this incident. 

We agree with the two audit recommendations and are actively committed 
to improving our processes. Enclosed are our comments that address each 
recommendation. 

I appreciate your continued support and the valuable guidance from your 
staff. If you have any questions or wish to discuss this response in 
more detail, please contact Daniel Galik, Chief, Mission Assurance and 
Security Services, at (202) 622-8910, regarding emergency response 
policy and plan development matters, or James P. Falcone, Chief, Agency-
Wide Shared Services, at (202) 622-7500, concerning emergency response 
execution. 

Sincerely, 

Signed for: 

Mark W. Everson: 

Enclosure: 

Comments of the Internal Revenue Service on the GAO report entitled 
"IRS Emergency Planning: Headquarters Plans Supported Response to 2006 
Flooding, but Additional Guidance Could Improve All Hazard 
Preparedness" (GAO-07-579): 

Recommendation 1: 

Revise IRS internal emergency planning guidance to fully reflect 
federal guidance on the elements of a viable continuity capability, 
including the identification and prioritization of essential functions; 
the preparation of necessary resources and alternate facilities; and 
regular completion of tests, training, and exercises of continuity 
capabilities. 

Response: 

We agree with this recommendation and will: 

* Conduct a thorough gap analysis between FPC 65 elements and business 
continuity planning guidance. 

* Update Internal Revenue Manual (IRM) guidance and business resumption 
plan templates to reflect areas of improvement resulting from the 
aforementioned gap analysis. 

* Under the auspices of the Emergency Management and Preparedness 
Steering Committee (EMPSC), formally direct annual tests, training and 
exercising of business resumption plans. 

Recommendation 2: 

Revise the IRS emergency plans in accordance with the new internal 
guidance. 

Response: 

We agree with this recommendation and as outcomes result from efforts 
addressing recommendation 1, above, emergency plans will be revised and 
implemented. 

[End of section] 

FOOTNOTES 

[1] Since each business unit within IRS headquarters has an individual 
plan for business resumption activities, we selected and examined 3 of 
13 business resumption plans available for use during the flood from 
the three business units with the most employees affected by the 
flooding in the headquarters building. The three largest business units 
in the building are Criminal Investigation, Wage and Investment, and 
Chief Counsel. These business units collectively represent over 50 
percent of the headquarters building employees. 

[2] We did not obtain the Disaster Recovery Plan--a contingency plan 
for the recovery of information technology equipment--because recovery 
of information technology equipment was addressed in a report from the 
Treasury Inspector General for Tax Administration. 

[3] GAO, Financial Audit: IRS's Fiscal Years 2006 and 2005 Financial 
Statements, GAO-07-136 (Washington, D.C.: Nov. 9, 2006), and 
Understanding the Tax Reform Debate: Background, Criteria, and 
Questions, GAO-05-1009SP (Washington, D.C.: September 2005). 

[4] Treasury Inspector General for Tax Administration, The Internal 
Revenue Service Building Flood Caused No Measurable Impact on Tax 
Administration, 2007-30-028 (Washington, D.C.: Feb. 7, 2007), and The 
Internal Revenue Service Adequately Protected Sensitive Data and 
Restored Computer Operations After the Flooding of Its Headquarters 
Building, 2007-20-023 (Washington, D.C.: Jan. 26, 2007). 

[5] Administrative leave is an excused absence from work with no loss 
of pay. 

[6] This suite of plans also includes the Disaster Recovery Plan, a 
contingency plan for the recovery of information technology equipment, 
and an Occupant Emergency Plan, which outlines procedures for building 
occupants and emergency personnel in responding to threats that require 
building evacuations or shelter in place. 

[7] CI investigates potential criminal violations of the Internal 
Revenue Code and related financial crimes. 

[8] W&I provides IRS customers with information, support, and 
assistance in fulfilling tax obligations. 

[9] Chief Counsel advises the IRS Commissioner on all matters 
pertaining to the interpretation, administration, and enforcement of 
the Internal Revenue laws and provides legal guidance and interpretive 
advice to IRS, Treasury, and taxpayers. 

[10] FPC 65 defines essential functions as those functions that enable 
an organization to provide vital services, exercise civil authority, 
maintain the safety of the general public, and sustain the industrial/ 
economic base during an emergency. 

[11] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005). 

[12] The Office of Physical Security and Emergency Preparedness--within 
the agency's Mission Assurance and Security Services unit--is the IRS 
program office responsible for emergency planning guidance and 
oversight. 

[13] According to the headquarters Incident Commander, a tabletop 
exercise scheduled for March 2006 was postponed because of a fire 
within the IRS headquarters building the day prior to the event. The 
rescheduled exercise was eventually canceled--along with a second 
exercise to be held later in the year--because of the June 2006 
flooding and subsequent closure of the building. 

[14] GAO, Catastrophic Disasters: Enhanced Leadership, Capabilities, 
and Accountability Controls Will Improve the Effectiveness of the 
Nation's Preparedness, Response, and Recovery System, GAO-06-618 
(Washington, D.C.: Sept. 6, 2006). 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. 
To have GAO e-mail you a list of newly posted products every afternoon, 
go to www.gao.gov and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 441 G Street NW, Room LM 
Washington, D.C. 20548: 

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 
512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm: 

E-mail: fraudnet@gao.gov: 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400: 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548: 

Public Affairs: 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800: 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: