Critical Infrastructure Protection: DHS Needs to Improve Its Risk Assessments and Outreach for Chemical Facilities

What GAO Found

In April 2013, GAO reported that, since 2007, the Department of Homeland Security's (DHS) Infrastructure Security Compliance Division (ISCD) assigned about 3,500 high-risk chemical facilities to risk-based tiers under its Chemical Facility Anti-Terrorism Standards (CFATS) program, but it has not fully assessed its approach for doing so. The approach ISCD used to assess risk and make decisions to place facilities in final tiers does not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. For example, the risk assessment approach is based primarily on consequences arising from human casualties, but does not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation, nor does it consider vulnerability, consistent with the NIPP. ISCD had taken some actions to examine how its risk assessment approach could be enhanced, including commissioning a panel of experts to assess the current approach and recommend improvements. In April 2013, GAO reported that ISCD needed to incorporate the results of these efforts to help ensure that the revised assessment approach includes all elements of risk. After ISCD has incorporated all elements of risk into its approach, an independent peer review would provide better assurance that ISCD can appropriately identify and tier chemical facilities, better inform CFATS planning and resource decisions, and provide the greatest return on investment consistent with the NIPP.

GAO also reported that DHS's ISCD has revised its process for reviewing facilities' site security plans--which are to be approved before ISCD performs compliance inspections. The past process was considered by ISCD to be difficult to implement and caused bottlenecks in approving plans. ISCD viewed its revised process to be an improvement because, among other things, teams of experts reviewed parts of the plans simultaneously rather than sequentially, as occurred in the past. ISCD intends to measure the time it takes to complete reviews, but will not be able to do so until the process matures. GAO estimated that it could take another 7 to 9 years before ISCD is able to complete reviews on the approximately 3,120 plans in its queue at the time of GAO's review. Thus, the CFATS regulatory regime, including compliance inspections, would likely be implemented in 8 to 10 years. ISCD officials said that they are exploring ways to expedite the process such as streamlining inspection requirements.

Furthermore, GAO reported that DHS's ISCD has also taken various actions to work with owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but trade associations that responded to GAO's query had mixed views on the effectiveness of ISCD's outreach. ISCD solicits informal feedback from facility owners and operators on its efforts to communicate and work with them, but it does not have an approach for obtaining systematic feedback on its outreach activities. GAO found that ISCD's ongoing efforts to develop a strategic communication plan may provide opportunities to explore how ISCD can obtain systematic feedback on these activities. A systematic approach for gathering feedback and measuring the results of its outreach efforts could help ISCD focus greater attention on targeting potential problems and areas needing improvement.

Why GAO Did This Study

Facilities that produce, store, or use hazardous chemicals could be of interest to terrorists intent on using toxic chemicals to inflict mass casualties in the United States. As required by statute, DHS issued regulations that establish standards for the security of high-risk chemical facilities. DHS established the CFATS program to assess the risk posed by these facilities and inspect them to ensure compliance with DHS standards. ISCD, which manages the program, places high risk facilities in risk-based tiers and is to conduct inspections after it approves facility security plans. This statement summarizes the results of GAO's April 2013 report on the extent to which DHS (1) assigned chemical facilities to tiers and assessed its approach for doing so, (2) revised its process to review facility security plans, and (3) communicated and worked with owners and operators to improve security. GAO reviewed DHS reports and plans on risk assessments, security plan reviews, and facility outreach and interviewed DHS officials. GAO also received input from 11 trade associations representing chemical facilities, about ISCD outreach. The results of this input are not generalizable but provide insights.