Board Report: 2014-IT-B-018 October 30, 2014
The Board has taken steps to facilitate continued operations in the event of a disaster, such as developing a COOP, designating dedicated COOP personnel, and securing a well-equipped alternate work site; however, we found that the ICCP has not been able to enforce division participation in COOP-related activities. FCD-1 guidance notes that department and agency continuity coordinators are responsible for ensuring that continuity managers and planners are provided the necessary authority and are positioned at an appropriate level within the organization to effectively oversee the day-to-day management of their continuity program. In December 2013, the Board delegated responsibility for continuity of operations and business-resumption activities to the director of the Management Division through its Delegations of Administrative Authority; however the ICCP informed us that they have not been able to enforce division participation because of the decentralized governance structure for the Board's continuity program. We believe that this deficiency could impair the Board's ability to resume operations in an emergency. Without adequate, centralized governance, the Board cannot be assured that its continuity plan meets all of the requirements of a viable plan and that it can be successfully executed in an emergency.
On December 20, 2013, the Board updated its Delegation of Administrative Authority. The Board's Chairman, who has authority under section 11(k) of the Federal Reserve Act to assign responsibility for performance of delegated functions, has selected one of the Board members to serve as the Board's administrative Governor, with authority to oversee day-to-day operations of the organization. The administrative Governor has delegated authority and responsibility for some of these operations to the Chief Operating Officer and to the Directors of the Board's offices and divisions. The Chief Operating Officer has delegated the responsibility and authority for continuity of operations and business-resumption activities to the Director of the Management Division through its Delegations of Administrative Authority. Within the Management Division, the ICCP is primarily responsible for the coordination and administration of the Board's COOP and contingency site; however ICCP staff members informed us that they have lacked the ability to enforce participation in COOP-related activities, such as Test, Training, and Exercise of the Board's COOP.
The ICCP has responsibilities for overseeing the Board's enterprise COOP program and primarily suggests to the divisions actions to take in developing and maintaining their subordinate COOP plans; it has not been able to require the divisions to take specific actions. We found, however, that 6 of the 12 divisions we interviewed did not believe that they received sufficient guidance in the development of their COOPs. Further, some division representatives cited inadequate governance in the Board's continuity program and expressed concerns about the viability of the Board's COOP in the event of an emergency.
Federal COOP guidance notes that department and agency continuity coordinators are responsible for ensuring that continuity managers and planners are provided the necessary authority and are positioned at an appropriate level within the organization to effectively oversee the day-to-day management of their continuity program. With the ICCP organizationally situated in the Management Division, the unit has not been able to oversee and implement an integrated continuity program that encompasses all Board divisions. As such, each division has developed its own COOP as part of the enterprise COOP, resulting in a decentralized continuity program that lacks central governance.
We recommend that the Director of the Management Division
In response to recommendation 1, the Director of the Management Division stated that the Management Division has implemented a more collaborative approach to develop and implement continuity programs throughout the Board. Additionally, the Intelligence & Resiliency Programs personnel met individually with almost all of the division continuity representatives in February and March 2014 to talk with them about continuity programs and ways to improve IRP's support and increase collaboration.
In our opinion, the actions described by the Director are responsive to our recommendation. We plan to follow up on the actions to ensure that the recommendation is fully addressed.
