We do not agree with the EP&R CIO's response.  First, it should be noted that 

during the audit we met with FEMA's strategic planning unit, as well as with 

other program officials to discuss the agency's planning activities.  Based on 

these meetings and our review of supporting documentation, we devised 

findings and recommendations regarding the need to update the strategic plan 

and establish better linkages between it and the IT plan.  At the May 17, 2005, 

audit exit meeting where we discussed a preliminary draft of the report, EP&R 

CIO officials did not address our conclusions or recommendations regarding 

strategic planning.  Indeed, one FEMA official conceded that the lack of 

alignment in strategic planning likely was due to creation of the EP&R 

directorate and FEMA's transition into the department events over which 

they had little control.  

Second, with regard to the EP&R CIO's concern about the overall tone of the 

report, we made considerable efforts to revise the report based on comments 

that EP&R CIO officials provided during our audit exit meeting and their 

review of a preliminary draft of our report pursuant to that meeting.  In 

response to the EP&R CIO's formal written comments, we have assessed the 

tone of the report and made additional changes where appropriate.  Still, a 

number of the IT issues we raise, such as the lack of systems integration and 

challenges in handling processing workloads, are not new, dating back to well 

before the current EP&R administration and FEMA's integration into DHS, 

and were consistently evidenced or voiced to us by EP&R officials and 

systems stakeholders during our audit.  We acknowledge in the report the 

various instances where EP&R is working to address such issues; our 

recommendations are intended to encourage continued progress and 

improvement in these areas. 

Third, we believe that the EP&R CIO incorrectly equates the agency's ability 

to meet the disaster management challenges to date with effective and 

efficient IT management.  While we state in our report that EP&R was able to 

get through the 2004 hurricanes, often experiencing significant achievements, 

high customer satisfaction, and high volume processing, we also recognize 

that FEMA's accomplishments were not necessarily because of its IT systems, 

but often in spite of them.  Users across EP&R consistently told us that they 

did not use the headquarters supplied systems, but instead relied upon 

alternative methods, such as creating ad hoc spreadsheets and databases or 

resorting to manual methods, to perform their jobs.  Where IT systems were 

used, they often did not operate effectively.  For example, systems were slow, 

froze, or lacked server space or memory due to the dramatic increases in 

systems users and processing workloads during the 2004 hurricanes.  The 

EP&R CIO's own FY 2005 strategic plan also states that during the 

Emergency Preparedness and Response Could Better Integrate Information Technology  

with Incident Response and Recovery 

Page 35