Chapter 7—Emergency Management—Public Safety Canada
Main Points
Introduction
Focus of the audit
Observations and Recommendations
Establishing policies and programs
Establishing and exercising federal leadership has been a challenge
A consistent risk management approach is lacking
Coordinating federal emergency management
There has been progress in developing a government operations centre
Lessons learned have not been used to improve emergency response
Coordination is unclear for responses to chemical, biological, radiological, nuclear, or explosives emergencies
Promoting a common approach for response
Standards to promote interoperability are still under development
Protecting critical infrastructure
A strategy for protecting critical infrastructure has been slow to develop
Canada’s critical infrastructure remains undetermined
The energy and utilities sector is making progress on protecting critical infrastructure
Cyber security has recently received more attention, but significant challenges remain
Conclusion
About the Audit
Appendix—List of recommendations
Exhibits:
7.1—The Emergency Management Act dictates specific responsibilities for ministers
7.2—Information coordination and decision making for emergency response set out in the Federal Emergency Response Plan
7.3—The 10 critical infrastructure sectors show varied progress toward their emergency management being operational
Main Points
What we examined
Emergency management refers to a wide range of measures to protect communities and the environment from risks and to recover from emergency events stemming from either natural or human-induced causes. While some emergencies in Canada can be handled locally by municipalities or provinces, the federal government will assist when requested, when the emergency transcends jurisdictional boundaries, or when its assistance is in the national interest. As emergency events today can escalate quickly, this federal capability has become increasingly necessary.
Through legislation and government policy, Public Safety Canada, which was created in December 2003, is responsible for leading by coordinating the management of emergencies among federal departments and agencies. This includes establishing policies and programs for the preparation, testing and exercising, and implementing emergency management plans; it also includes monitoring and coordinating a common federal approach to emergency response along with the provinces—an “all-hazards” approach incorporating prevention and mitigation, preparedness, response, and recovery. The Department’s responsibility for emergency management includes coordinating the protection of critical infrastructure—from planning for emergencies to recovering from them. Critical infrastructure includes physical and information technology facilities, networks, services, and assets essential to the health and safety or economic well-being of Canadians.
We examined how Public Safety Canada carries out these responsibilities. In addition, we looked at its efforts to enhance emergency response and recovery in coordination with six other departments that have specific roles in emergency management. Our audit included assessing the government’s progress on some of the commitments it made to Parliament. Our audit covers performance of federal departments and agencies and events taking place since our last audit, reported in April 2005, and 15 June 2009.
We did not examine the performance of emergency management efforts by provinces, territories, or local communities.
Why it’s important
The H1N1 pandemic, the 2003 eastern seaboard power blackout, Severe Acute Respiratory Syndrome (SARS), massive flooding, and terrorist conspiracies and attacks have demonstrated that global trade, international travel, and cyberspace have increased the speed at which emergencies escalate in scope and severity. Today, many emergencies can be difficult to contain by a single government department or jurisdiction. A federal response is needed for emergencies that are beyond the capacities of other players—emergencies that may have a low probability of occurrence but a high potential impact.
Public Safety Canada is faced with the challenging task of providing the coordination necessary for an overall federal approach to emergency management, in an environment where departments have operated as needed and through their ministers to provide federal assistance on a case-by-case basis.
What we found
Public Safety Canada has not exercised the leadership necessary to coordinate emergency management activities, including critical infrastructure protection in Canada. For example, it has yet to develop the policies and programs that would help clarify its leadership and coordination role for an “all-hazards” approach to the emergency management activities of departments. Public Safety Canada has taken the first step by developing the interim Federal Emergency Response Plan, which it considers to be final although it has not been formally approved by the government. Nor does the Plan include updated or completed definitions of the roles, responsibilities, and capabilities needed for an integrated, coordinated approach to emergency response.
Public Safety Canada has made considerable progress in improving federal emergency coordination through its Government Operations Centre. It keeps other departments informed of the status of events on a real-time basis and also produces regular situation awareness reports for such issues as the H1N1 virus, which allows decisions to be based on a common set of facts.
Public Safety Canada has developed a strategy to protect Canada’s critical infrastructure, but this strategy is still in draft form. At the time of our audit, the critical infrastructure that needs to be protected had not yet been determined. Public Safety has moved forward in promoting a consistent approach to protection efforts across government. For example, it has categorized critical infrastructure into 10 sectors, each headed by a federal department. However, it has not provided those departments with guidance for determining what assets or facilities are critical and require protection.
Progress has been slow until 2009 on Public Safety Canada’s 2004 commitment to develop a cyber security strategy, although threats to computer-based critical infrastructure, including federal information systems, have been growing and evolving. To date, it has identified the key elements of a cyber strategy and initiated action on a list of current cyber security initiatives along with other federal government departments. However, at the time of our audit, no date was planned for obtaining formal approval of the strategy.
Although the 2004 National Security Policy called for first responders’ equipment and communications to be interoperable, key gaps remain for voice communications. This limits the ability of fire, police, and ambulance services to work together and with other jurisdictions in an emergency. The Department has directed little or no funding toward standardizing equipment.
The Department and the Privy Council Office have responded. The Department and the Privy Council Office agree with all of the recommendations that are addressed to them. Their detailed responses follow the recommendations throughout the chapter.
Introduction
7.1 Emergencies today can have a broader impact than those of the past. Examples of emergencies that have recently affected Canadians include the outbreaks of H1N1 and avian influenza, severe acute respiratory syndrome (SARS), listeriosis, and mad cow disease; the 1998 ice storm in Eastern Canada; and the 2003 power blackout across the eastern seaboard. Urban density, international travel, and global trade have increased the speed at which emergencies can escalate and spread. Today, many emergencies can be difficult to contain, and the impact is likely to be greater. A federal response is needed for those emergencies that are beyond the capacity of municipalities or individual provinces or territories—emergencies that may have a low probability of occurrence but can have a high potential impact. To be able to respond effectively to large-scale emergencies and reduce the potential loss of life and property damage, there needs to be extensive planning and coordination.
7.2 Under Canada’s Constitution Act, 1867, provinces and territories have primary responsibility for emergency management within their boundaries. Emergencies such as fires and floods may remain local in nature and, if so, may be effectively managed within the local resources of the municipality and province or territory. If an incident escalates, so do the response activities of various levels of government. At the request of a province or territory or where the type of emergency falls within federal jurisdiction or occurs on federal lands, the federal government provides help to manage and coordinate the response to an emergency. The Emergency Management Act (2007) established that the Department of Public Safety and Emergency Preparedness (Public Safety Canada) is responsible for responding to requests for assistance made by provinces and territories and for coordinating the assistance provided by other federal departments and agencies to the provinces and territories.
7.3 Following the events of September 11, 2001, the Canadian government changed its approach to emergency preparedness and response. At that time, there was a highly decentralized division of responsibilities among federal departments, provinces, and territories. In December 2003, the government created the Department of Public Safety and Emergency Preparedness, bringing together emergency preparedness, national security, and policing responsibilities within one federal department. This restructuring was intended to better integrate public safety efforts and link various federal programs more closely.
7.4 Building the capability to manage a coordinated federal response to an emergency of national significance is a huge undertaking and cannot be achieved overnight. In the past, federal departments had organized their emergency response actions as situations arose. However, given the changing nature of national emergencies, this is no longer sufficient. Recognizing this, the federal government issued the National Security Policy in April 2004, which called for the federal government to be prepared to play an enhanced role in modern emergency management and to improve collaboration among governments and other entities. The 2004 policy outlined a number of initiatives to enhance the safety and security of Canadians. It identified the need for an “all-hazards” approach, meaning that whether or not the cause of an emergency is malicious, accidental, or natural, the federal government would be prepared to respond. To facilitate this, the policy called for an updated emergency response system in which federal entities would work together in a coordinated manner. As well, it identified the need for federal departments and agencies to be more strongly linked with emergency operations at the provincial, territorial, and local levels.
7.5 The 2004 National Security Policy, our 2005 audit of national security and emergency preparedness, the House of Commons Standing Committee on Public Accounts, and the Senate Standing Committee on National Security and Defence all called for updated federal legislation to clearly define and ensure adequate emergency management powers and responsibilities for the Minister of Public Safety.
7.6 In 2005, the Department of Public Safety and Emergency Preparedness Act was passed. It stipulates that the Minister of Public Safety is to exercise “leadership at the national level relating to public safety and emergency preparedness.” When she appeared before the Standing Committee on Justice, Human Rights, Public Safety and Emergency Preparedness, the Minister explained that she would be responsible for coordinating the federal response to emergencies, while respecting the Prime Minister’s prerogative in matters relating to national security and to the statutory authorities of other ministers.
7.7 In January 2007, federal, provincial, and territorial ministers agreed that emergency management would adopt a comprehensive all-hazards approach. This approach would incorporate the four functions of emergency management: prevention and mitigation, preparedness, response, and recovery.
7.8 In August 2007, the Emergency Management Act came into force. It assigns to the Minister of Public Safety the responsibility to “exercise leadership relating to emergency management by coordinating federal emergency management activities” (Exhibit 7.1).
Exhibit 7.1—The Emergency Management Act dictates specific responsibilities for ministers
The Emergency Management Act requires the Minister of Public Safety to exercise leadership for emergency management by coordinating emergency management activities among federal departments and agencies, and in cooperation with the provinces and territories.
The Minister’s responsibilities include
establishing policies and programs, and providing advice to other departments for the preparation of their emergency management plans;
analyzing and evaluating emergency management plans prepared by federal entities;
monitoring potential and actual emergencies and coordinating the federal response to an emergency;
coordinating federal emergency management activities with those of the provinces, and through the provinces, those of local authorities;
coordinating the provision of assistance to a province;
promoting a common approach to emergency management, including the adoption of standards and best practices; and
conducting exercises and providing emergency management education and training.
As well, other federal ministers are to identify the risks that are within their area of responsibility, including those related to critical infrastructure, and to prepare, maintain, test, implement, and exercise emergency management plans in respect of those risks in compliance with the policies, programs, and other measures established by the Minister of Public Safety.
Source: Adapted from the Emergency Management Act
7.9 Public Safety Canada is the coordinating agency for federal departments, which have various roles to play in an emergency. Public Safety Canada is to ensure that the federal government is ready to respond to any future emergencies through the development of policies, standards, and plans that define roles and responsibilities. The aim is to eliminate the potential for confusion when responding in a crisis and provide a federal point for coordination.
7.10 If a department or agency has a clear mandate to respond to an emergency and is responsible to act, it is the subject matter expert. However, if emergencies escalate and spread, other federal departments may be required to play a role to manage the impact within their area of expertise. For example, for an incident involving a terrorist or criminal act, the Royal Canadian Mounted Police (RCMP) would be the primary federal response agency in its law enforcement role. For a natural disaster involving an earthquake or a power outage, Natural Resources Canada would be the primary subject matter expert. The Public Health Agency of Canada would be the subject matter expert for public health, including infectious diseases, in concert with Health Canada. Other departments or agencies, such as the Canada Border Services Agency, would play a supporting role. In each of these examples, Public Safety Canada plays a coordinating role in helping to receive information and communicate the current situation to other departments and agencies, and to senior officials in the federal government and other jurisdictions.
7.11 For emergency management, Public Safety Canada had a budget of $58.5 million and 400 employees for the 2008–09 fiscal year. Many of Public Safety Canada’s emergency management programs are delivered through 11 regional offices. It also manages the federal Government Operations Centre that monitors emerging threats and provides round-the-clock coordination and support to government entities in the event of a national emergency. As well, it oversees the conduct of exercises on emergency management at the national level and an inter-jurisdictional training program for local frontline emergency workers at its Canadian Emergency Management College.
7.12 Public Safety Canada’s role as the lead department for coordinating federal emergency management includes critical infrastructure protection. Critical infrastructure consists of physical and information technology facilities, networks, services, and assets essential to the health and safety or economic well-being of Canadians, and the effective functioning of government. Examples of critical infrastructure include food, water, and energy supplies; health services; financial systems; and communication networks, including the Internet. Events such as the 1998 ice storm in Eastern Canada and the 2003 power blackout across the eastern seaboard highlight the impact of the failure of the electrical grid. The vast majority of Canada’s critical infrastructure is owned by the private sector or managed through another level of government. This creates a challenge for the federal government to establish its role with owners and operators and thereby ensure the protection and resiliency of the nation’s critical infrastructure.
Focus of the audit
7.13 In this audit, we focused on four main responsibilities of Public Safety Canada:
To establish policies and programs for emergency management plans and operations, provide advice to departments, and evaluate their plans.
To coordinate the emergency management activities among federal government institutions along with those of the provinces and territories.
To promote a common approach to emergency management, including the adoption of standards and best practices.
To coordinate the protection of Canada’s critical infrastructure.
7.14 Specifically, we examined Public Safety Canada’s responsibility to lead by coordinating the efforts of other federal entities and by coordinating federal efforts with those of the provinces and territories. We focused mainly on the Department’s preparedness efforts, including its coordination of the provision of critical infrastructure protection. As well, we examined progress by Public Safety Canada in enhancing emergency response and recovery in coordination with government departments and agencies.
7.15 We did not examine the performance of provinces, territories, or local communities in their delivery of emergency management services or activities, nor did we examine provincial and territorial or private sector critical infrastructure protection efforts. We also did not examine the security activities carried out in preparation for the 2010 Olympic and Paralympic Games, as responsibility for these activities was assigned to the Office of the Coordinator for 2010 Olympics and G8 Security, which reports to the National Security Advisor.
7.16 More details on the audit objectives, scope, approach, and criteria are in About the Audit at the end of this chapter.
Observations and Recommendations
Establishing policies and programs
Establishing and exercising federal leadership has been a challenge
7.17 Public Safety Canada is responsible under legislation to exercise leadership through planning, establishing policies and programs for emergency preparedness, cooperating with provinces and territories, and promoting a common approach to emergency management. It is responsible for coordinating the emergency management activities of various federal departments and agencies and fostering a cooperative approach to responding to emergencies.
7.18 Because the subject matter expertise and experience for dealing with emergencies resides in several different departments, Public Safety Canada has an important role to ensure that all potential hazards are addressed, that plans exist and have been shared and tested, and that, during a crisis, the kind of response needed is quickly established without confusion. However, Public Safety Canada does not assume control over other departments or tell them how to do their jobs. Each department remains responsible to its own minister and for acting as required under its own legislation. Public Safety Canada, under the Emergency Management Act, is responsible for establishing policies and programs that other ministers must follow in carrying out their emergency management responsibilities and determining how they will be coordinated. Given different mandates and accountabilities, it is important that Public Safety Canada know who it should communicate with and ensure that the various departments know how coordination will proceed and what the expected operating procedures will be. Nevertheless, each department determines whether it will assist during an emergency, what its role will be, and how it will operate with other federal, provincial, or territorial partners.
7.19 We found that while Public Safety Canada played a coordination role in some emergencies, including participating in the development of response plans for avian and pandemic influenza, it has yet to establish the policies and programs that would help define its leadership and coordination role for emergency management in an all-hazards environment. Defining a leadership role when each department responds to its own ministerial direction, and coordinating that direction with other departments can be a challenge. Nevertheless, Public Safety Canada was established to address these concerns and determine how to coordinate and harmonize the activities of the different departments needed to deal with today’s complicated and broad-reaching situations.
7.20 In order to move forward in its mandate to exercise leadership, Public Safety Canada needs to have experienced and knowledgeable staff in place. Another challenge we noted was that the Department has had difficulty attracting and retaining senior managers to provide the direction needed in its emergency management. This area of Public Safety Canada had an employee vacancy rate of 39 percent in the 2008–09 fiscal year and a vacancy rate of 50 percent the previous year. In April 2009, only 56 percent of senior managers had been in their jobs for more than 18 months. Turnover and change of staff has been particularly problematic, and in the 2008–09 fiscal year, the rate of employee movement (including appointments, promotions, deployments, acting assignments, and departures) was 71 percent in emergency management.
7.21 In 2006, Public Safety Canada was allocated approximately $115 million over five years to enhance its core capacity for emergency management; and, in 2008, it was allocated a further $28 million over five years. In the 2008–09 fiscal year, Public Safety Canada had an annual budget of $58.5 million for emergency management. However, it had not spent one third of its budget for emergency management in each of the past two years. In this context, it is evident that Public Safety Canada has been unable to develop its capacity for emergency management.
7.22 In the face of these challenges, Public Safety Canada has taken the first steps toward establishing its leadership role by developing the interim Federal Emergency Response Plan, a framework for coordinating emergency response activities across government. Work has been under way on developing this plan, in various forms, since 2004. In June 2005, the House of Commons Standing Committee on Public Accounts recommended that Public Safety Canada obtain formal support for its plan from other departments. At the time of our audit, the Plan was still an outline of the requirements of an emergency response plan. The Plan has been presented to an interdepartmental committee of assistant deputy ministers. Although it has not been formally approved by Public Safety Canada or endorsed by other departments, officials told us that it is, nevertheless, being considered final.
7.23 While the framework may be considered complete, the roles and responsibilities and the capabilities (contained in its annexes) needed for an integrated, coordinated approach to emergencies have not been updated or completed. Department officials told us that details on how the federal plan supports provincial and territorial plans and capabilities are being drafted. At the time of our audit, Public Safety Canada expected to share the draft document with provincial and territorial representatives in September 2009. While we recognize that the Federal Emergency Response Plan will always need to be updated to reflect changes in policies and practices, it is a significant policy document that, with formal government approval, would provide proper authority and clear support to Public Safety Canada.
7.24 The Federal Emergency Response Plan outlines a decision-making process to help coordinate a federal response to emergencies. Since 2006, an interdepartmental assistant deputy ministers’ committee for emergency management (now, ADM-EMC) has met regularly to discuss emergency management priorities and to make decisions to guide federal government actions during emergencies. Depending on the severity of a situation, this committee may make decisions, or may refer the issue to the Federal Coordinating Officer (usually the Deputy Minister of Public Safety), who may refer the issue to a committee of deputy ministers. Similarly, the issue may be referred to Cabinet or, ultimately, to the Prime Minister. The federal emergency response structure is summarized in Exhibit 7.2. The ADM-EMC is co-chaired by Public Safety Canada and the Privy Council Office to facilitate the sharing of information should decisions need to be taken to a higher level. The ADM-EMC has served as the coordinating body for events such as the 2007 floods in British Columbia and the H1N1 virus pandemic in 2009.
Exhibit 7.2—Information coordination and decision making for emergency response set out in the Federal Emergency Response Plan
Source: Adapted from the Federal Emergency Response Plan (April 2009)
7.25 As part of our audit, we reviewed federal responses to six emergencies that occurred between August 2006 and May 2009, where multiple federal departments were involved and for which after-action reports were available. We tried to determine whether the Federal Emergency Response Plan was used as the framework for a coordinated response. In each of these cases, the Government Operations Centre was used to varying degrees to share information and analysis among entities. However, the ADM-EMC, the body responsible for coordinating the federal response to an emergency, did not meet to discuss possible responses during three of these six emergencies. According to after-action reports prepared by participating departments for these emergencies, there were problems in coordinating the federal response among departments and agencies in all cases. Roles and responsibilities needed to achieve a coordinated approach were not well understood and some established practices were not followed. At the time of our audit, the ADM-EMC intended to clarify roles and responsibilities in its decision-making process.
7.26 Recommendation. The Privy Council Office and Public Safety Canada should ensure that all components of the Federal Emergency Response Plan are completed and should obtain government approval for the plan.
The Privy Council Office and the Department’s response. Agreed. The Privy Council Office and Public Safety Canada will seek approval for the completed Federal Emergency Response Plan (FERP) at the earliest possible date and the supporting Emergency Support Functions (ESFs) prior to the end of the 2009–10 fiscal year. Public Safety Canada will seek approval of the National Emergency Response System (NERS), an annex to the FERP, which articulates how the FERP supports provincial and territorial emergency response plans, by the end of August 2010. Public Safety Canada will organize information sessions with departmental executive committees to brief departments on the FERP and their associated roles and responsibilities. The FERP and its components will be maintained as an evergreen document.
A consistent risk management approach is lacking
7.27 In order to be ready to respond, emergency management plans need to address the most important risks. In 2007, the Deputy Ministers’ Committee directed Public Safety Canada to assess the federal government’s state of readiness for a national emergency. Through this review process, a number of capability gaps were identified; however, Public Safety Canada did not have a framework upon which to prioritize or rank the severity of the gaps and, as a result, has not moved forward with an action plan to address these gaps. As well, the review found that Public Safety Canada lacked an all-hazards risk assessment that identified potential hazards to public safety or security—whether malicious, natural, or accidental. It also lacked a framework to determine required capabilities to respond to these risks.
7.28 The 2004 National Security Policy and the 2007 Emergency Management Act recognized that the federal government needed to better understand Canada’s vulnerability to emerging risks and use this information to develop comprehensive emergency plans and programs. Under the Emergency Management Act, federal departments are to identify risks that are within their area of responsibility, and prepare emergency plans in respect of those risks according to the policies established by Public Safety Canada. Under its leadership role for emergency management activities, Public Safety Canada is to coordinate risk assessments in collaboration with other federal departments and to ensure that they have proper emergency management plans and preparedness measures in place.
7.29 We found that Public Safety Canada has made limited progress in developing the guidance that departments need to achieve a consistent approach when identifying their risks and their emergency management plans and programs. A comprehensive risk and vulnerability assessment to guide the development of plans and response capabilities under an all-hazards approach has not been conducted in Canada. A Public Safety Canada study conducted in 2008 of 36 federal departments found wide variation in the risk assessment processes used by departments to guide the development of plans and capabilities. Some departments had no process in place. In the six federal departments we examined, we found that none had received any guidance from Public Safety Canada on conducting risk assessments for emergency planning, yet all of these departments were working to update their plans. Public Safety Canada initiated a project in April 2009 to streamline and validate these risk assessment processes for emergency planning and capabilities development. This project is in the preliminary planning stage.
7.30 The Emergency Management Act stipulates that Public Safety Canada is responsible for reviewing departmental emergency management plans, which includes departmental business continuity plans. These plans are needed so that federal organizations can continue operating during an emergency. Under the Emergency Management Act, Public Safety Canada is responsible for ensuring that business continuity plans are complementary and meet the overall needs of the federal government. It had provided a self-assessment tool for departments to review their own business continuity plans. However, at the time of our audit, Public Safety Canada had not formally analyzed or evaluated departmental business continuity plans, nor did it have plans to do so. It had not determined whether there were gaps between departments.
7.31 Recommendation. As stipulated in the Emergency Management Act, Public Safety Canada should establish policies and programs and provide advice for departments to follow when identifying risks and developing their emergency management plans.
The Department’s response. Agreed. In keeping with the all-hazards approach to emergency management, Public Safety Canada is leading the development of an Emergency Management Planning Framework that will provide departments and agencies with guidance, tools, and best practices for developing emergency management plans. It is also working with federal departments to develop an all-hazards risk assessment framework. Under the Emergency Management Act, it is the responsibility of each minister accountable to Parliament for a government institution to identify the risks that are within or related to his or her area of responsibility.
7.32 Recommendation. As stipulated in the Emergency Management Act, Public Safety Canada should analyze and evaluate the emergency management plans prepared by departments to ensure that they are prepared according to the policies, programs, and advice provided, and it should identify potential gaps or risks to a coordinated emergency management response.
The Department’s response. Agreed. Public Safety Canada is developing the Emergency Management Planning Framework, which will include performance measurements that will allow Public Safety Canada to analyze and evaluate emergency management plans produced by departments and agencies. The Framework will also include self-assessment tools for departments and agencies. Public Safety Canada is currently developing an approach to implement this initiative.
Coordinating federal emergency management
There has been progress in developing a government operations centre
7.33 In 2004, Public Safety Canada established the Government Operations Centre as the core of its federal coordination efforts for events of national significance. The role of the Government Operations Centre is not to act as a decision-making body in an emergency response, but to assemble and communicate information to decision makers. It is connected with the operations centres of 20 federal departments and agencies, as well as with those of the provinces and territories, and other countries, including the United States.
7.34 The Government Operations Centre has coordinated information and analysis among federal departments and provinces for numerous events since its inception. The scope of the emergency determines the scale and extent of its functions. However, it has not clearly defined when or why its level of activation changes in response to the severity of events and what this means for participating departments. A government-wide exercise, conducted in February 2009 by Public Safety Canada, found that information analysis and sharing at the operations centre was poor. Furthermore, officials at Public Safety Canada told us that the Government Operations Centre did not have the physical facilities to support the number of staff needed to keep the operations centre fully functional for a major emergency lasting an extended period of time. Public Safety Canada was in the process of determining what corrective actions were needed as we completed our audit work.
7.35 Public Safety Canada has made considerable progress in federal emergency coordination through its Government Operations Centre, as the centre operates on a continual basis and can track many potential or evolving events. It keeps other departments informed of the status of events on a real-time basis and alerts them if the events escalate into a more serious situation. The centre produced regular situation awareness reports for such issues as the H1N1 virus pandemic and Manitoba’s spring flooding in 2009, which allowed decisions to be based on a common set of facts. We noted that the Government Operations Centre reviewed how well it performed after events, but this was a verbal process. Results from these reviews are not normally tracked or monitored to ensure that corrective action is implemented.
Lessons learned have not been used to improve emergency response
7.36 In order for response plans to be reliable during an emergency, they must be regularly exercised, especially the plans for coordination between departments and agencies and between different levels of government. The National Security Policy and the Emergency Management Act call for regular exercises to assess the adequacy of emergency response plans in various scenarios. In 2004, the National Exercise Division was established within Public Safety Canada, with resources dedicated to staging regular national exercises at the federal, provincial, and municipal levels and consolidating lessons learned to improve future performance.
7.37 Over the past three years, Public Safety Canada budgeted a total of $17.1 million to plan and conduct exercises related to emergency management across the federal government and with the provinces and municipalities, as well as to share lessons learned and best practices with exercise participants. However, over half of the budget allocated to national exercises was not spent in each of the last three fiscal years. Public Safety Canada maintains a calendar that lists exercises planned among federal departments and has developed a framework for federal departments and agencies to coordinate their national exercise efforts. Since April 2005, Public Safety Canada has coordinated five federal exercises, shared in the coordination of eight multi-jurisdictional exercises, and participated in an additional two exercises. However, we found that exercises were designed to meet the training objectives of individual departments, rather than to test the government’s overall coordination or readiness for a national emergency against identified risks. Public Safety Canada recognizes the need to increase the number of federal and multi-jurisdictional exercises.
7.38 In response to our April 2005 audit, Public Safety Canada committed to consolidating, on an ongoing basis, the results of lessons learned; however, at the time of our audit, it had not done so. The Department provided us with after-action reports for 14 of the exercises it coordinated or participated in since April 2005, but observations and recommendations from these reports were not systematically collected and used to improve emergency plans and operations.
Coordination is unclear for responses to chemical, biological, radiological, nuclear, or explosives emergencies
7.39 Following the events of September 11, 2001, Canada focused its attention on the significant threats posed by terrorist attacks and on the need to enhance readiness against emergencies caused by people, whether deliberate or accidental. In Budget 2001, the federal government allocated $513 million over six years to federal departments and agencies to improve their ability to respond to chemical, biological, radiological, or nuclear (CBRN) events, as these types of emergencies are beyond the response capacity of provinces, territories, and municipalities. Public Safety Canada receives $2.7 million annually for CBRN training. The initiative is currently being expanded to include the possibility of a threat due to explosives (CBRNE).
7.40 We examined the status of efforts made to improve CBRNE response capability, where a coordinated and integrated approach among federal departments, as well as provincial and local jurisdictions, is essential to success. To enhance the capacity of local emergency workers to respond to a CBRNE event, Public Safety Canada leads a training program for first responders from municipal, provincial, and territorial governments, with a combined annual federal budget of $12 million. From April 2003 to April 2009, it had trained 1,854 local first responders to assist during an event, and a further 10,400 had received awareness training. While Public Safety Canada has administered participant questionnaires and consulted experts and other government departments, it has not conducted a formal needs analysis for its first responder training.
7.41 In 2002, a federal team was established to prepare for and respond to potential CBRNE events, combining the efforts of the RCMP and National Defence; at the time, Health Canada; and, since 2004, the Public Health Agency of Canada. We expected that Public Safety Canada would lead the efforts of these departments, and we looked for evidence of joint planning and execution to develop the capabilities needed for a coordinated response and recovery.
7.42 Public Safety Canada is responsible for setting the overall federal policy on CBRNE issues. In 2005, it issued a federal strategy, identifying the roles and responsibilities of federal departments and agencies for an effective response to these types of emergencies. However, it did not address how federal departments and agencies would coordinate their resources with those of the provinces, territories, and municipalities to assist them in a national emergency, nor has it expanded the strategy to include explosives. At the time of our audit, Public Safety Canada was consulting with the provinces and territories to develop a national CBRNE strategy that included their responsibilities.
7.43 While the current strategy states that the government is to take all possible measures to pre-empt, prevent, mitigate, and respond effectively to a potential CBRNE incident, it has not identified the desired capability, mandate, roles, or priorities for crisis or consequence management for the responsible federal organizations. The role of the federal CBRNE team is to manage the crisis phase of an emergency; however, the team does not have the resources to manage the after effects of a CBRNE incident, including assisting in mass casualty evacuation, medical aid, or decontamination. In August 2008, the three departments involved in the federal CBRNE response team informed Public Safety Canada of their concerns with the team’s mandate, capacity, training, and the compatibility of communications equipment. While the responsibilities of each team member were clear, there were no defined operational protocols or agreements on how the team would work together in a coordinated manner. Team members felt that it was the responsibility of Public Safety Canada to define protocols and formalize agreements among members. At the time of our audit, these issues had not been resolved. Public Safety Canada officials told us that the role it could play in this type of emergency is unclear, as the three departments on the federal CBRNE team have the expertise, resources, and responsibility, while Public Safety Canada has none of these.
7.44 Recommendation. As stipulated in the Emergency Management Act, Public Safety Canada should ensure that its coordination role for the federal response to an emergency is well-defined and that the operational policies and plans that departments will follow are updated and consistent.
The Department’s response. Agreed. Public Safety Canada will maintain the Federal Emergency Response Plan and its components as an evergreen document. This includes ensuring the development of policies and event-specific plans that outline operational protocols and departmental roles and responsibilities, and reviewing these plans to ensure a coordinated approach as necessary.
Promoting a common approach for response
Standards to promote interoperability are still under development
7.45 The 2004 National Security Policy called for equipment and communications to be interoperable or compatible so that first responders could work together better. In response to our 2005 audit chapter, Public Safety Canada agreed to collaborate with a research group to develop standards for equipment for use in chemical, biological, radiological, or nuclear emergencies. The equipment is used in a variety of emergency response situations, and it includes fire and heavy urban search and rescue vehicles, personal suits, gear worn by first responders to protect against hazardous materials, and communications systems.
7.46 First responders have identified voice communications as the main constraint to their interoperability. Capability gaps remain in communications interoperability that limit the ability of fire, police, and ambulance services to talk to one another and to communicate across jurisdictions during an emergency. Public Safety Canada officials told us that its role is not to establish standards but to assist first responder groups that purchase and use the equipment to develop their own standards. Public Safety Canada completed a draft document on a national approach for communications interoperability but has yet to present the draft to provincial officials for approval. For other types of equipment, Public Safety Canada is currently assisting groups to establish standards for personal protective equipment.
7.47 As noted in our 2005 audit, while the federal government could use directed funding to promote standardized equipment, officials told us that it has not done more due to a lack of resources. About $5 million in federal funding is available through an existing cost-shared program. Under this program, choices of equipment purchases are left to the provinces.
Protecting critical infrastructure
A strategy for protecting critical infrastructure has been slow to develop
7.48 Public Safety Canada is the lead federal department for coordinating the protection of Canada’s critical infrastructure. Critical infrastructure consists of those physical and information technology facilities, networks, services, and assets that, if disrupted or destroyed, would have a serious impact on the health, safety, and security or economic well-being of Canadians or the effective functioning of governments in Canada. The Emergency Management Act stipulates that the Minister of Public Safety is to provide advice and to analyze and evaluate federal departmental emergency management plans, which include critical infrastructure plans.
7.49 We examined whether Public Safety Canada was providing a leadership role in developing and implementing a national strategy for critical infrastructure protection. Namely, we examined its initiatives to provide advice and promote standards to other federal and provincial or territorial authorities.
7.50 In February 2001, the federal government identified the need to provide national leadership to protect Canada’s critical infrastructure from the risks of failure or disruption. Following the terrorist attacks in the United States on September 11, 2001, the federal government allocated $190 million over five years to improve critical infrastructure protection and emergency management capacity across the federal government. In 2004, the National Security Policy directed the federal departments to work with provinces, territories, and the private sector on initiatives to improve national capabilities to protect critical infrastructure. In its 2004–05 Report on Plans and Priorities, Public Safety Canada committed to the development and release of a National Strategy for Critical Infrastructure by spring 2005.
7.51 While not meeting its target date in 2005, Public Safety Canada started to work with provinces, territories, and the private sector to develop a plan to implement a proposed National Strategy for Critical Infrastructure. In the strategy, 10 key sectors involved in critical infrastructure were identified, and federal departments were designated to head each sector. We found that Public Safety Canada has consulted with representatives of government and private sector organizations in order to draft the National Strategy for Critical Infrastructure. It expects that implementation will take three years once the strategy is formally approved. Department officials told us that they are continuing to work on implementation while they await formal approval. From its monitoring, Public Safety Canada found that progress was more advanced in some sectors than in others toward completion of the 37 milestones necessary for their emergency management to be fully operational (Exhibit 7.3).
Exhibit 7.3—The 10 critical infrastructure sectors show varied progress toward their emergency management being operational
Source: Based on data provided by Public Safety Canada
7.52 At the time of our audit, Public Safety Canada had started to develop guidance to promote a consistent approach to critical infrastructure risk assessments and protection efforts. However, this guidance had not been finalized or distributed to departments designated to head the sectors. We found that, in the absence of guidance from Public Safety Canada, departments have been developing their own approaches, without the assurance that they will result in plans that are coordinated and consistent across government.
Canada’s critical infrastructure remains undetermined
7.53 With the proposed critical infrastructure strategy, Public Safety Canada has taken the first step toward getting a complete picture of the infrastructure considered important at the federal, provincial, and municipal levels. However, to get this picture requires input from many different partners in government and the private sector. At the time of our audit, the critical infrastructure that needs to be protected had not yet been determined. Public Safety Canada had begun to map the infrastructure of 14 major Canadian cities. However, none of this information had been validated for its significance at the federal level. While certain assets may be deemed critical to an industry, municipality, province, or territory, those assets may not be critical at the federal or national level. This information is key for industry and all levels of government to allocate resources and develop their own protection plans.
7.54 There have been challenges to progress, specifically
the determination of which critical infrastructure needs protection;
the determination of what resources are available to protect critical infrastructure at the federal, provincial, and territorial levels and of where weaknesses or gaps exist; and
hesitation on the part of private sector owners and operators of some infrastructure to share information that would identify potential vulnerabilities that could provide competitors with an advantage.
7.55 While Public Safety Canada can move forward to develop policies and programs without resolving these issues, the unresolved issues will remain an impediment to achieving full success if they are not addressed. The proposed national strategy includes information sharing and protection as a key strategic objective, and the Access to Information Act has been amended to protect critical infrastructure information supplied by third parties. However, department officials at Public Safety Canada told us that, while they can provide advice and coordination to departments, it is the responsibility of operational departments to identify Canada’s critical infrastructure and determine how it should be protected before a national, coordinated approach can be implemented.
7.56 Public Safety Canada has provided no guidance to departments to ensure that they determine what critical infrastructure needs to be protected. Furthermore, there is little guidance to departments responsible for sectors to determine what assets or facilities are critical to the federal government. This information is essential for a coordinated approach to critical infrastructure protection.
The energy and utilities sector is making progress on protecting critical infrastructure
7.57 We examined the energy and utilities sector in more detail as it was seen to have made considerable progress in efforts to identify and protect critical infrastructure. Led by Natural Resources Canada, the sector is organized and has regular meetings and classified briefings to industry and government officials.
7.58 Natural Resources Canada is in the process of adding infrastructure information to maps, including not only pipelines and transmission lines, but also railways, telecommunications, and strategic buildings and structures. While these efforts are expected to complement the proposed national strategy, we note that this project was developed separately from Public Safety Canada, which has since initiated its own separate mapping of critical infrastructure.
Cyber security has recently received more attention, but significant challenges remain
7.59 Threats to computer-based critical infrastructure, including federal information systems, are evolving and growing. In April 2009, the Minister of Public Safety stated that there have been repeated attacks against this country’s computer systems. These cyber attacks may be initiated by individuals or groups and may be unintentional, amateur, or foreign state-sponsored espionage and information warfare, and present an ever-changing and evolving threat. Cyber attacks could have very damaging consequences. For example, computer and communications networks are used to control such things as our electrical grid, with varying vulnerabilities. Recently, the United States and the United Kingdom have significantly increased their efforts to fight cyber threats.
7.60 Public Safety Canada is in the process of developing a cyber security strategy—a commitment first made in the 2004 National Security Policy. While it has been working on a draft strategy, at the time of our audit, it had no date scheduled for its formal approval. Although the commitment was made in 2004, progress has been slow until this past year. Public Safety Canada has identified the key elements of a cyber strategy and has initiated action on a list of current cyber security initiatives along with other federal government departments.
7.61 Recommendation. Based on the responsibilities outlined in the Emergency Management Act, Public Safety Canada should provide policies and guidance for departmental sector heads to determine their infrastructure and assess its criticality, based on risk and its significance to the safety and security of Canadians; it should establish policies and programs to prepare plans to protect the infrastructure.
The Department’s response. Agreed. Based on the responsibilities outlined in the Emergency Management Act, Public Safety Canada will provide tools and guidance for sectors to determine their processes, systems, facilities, technologies, networks, assets, and services. Public Safety Canada will also provide tools and guidance for departmental sector heads to assess the infrastructure’s criticality based on risks and its significance to the safety and security of Canadians, and will establish policies and programs to prepare plans for their protection.
Conclusion
7.62 We found that Public Safety Canada has not exercised the leadership necessary to coordinate emergency management activities, including protection of critical infrastructure in Canada. While it has a challenging role, Public Safety Canada still needs to develop the policies and programs that would help clarify its leadership and coordination role for the emergency management activities of operational departments. Public Safety Canada has taken the first step by developing the interim Federal Emergency Response Plan. In our opinion, to make further progress, the plan would benefit from formal government approval and a better definition of roles and responsibilities of all players, as well as the capabilities needed for an integrated, coordinated approach to emergency response.
7.63 Public Safety Canada has drafted a strategy to protect Canada’s critical infrastructure, but it has not been formally approved. However, at the time of our audit, the critical infrastructure that needs to be protected had not yet been determined. It has categorized critical infrastructure into 10 sectors, each headed by a federal department.
7.64 We found that Public Safety Canada had made slow progress until this past year on its 2004 commitment to develop a cyber security strategy, although threats to computer-based critical infrastructure, including federal information systems, are evolving and growing. While it has been working on a draft strategy, at the time of our audit, it had no date scheduled for its formal approval. Public Safety Canada has identified the key elements of a cyber security strategy and has initiated action on a list of current cyber security initiatives along with other federal departments and agencies.
7.65 Over the period of our audit, Public Safety Canada, along with other federal departments and agencies, had made limited progress in enhancing the response to and recovery from emergencies in a coordinated manner. However, their rate of progress has improved, especially in the past year. Public Safety Canada has established a Government Operations Centre, which is connected to other federal departments and agencies. The centre has enabled Public Safety Canada to make considerable progress in coordinating response activities in times of crisis, as it keeps other departments informed of the status of events on a real-time basis. It also produces regular situation awareness reports for such issues as the H1N1 virus, which allow decisions to be based on a common set of facts. However, improvements can be made in identifying and implementing lessons learned from real emergencies and exercises. In its responsibility as the lead federal department for emergency management policies and plans, including chemical, biological, radiological, nuclear, and explosives, Public Safety Canada has not clarified the decision-making processes and operational protocols for emergency response activities.
7.66 Public Safety Canada is making progress in promoting standards for personal protective equipment used in responding to emergencies. However, key interoperability gaps remain for voice communications, limiting the ability of various fire, police, and ambulance services to work together in an emergency. The Department has directed little or no funding toward standardizing equipment.
About the Audit
All of the audit work in this chapter was conducted in accordance with the standards for assurance engagements set by The Canadian Institute of Chartered Accountants. While the Office adopts these standards as the minimum requirement for our audits, we also draw upon the standards and practices of other disciplines.
Objectives
The objectives of this audit were to
determine whether Public Safety Canada can demonstrate that it has exercised leadership by coordinating emergency management activities, including critical infrastructure protection in Canada; and
determine whether Public Safety Canada, along with federal departments and agencies, can demonstrate progress in enhancing the response to and recovery from emergencies in a coordinated manner.
Scope and approach
This audit examined federal efforts to improve the nation’s readiness and resiliency to respond to incidents or attacks, through improved coordination of emergency management activities at the federal level, and through work with provinces and territories to achieve unified and integrated response and recovery operations. While the focus of the audit was Public Safety Canada, audit work was also conducted at the Privy Council Office, National Defence, the Royal Canadian Mounted Police, the Public Health Agency of Canada, Health Canada, Natural Resources Canada, the Canadian Food Inspection Agency, and the Canada Border Services Agency.
We followed up on selected recommendations made in our April 2005 chapter, National Security in Canada, regarding emergency preparedness, including response capabilities for a chemical, biological, radiological, or nuclear event. Public Safety Canada has the lead responsibility for addressing the majority of these recommendations. We also followed up on selected recommendations from the June 2005 House of Commons Standing Committee on Public Accounts report that supported our audit chapter with several recommendations to federal departments.
The audit did not examine emergency management activities of the provinces and territories; it focused on Public Safety Canada’s coordination of emergency management among federal departments along with the provinces and territories. The audit did not examine the security activities carried out in preparation for the 2010 Olympic and Paralympic Games as responsibility for these activities was assigned to the Office of the Coordinator for 2010 Olympics and G8 Security reporting to the National Security Advisor.
Criteria
Listed below are the criteria that were used to conduct this audit and their sources.
Criteria
Sources
We expected that Public Safety Canada would exercise leadership by coordinating federal emergency management activities, as described in legislation and policies.
Department of Public Safety and Emergency Preparedness Act
Emergency Management Act, sections 3 and 4
National Security Policy (2004), page 22
We expected that Public Safety Canada would coordinate federal emergency management activities with those of the provinces and territories to provide timely and coordinated support to communities in an emergency.
Emergency Management Act, section 4.1(f)
National Security Policy (2004), page 25
We expected that Public Safety Canada would regularly test and exercise federal emergency management plans.
Emergency Management Act, section 4.1(a)
National Security Policy (2004), page 27
National Security in Canada: Report of the Standing Committee on Public Accounts, June 2005, page 10
We expected that Public Safety Canada would have a risk-based plan to lead and coordinate critical infrastructure protection efforts, and to reduce vulnerability to cyber attacks and accidents, by
adopting an all-hazards approach
agreeing upon roles and responsibilities for the federal government and others
determining what critical infrastructure should be protected
assessing the threats and risks to these assets
prioritizing risks and resources to protect critical infrastructure
implementing protective programs
developing measures to monitor and assess effectiveness
National Security Policy (2004), page 26
Public Safety Canada, Securing an Open Society: One Year Later (2005), page 23
Emergency Management Act, sections 3 and 4
We expected that Public Safety Canada and selected federal entities would use a risk-based approach to identify the resources needed and to coordinate the response to and recovery from emergencies.
Emergency Management Act, sections 4 and 6
Treasury Board of Canada Secretariat, Management Accountability Framework, Round V—Risk Management, sections 9.1 to 9.4
Treasury Board of Canada Secretariat, Integrated Risk Management Framework
We expected that Public Safety Canada would promote a common approach to emergency management, including the adoption of standards and best practices.
Emergency Management Act, section 4
National Security Policy (2004), page 26
We expected that Public Safety Canada, together with its federal partners, would provide emergency management training, based on a needs assessment and risk-based plan.
Emergency Management Act, section 4(1)(n)
Government of Canada, The Budget Plan 2001, page 100
Management reviewed and accepted the suitability of the criteria used in the audit.
Period covered by the audit
This audit covers the performance of federal departments and agencies and events taking place since our last audit of this subject reported in April 2005.
Audit work for this chapter was substantially completed on 15 June 2009.
Audit team
Assistant Auditors General: Wendy Loschiuk and Hugh McRoberts
Principal: Gordon StockDirector: Carol McCalla
Jenna LindleySean MacLennanSteven MarianiJohn-Patrick MooreNicolette O’ConnorBridget O’GradyStacey Wowchuk
For information, please contact Communications at 613-995-3708 or 1-888-761-5953 (toll-free).
Appendix—List of recommendations
The following is a list of recommendations found in Chapter 7. The number in front of the recommendation indicates the paragraph where it appears in the chapter. The numbers in parentheses indicate the paragraphs where the topic is discussed.
Recommendation
Response
Establishing policies and programs
7.26 The Privy Council Office and Public Safety Canada should ensure that all components of the Federal Emergency Response Plan are completed and should obtain government approval for the plan. (7.17–7.25)
The Privy Council Office and the Department’s response. Agreed. The Privy Council Office and Public Safety Canada will seek approval for the completed Federal Emergency Response Plan (FERP) at the earliest possible date and the supporting Emergency Support Functions (ESFs) prior to the end of the 2009–10 fiscal year. Public Safety Canada will seek approval of the National Emergency Response System (NERS), an annex to the FERP, which articulates how the FERP supports provincial and territorial emergency response plans, by the end of August 2010. Public Safety Canada will organize information sessions with departmental executive committees to brief departments on the FERP and their associated roles and responsibilities. The FERP and its components will be maintained as an evergreen document.
7.31 As stipulated in the Emergency Management Act, Public Safety Canada should establish policies and programs and provide advice for departments to follow when identifying risks and developing their emergency management plans. (7.27–7.30)
The Department’s response. Agreed. In keeping with the all-hazards approach to emergency management, Public Safety Canada is leading the development of an Emergency Management Planning Framework that will provide departments and agencies with guidance, tools, and best practices for developing emergency management plans. It is also working with federal departments to develop an all-hazards risk assessment framework. Under the Emergency Management Act, it is the responsibility of each minister accountable to Parliament for a government institution to identify the risks that are within or related to his or her area of responsibility.
7.32 As stipulated in the Emergency Management Act, Public Safety Canada should analyze and evaluate the emergency management plans prepared by departments to ensure that they are prepared according to the policies, programs, and advice provided, and it should identify potential gaps or risks to a coordinated emergency management response. (7.27–7.30)
The Department’s response. Agreed. Public Safety Canada is developing the Emergency Management Planning Framework, which will include performance measurements that will allow Public Safety Canada to analyze and evaluate emergency management plans produced by departments and agencies. The Framework will also include self-assessment tools for departments and agencies. Public Safety Canada is currently developing an approach to implement this initiative.
Coordinating federal emergency management
7.44 As stipulated in the Emergency Management Act, Public Safety Canada should ensure that its coordination role for the federal response to an emergency is well-defined and that the operational policies and plans that departments will follow are updated and consistent. (7.33–7.43)
The Department’s response. Agreed. Public Safety Canada will maintain the Federal Emergency Response Plan and its components as an evergreen document. This includes ensuring the development of policies and event-specific plans that outline operational protocols and departmental roles and responsibilities, and reviewing these plans to ensure a coordinated approach as necessary.
Protecting critical infrastructure
7.61 Based on the responsibilities outlined in the Emergency Management Act, Public Safety Canada should provide policies and guidance for departmental sector heads to determine their infrastructure and assess its criticality, based on risk and its significance to the safety and security of Canadians; it should establish policies and programs to prepare plans to protect the infrastructure. (7.48–7.60)
The Department’s response. Agreed. Based on the responsibilities outlined in the Emergency Management Act, Public Safety Canada will provide tools and guidance for sectors to determine their processes, systems, facilities, technologies, networks, assets, and services. Public Safety Canada will also provide tools and guidance for departmental sector heads to assess the infrastructure’s criticality based on risks and its significance to the safety and security of Canadians, and will establish policies and programs to prepare plans for their protection.
Definitions:
Capability gap—The gap between available resources and the desired result, which in this case is a timely and effective response to an emergency. (Return)
First responders—The police officers, firefighters, and emergency medical service workers who are the first to respond to an emergency. (Return)
