DHS Rolls Out "Voluntary National Emergency Preparedness Accreditation Program" for Private Sector Entities

On July 30, 2008, the Department of Homeland Security (DHS) signed an agreement with the ANSI-ASQ National Accreditation Board (ANAB) in Milwaukee, Wisconsin, to establish and oversee the development and implementation of the accreditation and certification requirements for a new federal government program, currently titled the "Voluntary Private Sector Preparedness Accreditation and Certification Program." (1) The 9/11 Commission of 2007 recommended this program and the US Congress passed Public Law 110-53 (August 3, 2007) to implement this recommendation, among many others. (2)

A July 31, 2008, FEMA email about the new accreditation program reads, "The goal of this voluntary program is to enhance nationwide resilience in an all hazards environment by improving private sector preparedness. Participation in the program will be voluntary and intended to be driven by the marketplace." [Italics added. See response to this statement under III below.] The DHS has not yet defined the set of eligible private sector entities.

I.   FEMA Administrator Paulison Given Responsibility for Program

DHS Secretary Michael Chertoff, as required by P.L. 110-53, assigned responsibility for the new accreditation program to R. David Paulison, a firefighter by professional background and administrator of the Federal Emergency Management Agency (FEMA). Paulison will chair an internal "Private Sector Preparedness Council" comprised of department leadership from the Science & Technology Directorate (Undersecretary Jay Cohen), Private Sector Office (Assistant Secretary Al Martinez-Fonts), and the Office of Infrastructure Protection (Assistant Secretary Robert Stephan). The purpose of this council is to select program standards, define and promote the business case for private sector entities to work toward voluntary certification, oversee the program's progress, and provide regular updates to Congress, says a DHS press release. (1)

Paulison said, "The success of this voluntary program will only come from a true public-private partnership to ensure that every step in the process meets the needs of private sector organizations. By providing common criteria for business preparedness, we will help strengthen our nation's economic resilience for all hazards." (1)

Public Law 110-53 noted above defines the term "voluntary preparedness standards" as "a common set of criteria for preparedness, disaster management, emergency management, and business continuity programs, such as the American National Standards Institute's National Fire Protection Association Standard on Disaster/Emergency Management and Business Continuity Programs (ANSI/NFPA 1600)." (2) The NFPA 1600 (2007 edition) Standard on Disaster/Emergency Management and Business Continuity Programs is available at http://www.nfpa.org/assets/files/PDF/NFPA1600.pdf; accessed July 30, 2008.

II.    ANSI-ASQ Background

The ANSI-ASQ National Accreditation Board established January 1, 2005, is "an accreditation body for management systems." (2) ANAB accredits certification bodies for:

• ISO 9001 quality management systems (QMS)
• ISO 14001 environmental management systems (EMS)
• ISO 22000 food safety management systems (FSMS)
• ISO 28000 supply chain security management systems (SCSMS)
• ISO/IEC 20000-1 information technology service management systems (ITSMS)
• ISO/IEC 27001 information security management systems (ISMS)
• ANSI/AIHA Z10 occupational health and safety management systems (OHSMS)
• Numerous industry-specific requirements. (3)

"The ANSI-ASQ National Accreditation Board had its roots in the Registrar Accreditation Board (RAB), which was established in 1989 by the American Society for Quality (ASQ). RAB's original mission was to provide accreditation services for ISO 9000 certification bodies (CBs). When RAB was created, it immediately sought to strengthen the US system for certifying body accreditation by pursuing a formal relationship with the American National Standards Institute. In 1991, ANSI and RAB joined forces to establish the American National Accreditation Program for Registrars of Quality Systems. In 1996, with the release of the ISO 14000 standards, the ANSI-RAB NAP was formed, replacing the original joint program. In October 2007, the ANSI-ASQ National Accreditation Board acquired ACLASS Accreditation Services to expand its range of accreditation services beyond management systems. Testing and calibration laboratories, reference material producers, and inspection bodies are accredited under the ACLASS mark. The ANSI-ASQ National Accreditation Board is financially self-supported and governed by a board of directors representing stakeholders. Policy is established by a board of directors. The ANSI-ASQ National Accreditation Board exists to serve the conformity assessment needs of business and industry." (3)

A background slide presentation on ANAB is available (4). The organization's white paper on the value of accreditation (it makes good business sense!) is available. (5)

The ANAB organization illuminates its part in the DHS preparedness program in its July 31, 2008, as follows:

The U.S. Department of Homeland Security (DHS) has named the ANSI-ASQ National Accreditation Board (ANAB) to operate a new program to accredit and certify private sector entities for preparedness. The new program is authorized under the "Implementing Recommendations of the 9/11 Commission Act of 2007" (Public Law 110-53), which directs the Secretary of Homeland Security to establish a program to accredit and certify private sector entities regarding their implementation of voluntary consensus standards for preparedness.

The ANAB program will allow private sector organizations to demonstrate through formal certification and other means their compliance with voluntary preparedness and business continuity standards and requirements.

"This program recognizes the importance of up-front planning to ensure business continuity even when calamitous events occur," Connie Conboy, Chair of ANAB's Board, said. "It will facilitate the application of national and international standards in support of U.S. private sector homeland security preparedness requirements. The awarding of the contract to ANAB is consistent with our existing operations as an accreditation body for various management systems standards."

Public Law 110-53 provides for the development of a private sector led voluntary certification program for all-hazards business emergency preparedness that would serve as confirmation of business preparedness.

Under the contract, ANAB will be responsible for carrying out independent accreditations, overseeing the certification process, and monitoring the operations of any third party conducting certifications for disaster/emergency management and business continuity programs.

The ANAB program will assess whether a private sector entity conforms with [sic] voluntary preparedness standards. The program will include separate classifications and methods of certification for small business concerns. The program will not involve issuance of any individual professional certifications. ANAB will accredit certifiers to certify private sector organizations against appropriate standards to be determined. A publicly available list of accredited certification organizations will be maintained by ANAB. The contract is effective for one base year with two additional option years. The ANSI-ASQ National Accreditation Board (ANAB) is the U.S. accreditation body for management systems. ANAB accredits certification bodies (CBs) for ISO 9001 quality management systems (QMS), ISO 14001 environmental management systems (EMS), ISO 27001 information security management systems, ISO 22000 food safety management systems, ANSI/AIHA Z10 occupational health and safety management

systems, and numerous industry-specific requirements.

III. Further DHS Perspective on New Accreditation Program

A second press report published by the Department of Homeland Security on July 30, 2008, provides more detail on the new accreditation program.

The goal of this voluntary program is to enhance nationwide resilience in an all hazards environment by improving private sector preparedness. Participation in the program will be voluntary and intended to be driven by the marketplace.

[Public Law 110-53] was signed into law on August 3, 2007. Title IX of this Act amends elements of the Homeland Security Act of 2002 to include development of a voluntary private sector preparedness accreditation and certification program. At present, there is no comprehensive set of standards by which American businesses and other private sector entities can assess their preparedness for all hazards, and yet these organizations are more at risk than ever of catastrophic losses due to natural or other disasters.

Establishment of the Voluntary Private Sector Preparedness Accreditation and Certification Program
The Department of Homeland Security (DHS) was charged with a number of core tasks to establish the voluntary accreditation and certification program, which include:

• The Secretary of Homeland Security was directed to designate an officer within the department responsible for the voluntary program;
• Designate one or more organizations to act as an accrediting body;
• Designate one or more standards for assessing private sector preparedness;
• Provide information and promote the business case for voluntary compliance with preparedness standards;
• Monitor the effectiveness of the program on an ongoing basis; and
• Submit report to Congress on the program.

Program Management Structure

Homeland Security Secretary Michael Chertoff designated FEMA Administrator R. David Paulison in August 2007 as the designated officer. In this role, Administrator Paulison will chair the Private Sector Preparedness Council comprised of Department leadership from the Science & Technology Directorate, Office of Infrastructure Protection, and Private Sector Office who will advise on the development of the program. Members of the council include:

• Jay Cohen, Under Secretary, Science and Technology Directorate
• Robert Stephan, Assistant Secretary for Infrastructure Protection
• Al Martinez-Fonts, Assistant Secretary for Private Sector

Establishment of an Accrediting Body
The second requirement of the legislation directed DHS to designate a third-party organization to act as an accrediting body for the voluntary program.

DHS has signed an agreement with the ANSI-ASQ National Accreditation Board (ANAB) to develop and oversee the certification process, manage the accreditation, and accredit qualified third parties to carry out the certification in accordance with the accepted procedures of the program.

ANAB, headquartered in Milwaukee, Wis., is an internationally recognized organization that serves the conformity assessment needs of business and industry. ANAB is a certified International Accreditation Forum member and is the only accreditation organization for process/management system certifiers based in the United States.

Designation of Preparedness Standards
The third requirement of the legislation is to designate one or more standards for assessing private sector preparedness. In developing and implementing the program, DHS will consider preparedness standards, business continuity standards, and best practices established under other provisions of Federal law, regulations, and as established by sector-specific agencies. DHS will coordinate with other preparedness and business continuity programs in other Federal agencies.

Private sector entities may choose a selected standard and become certified based on their compliance to that standard. The standards designated are used by the certification body to assess private sector preparedness compliance.

Through consultation with a broad range of private sector stakeholders and public comment through a coming Federal Register Notice, DHS will obtain input on:

• The scope of the Program;
• The desired content of the voluntary "preparedness" standards to be designated;
• Existing standards that should be evaluated and selected in this process;
• Target criteria that should be the foundation for evaluation of comprehensive voluntary preparedness standards to be developed in the future; and
• Views concerning standards and approaches for small businesses.

After the receipt, review, and adjudication of public comments, DHS will select target criteria to evaluate preparedness standards for use in the Program. DHS will coordinate with standards development organizations (SDOs) in the update of their current preparedness standards and the development of new standards.

DHS will work with private sector stakeholders and the critical infrastructure and key resources (CIKR) sectors to determine what sector-specific additions, guidance, or other expansion of the selected standards or target criteria are appropriate and desirable. This program and the standards to be selected are not expected or intended to address issues such as business strategy, competition, and financial practices or processes.

Business Case DHS will provide information and promote the business case for voluntary compliance with preparedness standards. According to the Institute for Business and Home Safety, an estimated 25 percent of businesses do not reopen following a major disaster. Having a plan to reduce the impact of disaster on business and protect employees can help ensure that a business impacted by disaster is able to recover and reopen.

Program Monitoring
DHS will monitor the effectiveness of the program on an ongoing basis. DHS will review the accreditation and certification program annually to ensure its effectiveness, to include the operations and management of any of the accreditation and certification bodies and the standards designated. The annual review will also provide recommendations for improvements and adjustments to the program as necessary and appropriate.

Understanding the Certification Process
Certification, in the context of this program, is confirmation that a third-party certification organization has validated a private sector entity's emergency preparedness and business continuity management system with an accepted standard(s). The process generally consists of an assessment of the documented plan's conformity with the standard(s) and an evaluation of the effectiveness of the system's implementation. Once an organization is certified, there is a periodic reassessment and audit process so the certification organization can continue to have confidence in the organization's emergency preparedness and business continuity management system's conformity. These certifications will be conducted by certification organizations that are accredited by ANAB for this program.

Private sector organizations, including businesses and critical infrastructure and key resources (CIKR) entities, may apply for certification to the applicable requirements of preparedness standard(s) selected for use in the Program. Certification will be performed by third-party certification organizations accredited by ANAB.

DHS will maintain and make public a listing of any private sector entity certified as being in compliance with the program, if that private sector entity consents to such a listing.[Italics added.]

Small Business Considerations
The act also requires that small business concerns be taken into consideration, including any need for separate guidance, recommendations, or best practices, as necessary and appropriate.

DHS, in coordination with the Ready Campaign (www.ready.gov) is considering the option of developing a self-assessment preparedness tool.  [Italics added.] Compliance for small business may be in the form of a formal self-declaration of conformity. (6)

IV.  Analysis of New DHS Accreditation Program by Dennis S. O'Leary, M.D., President Emeritus, Joint Commission

"To be honest, I didn't even realize that a Voluntary Private Sector Preparedness accreditation provision was part of the 9/11 Commission recommendations. I'm all for accreditation (of course), but voluntary accreditation is of course voluntary, and entities in any area of endeavor are unlikely to seek accreditation unless it gets them something significant (like money) or failure to get it penalizes them in some fashion. There is no evidence that market forces drive decisions to seek accreditation, especially where there is no critical mass of accredited entities. Even then, market forces are of dubious impact in leveraging decisions to seek accreditation. In sum, I don't see these announcements creating many waves unless they are tied to significant rewards or punishments of which we are not aware. [Italics added.] Of course, this is just my opinion." DSO

Notes:

1.  US Department of Homeland Security: "DHS Selects ANSI-ASQ National Accreditation Board To Support Voluntary Private Sector Preparedness Certification Program." July 30, 2008, DHS Release Number: FNF-08-068. Available at http://www.fema.gov/news/newsrelease.fema?id=45288; accessed July 30, 2008.

2.  Public Law 110-53, August 3, 2007: "Implementing Recommendations of the 9/11 Commission Act of 2007." Scroll down to Section 524: "Voluntary Private Sector Preparedness Accreditation and Certification Program. Available at http://www.ise.gov/docs/nsis/Implementing911_Act.pdf; accessed July 30, 2008.

3.  ANAB's website is at http://www.anab.org/; accessed July 30, 2008.

4.  Slide show on ANAB is available at http://www.anab.org/HTMLFiles/docs/ANABpresentation.pdf; accessed July 30, 2008.

5.  ANAB's white paper on the value of accreditation is available at http://www.anab.org/HTMLFiles/docs/Value.pdf; accessed July 31, 2008.

6.  FEMA: "Voluntary private sector preparedness accreditation and certification program." July 30, 2008, Release Number FNF-08-069. Available at http://www.fema.gov/news/newsrelease.fema?id=45287; accessed July 31, 2008.