Final Letter Report on the Audit of the Brooklyn Public Library’s Emergency Preparedness
By Electronic Mail
Linda E. Johnson
President & CEO
Brooklyn Public Library
10 Grand Army Plaza
Brooklyn, NY 11238
Re: Final Letter Report on the Audit of the Brooklyn Public Library’s Emergency Preparedness, SR24-082A
Dear Ms. Johnson:
This Final Audit Letter Report concerns the New York City Comptroller’s audit of the Brooklyn Public Library’s Emergency Preparedness.
Background
The Brooklyn Public Library (BPL) is a private non-profit organization with 60 branch locations throughout Brooklyn, serving a borough with a population of 2.7 million residents. The BPL’s mission is to preserve and share society’s knowledge, history, and culture, while offering the people of Brooklyn free and open access to information for education, recreation, and reference. According to their website, the BPL served nearly 5.9 million visitors in Fiscal Year 2024.
The Robert T. Stafford Disaster Relief and Emergency Assistance Act (the Stafford Act) is a federal law that allows libraries to receive disaster assistance if they provide critical services in the event of a major disaster. Both the Stafford Act and the American Library Association recognize the important role that libraries play in responding to disasters—in particular, their role in providing information to the public.
Given its established role in the community and borough-wide locations, the BPL is positioned to provide the public with information and to serve as an access point for services during emergencies. For example, during the COVID-19 pandemic, the BPL expanded its digital materials collection, offered virtual programming and resources, and provided grab-and-go services. In addition, some BPL branches served as Learning Bridges sites—free, safe, and supported locations where students could connect to remote school classrooms and engage in other group activities. BPL branches also served as vaccination and testing sites and distributed free at-home test kits.
The objective of this audit was to determine whether the BPL is adequately prepared both in planning for and responding to emergencies, to ensure continuity of its operations and to serve the public during major disasters and other events.
Findings
The audit found that BPL served the public in numerous ways during emergencies but needs to improve certain aspects of its emergency preparedness to ensure the continuity of operations.
Serving the Public
During the audit period, BPL assisted during extreme heat and cold weather events. When the National Weather Service issues a heat advisory with a forecasted heat index of 95 degrees or higher for two or more days, or 100 degrees for any period, New York City opens cooling centers located in air-conditioned facilities. These locations are free and open to the public, such as libraries. BPL branch locations served as cooling centers during their regular business hours.
From June through August 2024, heat emergencies were declared on 14 days. While the vast majority of branches that were open for business served as cooling centers on those days, the auditors found that four branches listed as cooling centers were closed on July 16, 2024: two due to extreme heat in the building and two for maintenance or repairs.[1]
BPL branches also served as a warm place for people to go on extremely cold days. The audit team visited seven branches on days when the outside temperature was below freezing and tested the inside temperature at various locations within each branch. Each of the branches provided adequate heat with temperatures ranging from 70.8 to 78 degrees.
In addition, BPL branch sites have free Wi-Fi at all locations. BPL uses mesh Wi-Fi at the Central Library (BPL’s main branch, located on Grand Army Plaza) and branches with multiple floors, which supports communications in hard-to-reach areas and can be used in emergency response communications. For the same seven above-mentioned branches, the audit team tested Wi-Fi connectivity and found it to be working.
BPL officials stated that library branches have been used as staging areas or command posts during emergency situations and may serve as temporary shelters for displaced individuals. Furthermore, officials stated that BPL provided resources to support asylum seekers and refugees on its own and in partnership with City agencies and private entities. This included working to expand walk-in beginner-level English for Speakers of Other Languages programs, increasing the translation of library materials, and offering workforce assistance. BPL officials also stated that BPL hosts resource fairs and community events, trains staff to better meet the needs of asylum seekers and refugee patrons, and strengthens partnerships with agencies and organizations that serve these populations.
Resiliency and Flood Protection and Mitigation Measures
BPL implemented measures to strengthen its resiliency and to support continuity of operations during emergency events. The Central Library is equipped with a generator to ensure that critical systems including elevators, fire alarms, access control, and heating, ventilation, and air conditioning (HVAC) remain operational during power outages. In addition, four BPL branches located in flood-prone areas are equipped with solar panels and battery backup systems. In a serious weather event, the backup systems will power lighting and allow those libraries to serve as an emergency hub where people can charge electronic devices or tools and access emergency services available in the library buildings.
BPL implemented flood protection and mitigation measures at three of the six branches located in the 100- and 500-year floodplains. As part of comprehensive renovations for Red Hook, the library will be dry floodproofed and mechanical and electrical systems will be installed on the roof. The building will have flood-resistant walls and windows and moveable floodproof barriers which can be placed at doors. In addition, the site will incorporate permeable landscaping and a bioswale to manage stormwater. BPL also reported that Ulmer Park electrical panels were elevated in the basement and that the first floor of Adams Street was raised above street.
BPL did not implement any flood protection and mitigation measures for the other three branches located in the floodplain—Brighton Beach, Gerritsen Beach, and Sheepshead Bay. BPL officials stated that these branches are not currently affected by flooding. Given their location within the floodplain and the significant impact of Hurricane Sandy on these locations, BPL should implement flood protections.
BPL officials also stated that flood protection and mitigation measures were implemented at three other branches which are not within the floodplain but are impacted by localized flooding. BPL officials reported that BPL installed flood barriers at Rugby and the Center for Brooklyn History and elevated IT infrastructure at McKinley.
Emergency Preparedness
At the BPL’s request, the Cybersecurity and Infrastructure Security Agency (CISA)—a component of the U.S. Department of Homeland Security—conducted an Infrastructure Survey Tool (IST) assessment for BPL’s Central Library to identify and document critical infrastructure, security measures in place, and resilience factors. The tool was used to evaluate security and resilience posture, identify hazards and vulnerabilities, provide options to improve security and resilience planning, and facilitate information sharing.[2]
On June 1, 2023, CISA issued a report that identified numerous vulnerabilities and opportunities to improve physical security, operational security, and resilience at BPL’s Central Library. Those vulnerabilities included inadequate communication and coordination with law enforcement and security plans, a failure to test plans and train all Central staff on plans, and weaknesses in electronic security systems.
Based on the audit team’s review, BPL took actions to address vulnerabilities related to communication and coordination. BPL participates in the NYPD Shield program, which keeps private sector partners informed of situations in the City and receives borough-specific alerts from New York City Emergency Management (NYCEM). BPL officials stated that the library system implemented a new radio communication system, which allows them to receive NYCEM alerts and communicate with City agencies and other entities in real time. Alerts are then relayed to branches as needed.
In addition, BPL has a Cybersecurity Plan, which prioritizes systems and data for protection, lists the tools and methods used to protect them, and outlines how BPL responds to an information security incident or cyber-attack. BPL’s system and data priorities include its networks, infrastructure, website, email, materials catalog, fundraising tool, Enterprise Resource Planning tool, and staff files. In its Cybersecurity Plan, BPL stated that maintaining the plan requires regular drills to test for weaknesses and continual updates based on new threats and changes to networks, devices, and staff. BPL provided documentation to show that it conducted two incident analyses to evaluate how BPL can enhance its response to future events.
BPL officials also reported that they are evaluating enhancements to BPL’s security systems and identifying funding. However, BPL did not address other cited vulnerabilities. Further details follow below.
BPL Lacks a Comprehensive Emergency Plan
BPL has numerous public safety and emergency preparedness and response policies and procedures for both the Central Office and branch locations that address a range of emergency situations, including fire safety and evacuation plans, active shooter protocols, and emergency closures. However, it lacks a comprehensive emergency plan that provides incident stabilization and assigns responsibilities for carrying out specific actions to protect people, property, operations, and the environment in an emergency.
BPL officials stated that BPL requested the IST assessment to proactively identify gaps and vulnerabilities, enhance preparedness, and guide the development of more comprehensive emergency plans. BPL officials provided the audit team a draft version of the Public Safety Response Guide which represents BPL’s initial effort to streamline emergency response policies and clarify related responsibilities and stated that BPL expects to finalize a comprehensive emergency plan in the first quarter of Fiscal Year 2026.
BPL Did Not Annually Review, Update, and Test Business Continuity Plan
BPL did not conduct tabletop exercises or review and update its Business Continuity Plan annually, as required. This is a general emergency preparedness plan that outlines how BPL will continue to function during or after an emergency, disaster, or event, focusing on the restoration of key services and systems. The BPL Crisis Management Team is responsible for testing, reviewing, and updating the Business Continuity Plan annually. However, BPL did not conduct tabletop exercises to test the plan each year. The BPL conducted tabletop exercises in August 2021 and January 2025, but did not test the plan in 2022, 2023, or 2024. Further, BPL has not reviewed and updated the plan since August 2021.
BPL officials stated that they review the Business Continuity Plan regularly but have not made any edits since 2021. Going forward, BPL officials stated that they will adjust the date of the document each time it is reviewed even if there are no changes.
Biannual Fire Drills Were Not Conducted for Some BPL Branches
The BPL Fire Safety and Evacuation Plan states that fire drills must be conducted at least twice a year. Following each drill, a debriefing must be held to discuss any problematic areas and potential improvements. After drills are conducted, Branch Managers must submit Fire Drill Reports to the Central Office. However, based on a review of BPL Fire Drill Reports and security logs for Calendar Years 2023 and 2024, some branches did not conduct biannual drills as required. For CY2023, seven (13.5%) of the 52 branches did not conduct biannual drills, six branches conducted only one drill, and one branch did not conduct any drills.[3] For CY2024, performance improved; four (7.7%) of the 52 branches did not conduct biannual drills. Each of those branches conducted only one fire drill in CY2024.
Inadequate Training and Communication
The audit team surveyed BPL branch locations to determine whether the Central Office communicated existing policies and procedures to Branch Managers, provided training to staff, and ensured that key policies were implemented at the branch level. Of the 60 branches that are currently open, 25 (41.7%) did not respond to the survey. Of the 35 branches that did respond to the survey, six branches reported that they did not receive active shooter training, and 16 branches reported that they did not receive any other safety or emergency preparedness training.
In addition, 13 of the 35 branches that responded to the survey stated that the Central Office did not inform them of emergency alerts in their area. During the discussion of findings meeting, BPL officials stated that branches are notified only of emergencies in their area that are expected to have a direct impact on their operations. If an emergency occurs in the general vicinity of a branch but it is not anticipated to affect branch services or safety, an alert will not be sent.
Recommendations
To address the findings, the auditors recommend that BPL should:
- Ensure facility assessments are conducted at all branches ahead of summer cooling and winter heating seasons to ensure HVAC systems are properly maintained and functioning.
BPL’s Response: BPL agreed with this recommendation, stating “it is consistent with our current practice. Facility assessments are conducted at all branches prior to switchover to heating for the winter and cooling for the summer. This is done in sufficient time to conduct maintenance and repairs, as necessary.”
- Consider installing generators or other backup power systems at additional BPL branches to ensure continuity of operations and enable libraries to serve the public during emergencies. [4]
BPL’s Response: BPL agreed with this recommendation, stating that it considers emergency power improvements on a case-by-case basis, depending on the building’s infrastructure, usage demands and community needs.
- Consider installing flood protection and mitigation measures at Brighton Beach, Gerritsen Beach, and Sheepshead Bay due to their floodplain location and past storm impacts.
BPL’s Response: BPL agreed with this recommendation but stated that extensive flood protection and mitigation measures would require design studies and significant capital investments. Currently, BPL uses temporary measures such as barriers at these branches, if needed.
- Create a comprehensive public safety and emergency plan that assigns responsibilities for carrying out specific actions to protect people, property, operations, and the environment in an emergency and provides incident stabilization.
BPL’s Response: BPL agreed with this recommendation and stated that it is in the process of consolidating its emergency management and business continuity plans into a single comprehensive document, which is expected to be published in the first quarter of FY2026.
- Train all staff on the comprehensive public safety and emergency plan and Business Continuity Plan, test and evaluate plans at least once per year, and update them as necessary.
BPL’s Response: BPL agreed with this recommendation.
- Ensure that biannual drills are conducted for all BPL locations.
BPL’s Response: BPL agreed with this recommendation.
- Implement a centralized notification system or platform to quickly relay information to all branch managers and staff, including local emergency updates and BPL instructions related to public health, weather conditions, or security situations.
BPL’s Response: BPL agreed with this recommendation, stating that it has several methods for reaching staff including a mass text notification system, call-in number with a recorded message, mobile radios, email, phone, intranet, external webpage, and social media.
Recommendations Follow-up
Follow-up will be conducted periodically to determine the implementation status of each recommendation contained in this report. Agency reported status updates are included in the Audit Recommendations Tracker available here:
https://comptroller.nyc.gov/services/for-the-public/audit/audit-recommendations-tracker/
Scope and Methodology
We conducted this performance audit in accordance with Generally Accepted Government Auditing Standards (GAGAS). GAGAS requires that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions within the context of our audit objectives. This audit was conducted in accordance with the audit responsibilities of the City Comptroller as set forth in Chapter 5, §93, of the New York City Charter.
As required under New York State law, the Comptroller sits on the BPL’s Board of Trustees through a representative and is one of the Board’s four ex-officio members. In conjunction with the appointed trustees, these ex-officio members comprise the Board of the BPL. Neither the Comptroller nor his representative on the Board were involved in the audit process.
The scope period of this audit was Calendar Year 2023 until May 27, 2025. The methodology for this audit consisted of the following steps; specifically, the auditors:
- Conducted an interview with BPL’s Executive Vice President for Finance and Administration, and the Vice President of Public Safety to gain an understanding of how the BPL prepares for emergencies at the branch and centralized level, how the BPL develops emergency plans, and how information is shared with the branches, as well as how the BPL assists the City in wider scale emergency situations
- Obtained BPL policies and procedures related to emergency preparedness, with regards to planning for and responding to emergencies, ensuring the continuity of operations, and serving the public during major disasters and other events.
- Developed a checklist of potential emergencies the BPL may need to plan for at both the Central Library and branch locations. In addition, we reviewed existing BPL policies and procedures to assess whether they adequately address the identified areas of concern.
- Documented BPL branch sites that were used as cooling centers during heat emergencies, and checked against the BPL website to ensure locations that were closed according to the BPL website were not included on the list of open cooling centers
- Reviewed CY2023 and CY2024 Fire Drill Reports and security logs to determine whether BPL branches conducted fire drills as required
- Visited sampled BPL branch sites during cold weather to determine whether the sites had adequate heat. We also tested the Wi-Fi connections at these sampled sites
- Developed and sent a survey to BPL branches to solicit feedback concerning policies at the branch
- Summarized results of the branch survey and shared with BPL Central
The results of the above tests provide a reasonable basis for the audit team to determine whether BPL is adequately prepared to plan for and respond to emergencies, to ensure continuity of its operations, and to serve the public during major disasters and other events.
Preliminary results of this audit were discussed with BPL officials on May 27, 2025. BPL agreed to waive the need for an Exit Conference Summary and an Exit Conference. On June 6, 2025, a Draft Audit Letter Report was submitted to BPL with a request for written comments. Our office received a written response from BPL dated June 13, 2025. In its response, BPL agreed with each of the audit’s seven recommendations. The full response is attached to this report as an addendum.
Sincerely,
Maura Hayes-Chaffe
c: Karen Sheehan, Executive Vice President, Finance & Administration, CFO
Garry Resnick, Vice President, Public Safety and Support Services
Jean-Claude Lebec, Director, Mayor’s Office of Risk Management and Compliance
Douglas Giuliano, Deputy Director, Audit Management, Mayor’s Office of Risk Management and Compliance
Footnotes
[1] From June through August 2024, 10 (16.7%) branches were closed for renovations and therefore were not available to serve as cooling centers.
[2] The IST is a risk-based assessment aligned with the 2013 National Infrastructure Protection Plan, supporting efforts to identify threats, reduce vulnerabilities, and mitigate consequences to critical infrastructure.
[3] During Calendar Year 2023, 52 BPL locations were open for the full year and eight locations were closed for all or part of the year for renovations.
[4] The draft version of this report recommended that BPL implement back-up power systems at all BPL branches. After the draft report was issued, BPL officials raised concerns regarding the financial feasibility of implementing back-up power systems at all BPL branches. In response to BPL’s feedback, the final report was modified to recommend that BPL consider implementing back-up power systems at additional BPL branches. On June 9, 2025, the audit team advised BPL officials that this recommendation would be modified in the final audit report.
Addendum