prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: International financial transactions, including the transfer of U S  humanitarian assistance funds, rely on a system of correspondent banking relationships  State and USAID provide humanitarian assistance through funding awards to partners  Funds to U S  partners are deposited into the partners’ bank accounts located in the United States  The partners are then responsible for transferring the funds to recipient countries for project implementation  These transfers typically involve the use of a correspondent, or intermediary, bank to transfer the funds from a U S -based account to an account held at the recipient country, where the funds are then used by in-country staff to implement the project  See appendix IV for more information on the State and USAID offices providing humanitarian assistance  According to research by the Bank for International Settlements, the number of correspondent banking relationships has declined over the past several years, especially for banks that are located in higher-risk jurisdictions (such as those subject to sanctions), have customers perceived as higher-risk, and who generate revenues insufficient to recover compliance costs  Further, the Financial Stability Board noted that a decline in the number of correspondent banking relationships could affect the ability to send and receive international payments and may drive some payment flows underground, with potential consequences on growth, financial inclusion, and the stability and integrity of the financial system  When performing overseas money transfers, U S  banks and financial institutions must comply with the Bank Secrecy Act’s (BSA) anti-money laundering (AML) regulations and relevant regulations that implement U S  sanctions  The BSA has established reporting, recordkeeping, and other AML requirements for financial institutions  BSA/AML regulations require that each bank tailor a compliance program that is specific to its own risks based on factors such as products and services offered, and customers and locations served  By complying with BSA/AML requirements, U S  financial institutions assist government agencies in the detection and prevention of money laundering and terrorist financing by, among other things, maintaining compliance policies, conducting ongoing monitoring of customers and transactions, and reporting suspicious financial activity  In addition to BSA regulations established by Treasury, federal banking regulators have issued their own BSA regulations  These regulations require banks to establish and maintain a BSA compliance program that, among other things, identifies and reports suspicious activity  The banking regulators are also required to review banks’ compliance with BSA/AML requirements and regulations, and they generally do so every 12 to 18 months as a part of their routine safety and soundness examinations  Among other things, examiners review whether banks have an adequate system of internal controls to ensure ongoing compliance with BSA/AML regulations  The federal banking regulators may take enforcement actions using their prudential authorities for violations of BSA/AML requirements  They may also assess civil money penalties against financial institutions and individuals  Banks must also comply with relevant regulations that implement U S  sanctions in certain countries  When the United States imposes sanctions on an entity or individual, it freezes assets subject to U S  jurisdiction  All U S  transactions with the entity or individual are prohibited, including transactions by banks and NPOs  When appropriate, Treasury’s Office of Foreign Assets Control (OFAC) may issue a general license authorizing the performance of certain categories of transactions, including funds transfers for the provision of humanitarian assistance  OFAC also issues specific licenses on a case-by-case basis under certain limited situations and conditions  Treasury, as a lead agency in fighting financial crimes and as an issuer of regulations that have a significant effect on charities’ access to the banking system, takes actions to help prevent financial crimes, and considers NPOs operating in conflict areas and other high risk zones as potentially vulnerable to such crimes  Treasury leads U S  efforts to fight various financial crimes primarily through its Office of Terrorism and Financial Intelligence (TFI)  TFI develops and implements U S  government strategies to combat terrorist financing domestically and internationally, and develops and implements the National Money Laundering Strategy as well as other policies and programs to fight financial crimes  Relevant offices under TFI include: The Office of Terrorist Financing and Financial Crimes (TFFC)  TFFC, the policy development and outreach office for TFI, works across all elements of the national security community – including the law enforcement, regulatory, policy, diplomatic, and intelligence communities – and with the private sector and foreign governments to identify and address the threats presented by all forms of illicit finance to the international financial system  The Office of Foreign Assets Control (OFAC)  OFAC administers and enforces economic and financial sanctions based on U S  foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, transnational criminal organizations, human rights abusers and corrupt actors, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy, or economy of the United States  The Financial Crimes Enforcement Network (FinCEN)  FinCEN, among other duties, is responsible for administering the BSA, has authority for enforcing compliance with its requirements and implementing regulations, and also has the authority to enforce the BSA, including through civil money penalties  FinCEN issues regulations under the BSA and relies on the examination functions performed by other federal regulators, including federal banking regulators  FinCEN also collects, analyzes, and maintains the reports and information filed by financial institutions under BSA and makes those reports available to law enforcement and regulators  According to Treasury, organizations, including NPOs, implementing humanitarian assistance in high-risk areas may be vulnerable to exploitation by terrorist groups and their support networks  These terrorist groups and support networks may establish or abuse charities to raise and move funds, or provide other forms of support, that benefit the terrorist groups  As of May 2017, Treasury, through OFAC, had designated 67 charities, branches, and foreign terrorist organizations’ potential fundraising front organizations for violations of U S  sanctions  For 7 of our 18 selected projects, State and USAID partners told us that they had experienced banking access challenges  Additionally, 15 of the 18 partners we interviewed noted that they had experienced banking access challenges on their global portfolio of humanitarian assistance projects over the previous 5 years  Most of the 18 partners we interviewed told us that they were able to mitigate these challenges through various actions or the challenges were not significant enough to affect project implementation  Nevertheless, a few partners noted that projects they were implementing were adversely affected by such challenges  For example, 1 of our 18 selected projects faced repeated delays as a result of banking access challenges  Additionally, 2 partners noted that they had to reduce the scope of implementation or suspend projects in their global humanitarian assistance portfolio because of banking access challenges  Furthermore, several partners and other NPOs told us that such challenges posed potential risks to project implementation  Lastly, a recent study found that more than two-thirds of all U S -based NPOs that work internationally experienced banking access challenges, but that few NPOs canceled programs as a result of those challenges  For our 18 selected U S -funded projects, 7 of the partners told us that they had experienced banking access challenges in implementing their projects, with the majority citing delays or denials of funds transfers  Specifically, 3 (of 5) partners in Somalia and 4 (of 7) partners in Syria told us that they had experienced banking access challenges related to the selected project  None of the partners implementing selected sample projects in Haiti or Kenya noted that they had experienced any banking access challenges  Denials of funds transfers to the destination country was the most frequently cited banking access challenge (experienced by 5 of the 7 projects), followed by delays of funds transfers (experienced by 3 of the 7 projects) (see fig  2)  Fifteen of the 18 partners that we interviewed noted that they had experienced banking access challenges on their global portfolio of humanitarian assistance projects implemented over the previous 5 years (see fig  3)  The most frequently cited challenges were funds transfer delays and denials  Twelve partners noted that they had experienced transfer delays, with 8 noting that the delays occurred occasionally and 6 noting that the delays lasted weeks or months  Most partners that noted experiencing delays told us that the delays were caused exclusively by intermediary banks  Eleven partners noted that they had experienced transfer denials, including 5 that told us the denials occurred occasionally  Five partners also noted that transfers were denied by intermediary banks  In addition, 2 partners noted that they had experienced challenges opening new bank accounts; 3, increased costs to transfer funds; 1, a bank-initiated account closure; and 2, other challenges  For more information on the types of banking access challenges that partners identified, including details on the duration of delays and the frequency of denials, see appendix V  Some partners that experienced banking access challenges told us that those challenges had adversely affected or posed a potential risk to implementation of projects  Of those partners experiencing challenges, 3 partners noted that banking access challenges had adversely affected a project’s implementation  Specifically, 1 partner that experienced challenges on one of our selected projects and 2 partners that experienced challenges on projects outside of our sample noted that the challenges they had experienced resulted in a project being adversely affected in some form, such as: Reduced scope of implementation  One partner told us that its project in the Democratic People’s Republic of Korea was scaled back significantly because of difficulty transferring funds to the country  Delays implementing a project  One partner told us that for one of our selected projects, in part because of banking access challenges, implementation of the project was delayed and required approval for two no-cost extensions from USAID  The partner noted that it had experienced recurring issues with funds transfers to Syria, including 3- to 6-week delays and frequent denials of transfers  Suspension of an in-progress project  One partner told us that an ongoing project it implemented in Syria (outside of our sample of projects) to deliver food assistance had been suspended for about a week because its funds transfers to the country were denied  While some projects were adversely affected, 6 of the 7 partners of our selected projects that noted experiencing banking access challenges told us that the challenges they had experienced did not adversely affect project implementation  Similarly, 12 of the 15 partners that noted experiencing banking access challenges on their global portfolio of humanitarian assistance told us that the challenges did not affect project implementation  Additionally, for both our selected projects and their global portfolio of humanitarian assistance projects, the challenges experienced were either not significant enough to affect project implementation, or were mitigated through various actions  For example, partners told us that they had mitigated challenges by: Maintaining a funding buffer  Partners may keep enough funding to operate a project for several weeks in order to mitigate delays and denials of funds transfers  For example, one partner noted that projects maintain approximately 4 weeks of operating funds on hand, which is enough to mitigate transfer delays that last up to 3 weeks  Using alternate methods to move funds  Partners may use alternate methods to move funds, such as using different intermediary banks or money transmitters, or by carrying cash  For example, one partner told us that when its U S  bank stopped allowing funds transfers to Syria, the partner opened an account with a different bank  That partner also told us that because it was unable to reliably transfer funds to Syria, it regularly transfers funds to Lebanon—either to intermediaries or to the personal accounts of individuals involved in the projects—and manually moves the physical currency to Syria  Maintaining multiple bank accounts  Partners may maintain accounts with multiple banks in order to mitigate the risk of a bank-initiated account closure  For example, one partner told us that after a bank closed all of its accounts without warning or explanation, the partner opened accounts across three different banks in order to mitigate the effects of any individual bank closing its account  While most partners’ projects did not experience adverse effects as a result of banking access challenges, three USAID partners—as well as another NPO that we spoke with—told us that banking access challenges posed a potential risk to project implementation, such as: Potential for physical violence  One partner told us that, for one of our selected projects, there were concerns of violence if payments were halted because of funds transfer delays, while another partner told us that violence was a concern if it was unable to pay vendors on time  An NPO also told us that there was a potential for physical violence if local staff were not paid on time  Potential for insolvency of vendors  One partner told us that, for one of our selected projects, transfer delays prevented it from reimbursing a money transmitter it used to move funds to Somalia, which in turn caused that money transmitter to experience financial difficulties  The partner stated that the delays were almost significant enough to affect operations, though it was able to resolve the situation in time to prevent its vendor from becoming insolvent  Potential for project suspension  One partner told us that it provides advance funding for projects to account for delays, but at times transfer delays have come close to exhausting the advance funding  For example, the partner told us that it provided funding for projects 4 weeks in advance and experienced transfer delays averaging 3 weeks  In addition, an NPO told us that staff are sometimes not paid for several months because of such delays; thus, if transfer delays worsened or staff were unwilling to work without being paid, project implementation may be adversely affected  A recent study by Charity and Security Network on banking access for U S  NPOs, which included NPOs that received U S  government funds, found widespread banking challenges for U S -based NPOs  Data for a survey conducted as part of this study indicated that about two-thirds of the responding U S -based NPOs that work internationally experienced banking access challenges  The challenges included delays of wire transfers, unusual requests for documentation, and increased fees  Some NPOs also cited experiencing account closures and refusals to open accounts  About 15 percent of the NPOs that responded to the survey noted that they experienced these banking access challenges constantly or regularly, and about 3 percent of NPOs reported cancelling a project because of banking access challenges  Furthermore, transfers to all parts of the globe were affected, and the challenges were not limited to conflict zones  According to the report, NPOs with 500 or fewer staff were more likely to experience delayed wire transfers, fee increases, and account closures  Smaller organizations were more likely to receive unusual requests for documentation, according to the report  The smallest NPOs, those with 10 or fewer employees, reported experiencing more trouble opening accounts than larger organizations  According to the report, as a result of the challenges they experienced, NPOs were sometimes forced to move money through less transparent, less traceable, and less safe channels, such as carrying cash  As shown in table 1, survey data from the Charity and Security Network study indicated that there were only minor differences between NPOs receiving and not receiving U S  government funding in terms of experiencing banking access challenges  For example, about 15 percent of responding NPOs, regardless of whether or not they received U S  funds, noted experiencing banking access challenges regularly or constantly, with transfer delays the challenge most frequently cited by both groups  Additionally, about the same proportion of NPOs that received or did not receive U S  funds reported that they rarely or never experienced banking access challenges  Both groups of NPOs also noted taking similar measures to deal with banking access challenges  USAID’s partners’ written reports do not capture potential risks posed by banking access challenges because USAID generally does not require most partners to report in writing any challenges that do not affect implementation  Six of the 7 projects that noted experiencing banking access challenges were USAID projects  None of those 6 USAID partners reported on the banking access challenges they had experienced to USAID in their regular project reporting  USAID requires partners to report adverse effects to their projects, but 1 partner that faced delays on its project as a result of banking access challenges did not identify these challenges as the reason for delays in its reporting to USAID  We also reviewed over 1,300 USAID partner reports for fiscal years 2016 and 2017 from high-risk countries and found no explicit discussion of banking access challenges  USAID generally requires partners implementing humanitarian assistance projects to report challenges that affect project implementation  USAID, through the Office of U S  Foreign Disaster Assistance (OFDA) and the Office of Food For Peace (FFP), provides humanitarian assistance and monitors the implementation of projects through various methods, including periodic performance reports  USAID’s reporting requirements, as well as the number of partners of selected projects that told us they had experienced banking access challenges, are as follows: USAID/OFDA  USAID/OFDA agreements for the selected projects we reviewed require the awardee to report via email (1) developments that have a significant effect on the activities supported by the agreement, and (2) problems, delays, or adverse conditions that materially impair the ability to meet the objectives of this agreement  The agreements also require Program Performance Reports that must address reasons why established goals were not met, the impact on the program objectives, and how the impact has been or will be addressed  Four of the 6 USAID partners that told us they had experienced banking access challenges were implementing USAID/OFDA projects  USAID/FFP  USAID/FFP’s Fiscal Year 2017 Annual Program Statement for International Emergency Food Assistance requires partners to report, as part of their quarterly reporting, any challenges that the project has faced during the quarter and how they were resolved and discuss any potential challenges or delays that may affect the program’s ability to achieve its objectives  Each of the agreements—both for NPOs and for public international organizations—that we reviewed require the partner to notify USAID of any developments, problems, or delays that may have an adverse effect on the project  Two of the 6 USAID partners that told us they had experienced banking access challenges were implementing USAID/FFP projects  Five of the 6 USAID partners of selected sample projects that noted experiencing banking access challenges told us those challenges did not adversely affect project implementation and therefore did not need to be reported  The sixth—a partner that noted its project was adversely affected by banking access challenges—did not include these challenges in its reporting to USAID, although the challenges met the reporting threshold of adversely affecting project implementation  While both USAID and the partner told us that the delays were communicated to USAID through emails and conversations with a designated USAID contact and in the justification for the no-cost extensions submitted to USAID, our review of the partner’s program performance reports to USAID and the no-cost extensions found no explicit discussion of banking access challenges  Our review of the over 1,300 publicly available USAID partner reports for fiscal years 2016 and 2017 from high-risk countries found no explicit discussion of banking access challenges  Overall, we identified 5 reports out of the over 1,300 that included some mention of challenges related to banking access  However, those reports lacked sufficient detail for us to determine the type, severity, or origin of the challenges  For example, one report stated that there are sometimes delays in the payment of salaries through foreign accounts, with no further details about the delays, while another report stated that subgrantees experienced delays in payments without identifying the reasons for these delays, which could include late reports, late verification, late processing, or banking issues  While most of the partners we interviewed noted that they did not report banking access challenges because the challenges did not adversely affect their projects, an NPO advocacy group and a large international NPO told us that NPOs may be reluctant to discuss or report banking access challenges publicly because of concern about being perceived as high-risk or unable to carry out their mission, and that any public mention of banking access challenges could adversely affect their ability to raise funds  Standards for Internal Control in the Federal Government require agencies to identify and respond to risks related to achieving their goals, and USAID currently has no other process for collecting information on banking access challenges affecting its partners  Without this information, USAID does not have a record of the frequency and prevalence of the challenges and may not be aware of the full extent of risks to achieving its humanitarian assistance objectives  Further, as mentioned previously, two USAID partners stated that their projects faced potential adverse effects from banking access challenges  Documenting the prevalence and frequency of banking access challenges experienced by USAID partners is important given the potential adverse effects that these challenges can have on project implementation  Both Treasury and State have taken actions to help address banking access challenges encountered by NPOs; however, USAID’s efforts to address these challenges have been limited by a lack of communication about them—both within the agency and with external entities  Treasury, as a lead agency in fighting financial crimes and as an issuer of regulations that have a significant effect on charities’ access to the banking system, has conducted meetings between charities, banks, and government officials to discuss banking access challenges and released guidance on sanctions and other related issues  State, as a provider of funding for humanitarian assistance, has issued guidance to its overseas posts on banking access challenges  In addition, both State and Treasury are involved in international efforts led by the World Bank and the Financial Action Task Force (FATF) to help address banking access challenges  Although USAID’s partners have experienced banking access challenges, USAID has had more limited engagement than State and Treasury with other agencies, international organizations, and NPOs on addressing such challenges—in part because of a lack of communication about them, both within the agency and with external entities  Treasury’s efforts to help address banking access challenges encountered by NPOs include holding roundtable meetings and issuing guidance and resources for charitable organizations  Treasury, in its role as a regulator of the banking system, serves as a nexus between the banks and the U S  agencies providing humanitarian assistance  Treasury has organized several roundtable meetings with the charitable sector to facilitate a dialogue on banks’ expectations  These sessions brought together representatives from charities, banks, financial supervisors, and the U S  government to discuss the factors that banks consider related to charity accounts and that examiners use in their review of banks’ procedures  Since 2013, Treasury’s Office of Terrorist Financing and Financial Crimes (TFFC) has dedicated three of these roundtable meetings specifically to banking access challenges affecting charities, as follows: December 17, 2013: This initial Treasury / TFFC working group meeting with charities included a discussion of terrorist financing risk mitigation guidance  There was also a discussion of banking access challenges, during which TFFC provided an overview of the NPO section of the manual used by bank examiners to conduct bank examinations and explained the bank examination process to the charities  March 21, 2014: This meeting focused on a discussion of access to financial services for charities  A Muslim-American charity delivered a presentation on how it has managed its banking relationships over the past several years  Several banks also delivered presentations to help charities better understand the factors that banks consider and the complex processes related to banking transactions and opening or maintaining bank accounts  November 12, 2015: This meeting included a stakeholder discussion of banking access challenges for charities, with charities, bankers, and regulators presenting each of their perspectives and discussing the challenges faced on all sides  In addition, in May 2015, Treasury, with the Department of Homeland Security, conducted a roundtable on banking access challenges with Syrian-American charities, U S  regulators, and bankers  This event was focused on challenges affecting the Syrian-American charitable community and delivering humanitarian assistance to Syria during the worsening conflict  Treasury provided guidance related to OFAC’s general license 11a for U S  charities to provide humanitarian assistance for Syria  Further, officials reported that Treasury also maintains contact with the charitable sector through various domestic and international events, and holds frequent meetings with members of the charitable sector in Washington, D C  and around the United States  Treasury has also issued guidance and resources on its website for charities, including frequently asked questions and best practices  Treasury’s website provides information and resources for all stakeholders in four strategic areas—private sector outreach, coordinated oversight, targeted investigations, and international engagement  The guidance includes: voluntary best practices regarding anti-terrorist financing for charities, lists of frequently asked questions regarding sanctions and charities, list of charities that have been designated by OFAC for assisting or having ties to terrorist organizations, several international multilateral organization reports on banking access challenges and terrorist exploitation of charities, and OFAC guidance specifically related to the provision of humanitarian assistance  Lastly, Treasury has taken actions on derisking challenges more generally  According to Treasury officials, these more general actions focused on encouraging dialogue and making clear to financial institutions that they are expected to make individual risk-based decisions rather than wholesale, indiscriminate policies for entire sectors or classes of customers  Treasury officials noted that banks retain the flexibility to make business decisions such as which clients to accept, since banks are in the best position to know whether they are able to implement controls to manage the risk associated with any given client  These officials indicated that Treasury pursues market-driven solutions and cannot order banks to open or maintain accounts  The officials have stated that Treasury does not view the charitable sector as presenting a uniform or unacceptably high risk of money laundering, terrorist financing, or sanctions violations  However, charities delivering critical assistance in high-risk conflict zones have, in some cases, had terrorist organizations and their support networks exploit donations and operations to support terrorist activities  State has issued guidance to its staff overseas to help address banking access challenges encountered by NPOs and others and identified a focal point for banking access challenges within the agency  In July 2017, State issued internal guidance, through a document issued to all of its overseas embassies, regarding derisking  State, based on guidance from Treasury, developed guidance for all personnel that provides background on “de-risking” and related talking points, additional web-based resources, and an assessment framework tool to evaluate the current state of banking relationships in a given market  The guidance includes links to resources from Treasury, U S  banking regulators, and various international organizations, such as the World Bank, International Monetary Fund, and FATF  The guidance is designed to give embassy staff some tools to work with host governments on these issues and to help identify countries and markets where further U S  government engagement is necessary  In addition, State’s Office of Threat Finance Countermeasures serves as the main focal point for all banking access challenges brought to the attention of State  This office provides assistance to State’s embassies when banking-access-related issues are raised through the embassy to State headquarters  All embassy staff, as part of the guidance issued on derisking, have been instructed to direct all questions received on banking access issues to the Office of Threat Finance Countermeasures  In addition, this office is responsible for interfacing with Treasury on banking access issues and staff from this office have attended all of the relevant Treasury-hosted roundtable meetings focused on banking access challenges encountered by charities  The World Bank and FATF have several efforts underway—with participation from Treasury and State—to address banking access challenges for NPOs  The World Bank, in collaboration with the Association of Certified Anti-Money Laundering Specialists (ACAMS), is working with humanitarian organizations, banks, and U S  regulators on the question of how humanitarian organizations can maintain access to the financial system  More specifically, the World Bank and ACAMS have launched three primary work streams focused on different aspects of banking access to improve NPOs’ understanding of what the financial institutions require and to improve the banks’ understanding of how NPOs operate  According to a World Bank official, the three workstreams are as follows: Work Stream 1: This work stream aims to ensure a better understanding of bank examiners of the NPO sector and to enable more risk differentiation on the part of those examiners when they conduct on-site supervision and examine bank client accounts  Work Stream 2: This work stream aims to help banks conduct due diligence on charities more easily through the use of technological tools, such as databases that contain key information on charities  Work Stream 3: This work stream aims to work with the regulatory bodies to help bank examiners change their perceptions of the risk potential of charities  In addition, the World Bank and ACAMS have organized roundtable meetings as part of the ongoing Stakeholder Dialogue on De-Risking  The objectives of a January 2017 meeting were to promote access of humanitarian organizations to financial services and to discuss practical measures to foster the relationship between NPOs and financial institutions, improve the regulatory and policy climate for financial access for NPOs, and build coalitions and create opportunities for sharing information and good due diligence practices  Officials from Treasury and State have been involved with the dialogues and various work streams  FATF, with participation from both Treasury and State, also has several efforts underway to help address banking access challenges, including revising its recommendations and issuing guidance  Derisking has been a stated FATF priority since October 2014  In June 2016, FATF revised its recommendation that pertains to how countries should review NPOs and its interpretive note to better reflect how to implement measures to protect NPOs from terrorist abuse, in line with the proper implementation of the risk-based approach  According to Treasury, this approach emphasizes that not all charities are considered high-risk  Specific changes included defining NPOs, removal of the words “particularly vulnerable” from previous language, and emphasis on a risk-based approach for evaluating NPOs  The FATF has also issued guidance and best practices to guide both financial institutions and regulators on how to properly implement the risk-based approach, in line with the revised FATF recommendations  Additionally, according to Treasury, the FATF updated a report analyzing the global terrorist threat to the charitable sector, gathering over 100 examples of terrorist abuse of charities to pinpoint which types of charities are considered higher-risk  This report and its findings were published in June 2014  USAID efforts to address banking access challenges have been limited, in part because of a lack of communication within the agency and with external entities about challenges faced by USAID’s partners  Within USAID, we found that information on banking access challenges faced by partners was not always communicated beyond staff directly overseeing the project
Report 2:  According to FERC officials, for dams not subject to an independent consultant inspection, FERC staff review engineering studies on an as needed basis, depending on whether the underlying assumptions and information from the previous studies are still relevant  For example, for the 20 dams in our study not subject to an independent consultant inspection, we found that most (15) of these studies were reviewed by FERC within the past 10 years, usually during the project’s relicensing  Multiple levels of supervisory review  As part of FERC’s quality control and internal oversight process, multiple FERC staff are to review the studies produced by the licensee and its consultant, with the number of successive reviews proportional to the complexity or importance of the study, according to FERC officials  FERC’s Operating Manual establishes the general procedure for the review of engineering studies  To begin the review process, the staff assigned to a dam is to review the engineering study and prepares an internal memo on its findings; that memo is then to be reviewed for accuracy and completeness by both a regional office Branch Chief, and the Regional Engineer  If necessary, Washington, D C , headquarters office staff are to review and approve the final memo  Upon completion of review, FERC staff are to provide a letter to the licensee indicating any particular areas where additional information is needed or where more studies are needed to evaluate the dam’s performance  According to FERC officials, each level of review adds successive quality control steps performed by experienced staff  We have previously found in reporting on other regulatory agencies that additional levels of review increases transparency and accountability and diminishes the risk of regulatory capture  Rotation of FERC staff responsibilities  As part of an internal quality control program to help minimize the risk of missing important safety- related items, FERC officials told us they rotate staff assignments and responsibilities approximately every 3 to 4 years  According to FERC officials, this practice decreases the chance that a deficiency would be missed over time due to differences in areas of engineering expertise between or among staff  We have previously found in our reporting on other regulatory agencies that strategies such as more frequently rotating staff in key roles can help reduce the risk to supervisory independence and regulatory capture  Some FERC regional offices have developed practices to further enhance their review of these studies  For example, the New York Regional Office established a subject matter expert team that helps review dams with unusually complex hydrology issues  This team was created, in part, because FERC staff noted that some of the hydrology studies conducted in the 1990s and 2000s were not as thorough as they would have wanted, and warranted a re-examination  Currently, the New York Regional Office is reviewing the hydrology analysis associated with 12 dam break studies to determine if the hydrology data used in developing these studies were as rigorously developed and validated  According to the FERC staff in this office, utilizing a team of subject matter experts has reduced Regional Office review time and improved the hydrology studies’ accuracy  FERC staff in the New York Regional Office also told us that they are working with other regional offices on setting up similar technical teams  For example, FERC staff in the New York Regional Office have been working with the Portland Regional Office to set up a similar team  FERC procedures require the use of engineering studies at key points over the dam’s licensing period to inform components of its safety oversight approach, including during the potential failure mode analyses of individual dams as well as during relicensing  Potential failure mode analysis  The potential failure mode analysis is to occur during the recurring independent consultant inspection and is conducted by the licensee’s independent consultant along with other key dam safety stakeholders  As previously explained, the analysis incorporates the engineering studies and identifies events that could cause a dam to potentially fail  During the potential failure mode analysis, FERC, the licensee, the consultant, and other key dam safety stakeholders are to refer to the engineering studies to establish environmental conditions that inform dam failure scenarios, the risks associated with these failures, and their consequences for an individual dam  Further, according to a FERC white paper on risk analysis, FERC is beginning to use information related to potential failure modes as inputs to an analysis tool that quantifies risks at each dam  With this information, FERC expects to make relative risk estimates of dams within its inventory and establish priorities for further study or remediation of risks at individual dams, according to the white paper  Relicensing  During relicensing, FERC staff are to review the engineering studies as well as information such as historical hydrological data and extreme weather events, which also inform their safety evaluation of the licensee’s application  FERC officials also stated that as a result of their relicensing review, they might alter the articles of the new license before it is issued should their reviews indicate that environmental conditions affecting the dam’s safety have changed  We found that FERC generally met its requirement to evaluate dam safety during the relicensing process for the 42 dams we reviewed  During the relicensing process, we found that for the dams we reviewed, FERC staff review safety information such as the past reports, inspections, and studies conducted by FERC, the licensee, and independent consultants and determine whether or not a dam owner operated and maintained its dam safely  According to FERC staff, the safety review for relicensing is generally a summary of prior safety and inspection information, rather than an analysis of new safety information, unless the licensee proposes a change to the operation or structure  FERC’s review during relicensing for the high hazard and significant hazard dams we reviewed was generally consistent with its guidance and safety memo template, though the extent of its review of low hazard dams varied  (See fig  3 ) For example, for the 22 high and significant hazard dams we reviewed, the safety relicensing memos followed the template and nearly all included summaries of hydrology studies, stability analyses, prior FERC inspections, and applicable independent consultant reports  For the 20 low hazard dams, FERC staff noted that some requirements in the template are not applicable or have been exempted and therefore were not reviewed during relicensing  While low hazard dams were more inconsistently reviewed during relicensing, FERC staff also noted that there has been a recent emphasis to more closely review, replace, or conduct engineering studies, such as the stability study, for low hazard dams during relicensing  Moreover, FERC staff told us that the safety risks associated with these dams are minimal, as the failure of a low hazard dam, by definition, does not pose a threat to human life or economic activity  According to FERC staff, if a licensee proposed altering the dam or its operations in any way as part of its application for a new license, FERC staff would review the proposed change and may recommend adding articles to the new license prior to its issuance to ensure dam safety  FERC officials noted that, as part of their review, any structural or operational changes proposed by the licensee during relicensing are reviewed by FERC  These officials also noted that FERC generally recommends modifications to the licensees’ proposed changes prior to their approval and inclusion in the new license  However, FERC officials noted that, in some cases, additional information is needed prior to approving the structural or operational change to ensure there are no risks posed by the changes  In those instances, FERC may recommend that articles be added to the new license, that require the licensee to conduct additional engineering studies of the issue and submit them to FERC for review and approval  For example, during the relicensing of the Otter Creek project in Vermont in 2014, the licensee proposed changes to the project’s operation resulting from construction  As a result, FERC’s staff recommended adding a number of articles to the license, including that the licensee conduct studies to evaluate the effect of the change on safety and to ensure safety during construction  During relicensing, third parties—such as environmental organizations, nearby residents and communities, and other federal agencies, such as the U S  Fish and Wildlife Service—may provide input on various topics related to the project, including safety  However, FERC officials said that very few third parties file studies or comments related to dam safety during relicensing  FERC’s template and guidance do not specifically require the consideration of such analyses as part of its safety review, and we did not identify any safety studies submitted by third parties for dams or reviewed by FERC in our sample  According to FERC officials, when stakeholders submit comments during relicensing, the comments tend to focus on environmental aspects of the project, such as adding passages for fish migration  Further, FERC is not required under the Federal Power Act to respond to any comments, including those related to dam safety, from third parties, according to FERC officials  However, according to FERC officials, courts have held that the Administrative Procedure Act precludes an agency from arbitrarily and capriciously ignoring issues raised in comments  Furthermore, these officials stated that if a court determines that FERC did not sufficiently address issues raised during the relicensing process, its orders are subject to being reversed and remanded by applicable United States courts of appeals  Moreover, FERC officials noted that the information needed to develop third party safety studies, such as the dam design drawings and engineering studies, are property of the licensee, rather than FERC  In addition, this information may not be readily available to third parties or the public if FERC designates it as critical energy infrastructure information, which would preclude its release to the general public  FERC staff we interviewed stated that there have been no instances where the Commission denied a new license to a licensee as a result of its safety review during relicensing  FERC staff stated that given the frequency of other inspections, including the FERC staff inspections, and independent consultant inspections, it is unlikely staff would find a previously unknown major safety issue during relicensing  FERC staff told us that rather than deny a license for safety deficiencies, FERC will keep a dam owner under the terms of a FERC license to better ensure the licensee remedies existing safety deficiencies  Specifically, FERC staff noted that under a license, FERC can ensure dam safety by (1) closely monitoring the deficiency’s remediation progress through its inspection program, (2) adding license terms in the new license tailored to the specific safety deficiency, and (3), as necessary, pursuing compliance and enforcement actions, such as civil penalties or stop work orders, to enforce the terms and conditions of the license  For example, prior to and during the relicensing of a FERC-licensed project in Wisconsin in 2014, FERC’s review identified that the spillway capacity was inadequate  While the project was relicensed in 2017 without changes to the spillway, FERC officials stated that they have been overseeing the plans and studies of the remediation of the spillway through their ongoing inspection program  However, if an imminent safety threat is identified during the relicensing review, FERC officials stated that they will order that the licensee take actions to remedy the issue immediately  Moreover, FERC officials noted that, if necessary, a license can be revoked for failure to comply with the terms of its license  FERC designed a multi-layered safety approach—which uses inspections, studies, and other assessments of individual dams—to reduce exposure to safety risks  However, as the spillway failure at the Oroville Dam project in 2017 demonstrated, it is not possible to eliminate all uncertainties and risks  As part of a continuing effort to ensure dam safety at licensed projects, FERC could complement its approach to evaluating the safety of individual dams by enhancing its capability to assess and identify the risks across its portfolio of licensed dams  Specifically, while FERC has collected and stored a substantial amount of information from its individual dam safety inspections, FERC’s approach to recording this information is inconsistent due to a lack of standard language and procedures  By clarifying its approach to the recording of information collected during inspections, FERC officials could help ensure that the information recorded is comparable when shared across its regions  Moreover, the absence of standard language and procedures to consistently record inspection information impedes a broader, portfolio- wide analysis of the extent of and characteristics associated with common safety deficiencies identified during FERC inspections  While FERC has not yet conducted such an analysis, a proactive assessment of common safety inspection deficiencies across FERC’s portfolio of licensed dams— similar to its identification of dam spillways with safety concerns following the Oroville Dam incident—could help FERC and its licensees identify safety risks prior to a safety incident and to develop approaches to mitigate those risks  We are making the following two recommendations to FERC: FERC should provide standard language and procedures to its staff on how to record information collected during inspections, including how and where to record information about safety deficiencies, in order to facilitate analysis of safety deficiencies across FERC’s portfolio of regulated dams  (Recommendation 1) FERC should use information from its inspections to assess safety risks across its portfolio of regulated dams to identify and prioritize safety risks at a national level  (Recommendation 2) We provided a draft of this report to FERC for review and comment  In its comments on the draft report, FERC said it generally agreed with the draft report’s findings and found the recommendations to be constructive  FERC said that it would direct staff to develop appropriate next steps to implement GAO’s recommendations  These comments are reproduced in appendix IV  In addition, FERC provided technical comments, which we incorporated as appropriate  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the Chairman of FERC and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at 202-512-2834 or vonaha@gao gov  Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made major contributions to this report are listed in appendix V  FERC seeks to ensure licensees’ compliance with FERC regulations and license requirements, including remediating safety deficiencies, by using a mix of preventative strategies to help identify situations before they become problems and reactive strategies such as issuing penalties  As part of its efforts, FERC published a compliance handbook in 2015 that provides an overall guide to compliance and enforcement of a variety of license requirements, including dam safety  The handbook includes instructions for implementing FERC rules, regulations, policies, and programs designed to ensure effective compliance with license conditions, which include dam safety, to protect and enhance beneficial public uses of waterways  FERC developed a range of enforcement actions, that include holding workshops to encourage compliance and issuing guidance, that increase in severity depending on the non- compliance issue  (See fig  4 ) More broadly, FERC’s guidance directs officials to determine enforcement actions and time frames for those actions on a case-by-case basis, depending on the characteristics of the specific compliance issue  According to FERC officials, many of these safety compliance discussions are handled informally  In addition, their compliance approach emphasizes activities that assist, rather than force, licensees to achieve compliance, according to its guidance  These activities include facilitating open lines of communication with licensees, participating in technical workshops, and publishing brochures and guidance documents, among other efforts  Also, according to these officials, FERC works with licensees to provide guidance and warnings of possible non-compliance matters, in order to avoid usage of any enforcement tools, if possible  According to FERC officials, any safety issues that endanger the public will result in immediate penalty or removal of the dam from power generation, but this action is not lightly taken  Additionally, the length of time between when a safety deficiency is identified and is resolved varies substantially depending on the specific project  As stated earlier in this report, FERC works with licensees to determine a plan and schedule for investigating safety issues and making any needed modifications  However, FERC officials stated that the majority of safety compliance issues are resolved within a month  However, FERC officials stated that if a licensee repeatedly does not take steps to address a compliance issue, FERC will explore enforcement actions through a formal process  According to officials, FERC’s enforcement options are based on authorities provided under the Federal Power Act and such options are flexible because of the variation in hazards, consequences, and dams  According to FERC officials, to ensure compliance with safety regulations, if a settlement cannot be reached, FERC may, among other things, issue an order to show cause, issue civil penalties in the form of fines to licensees, impose stop work or cease power generation orders, revoke licenses, and seek injunctions in federal court  Nevertheless, FERC officials stated that there is no specific requirement for how quickly the compliance issues or deficiencies should be resolved and that some issues can take years to resolve  For example, in 2004, the current licensee of a hydroelectric project operating in Edenville, Michigan, acquired the project, which was found by FERC to be in a state of non-compliance at that time  FERC staff made numerous attempts to work with the licensee to resolve the compliance issues  However, they were unable to resolve these issues and as a result issued a cease generation order in 2017, followed in 2018 by a license revocation order  In practice, FERC’s use of these enforcement tools to resolve safety issues has been fairly limited, particularly in comparison to other license compliance issues, according to FERC officials  Since 2013, FERC has issued one civil penalty for a safety-related hydropower violation and has issued compliance orders on eight other projects for safety-related reasons, including orders to cease generation on three projects  For the 14 projects and 42 dams we reviewed, FERC licensees and their consultants used a variety of tools to develop engineering studies of dam performance (see table 3)  These tools included programs and modeling tools developed by government agencies, such as the U S  Army Corps of Engineers (the Corps), as well as commercially available modeling tools  FERC officials stated that they also used a number of the same tools used by its licensees and consultants  Similarly, for the 14 projects and 42 dams we reviewed, FERC licensees and their consultants used a variety of datasets to develop engineering studies of dam performance (see table 4)  These datasets included data maintained and updated by various government agencies, including the United States Geological Survey and National Oceanic and Atmospheric Administration  FERC officials stated that they also used a number of the same datasets used by its licensees and consultants  This report assesses: (1) how FERC collects information from its dam safety inspections and the extent to which FERC analyzes it; (2) how FERC evaluates engineering studies of dam performance to analyze safety, and (3) the extent to which FERC reviews dam safety information during relicensing and the information FERC considers  This report also includes information on FERC actions to ensure licensee compliance with license requirements related to dam safety (app  I) and selected models and data sets used to develop and evaluate engineering studies of dam performance (app  II)  For each of the objectives, we reviewed laws, regulations, FERC guidance, templates, and other documentation pertaining to FERC’s evaluation of dam safety  In addition, we reviewed an independent forensic team’s assessment of the causes of the Oroville Dam incident, including the report’s analysis of FERC’s approach to ensuring safety at the project, to understand any limitations of FERC’s approach identified by the report  We also reviewed dam safety documentation, including dam performance studies, FERC memorandums, the most recent completed inspection report, and other information, from a non-probability sample of 14 projects encompassing 42 dams relicensed from fiscal years 2014 through 2017  (See table 5 ) We selected these projects and dams to include ones that were geographically dispersed, had varying potential risks associated with their potential failure, and had differences in the length of their relicensing process  We developed a data collection instrument to collect information from the dam safety documentation and analyzed data from the sample to evaluate the extent to which FERC followed its dam safety guidance across the selected projects  To develop the data collection instrument, we reviewed and incorporated FERC oversight requirements from its regulations, guidance, and templates  We conducted three pre-tests of the instrument, and revised the instrument after each pre-test  To ensure consistency and accuracy in the collection of this information, for each dam in the sample, one analyst conducted an initial review of the dam safety documentation; a second analyst reviewed the information independently; and the two analysts reconciled any differences  Following our review of the information from the dam safety documentation, we conducted semi-structured interviews with FERC engineering staff associated with each of the 14 projects and 42 dams to obtain information about FERC’s inspections, review of dam performance studies, and analysis of safety during the relicensing of these projects  Our interviews with these FERC staff provided insight into FERC’s dam safety oversight approach and are not generalizable to all projects  We also interviewed FERC officials responsible for dam safety about dam safety practices  In addition, to review how FERC collects information from its dam safety inspections and the extent to which FERC analyzes it, we also reviewed inspection data from FERC’s information management systems from fiscal years 2014 through 2017  To assess the reliability of these data, we reviewed guidance and interviewed FERC officials  We determined that the data were sufficiently reliable for our purposes  We compared FERC’s approach to collecting, recording and using safety information to federal internal control standards for the design of information systems and related control activities  We also reviewed our prior work on portfolio- level risk management  To evaluate how FERC evaluates engineering studies of dam performance to analyze dam safety, we reviewed FERC policies and guidance  We interviewed six independent consultants having experience inspecting and analyzing FERC-regulated dams to understand how engineering studies of dam performance are developed  We selected consultants who had submitted an inspection report to FERC recently (between December 2017 and February 2018) based on the geographic location of the project they reviewed and experience conducting these inspections, and the number of reports submitted to FERC over this time period  (See table 6 ) Our interviews with these consultants provided insight into FERC’s approach to conducting and reviewing studies and are not generalizable to all projects or consultants  To evaluate the extent to which FERC reviews dam safety information during relicensing and the information it considers, we reviewed templates developed by FERC to assess safety during the relicensing and analyzed the extent to which staff followed guidance in these templates for the 14 projects and 42 dams in our sample  We also interviewed stakeholders, including the National Hydropower Association and Friends of the River to obtain general perspectives on FERC’s relicensing approach  Our interviews with these stakeholders provided insight into FERC’s approach to relicensing, and these views are not generalizable across all stakeholders  To review actions to ensure licensee compliance with license requirements related to dam safety, we reviewed FERC’s guidance related to compliance and enforcement and interviewed FERC officials responsible for implementation of the guidance  To review information on models and datasets used to develop and evaluate engineering studies of dam performance, we reviewed dam safety documentation associated with the projects in our sample (described previously), reviewed FERC documentation, and interviewed FERC officials  We conducted this performance audit from July 2017 to October 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  Andrew Von Ah, (202) 512-2834 or vonaha@gao gov  In addition to the contact named above, Mike Armes (Assistant Director); Matt Voit (Analyst-in-Charge); David Blanding; Brian Chung; Geoff Hamilton; Vondalee Hunt; Rich Johnson; Jon Melhus; Monique Nasrallah; Madhav Panwar; Malika Rice; Sandra Sokol; and Michelle Weathers made key contributions to this report 

ground_truth: FEMA, an agency of the Department of Homeland Security (DHS), has obligated more than $36 billion in PA grants to state, local, and tribal governments to help communities recover and rebuild after major disasters since 2009. Further, costs are rising with disasters, such as Hurricanes Harvey, Irma, and Maria in 2017. FEMA recently redesigned how the PA program delivers assistance to state and local grantees to improve operations and address past challenges identified by GAO and others. FEMA tested the new delivery model in selected disasters and announced implementation in September 2017. GAO was asked to assess the redesigned PA program. This report examines, among other things, the extent to which FEMA's new delivery model addresses (1) past workforce management challenges and assesses future workforce needs; and (2) past information sharing challenges and key IT management controls. GAO reviewed FEMA policy, strategy, and implementation documents; interviewed FEMA and state officials, PA program applicants, and other stakeholders; and observed implementation of the new model at one test location following Hurricane Matthew in 2016. The Federal Emergency Management Agency (FEMA) redesigned the Public Assistance (PA) grant program delivery model to address past challenges in workforce management, but has not fully assessed future workforce staffing needs. GAO and others have previously identified challenges related to shortages in experienced and trained FEMA PA staff and high turnover among these staff. These challenges often led to applicants receiving inconsistent guidance and to PA project delays. As part of its new model, FEMA is creating consolidated resource centers to standardize and centralize PA staff responsible for managing grant applications, and new specialized positions, such as hazard mitigation liaisons, program delivery managers, and site inspectors, to ensure more consistent guidance to applicants. However, FEMA has not assessed the workforce needed to fully implement the new model, such as the number of staff needed to fill certain new positions, or to achieve staffing goals for supporting hazard mitigation on PA projects. Fully assessing workforce needs will help to ensure that FEMA has the people and the skills needed to fully implement the new PA model and help to avoid the long-standing workforce challenges the program encountered in the past. FEMA designed a new PA information and case management system—called the FEMA Applicant Case Tracker (FAC-Trax)—to address past information sharing challenges, such as difficulties in sharing grant documentation among FEMA, state, and local officials and tracking the status of PA projects, but additional actions could better ensure effective implementation. Both FEMA and state officials involved in testing of the new model stated that the new information system allows them to better manage and track PA applications and documentation, which could lead to greater transparency and efficiencies in the program. Further, GAO found that this new system fully addresses two of four key information technology (IT) management controls—project planning and risk management—that are necessary to ensure systems work effectively and meet user needs. However, GAO found that FEMA has not fully addressed the other two controls—requirements development and systems testing and integration. By better analyzing progress on high-level user requirements, for example, FEMA will have greater assurance that FAC-Trax will meet user needs and achieve the goals of the new delivery model. GAO is making five recommendations, including that FEMA assess the workforce needed for the new delivery model and improve key IT management controls for its new information sharing and case management system, FAC-Trax. DHS concurred with all recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Major disaster declarations can trigger a variety of federal response and recovery programs for government and nongovernmental entities, households, and individuals  FEMA’s Office of Response and Recovery manages the PA grant program, providing funds to states, territorial governments, local government agencies, Indian tribes, authorized tribal organizations, and certain private nonprofit organizations in response to presidentially declared disaster declarations to repair damaged public infrastructure such as roads, schools, and bridges  Figure 1 shows the total amount of PA funds obligated by county from January 2009 through February 2017 for federal disaster declarations  To implement the PA program, FEMA’s staff includes a mix of temporary, reservist, and permanent employees under two authorities, the Stafford Act and Title 5  Reservists make up the largest share of the PA workforce, which consisted of 1,852 employees––1,041 reservists, 634 full-time equivalents, and 177 temporary Cadre of On-Call Response/Recovery Employees––as of June 2017, according to PA officials  Figure 2 summarizes the key characteristics for each type of employee  After a disaster, FEMA sends PA program staff to the affected area to work with state and local officials to assess the damage prior to a disaster declaration  FEMA officials establish a temporary Joint Field Office (JFO) to house staff who will manage response and recovery functions after a declared disaster (including operations, emergency response and support teams, planning, administration, finance, and logistics)  Once the President has declared a disaster, PA staff work with grant applicants to help them document damages, identify eligible costs and work, and prepare requests for PA grant funds by developing project proposals  These proposals may include proposals for hazard mitigation if the hazard mitigation work is related to the repair of damaged facilities, referred to as permanent work projects  Immediate emergency measures, such as debris removal, are not eligible for hazard mitigation  Officials then review and obtain approval of the projects prior to FEMA obligating funds to state grantees  Figure 3 describes the process used to develop, review, and obligate PA projects  In addition to rebuilding and restoring infrastructure to its predisaster state, the PA program can be used to fund hazard mitigation measures that will reduce future risk to the infrastructure in conjunction with the repair of disaster-damaged facilities  There is no preset limit to the amount of PA funds a community may receive; however, PA hazard mitigation measures must be determined to be cost effective  Some examples of hazard mitigation measures that FEMA has predetermined to be cost effective, if they meet certain requirements, include installing shut-off valves on underground pipelines so that damaged sections can be isolated during or following a disaster; securing a roof using straps, clips, or other anchoring systems in locations subject to high winds; and installing shutters on windows or replacing glass with impact-resistant material  Applicants can also propose mitigation measures that are separate from the damaged portions of a facility, such as constructing floodwalls around damaged facilities to avoid future flooding  FEMA evaluates these proposals, considering how the proposed measure protects damaged portions of a facility and whether the measure is reasonable based on the extent of the damage, and determines eligibility on a case-by-case basis  FEMA’s Federal Insurance and Mitigation Administration (FIMA) deploys a cadre of mitigation staff to help coordinate and implement hazard mitigation activities during disaster recovery, including PA hazard mitigation  A primary task of these staff is to identify and assess opportunities to incorporate hazard mitigation into PA projects  Generally, if an applicant seeks to incorporate hazard mitigation measures into a PA project, FIMA’s hazard mitigation staff develop a hazard mitigation proposal  We, the DHS OIG, and others have reported past challenges with FEMA’s management of the PA program related to workforce management, information sharing, and hazard mitigation  For example, we reported in 2008 that the PA program had a shortage of experienced and knowledgeable staff, relied on temporary rotating staff, and provided limited training to their workforce, which impaired PA program delivery and delayed recovery efforts after Hurricanes Katrina and Rita  We found that staff turnover, coupled with information sharing challenges, delayed projects when applicants had to provide the same information each time FEMA assigned new staff and that poorly trained staff provided incomplete and inaccurate information during their initial meetings with applicants or made inaccurate eligibility determinations, which also caused processing delays  We recommended that FEMA strengthen continuity among staff involved in administering the PA program by developing protocols to improve information and document sharing among FEMA staff  In response, in 2013 FEMA instituted a PA Consistency Initiative, which included hiring new managers for FEMA regional offices, stakeholder training on PA program administration, and using a newly developed internal website to allow staff to post and share information to address continuity and knowledge sharing concerns during disaster operations  FEMA also developed the Public Assistance Program Delivery Transition Standard Operating Procedure to facilitate the transfer of responsibility for PA program activities during cases of staff turnover during recovery operations  Despite FEMA’s efforts to implement our recommendations, the DHS-OIG, in 2016, found continuing challenges after Hurricane Sandy with workforce levels, skills, and performance of reservists, who make up the majority of the PA workforce  Regarding information sharing, in 2008, we also identified difficulties sharing documents among federal, state, and local participants in the PA process and difficulties tracking the status of projects  We recommended that FEMA improve information sharing within the PA process by identifying and disseminating practices that facilitate more effective communication among federal, state, and local entities  In response, FEMA proceeded with the implementation of a grant tracking and management system, called EMMIE, which was used previously in 2007  However, in subsequent years we found weaknesses in how FEMA developed the system and the DHS-OIG found that information sharing problems similar to the ones identified in our 2008 report persisted  Regarding hazard mitigation, we reported in 2015 that state and local officials experienced challenges in using PA hazard mitigation during the Hurricane Sandy recovery efforts because PA officials did not consistently prioritize hazard mitigation, and in some cases discouraged mitigation projects during the PA grant application process, among other challenges  We recommended that FEMA assess the challenges state and local officials reported, including the extent to which they can be addressed, and implement corrective actions, as needed  In response to our recommendation, FEMA developed a corrective action plan that included actions and milestones for reviewing, updating, and implementing PA hazard mitigation policy  FEMA also identified the PA new delivery model as a solution for some of the challenges state and local officials reported  Previously, the OIG also reported that PA program officials did not consistently identify eligible PA hazard mitigation projects, and that PA officials did not prioritize the identification of PA hazard mitigation opportunities at the onset of recovery efforts after the 2005 Gulf Coast hurricanes  See appendix I for a summary of findings and the status of our past recommendations on challenges with workforce management, information sharing, and hazard mitigation related to the PA program since our last review in December 2008  FEMA’s own internal reviews and outreach efforts have also identified similar challenges  For example, at FEMA’s request the Homeland Security Studies and Analysis Institute assessed the effectiveness and efficiency of the PA program in 2011  The institute’s report outlined 3 key findings and 23 recommendations relating to the PA preaward process  For example, the report found that FEMA could enhance training programs to develop a skilled and experienced workforce; utilize technology and employ web-based tools to support centralized processing, transparency, and efficient decision making; and identify and address potential special considerations, such as hazard mitigation proposals, as early as possible in the preaward process to improve consistency  In 2014, PA program officials analyzed the PA grant process and used input from agency staff and officials involved in various aspects of the program to identify potential improvements  The resulting Public Assistance Program Realignment report found that challenges in workforce management, information sharing, and hazard mitigation continued, and included recommendations for improvement  For example, the report concluded that a shortage of qualified staff, high turnover, unclear organizational responsibilities, and inconsistent training were long-standing and continuing challenges that impaired the PA pre-award process  In addition, from January 2015 to April 2015, FEMA conducted extensive outreach with more than 260 stakeholders across FEMA headquarters, all 10 regions, 43 states, and 4 tribal nations to discuss challenges in the PA program and opportunities for improvement  For example, stakeholders identified challenges with ineffective information collection during the preaward process and suggested identifying special considerations, such as hazard mitigation, earlier in the PA process as an idea for improvement  In response, FEMA began redesigning the PA preaward process to operationalize the results of its 2014 report and address areas for improvement identified through its outreach efforts  FEMA awarded a contract for program support to help PA officials implement a redesigned PA program in 2015  This included a new process to develop and review grant applications, and obligate PA funds to states affected by disasters; new positions, such as a new program delivery manager who is the single point of contact throughout the grant application process; a new Consolidated Resource Center (CRC) to support field operations by supplementing project development, validation, and review of proposed PA project applications; and a new information system to maintain and share PA grant application documents  As part of the new process, PA program officials identified the need to ensure that staff emphasize special considerations, such as hazard mitigation, earlier in the process  Taken together, these efforts represent FEMA’s “new delivery model” for awarding PA program grants  Enhancements in the PA program under the new delivery model are presented in figure 4  Regarding the new delivery model process, FEMA introduced several changes to enhance outreach to applicants during the “exploratory call”— the first contact between FEMA and local officials—and during the first in- person meeting, called the “recovery scoping meeting ” FEMA also revised decision points during the process, when program officials can request more information from applicants, and applicants can review and approve the completion of project development steps  FEMA also incorporated special considerations, such as hazard mitigation, earlier in the new process during the exploratory calls and recovery scoping meetings  The changes and enhancements to the PA grant award process in the new delivery model are presented in figure 5  The new process divides proposed PA projects based on complexity and type of work into three categories—100 percent completed, standard, and specialized—that PA staff manage to expedite review or assign skilled staff to technical projects as needed  If the applicant has already completed work following a disaster, such as debris removal, it is considered “100 percent completed” and JFO staff collect the necessary documents and provide the information to the CRC staff who complete the development of project applications, validate the information, and complete all necessary reviews  Projects that require repairs and further assistance from PA program staff at the JFO include “standard” and “specialized” projects, which include a site inspection to document damages, before the JFO staff provide the information to the CRC  Further, PA program officials assign PA staff based on their skills and experience to standard projects, which are less technically complex to develop, and specialized projects, which are more technically complex and costly  We discuss the new workforce positions FEMA developed for JFOs and CRCs, the new information system FEMA developed to maintain and share PA grant documents with applicants, and FEMA’s efforts to incorporate hazard mitigation into PA projects later in this report  Since 2015, FEMA has invested almost $9 million to redesign the PA program through the reengineering and implementation of the new delivery model, including about $4 7 million for contract support for implementation, and $4 million for acquisition of the new information system  FEMA tested the new delivery model in a series of selected disasters, using a continuous process improvement approach to assess and improve the process, workforce changes, and information system requirements, prior to implementing the new model for all future disasters  For example, FEMA first tested the new process in Iowa in July 2015 and, in February 2016, PA program officials expanded their test to include all of the new staff positions  In October 2016, PA program officials added the new information system to achieve a comprehensive implementation of all of the elements of the new delivery model for the agency’s response to Hurricane Matthew in Georgia, two additional disasters in Georgia in January 2017, and in Missouri, North Dakota, Wyoming, Vermont, and two disasters in New Hampshire from June through August 2017  The timeline for PA’s implementation of the new delivery model is shown in figure 6  According to program officials, FEMA planned to implement the new model for all future disasters beginning in January 2018  However, historic disaster activity during the 2017 hurricane season accelerated full implementation  As a result, on September 12, 2017, FEMA officials announced that, unless officials determined it would be infeasible in an individual disaster, the program would use the new delivery model in all future disasters  According to FEMA’s 2014 PA Program Realignment report and other program documents, PA officials designed the new delivery model to respond to persistent workforce management challenges related to identifying the required number of staff and needed skills and training, among other things, to improve the efficiency and effectiveness of the PA preaward process  To address these challenges, PA program officials centralized much of the responsibility for processing PA projects in the CRCs, created additional new positions with specialized roles and responsibilities in JFOs, and established training and mentoring programs to help build the new staffs’ skills  In 2016, PA program officials centralized some of the project activities that otherwise were being carried out at individual JFOs at FEMA’s first new CRC in Denton, Texas  Officials did so by establishing 18 new positions, many of which directly correlated with positions that FEMA deployed to individual JFOs in the legacy PA delivery model  According to PA officials, centralizing positions will improve standardization in project processing, and result in a higher quality work product  As part of the new delivery model, PA program officials created a new hazard mitigation liaison position for PA program staff at the CRC that did not previously exist at individual JFOs  The other new positions that PA program officials either created or centralized at the CRC included two specialized positions responsible for costing and validating PA projects  Previously, the PA project specialist deployed to the JFO would complete these tasks and others; however, the consistency of project development varied across the regions and disasters  In contrast, CRC staff are full-time employees who receive training to specialize in completing standardized project development steps for PA projects from multiple disasters on an ongoing basis  Program officials anticipate that centralizing new specialized staff at the CRCs will also reduce PA administrative costs and staffing levels at the JFOs  For example, staff at the CRCs, such as the new hazard mitigation liaisons and insurance and costing specialists, could support project development for multiple disasters and regions simultaneously, whereas PA previously needed to deploy staff to each JFO to fulfill these roles  In addition, once JFOs operating under the new model send projects to the CRCs for processing and review, FEMA can more rapidly close its JFOs, reducing associated administrative costs  For example, following Hurricane Matthew, FEMA credited the new delivery model, in part, with its ability to close the JFO in Georgia sooner than several other JFOs in neighboring states not involved in the implementation of the new delivery model  PA program officials created new positions with more specialized roles and responsibilities to help PA staff at JFOs provide more consistency in the project development process and guidance to applicants  Program officials split the broad responsibilities previously managed at the JFOs by PA crew leaders and project specialists, into two new, specialized positions—the program delivery manager and site inspector  The program delivery manager serves as the applicant’s single point-of-contact throughout the preaward process, manages communication with the applicant, and oversees document collection  All three PA grant applicants we spoke to following Hurricane Matthew in Georgia greatly appreciated the knowledge and assistance provided by their program delivery managers  Site inspectors are responsible for conducting the site inspection to document all disaster-related damages; determining the applicant’s plans for recovery, coordinating with other specialists, and verifying the information collected with the applicant  Officials expect deployed staff at JFOs can complete the fieldwork faster and provide greater continuity of service to applicants  Further, program officials believe that specializing roles will enable them to provide more targeted training, and improve employee satisfaction  Site inspection, hazard mitigation, and environmental and historic preservation specialists, along with a new Public Assistance program mentor, conduct a site inspection with the applicant to document damages to a historic cemetery in Savannah, Georgia, following Hurricane Matthew in 2016  PA program officials designed new training and mentoring programs for the new positions at the CRCs and JFOs and used a continuous feedback process to update and improve the training, position guides, and task books throughout the implementation of the new delivery model, according to PA officials  According to a June 2017 update of the PA Cadre Training Plan, training for the new model has five major focuses: required training and skills for position qualification; on-site refresher training; mentor training; regional-based state, local, tribal, and territorial training; and training on the new information system  Specifically, officials developed six new training courses, and identified which are required for each position under the new delivery model  For example, a program delivery manager at the JFO is required to complete both the program delivery manager and site inspector specialist courses  As of June 2017, PA program officials had provided at least one new model training course to 93 percent of their cadre (including program delivery manager training to 366 individuals and site inspector training to 1,172 individuals) and planned to provide 28 additional courses through September 2017 to the PA cadre  According to regional and CRC officials, the training courses and mentoring from experienced staff helped maximize new staff’s capabilities in the new process  Throughout the third implementation of the new delivery model, JFO and CRC staff, as well as regional PA staff, stakeholders, and applicants, identified staff skills and training as a key area that needed more attention for full implementation of the new delivery model  Our work and FEMA’s after-action reports from the third test in Georgia identified problems with site inspector skills, which affected the timeliness and accuracy of projects  Specialists and managers at the CRC noted that poorly trained site inspectors did not consistently provide the necessary information from the field, which resulted in delays for the CRC staff to process projects, and after-action reports also identified challenges with site inspector skills  According to a PA applicant in Georgia, the inconsistency of skills and experience of their site inspector resulted in the need to conduct a “do-over” site inspection on one of the applicant’s projects, causing delays  PA staff and state officials attribute much of the site inspectors’ skill gaps to their lack of training and experience in the program  According to PA Region officials, providing timely training will be a resource-intensive challenge for implementing the new delivery model for all future disasters  For example, it can be difficult to train reservists before FEMA deploys them to disasters, and many of the program’s experienced reservists have retired or resigned, resulting in few mentors for the program and a high need to provide training to inexperienced and newly hired staff  PA officials and stakeholders also emphasized the need for FEMA to provide additional training for state and local officials to build capacity and support the goals of the new delivery model  For example, according to JFO officials at the third implementation, the new delivery model increases responsibilities for applicants, who will require more applicant training than FEMA currently provides  According to state officials, applicant capabilities vary, and FEMA should provide training to state and local officials on the new delivery model and the information system before a disaster  Skill gaps among applicants could result in inconsistent implementation of the new process, according to PA staff and stakeholders, and PA staff said that training was important to prevent applicants from reverting back to the legacy PA grant application process  To support full implementation of the new delivery model for all disasters, PA program officials have updated training courses for PA staff and applicants, and planned additional training to address these challenges and other lessons learned through the test implementation  For example, PA officials told us they updated the site inspector training program in May 2017 and scheduled a new site inspector training session in August 2017 to include more hands-on training to help address the skill gaps identified for site inspectors  PA officials created a new training course for FEMA’s regional offices, in part to enable regional PA staff to provide new delivery model training to state and local officials  PA officials also planned to develop a self-paced, online course for state and local officials by the end of 2017  PA officials have not fully assessed the workforce needed for JFO field operations, CRC staff, or FIMA’s hazard mitigation staff to support implementation of the new delivery model for all future disasters  PA program officials developed an initial assessment of the total number of staff needed in the field and the CRCs in 2016 to estimate cost savings associated with consolidating and specializing positions at the CRCs and deploying fewer staff to JFOs  However, the assessment did not identify the number of staff required to fill specific positions, including program delivery managers and hazard mitigation specialists, needed to support the new delivery model for full implementation  In reviewing the test implementations of the new delivery model, we found that inadequate staffing levels at the JFOs and CRCs, and with FIMA’s hazard mitigation staff, affected staffs’ ability to achieve the goals of the new delivery model  Staff levels at the JFO  We identified challenges with having the right number of program delivery managers and site inspection specialists to achieve program goals for customer satisfaction, efficiency, and quality in test implementations of the new delivery model  For example, in the second test implementation of the new delivery model in Oregon in 2016, PA did not deploy enough program delivery managers to the disaster, which resulted in unmanageable caseloads for program delivery managers, according to state and PA officials  PA program officials assigned program delivery managers an average caseload of 12 PA applicants, which was more than they could effectively manage, according to PA staff, and program officials aim for a caseload of 8 to 10 applicants  According to state officials, local officials reported they did not always receive the support they needed from program delivery managers who managed caseloads consisting of dozens of projects at multiple sites for each applicant during the Oregon implementation  As a result of overwhelmed program delivery managers, local officials faced challenges understanding their responsibilities, such as recognizing when they needed to provide information for the project development to proceed, according to state officials  PA staff involved with the third test implementation in Georgia in 2016 and 2017 said there were not enough site inspectors or program delivery managers to fully manage the workload at the JFO  Because of the specialization of roles, projects could not move forward when there were not enough staff to execute the next step in the process  For example, PA staff at the JFO said program delivery managers completed recovery scoping meetings rapidly, but faced a bottleneck in scheduling site inspections because there were more applicants awaiting site inspections than could be fulfilled by the number of site inspection specialists available  Staff levels at the CRC  Staff at the CRC reported challenges with staffing levels during the Oregon and Georgia test implementations, and expressed concerns about when PA officials will staff the CRCs to support full implementation of the new model for all disasters  During the Oregon test implementation, a CRC specialist said there were not enough technical specialists to manage the workload and, as a result, PA program officials had to redeploy site inspectors from their JFO field operations to the CRC to complete costing estimates  During the third test in Georgia, quality assurance specialists said that their workload resulted in added stress trying to complete the work in time while adhering to quality standards  According to CRC specialists in Denton, Texas, PA officials had not determined required staff levels for full implementation, but agreed that workload was too high and program officials needed to determine the appropriate staff levels for each CRC to support full implementation  PA officials were still evaluating CRC processing times and workload management from the Oregon and Georgia test implementations to determine staffing needs, according to PA officials  Further, PA program officials plan to establish a second CRC in Winchester, Virginia, before the end of 2017, but have not determined the number of additional permanent full-time staff needed to support the CRCs for full implementation of the new delivery model  Staff levels for the hazard mitigation specialists  PA officials have not identified the number of hazard mitigation specialists in FIMA’s hazard mitigation cadre needed for full implementation of the new delivery model  According to JFO staff, current hazard mitigation staff levels are insufficient to provide the desired in-person participation of hazard mitigation staff on all recovery scoping meetings to share information on hazard mitigation with applicants and help them identify potential mitigation opportunities  A PA program official said officials missed opportunities to pursue hazard mitigation during the test implementation after Hurricane Matthew in Georgia due to lack of hazard mitigation specialists  In addition, for the test implementation in Oregon, there were not enough hazard mitigation specialists to cover all site inspections and implement their new delivery model responsibilities, according to FEMA’s after-action reports  The absence of hazard mitigation specialists in the early stages of PA project development may cause delays in officials’ identifying hazard mitigation opportunities, according to a FIMA official  PA program officials said they did not work with FIMA to determine the appropriate levels of hazard mitigation staff under the new delivery model because they were refining the new process, but as of June 2017 were working with FIMA to do so  One of the key implementation activities in our Business Process Reengineering Assessment Guide includes addressing workforce management issues  Specifically, this includes identifying how many and which employees will be affected by the position changes and retraining  Further, our prior work has found that high-performing organizations identify their current and future workforce needs—including the appropriate number and deployment of staff across the organization— and address workforce gaps, to improve the contribution of critical skills and competencies needed for mission success  According to a PA program official, their initial workforce assessment was not comprehensive because they were still collecting data required to make informed decisions  PA officials agreed that updating their workforce assessments prior to full implementation could be helpful, and acknowledged that program officials needed to be more proactive applying the lessons learned as they pivot from testing to full implementation of the new delivery model in 2018  FEMA also conducts a standard agency wide workforce structure review every 2 to 3 years, which helps officials determine the appropriate disaster workforce levels  As of June 2017, PA officials were working with other offices within FEMA to expedite the agency-wide assessment of the PA and FIMA hazard mitigation cadres, but did not know when they would complete the assessment  PA officials also acknowledged that they faced an aggressive schedule to complete various planned activities for workforce management, training, and other efforts, in support of full implementation, and that they may not be able to complete all efforts as thoroughly as they would like in order to expedite the transition of the PA program to the new delivery model  The gaps in PA workforce assessment in the JFOs, CRCs, and for FIMA’s hazard mitigation cadre present a risk that PA program managers will not have a sufficient workforce to support the goals of the new delivery model  In addition, the timing and implementation of the hiring and training activities for new PA program staff could take multiple months, and program officials will need to know what staff levels are necessary for full implementation of the new delivery model to inform resource decisions for the program in coordination with other agency offices  According to PA program officials, workforce assessment efforts have been delayed as a result of disaster response and recovery efforts related to Hurricanes Harvey, Irma, and Maria  Completing a workforce assessment will help program officials identify gaps in their workforce and skills, which could help PA program officials minimize the effects of long- standing workforce staffing and training challenges on the PA program delivery and inform full implementation for all disasters  costs  For example, EMMIE does not collect information on all of the preaward activities that are part of the PA grant application process  As a result, PA program officials said they, and applicants, must use ad hoc reports and personal tracking documents to manage and monitor the progress of grant applications  PA officials added that EMMIE is not user- friendly and applicants often struggle to access the system  In response to these ongoing challenges, PA program officials developed FAC-Trax— a separate information system from EMMIE—with new capabilities designed to improve transparency, efficiency, and management of the PA program  Specifically, FAC-Trax allows FEMA staff (PA Grants Manager) and applicants (PA Grants Portal), to review, manage, and track current PA project status and documentation  For example, applicants can use FAC- Trax to submit requests for public assistance, upload required project documentation, approve grant application items, and send and receive notifications on grant progress and activities  In addition, the FAC-Trax system includes standardized forms, as well as required fields and tasks that PA program staff and applicants must complete before moving on to the next steps in the PA preaward process  According to PA officials, these capabilities increase transparency, encourage greater applicant involvement, and enhance collaboration and communication between FEMA and grant applicants, to improve efficiency in processing and awarding grant applications and enhance the quality of project development  Further, PA officials said that FAC-Trax could reduce challenges associated with staff turnover during the project development process because the system stores and maintains applicant information and project documentation, making it easier for transitioning staff to assist an applicant  They also said they use FAC-Trax to gather and analyze data that supports management of the PA process, including measuring the timeliness of the grant application process  For example, during the test implementation of the new delivery model in Georgia following Hurricane Matthew, officials were able to document that, on average, program delivery managers took 5 days to conduct the exploratory call and 14 days to hold the recovery scoping meeting with applicants, and CRC officials took 33 days to develop and review grant proposals  Managers use this data to assess staffing needs and identify bottlenecks in the PA process, according to PA officials  FAC-Trax is critical to the new PA delivery model and will be a primary means of sharing grant application documents, tracking ongoing PA projects, and ensuring that FEMA staff and applicants follow PA grant policies and procedures  Given the importance of developing and testing this new information sharing system, we evaluated its development against four key IT management controls—(1) project planning; (2) risk management; (3) requirements development; and (4) systems testing and integration  When implemented effectively, these controls provide assurance that IT systems will be delivered within cost and schedule and meet the capabilities needed by its users  We found that FEMA’s development of FAC-Trax fully satisfied best practices for project planning and risk management, but additional steps are needed to fully satisfy the areas of requirements development and systems testing and integration, as discussed below  See appendix II for the full assessment of each IT management control  PA program officials fully satisfied all five practices in the project planning control area, according to our assessment  Key project planning practices are (1) establishing and maintaining the program’s acquisition strategy, (2) developing and maintaining the overall project plan and obtaining commitment from relevant stakeholders, (3) developing and maintaining the program’s cost estimate, (4) establishing and maintaining the program’s schedule estimate, and (5) identifying the necessary knowledge and skills needed to carry out the program  To address the first and second practices, program officials established detailed plans that describe the acquisition strategy and objectives, the program’s scope, and its framework for using an Agile software development approach, among other key actions  Agile is a method of software development that utilizes an iterative process and constantly improves software based on user needs and feedback  Program officials also developed a plan detailing the program’s approach to deploy and maintain FAC-Trax and established stakeholder groups and an integrated product team to support and oversee the development of FAC-Trax  To address the third and fourth practices, they developed and maintained a master schedule of all implementation tasks and milestones through project completion, and developed a life-cycle cost estimate of over $19 million  Additionally, FAC-Trax’s acquisition performance baseline describes the system’s minimum acceptable and desired baselines for performance, schedule, and cost  Lastly, in regards to the fifth practice, program officials identified the knowledge and skills needed to carry out the program in the FAC-Trax Request for Proposal and FAC-Trax Capability Development Plan  PA program officials fully satisfied all four practices in the risk management control area, according to our assessment  Key risk management practices are (1) identifying risks, threats, and vulnerabilities that could negatively affect work efforts, (2) evaluating and categorizing each identified risk using defined risk categories and parameters, (3) developing risk mitigation plans for selected risks, and (4) monitoring the status of each risk periodically and implementing the risk mitigation plan as appropriate  To address the first and second practices, program officials identified key risks that could negatively affect FAC-Trax in a “risk register”—an online site used to track risks, issues, and mitigating actions  As of May 2017, officials had identified 13 risks in the risk register—four open and nine closed—and evaluated and categorized the identified risks based on the probability of occurrence and scope, schedule, and cost impacts  For example, program officials reported that two of its open risks have a “medium” risk rating—meaning the risk has the potential to slightly affect project cost, schedule, or performance  To address the third and fourth practices, program officials developed and documented risk mitigation plans for all identified risks  For example, program officials planned to mitigate the risk of limited engagement of subject matter experts by identifying and engaging with appropriate experts through workshops, and monitoring the capability development process to identify any issues that may cause project delays  In addition, PA program officials documented the responsible officials, reevaluation date, and risk status, among other things, for each risk in the register, and reviewed and updated risks during weekly and monthly program reviews with stakeholders throughout FEMA  PA program officials fully satisfied four out of five practices in the requirements development control area, according to our assessment  Key requirements development practices are (1) eliciting stakeholder needs, expectations, and constraints, and transforming them into prioritized customer requirements; (2) developing and reviewing operational concepts and scenarios to refine and discover requirements; (3) analyzing requirements to ensure that they are complete, feasible, and verifiable; (4) analyzing requirements to balance stakeholder needs and constraints; and (5) testing and validating the system as it is being developed  To address the first and second practices, program officials developed a requirements management plan outlining how officials capture, assess, and plan for FAC-Trax enhancements, and established a change control process to review, prioritize, and verify user requests for changes to the system and feedback  As of May 2017, the PA program office received 734 change requests related to FAC-Trax, of which program officials completed 420 changes and planned to address an additional 277 entries  Program officials also developed a functional requirements document outlining the high-level requirements for FAC- Trax and detailed operational concepts and scenarios for each phase of the preaward process in the system’s concept of operations  To address the fourth practice, program officials created a standard template to analyze and document the user needs and acceptance criteria for planned system capabilities in March 2017  In addition, PA program officials identified risks and dependencies for recommended changes to FAC-Trax, and balanced the cost and priority of system enhancements as part of the change control process  Lastly, regarding the fifth practice, program officials tested and evaluated FAC-Trax during development, which included validating system enhancements through user acceptance testing  However, program officials did not fully address the third practice— analyzing requirements to ensure they are complete, feasible, and verifiable—because they did not ensure detailed user requirements were necessary and sufficient by tracking them back to higher-level requirements  For example, although program officials reviewed change requests for completeness and followed up with users to verify requirements, officials did not track system enhancements, made in response to detailed user requirements (e g , allowing users to search PA projects by project number), back to the high-level requirements (e g , storing data and information provided by the applicant) identified in the FAC-Trax functional requirements document and performance work statement  Officials did not track system enhancements back to high-level requirements because they did not have a complete understanding of basic user needs and system requirements at the beginning of the FAC- Trax effort, according to the PA program manager  A PA official also said the change control process was a way to identify the basic capabilities FAC-Trax needed to have and that tracking enhancements back to high- level requirements could have made the change control process more difficult to manage, and reduced user participation if, for example, users needed to understand how their change requests related to high-level requirements  However, program officials could have tracked enhancements back to high-level requirements themselves using the change control process without putting any additional burden on users  Despite not having a complete understanding of user needs and system requirements at the beginning of the FAC-Trax effort, analyzing whether users’ change requests satisfy higher-level requirements identified in key design and planning documents would have provided officials with a basis for more detailed and precise requirements throughout project development and helped them better manage the project, according to IT management controls  Further, according to the PMBOK® Guide, tracking or measuring system capabilities against approved requirements is a key process for managing a project’s scope, measuring project completion, and ensuring the project meets user needs and expectations  Program officials acknowledged the importance of tracking system enhancements back to documented system requirements  Ensuring that FAC-Trax meets user needs and expectations is especially important because the information system is key to the success of the new delivery model, according to PA officials  By analyzing progress made on documented, high-level requirements, a step that reflects a key IT management control for requirements development, the PA program will have greater assurance that FAC-Trax will provide functionality that meets user needs and expectations  PA program officials did not fully satisfy either of the two practices in the systems testing and integration control area, according to our assessment  Key systems testing and integration practices are (1) developing test plans and test cases, which include a description of the overall approach for system testing, the set of tasks necessary to prepare for and perform testing, the roles and responsibilities for individuals or groups responsible for testing, and criteria to determine whether the system has passed or failed testing; and (2) developing a systems integration plan to identify all systems to be integrated, describe how integration problems are to be documented and resolved, define roles and responsibilities of all relevant participants, and establish a sequence and schedule for every integration step  In regards to the first practice, PA program officials and the FAC-Trax contractor established a test plan that identifies the method and strategy to perform testing, including the necessary tasks, such as responding to user feedback and testing errors, and incorporating necessary resolutions into future work, testing parameters, and the roles and responsibilities of the individuals responsible for testing  However, program officials have not developed system testing criteria to evaluate FAC-Trax, which would align with the practice described above of using criteria to determine whether the system has passed or failed testing  A key feature of Agile software development is the “definition of done”—a set of clear, comprehensive, and objective criteria, that the government should use to evaluate software after each iteration of development  PA program officials said they did not establish a definition of done because officials initially managing the FAC-Trax effort lacked familiarity with system development in the Agile environment  Officials acknowledged the importance of establishing a definition of done and said they are planning to develop one, but have not identified how or when to incorporate it into the development process  According to the TechFAR—the government’s handbook for procuring digital services using Agile processes—the government and vendor should establish this definition after contract award at the beginning of each cycle of software development  By establishing criteria, such as a definition of done, to evaluate the system—a step that reflects a key IT management control for system testing and is an effective practice for applying Agile to software development—the PA program will have greater assurance that FAC- Trax is usable and responsive to specified requirements  In regards to the second practice, PA program officials developed a systems integration plan in June 2017 that identified the potential for integration of FAC-Trax with four FEMA systems, including EMMIE  In addition, program officials included a description of how staff should document integration problems and the resolution of problems in FAC- Trax development and test plans  However, the systems integration plan does not define roles and responsibilities of all participants for system integration activities or establish a sequence and schedule for every integration step for the four FEMA systems  PA officials said that system integration planning for FAC-Trax is in the early stages, but acknowledged the importance of these elements of system integration planning  Officials plan to define roles and responsibilities of all participants for system integration activities and develop the sequence and schedule for every integration step as they add new systems to the FAC-Trax development plan and obtain funding needed for their integration  Nonetheless, FEMA has used FAC-Trax for selected PA disasters since October 2016 and plans to use FAC-Trax for all future disasters  According to IT management controls, agencies should establish the systems integration plan early in the project and revise it to reflect evolving and emerging user needs  By ensuring that the FAC- Trax systems integration plan defines the roles and responsibilities of relevant participants for all integration relationships and establishes a sequence and schedule for every integration step, the PA program will have greater assurance that FAC-Trax functions properly with other systems and meets user needs  FEMA’s new delivery model enhances participation of hazard mitigation staff with the goal of identifying opportunities for mitigation earlier in the PA preaward process, according to PA officials  Two key changes related to hazard mitigation under the new model include (1) an emphasis on engaging with hazard mitigation specialists at the JFO earlier in the PA process and involving them in specific PA preaward activities and (2) the establishment of the PA program’s hazard mitigation liaison at the CRC  For example, position guides direct program delivery managers to coordinate with FIMA’s hazard mitigation specialists prior to recovery scoping meetings, and site inspectors to coordinate with hazard mitigation specialists prior to site inspections to discuss a PA grant applicant’s damages and any potential mitigation opportunities  PA program officials also developed guidance for conducting the exploratory call and the recovery scoping meeting with applicants, which include questions for PA staff to ask on the applicant’s interest in or plans for incorporating hazard mitigation into potential projects  In addition, a new hazard mitigation liaison at the CRC is responsible for reviewing PA projects for hazard mitigation opportunities and serving as a mitigation subject matter expert for the PA program  According to data provided by FEMA, PA grant applicants incorporated hazard mitigation into approximately 18 percent of permanent work projects for all disasters nationwide from 2012 to 2015  During test implementation of the new delivery model, state, PA, and FIMA officials all reported an increase in the number of hazard mitigation activities on PA permanent work projects  For example, state officials who participated in the second new model test in Oregon said that effective communication and coordination between PA and hazard mitigation staff resulted in applicants incorporating hazard mitigation into over 60 percent of permanent work projects  Furthermore, PA officials reported an increase in hazard mitigation during the third test implementation of the new model in Georgia following Hurricane Matthew, where approximately 16 percent of permanent work projects included mitigation, as of June 2017  This represents an increase compared to the PA program’s estimate for the proportion of projects that incorporate hazard mitigation among previous PA hurricane disasters in Georgia, which was about 3 percent, according to PA officials  While PA officials are trying to increase hazard mitigation through the new delivery model, not all disasters present the same number of opportunities to incorporate hazard mitigation  First, the PA program only incorporates hazard mitigation measures for permanent work projects, such as repairs to roads, bridges, and buildings  For example, as of June 2017, approximately 60 percent of the projects FEMA funded in Georgia for the third test implementation after Hurricane Matthew were for emergency work, which is not eligible for hazard mitigation measures  Second, the PA program only funds mitigation measures that officials determine to be cost-effective  In addition, we have previously reported on other factors that affect whether applicants incorporate hazard mitigation into PA projects, such as their capacity to manage and ability to fund hazard mitigation projects  National Planning for Hazard Mitigation In our 2015 report on disaster resilience following Hurricane Sandy, we noted that disaster affected areas have different threats and vulnerabilities, and local stakeholders make the ultimate determination whether or not to incorporate hazard mitigation into a project  Further, without a strategic approach to making disaster resilience investments, the federal government and its nonfederal partners may be unable to fully capitalize on opportunities for mitigation on the greatest known threats and hazards  We recommended that the Mitigation Framework Leadership Group develop an investment strategy to help ensure that federal funds expended to enhance disaster resilience achieve the goal of reducing the nation’s fiscal exposure because of climate change and the rise in the number of federal major disaster declarations as effectively and efficiently as possible  In response, the Federal Emergency Management Agency (FEMA) plans to issue a final National Mitigation Investment Strategy in 2018  The goals of this strategy include increasing the effectiveness of investments in reducing disaster losses and increasing resilience, and improving coordination of disaster risk management among federal, state, local, tribal, territorial, and private entities  Although the new model establishes hazard mitigation activities for PA and FIMA staff in the preaward process, it does not standardize and prioritize hazard mitigation planning at JFOs in the way FEMA has done with prior PA program policy  Specifically, FEMA’s 2007 PA program policy standardized planning for hazard mitigation across PA recovery efforts by stating that agency and state officials should issue a memorandum of understanding (MOU) early in the disaster, outlining how PA hazard mitigation will be addressed for the disaster, including what mitigation measures will be emphasized, and identifying applicable codes and standards, and any potential integration with other mitigation grant programs  However, PA program officials did not include guidance that standardizes planning for hazard mitigation, such as encouraging the use of an MOU, in FEMA’s 2010 PA program policy, the most recent update to the Public Assistance Program and Policy Guide in April 2017, or the New Delivery Model Operations Manual  As a result, FIMA officials said FEMA and state officials do not consistently issue MOUs that outline how FEMA and the state plan to promote PA hazard mitigation during the recovery effort, explaining that the use of the MOU is based on the preferences and priorities of the FEMA officials involved  When not issuing an MOU, FIMA hazard mitigation staff and PA officials at the JFO meet to determine the extent which hazard mitigation staff interact directly with applicants regarding PA hazard mitigation during the recovery process, according to a FIMA official  Having a consistent approach to planning for and prioritizing hazard mitigation across all disasters is important for FEMA, given that FEMA experienced challenges consistently prioritizing and integrating hazard mitigation across PA recovery efforts, according to GAO and others  For example, in our 2015 report on resilience in the Hurricane Sandy recovery, we found that state and local officials experienced challenges maximizing disaster resilience in the recovery effort because PA officials did not consistently prioritize hazard mitigation during project development  According to FEMA’s National Mitigation Framework, planning is vital for mitigation efforts during disaster recovery, and federal, state, and local officials should establish procedures that emphasize a coordinated delivery of mitigation activities and capitalize on opportunities to reduce future disaster losses  Similarly, the Recovery Federal Interagency Operational Plan, which supports FEMA’s National Disaster Recovery Framework, identifies planning as a key task for identifying mitigation opportunities and integrating risk reduction considerations into decisions and investments during the recovery process  FIMA officials agreed that including the development of a formal plan, such as the historical 2007 PA program policy regarding the use of MOUs, for PA hazard mitigation in operations guidance would help program officials plan for and prioritize hazard mitigation  They noted that FIMA’s hazard mitigation field operations guide includes procedures for implementing proposed MOUs to achieve mitigation goals  PA program officials said that, in light of changes to the PA process under the new model and subsequent updates to program policies, the MOU policy from the 2007 PA program policy was outdated  But officials agreed that planning for and prioritizing hazard mitigation at the operational level is important and said they were examining additional ways to incorporate these activities early in the PA process  As FEMA continues to implement the new model, establishing procedures to standardize hazard mitigation planning for each disaster, as it did through prior policy, could improve the prioritization of hazard mitigation in PA recovery efforts and increase the effectiveness of mitigation for reducing disaster losses and increasing resilience  PA program officials developed performance objectives and measures for hazard mitigation in the new delivery model, but could add measures to better align performance assessment for the PA program with FEMA’s broader strategic goals for hazard mitigation  In its strategic plan for 2014–2018, FEMA established an agency-wide goal to increase the percentage of FEMA-funded disaster projects, such as those under the PA program, that provide mitigation above local, state, and federal building code requirements by 5 percentage points by the end of fiscal year 2018  For example, local building codes may require measures for new construction to mitigate against future damage  To align with FEMA’s strategic goal, PA officials would also need to measure the number of PA projects that included mitigation measures that bring any repaired infrastructure to a level above applicable building codes  However, under the new model, FEMA officials developed performance objectives (and associated measures) to increase the number of projects that include hazard mitigation by 5 percent, and increase the total dollars spent on hazard mitigation by 2 percent  While these measures could help to incentivize mitigation, they are not tied to building codes and do not include specific information that FEMA could use to continually assess the PA program’s contributions to meeting the agency’s strategic goal  According to Standards for Internal Control in the Federal Government, agency management should design control activities, such as establishing and reviewing performance measures, to achieve the agency’s objectives  In addition, our work on leading public sector organizations has found that such organizations assess the extent to which their programs and activities contribute to meeting their mission and desired outcomes, and strive to establish clear hierarchies of performance goals and measures  A clear connection between performance measures and program offices helps to both reinforce accountability and ensure that, in their day-to-day activities, managers keep in mind the outcomes their organization is striving to achieve  FEMA’s ability to evaluate and report on PA hazard mitigation data is constrained, but officials are addressing this challenge through the development of data reporting and analytics capabilities for the PA program’s new information system, according to PA officials  PA program officials developed measures they could use to evaluate the new model during test implementation and compare new model performance to the legacy PA process, and agreed that aligning PA program hazard mitigation goals with FEMA’s agency-wide strategic goals would be helpful  As FEMA continues to develop and implement the new model, developing performance measures and objectives to better inform and support the agency’s broader strategic goals could help to ensure that FEMA capitalizes on hazard mitigation opportunities in PA recovery efforts  FEMA’s Public Assistance grant program is a complicated, multi-billion dollar program that is critical to helping state and local communities rebuild and recover after a major disaster  In recent years, FEMA has undertaken a major reengineering effort to make the PA preaward process simpler and more efficient for applicants and to address challenges encountered during recovery from past disasters  FEMA’s new delivery model represents a significant opportunity to strengthen the PA program and address these past challenges, and growing pains are to be expected when implementing any large reengineering effort  Further, FEMA officials work to implement these changes while supporting response and recovery following disasters, including the catastrophic flooding from Hurricane Harvey in August 2017 and widespread damages from Hurricanes Irma and Maria in September 2017  As such, it is critical that feedback obtained and lessons learned while testing the new model inform decisions and actions as FEMA proceeds with full implementation for all disasters, including the complex recovery efforts in the states and territories affected by Hurricanes Harvey, Irma, and Maria  FEMA has redesigned the PA delivery model to address various challenges related to workforce management, information sharing with state and local grantees, and incorporating hazard mitigation into PA projects  FEMA has developed new workforce processes, training, and positions to address past challenges, but completing a workforce assessment that identifies the number of staff needed will inform workforce management and resource allocation decisions to help FEMA ensure a more successful implementation  This is particularly important as FEMA is using the new model for the long-term recovery from the 2017 hurricanes, and FEMA faces capacity challenges as its workforce is stretched thin  Further, FEMA’s new FAC-Trax information sharing system provides FEMA and state and local applicants and grantees with better capabilities to address past challenges in managing and tracking PA projects  In developing FAC-Trax, FEMA implemented many of the key IT management controls that can help ensure that new IT systems are implemented effectively  However, additional steps are needed to fully satisfy the areas of requirements development and systems testing and integration  Finally, FEMA has taken some actions to better promote hazard mitigation as part of its new PA model  However, more consistent planning for hazard mitigation following a PA disaster and developing specific performance measures and objectives that better align with and support the agency’s broader strategic goals related to hazard mitigation could help to ensure that mitigation is incorporated into recovery efforts, which presents an opportunity to encourage disaster resilience and reduce federal fiscal exposure from recurring catastrophic natural disasters  We are making the following five recommendations to FEMA’s Assistant Administrator for Recovery: The FEMA Assistant Administrator for Recovery should complete a workforce staffing assessment that identifies the appropriate number of staff needed at joint field offices, Consolidated Resource Centers, and in FIMA’s hazard mitigation cadre to implement the new delivery model nationwide  (Recommendation 1) The FEMA Assistant Administrator for Recovery should establish controls for tracking FAC-Trax capabilities to the system’s functional and operational requirements to more fully satisfy requirements development controls and ensure that the new information system provides capabilities that meets users’ needs and expectations  (Recommendation 2) The FEMA Assistant Administrator for Recovery should establish system testing criteria, such as a “definition of done,” to assess FAC- Trax as it is developed; define the roles and responsibilities of all participants; and develop the sequence and schedule for integration of other systems with FAC-Trax to more fully satisfy systems testing and integration controls  (Recommendation 3) The FEMA Assistant Administrator for Recovery, in coordination with the Associate Administrator of the Federal Insurance and Mitigation Administration, should implement procedures to standardize planning for addressing PA hazard mitigation at the joint field offices, for example, by requiring FEMA and state officials to develop a memorandum of understanding outlining how they will prioritize and address hazard mitigation following a disaster as it did through prior policy  (Recommendation 4) The FEMA Assistant Administrator for Recovery, in coordination with the Associate Administrator of the Federal Insurance and Mitigation Administration, should develop performance measures and associated objectives for the new delivery model to better align with FEMA’s strategic goal for hazard mitigation in the recovery process  (Recommendation 5) We provided a draft of this report to DHS and FEMA for review and comment  DHS provided written comments, which are reproduced in appendix III  In its comments, DHS concurred with our recommendations and described actions planned to address them  FEMA also provided technical comments, which we incorporated as appropriate  With regard to our first recommendation, that FEMA complete a workforce staffing assessment that identifies the number of staff needed at joint field offices, Consolidated Resource Centers, and FIMA’s hazard mitigation cadre, DHS stated that PA, in coordination with the Field Operations Directorate and FIMA, will continue to refine and evaluate staffing needs and update the cadre force structures under the new delivery model  DHS estimated that this effort would be completed by June 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our second recommendation, that FEMA establish controls for tracking FAC-Trax capabilities to ensure the new information system meets users’ needs, DHS stated that Recovery program managers will update the FAC-Trax Requirements Management Plan and the FAC-Trax Release Plan to ensure the tracking and traceability of FAC-Trax functional and operational requirements  DHS estimated that this effort would be completed by January 31, 2018  This action, if fully implemented, should address the intent of the recommendation  With regard to our third recommendation, that FEMA establish systems testing criteria to assess the development of FAC-Trax; and define the roles and responsibilities, and sequence and schedule for system integration, DHS stated that Recovery program managers will update the FAC-Trax System Integration Plan to include integration with the Deployment Tracking System, Enterprise Data Warehouse, Preliminary Damage Assessment interface, and State Grants Management system interface  DHS estimated that this effort would be completed by June 29, 2018  This action, if fully implemented, should address the intent of the recommendation  With regard to our fourth recommendation, that FEMA implement procedures to standardize planning for addressing PA hazard mitigation at the JFO, DHS stated that PA will update current process documents or develop new documents to better incorporate mitigation into the operational planning phase of the new delivery model  DHS estimated that this effort would be completed by July 31, 2018  This action, if fully implemented, should address the intent of the recommendation  With regard to our fifth recommendation, that PA coordinate with FIMA to develop performance measures and associated objectives for the new delivery model that better align with FEMA’s strategic goals for hazard mitigation in the recovery process, DHS stated that PA will reconvene the PA-Mitigation working group to develop and refine PA related hazard mitigation performance measures  DHS estimated that this effort would be completed by June 29, 2018  This action, if fully implemented, should address the intent of the recommendation  We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees  If you or your staff have any questions about this report, please contact me at (404) 679-1875 or CurrieC@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IV  Appendix II: Assessment of Information Technology Management Controls for the FEMA Applicant Case Tracker (FAC-Trax) Table 2 shows details on the Federal Emergency Management Agency (FEMA) Public Assistance (PA) program office’s implementation of key practices across four information technology (IT) management control areas for its new information system, the FEMA Applicant Case Tracker (FAC-Trax)  PA developed FAC-Trax as a web-based project tracking and case management system to supplement the Emergency Management Mission Integrated Environment (EMMIE) and help resolve long-standing information sharing challenges  To determine the extent to which the FAC-Trax program office implemented IT management controls, we reviewed documentation from the FAC-Trax program and compared it to key management best practices, including the Software Engineering Institute’s Capability Maturity Model® Integration for Acquisition and Development, the Project Management Institute’s Guide to the Project Management Body of Knowledge (PMBOK® Guide), and the Institute of Electrical and Electronics Engineers’ Standard for Software and System Test Documentation  We assessed the program as having fully implemented a practice if the agency provided evidence that it fully addressed the practice; partially implemented if the agency provided evidence that it addressed some, but not all, portions of the practice; and not implemented if the agency did not provide any evidence that it addressed the practice  Table 2  Public Assistance (PA) Program Office’s Implementation of Key Information Technology Management Controls for FAC-Trax PA program officials developed an acquisition plan for FAC-Trax identifying the capabilities the system is intended to deliver, the acquisition approach, and acquisition objectives  Additionally, program officials developed a capability development plan outlining a strategy for the program to obtain approval to acquire FAC-Trax  Lastly, program officials developed a systems engineering plan describing the program’s scope and its framework for using an Agile development approach, as well as a deployment, support, and maintenance plan for FAC-Trax  PA program officials developed an acquisition program baseline detailing FAC-Trax’s cost parameters and a life-cycle cost estimate for the system  As of May 2017, the life- cycle cost estimate for FAC-Trax through fiscal year (FY) 2023 is approximately $19 3 million  PA program officials updated the life-cycle cost estimate for FYs 2016 and 2017 after price negotiations with the FAC-Trax contractor, and will continue to update the estimate as annual budgets are approved, according to the Integrated Logistic Support Plan  The contracting officer’s representative for FAC-Trax performs a cost review at the end of each month, according to program officials  Furthermore, the contractor’s weekly status report includes information on the number of hours worked and the percent of contract value spent  Program officials also review program costs with Office of Response and Recovery, PA, Office of the Chief Information Officer (OCIO), and other program office stakeholders during a weekly program review  PA program officials developed an acquisition program baseline detailing FAC-Trax’s schedule parameters, as well as an integrated master schedule for the system  The integrated master schedule identifies tasks, major milestones, and task dependencies  The PA program manager reviews and updates the integrated master schedule on a weekly basis  Program officials also review FAC-Trax’s schedule with Office of Response and Recovery, PA, OCIO, and other program office stakeholders during a weekly program review  PA program officials identified the knowledge and skills needed to carry out the program in FAC-Trax contract documentation and the capability development plan  Specifically, program officials included an attachment to the FAC-Trax contract listing the required labor categories and corresponding functional position descriptions  Program officials also described the role, position type, minimum grade, and minimum certification for required personnel resources for the acquisition, development, and implementation of FAC-Trax  PA program officials developed, reviewed, and maintained project planning documents and obtained commitment from relevant stakeholders  For example, program officials reviewed and updated the integrated master schedule and costs on a weekly and monthly basis, respectively  Further, program officials reviewed the status of project elements, such as the schedule, quality and technical issues, stakeholders, staffing, cost, and risks, with Office of Response and Recovery, PA, OCIO, and other program office stakeholders during a weekly program review  PA program officials also established tactical, functional, and stakeholder groups, as well as an Integrated Product Team to support and oversee the development of FAC-Trax  FEMA’s Recovery Technology Programs Division (RTPD) has a division-level risk management plan that serves as guidance for all Recovery systems, including FAC- Trax  Program officials identified key risks that could negatively affect FAC-Trax work efforts in RTPD’s “risk register”—an online site used to track risks, issues, and mitigating actions for the division and each program office  Program officials also identified five technical, cost, and schedule risks in the FAC-Trax acquisition plan  Program officials included one of these risks in the risk register, while the remaining four were managed outside of the register  As of May 2017, program officials had identified 13 risks in its risk register—four open and nine closed  The four open risks were (1) limited subject matter expert engagement during requirements development, (2) vacancies in program management office support positions, (3) unresolved service level agreement support and funding issues, and (4) the loss of the authority to operate due to a Trusted Internet Connection that is not compliant with Department of Homeland Security security policy  Program officials evaluated and categorized the identified risks based on the probability of occurrence and scope, schedule, and cost impacts  These four points of measurement are used to calculate an overall risk score  The risk score helps program officials determine a risk’s risk rating—low, medium, or high  For example, program officials reported that two of its open risks have a “medium” risk rating—meaning the risk has the potential to slightly impact project cost, schedule, or performance  In addition, program officials detailed the risk category, probability, and impact for the five risks identified in the FAC-Trax acquisition plan  Program officials developed risk mitigation and contingency plans for each risk in the risk register  For example, program officials planned to mitigate the open risk concerning subject matter expert engagement, by identifying and engaging with appropriate subject matter experts through requirements development workshops scheduled in advance of the sprint they are to support, and monitoring the development of user stories to identify any issues that may cause delays  In addition, program officials described the risk management plan and responsible officials for the five risks identified in the FAC-Trax acquisition plan  PA program officials review and update program risks during a monthly program meeting  Program officials also review program risks with Office of Response and Recovery, PA, OCIO, and other program office stakeholders during a weekly program review  Furthermore, the FAC-Trax contractor provides a weekly status update which includes a section on identified risks  Program officials established re-evaluation dates and recorded updates, including any actions taken, for each risk in the risk register  In addition, program officials were able to provide updates on the four risks identified in the FAC-Trax acquisition plan and managed outside of the register  According to PA officials, these risks were addressed and closed by the approval of program planning documents, such as the mission needs statement, concept of operations, and operational requirements document, following the solutions engineering review, which demonstrates the readiness of the program to proceed with the procurement, in September 2016  Program officials established a requirements management plan outlining how it captures, assesses, and plans for FAC-Trax enhancements, and established a change control process to review, prioritize, and verify user requests for changes to the system and feedback  As of May 2017, the PA program office received 734 change requests related to FAC-Trax, of which program officials completed 420 changes and planned to address an additional 277 entries  PA program officials also facilitated workshops to gather requirements for specific user groups and obtained additional requirements for FAC-Trax through customer feedback on a temporary technology tool— an Access database referred to as the Public Assistance Recovery Information System—used to support an early stage of the new model implementation  Further, program officials developed a functional requirements document outlining the high-level functional and operational requirements for FAC-Trax  PA program officials developed a concept of operations for FAC-Trax detailing operating concepts and scenarios for each phase of the PA preaward process  Program officials also detailed the workflow, phases, business functions, and data inputs and outputs for the re-engineered PA process in FAC-Trax’s functional requirements document  In March 2017, program officials developed a standard template to describe the process, tasks, and data inputs and outputs for specific system capabilities  As part of the change control process, PA program officials meet three times a week to discuss and prioritize change requests  Specifically, program officials review submissions to the change control form to ensure completeness, validate impacts and root cause, and research details for incoming requests  PA program officials also follow up with users to understand and verify requirements  In March 2017, program officials developed a standard template to capture acceptance criteria for specific requirements  However, PA program officials do not track system enhancements back to the high-level requirements identified in FAC-Trax’s operational and functional requirements documentation and performance work statement  PA program officials identified system requirements and constraints in the FAC-Trax concept of operations and functional and operational requirements documents  Further, through its change control process, program officials collect suggestions, issues, and feedback on FAC-Trax and system enhancements from stakeholders, identify risks for change requests, and balance prioritized requirements and estimated level of efforts with projected costs prior to each sprint  In March 2017, program officials developed a standard template to analyze and document the urgency and need for specific requirements  PA program officials and the FAC-Trax contractor established a testing and evaluation plan for the system, developed acceptance criteria for user stories, and obtained feedback from users during and after testing  The testing process concludes with user acceptance testing (UAT)  If a change request fails during UAT or a new requirement is discovered during development, the PA program will capture the failed request or new requirement in the product backlog for implementation in a future product release  Key practices Systems testing and integration Developing test plans and test cases PA program officials and the FAC-Trax contractor tested and evaluated the system during development  The FAC-Trax test plan identifies the method and strategy to perform the testing, including the necessary tasks, testing parameters, and the roles and responsibilities of the individuals responsible for testing  However, program officials did not develop system testing criteria to evaluate FAC-Trax  A key feature of Agile software development is the “definition of done”—a set of clear, comprehensive, and objective criteria, that the government should use to evaluate software after each iteration of development  PA program officials developed a systems integration plan in June 2017 that identifies potential integration of FAC-Trax and four FEMA systems, including the Emergency Management Mission Integrated Environment  Specifically, the plan includes data requirements and standards; descriptions of the four systems FEMA plans to integrate with FAC-Trax and the proposed relationship for each connection; and security and access management requirements  In addition, program officials included a description of how integration problems are to be documented and resolved in FAC-Trax development and test plans  However, the systems integration plan does not define roles and responsibilities of all participants for system integration activities or establish a sequence and schedule for every integration step for the four FEMA systems  ● Fully implemented: The agency provided evidence that it fully addressed this practice  ◐ Partially implemented: The agency provided evidence that it addressed some, but not all, portions of this practice  ◌ Not implemented: The agency did not provide any evidence that it addressed this practice  In addition to the contact named above, Chris Keisling (Assistant Director), Amanda R  Parker (Analyst-in-Charge), Mathew Bader, Allison Bawden, Anthony Bova, Eric Hauswirth, Susan Hsu, Rianna Jansen, Justin Jaynes, Tracey King, Matthew T  Lowney, Heidi Nielson, Claire Peachey, Brenda Rabinowitz, Ryan Siegel, Martin Skorczynski, Niti Tandon, Walter K  Vance, James T  Williams, and Eric Winter made key contributions to this report 


Report 2:  We found that the USAID staff who had direct responsibility for managing the project were generally aware of banking access challenges that affected project implementation, and had taken steps to help mitigate these challenges on a project-level basis  However, other relevant staff, such as USAID management and country-level headquarters staff, were not aware of these challenges  For example, partners in Syria and Somalia that we interviewed noted experiencing banking access challenges, but the USAID officials representing these countries in headquarters told us they were not aware of such challenges occurring recently  This situation may be, in part, because USAID has no designated office or process that focuses on communicating these issues throughout the agency to other relevant officials, including USAID management  Federal standards for internal control note that management should use quality information to achieve the entity’s objectives, and that entity management needs access to relevant and reliable communication related to internal as well as external events  If information on banking access challenges experienced by USAID partners is only reported to program-level staff and not communicated to a wider audience within the agency, then the agency as a whole may not fully recognize the overall risks posed by banking access challenges to USAID’s ability to achieve its objectives  Further, the agency may miss opportunities to assist other partners that might be experiencing similar issues based on lessons learned from previous experiences, if staff are not aware of the banking access challenges that have been experienced by its partners implementing other projects or working in other countries  USAID participation in interagency and partner efforts to address banking access challenges has been limited, in part because of a lack of communication with these external entities  According to Treasury officials, because there is no main focal point at USAID for banking access challenges, there is no consistency on who attends, or whether anyone attends, the Treasury-hosted roundtable meetings on banking access challenges from USAID  Further, an NPO trade association and other NPOs told us that it is difficult to find a person at USAID to engage with on banking access challenges  Lastly, a USAID/OFDA official stated that USAID has had limited engagement on issues related to banking access challenges  The OFDA official stated that once OFDA fully staffs its new Award, Audit, and Risk Management Team, it will be able to more fully engage on these issues  Federal standards for internal control state that management should communicate the necessary quality information both internally and externally to achieve the organization’s objectives  Without effective communication with partners and other government agencies about banking access challenges its partners face, USAID’s ability to effectively and consistently engage with these entities or contribute to efforts to help address these challenges is limited  The United States provides humanitarian assistance in countries that are often plagued by conflict, instability, or other issues that increase the risk of financial crimes  Some of these countries also face U S  sanctions that are aimed at their governments or other actors that engage in terrorism or illicit activities  Additionally, to ensure that the U S  financial system is not used for money laundering or financing terrorism, financial institutions such as banks are subject to various U S  laws and regulations that require banks to conduct proper due diligence on entities, such as those transferring funds to high-risk countries  However, there is concern among some organizations that banks’ higher level of due diligence, especially for clients such as charitable organizations that provide humanitarian assistance in high-risk countries, may create undue difficulties, including delays, for these organizations  Charitable organizations and others believe that because the United States and a key multilateral organization previously labeled charitable organizations as high-risk, banks remain reluctant to serve these organizations even though a case-by-case assessment of risk is now recommended  As such, we found that the majority of implementing partners—many of which are charitable organizations—of U S  government assistance that we interviewed had experienced some banking access challenges  Despite our findings and others’ findings on the prevalence of banking access challenges facing humanitarian assistance organizations, USAID’s current partner reporting does not capture information related to the potential risks of banking access challenges faced by its partners  Without collecting this information, USAID cannot help the partners mitigate banking access challenges  Additionally, if these challenges are not documented and shared throughout the agency, the prevalence of the challenges and potential risks cannot be fully assessed  Further, without communicating about banking access challenges faced by its partners throughout the agency and to others, the potential risk to agency objectives will not be known and USAID’s ability to engage with other agencies and organizations in helping to address these challenges is limited  We are making the following two recommendations to USAID: The Administrator of USAID should take steps to collect information on banking access challenges experienced by USAID’s implementing partners  (Recommendation 1) The Administrator of USAID should take steps to communicate information on banking access challenges faced by partners both within USAID and with external entities, such as other U S  agencies and U S  implementing partners  (Recommendation 2) We provided a draft of this report to State, USAID, and Treasury for comment  We received written comments from USAID that are reprinted in appendix VI  USAID concurred with our recommendations  Treasury provided technical comments, which we incorporated as appropriate  State told us that it had no comments on the draft report  We are sending copies of this report to the appropriate congressional committees, the Secretary of State, the Administrator of the U S  Agency for International Development, the Secretary of the Treasury, and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-9601 or melitot@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix VII  While the Department of State (State) and the U S  Agency for International Development (USAID) have encountered some banking access challenges, such as closed accounts and delays in transferring funds, these challenges did not affect their operations for providing assistance to high-risk countries  To send funds overseas, State, through two U S  disbursement offices managed by State’s Bureau of the Comptroller and Global Financial Services (CGFS), maintains foreign currency bank accounts in 172 countries  Funds are transferred from a Federal Reserve Bank to a U S  dollar bank account maintained by State, after which the funds are directed through a correspondent bank or a foreign exchange broker to a foreign bank account maintained by State  A correspondent bank serves as the intermediary between the bank sending a transfer, in this case a U S  dollar denominated bank account, and the bank issuing payment to the recipient, in this case the State-held account in the recipient country  Both the bank sending the transfer and the bank receiving the transfer hold an account at the correspondent bank, which is used for fund transfers, cash management, and other purposes  According to State, all State transfers overseas, as well as the majority of USAID payments overseas, are managed by CGFS, and in fiscal year 2017 CGFS’s two disbursement offices processed approximately 3 million payments through accounts managed by State in 172 countries  State officials told us that State encounters occasional banking access challenges, including short delays in funds transfers, denials of funds transfers to certain countries, and one bank-initiated account closure  State officials told us that they are able to mitigate the occasional banking access challenges that they encounter to ensure operations are not affected  For example: State’s transfers to countries sanctioned by the Office of Foreign Asset Control (OFAC) are occasionally flagged by intermediary banks  According to State, in fiscal year 2017 approximately one- tenth of one percent (0 1%) of payments were delayed because of OFAC sanctions  When this occurs, State receives questions on the details of those transfers  According to officials, this is an ongoing challenge, but State resolves such delays within 2 weeks—and typically within days—and there are no operational effects as a result of the delays  In some instances—including once in 2012, and once in 2018—an intermediary bank used by CGFS’s U S  bank stopped processing transfers to a recipient bank in a specific country  According to State officials, in both cases State identified an alternative intermediary bank to transfer funds to the destination country  In both cases, there were no operational effects  In 2014, an intermediary bank used by CGFS’s U S  bank ended its banking relationship with an OFAC-sanctioned country (Syria), and State was unable to move funds from its U S -dollar denominated accounts to that country  State, with the advice of the recipient bank in the OFAC-sanctioned country, identified an alternative intermediary bank that was able to move funds to that country using euro-denominated accounts  In 2014, a U S  bank—at which State maintained an account and that State used to fund its operations in Brunei—notified State that it would be closing State’s account with 29 days’ notice  State worked with Treasury to identify an alternative bank that would be willing to maintain a State bank account  The operation was not affected  For this review, we selected four countries—Syria, Somalia, Haiti, and Kenya—that may have a higher risk of financial crimes because of conflict, instability, or other issues  We selected them based on factors including the level of humanitarian assistance they received from U S  agencies, their inclusion on multiple financial-risk-related indices, and geographical diversity  Syria  Since 2011, Syria has been plagued by an ongoing multisided armed conflict fought primarily between the government of President Bashar al-Assad, along with its allies, and various forces opposing both the government and each other  Syria’s economy has deeply deteriorated amid the ongoing conflict, declining by more than 70 percent from 2010 to 2017  During 2017, the ongoing conflict and continued unrest and economic decline worsened the humanitarian crisis, necessitating high levels of international assistance, as more than 13 million people remained in need inside Syria and the number of registered Syrian refugees increased from 4 8 million to more than 5 4 million  Multiple terrorist groups operate inside Syria, raising the potential risk of terrorist financing  Additionally, according to a Central Intelligence Agency report, Syria is a transit point for opiates, hashish, and cocaine bound for regional and Western markets, and weak anti-money-laundering controls and bank privatization may leave it vulnerable to money laundering  The U S  maintains a comprehensive Syria sanctions program  A general license in the Syria regulations authorizes nonprofit organizations to provide services, including financial services, to Syria in support of certain not-for-profit activities, such as activities to support humanitarian projects to meet basic human needs and support education in Syria  Organizations providing humanitarian assistance that is not authorized by the general license may apply for a specific license to engage in those transactions  The United States has provided approximately $3 3 billion in humanitarian assistance for Syria since 2012  Somalia  Since 1969, Somalia has endured political instability and civil conflict, and is the third-largest source of refugees, after Syria and Afghanistan  Somalia lacks effective national governance and maintains an informal economy largely based on livestock, money transfer companies, and telecommunications  In the absence of a formal banking sector, money transfer companies have sprung up throughout the country, handling up to $1 6 billion in remittances annually  According to a 2016 State report, Somalia remained a safe haven for terrorists who used their relative freedom of movement to obtain resources and funds, recruit fighters, and plan and mount operations within Somalia and neighboring countries  The United States maintains a targeted list-based Somalia sanctions program  Organizations providing humanitarian assistance may apply for a specific license to engage in transactions that otherwise would be prohibited by the Somalia sanctions regulations  The United States has provided approximately $1 2 billion in humanitarian assistance for Somalia since 2012  Haiti  Currently the poorest country in the western hemisphere, Haiti has experienced political instability for most of its history  Remittances are the primary source of foreign exchange, equivalent to more than a quarter of GDP, and nearly double the combined value of Haitian exports and foreign direct investment  In January 2010, a catastrophic earthquake killed an estimated 300,000 people and left close to 1 5 million people homeless  Hurricane Matthew, the fiercest Caribbean storm in nearly a decade, made landfall in Haiti on October 4, 2016, creating a new humanitarian emergency  An estimated 2 1 million people were affected by the category 4 storm, which caused extensive damage to crops, houses, livestock, and infrastructure across Haiti’s southern peninsula  Haiti is identified as a fragile state by the Organisation for Economic Co-operation and Development, and as a jurisdiction of primary concern for money laundering in State’s International Narcotics Control Strategy Report  According to USAID, the agency has provided $187 8 million in humanitarian assistance for Haiti since 2012  Kenya  Kenya is the economic, financial, and transport hub of East Africa  Since 2014, Kenya has been ranked as a lower middle income country because its per capita GDP crossed a World Bank threshold  Al-Shabaab aims to establish Islamic rule in Kenya’s northeastern border region and coast and carried out a spate of terrorist attacks in Kenya  Kenya is identified as a fragile state by the Organisation for Economic Co-operation and Development, and as a jurisdiction of primary concern for money laundering in State’s International Narcotics Control Strategy Report  The United States has provided approximately $807 million in humanitarian assistance for Kenya since 2012  This report examines (1) the extent to which implementing partners of the Department of State (State) and the U S  Agency for International Development (USAID) experience banking access challenges that affect their implementation of humanitarian assistance projects, (2) USAID implementing partners’ reporting on banking access challenges, and (3) actions relevant U S  agencies have taken to help address banking access challenges encountered by nonprofit organizations (NPO)  In addition, we provide information on the extent to which State and USAID experience banking access challenges in providing assistance in high-risk countries in appendix I  To address these objectives, we examined U S -funded projects and their implementers in four high-risk countries—Syria, Somalia, Haiti, and Kenya  We selected these countries based on factors including the high level of humanitarian assistance they received from U S  agencies, their higher propensity for the occurrence of financial crimes based on their inclusion on multiple financial-risk-related indices, and to obtain geographical diversity  More specifically, to identify our list of high-risk countries in terms of banking or financial risk, we used several indices including ones based on financial risk, money laundering risk, and counterterrorism-related risk  The indices we chose to use were State’s International Narcotics Control Strategy Report (2014- 2016) (Money Laundering Risks), the Department of the Treasury’s (Treasury) Office of Foreign Assets Control (OFAC) sanctions, the Organisation for Economic Co-operation and Development’s (OECD) Fragile State Index (2014-2016), the 2017 Financial Action Task Force (FATF) High Risk and Non- Cooperative Jurisdictions list, and the BASEL AML Index, 2017  We then identified 19 countries that appeared on at least two of the five lists and received at least $100 million in U S  based humanitarian assistance from 2012 through 2017, based on data from the United Nations Office for the Coordination of Humanitarian Affair’s financial tracking system  We then applied the following primary selection criteria to select our four countries: whether they (1) appeared on at least three of the five identified lists and (2) have received at least $100 million in U S  humanitarian assistance since 2012  Secondary considerations that informed our selection included whether a country had been identified as having banking access challenges by USAID, geographical diversity, and ensuring we had at least one country from each of the five indices we chose  The data we obtained for these four countries cannot be generalized beyond our selected projects and partners  For our first objective, to examine the extent to which implementing partners of State and USAID experienced banking access challenges that affected their implementation of humanitarian assistance projects, we conducted semi-structured interviews with 18 partners about (1) one of 18 specific projects we had selected in one of our high-risk countries and (2) their experiences implementing their global portfolio of humanitarian assistance projects over the previous 5 years  In order to determine our sample of partners, we selected a weighted, non-generalizable sample of 18 projects located in our four selected high-risk countries  We selected our projects from a list, provided by State and USAID, of 195 projects that were active as of the end of fiscal year 2017 in these countries  In making our selection of projects we made sure that our sample included a mix of projects from each country (7 projects for Syria, 5 for Somalia, 3 for Haiti, and 3 for Kenya), and a mix of State and USAID projects (3 State and 15 USAID)  We selected those numbers for each country and each agency based on the number of projects in each country and the proportion of assistance provided  We selected one State project in each of the three countries where they were active  Once we had determined these parameters for our non-generalizable sample, we made the final selections of the projects at random, making sure that we did not select more than one project for any one partner  Several of the implementing partners in our sample operate in over 100 countries in every part of the world, while a few operate in 20 or fewer countries  Three of the partners are United Nations organizations  The implementing partners in our sample had fiscal year 2016 annual revenues ranging from $5 9 billion to just over $10 million  We conducted semi-structured interviews with each of the 18 implementing partners on potential banking access challenges, such as the ability to open and maintain new accounts and make transfers in a timely fashion, and the effect of those challenges on project implementation  Our interviews were separated into two distinct sets of questions—one on banking access challenges the implementing partner encountered on the selected project, and the other on any banking access challenges the implementing partner encountered in its global portfolio of humanitarian assistance projects over the previous 5 years (2013-2017)  When discussing their global humanitarian assistance portfolios, the partners did not limit their responses to projects funded by U S  government agencies, but instead considered projects funded by all of their donors  We did not ask the partners to quantify the number of projects they had implemented over the previous 5 years, nor did we ask them to quantify the number of projects in their global portfolio of humanitarian assistance for which they had experienced banking access challenges  Our interview followed a protocol that asked both closed and open-ended questions  For most banking access challenges, when interview respondents indicated that their project or organization had experienced a banking access challenge, we probed for details of the challenge, including whether the challenge had caused an adverse effect on the project, such as project delays or cancellations  After the interviews had been conducted, we content-coded some of the open- ended answers we received  Specifically, we developed codes on whether any challenges reported had adversely affected the projects, the extent and duration of delays in transferring funds, and the extent and frequency of denials of international fund transfers  Two analysts independently coded each interview  The analysts then compared their coding and reconciled any initial disagreements  We also reviewed relevant studies on banking access challenges for NPOs conducted by the World Bank and the Charity and Security Network (CSN)  The study conducted by CSN included a survey that was designed to be generalizable to the population of all U S  NPOs with activities outside the U S , including providing humanitarian assistance  This survey received more than 300 responses, which constituted a reported response rate of about 38 percent  The researchers conducting the survey indicated that this response rate could be considered high for a public opinion telephone survey but low for a survey like the Census  The study determined the survey findings to be representative of the population with some qualifications, such as the fact that smaller organizations were more likely to complete the survey than larger organizations  The maximum margin of error was estimated to be 5 4 percent  More than 70 of the NPOs reported that they had received U S  government funding  We requested and received some additional data analysis from the researchers who had conducted this survey  We examined the aggregate survey responses in detail and compared them to the responses we received to our semi-structured interview questions, which probed into similar aspects of financial access  We reviewed documentation and interviewed the officials responsible for the survey and determined that they had used a reasonable methodology to conduct the survey  We also interviewed several NPOs and NPO groups that were not part of our sample to obtain their views on banking access challenges affecting those delivering humanitarian assistance  For our second objective, to examine USAID implementing partners’ reporting on banking access challenges, we reviewed the fiscal year 2017 progress reports, including quarterly, semi-annual, and annual reports, that USAID provided for our selected projects to determine if banking access challenges the implementing partners told us about in the interviews had been reported in accordance with requirements in the individual award agreements  In total, we reviewed 26 reports from these partners  We also interviewed USAID agreement officers for the projects that stated they had experienced banking access challenges about implementing partners’ reporting of those banking access challenges  To obtain a broader context, we also reviewed over 1300 USAID implementing partner reports for fiscal years 2016 and 2017 from a wider selection of high-risk countries to determine the extent to which banking access challenges are being reported to USAID  To identify the relevant USAID progress reports, we searched USAID’s Development Experience Clearinghouse (DEC) for all periodic progress reports filed for fiscal years 2016 and 2017 by implementing partners working in selected 19 high-risk countries for instances of reporting on financial access challenges  Using these criteria, we identified 1,369 reports from fiscal years 2016-2017 from our selected 19 high-risk countries  The reports included annual reports, final contractor / grantee reports, final evaluation reports, and periodical and periodic reports (such as quarterly or semi-annual reports)  The 1,369 reports constituted our universe of reports for which we used a textual analysis program to automatically scan and search for words and phrases that we identified in a lexicon of financial access terms  We developed this lexicon of financial access terms based on a review of relevant research, interviews with industry organizations, and a manual review of USAID progress reports  Using the lexicon, our textual analysis program identified all mentions of identified terms in the universe of reports  Next, two analysts independently reviewed the mentions identified through our textual analysis software program to determine whether the mentions actually constituted a reporting of a financial access challenge  The analysts then reconciled any differences in their reviews  For the purposes of this review, we considered a relevant financial access challenge to be any challenge encountered by the implementing partner in obtaining U S  banking services, or in transferring funds from the United States to the destination country  We did not conduct a similar review of State partner reporting because we only had a sample of three State projects and one of the projects did not require direct written reporting to State  In addition, State does not have a central depository for partner reports that we could search, such as USAID’s DEC  For our third objective, to examine actions relevant U S  agencies have taken to help address banking access challenges encountered by NPOs, we conducted interviews with and reviewed documentation from State, USAID, and Treasury on actions they have taken to help address these challenges  We also discussed U S  agency involvement in efforts to help address these challenges with relevant organizations that represent NPOs  In addition, we reviewed relevant documentation published by the World Bank and the Financial Action Task Force on actions they have taken to help address banking access challenges encountered by NPOs, and interviewed relevant staff at the World Bank on efforts undertaken to address banking access challenges  To examine the extent to which State and USAID encountered banking access challenges in providing assistance in high-risk countries, we interviewed State officials responsible for conducting overseas transfers of funds for both State and USAID to determine if any banking access challenges exist that are specific to our case study countries as well as for U S  assistance worldwide  We also interviewed State and USAID officials with responsibility for overseeing programs in our four selected countries to determine if they had seen any effects of banking access challenges  We focused primarily on these agencies’ ability to access banking services in the United States and on the transfer of funds to the ultimate destination  We conducted this performance audit from July 2017 to September 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The United States provides humanitarian assistance primarily through offices and bureaus within the Department of State (State) and the U S  Agency for International Development (USAID)  The primary humanitarian offices and bureau are: State’s Bureau of Population, Refugees, and Migration (PRM)  PRM’s stated mission is to provide protection, ease suffering, and resolve the plight of persecuted and uprooted people around the world by providing life-sustaining assistance, working through multilateral systems to build global partnerships, promoting best practices in humanitarian response, and ensuring that humanitarian principles are integrated into U S  foreign and national security policy  PRM does not operate refugee camps or give aid directly to refugees, but rather works with entities that operate these programs, including the United Nations, other international organizations, and nonprofit organizations  USAID’s Office of U S  Foreign Disaster Assistance (OFDA)  OFDA states that it helps countries prepare for, respond to, and recover from humanitarian crises  According to USAID, OFDA works with the international humanitarian community to give vulnerable populations resources to build resilience and strengthen their ability to respond to emergencies  Assistance includes provision of emergency relief supplies, establishing early warning systems, and training on search and rescue efforts, as well as programs to help victims of disasters recover  USAID’s Office of Food For Peace (FFP)  FFP’s stated mission is to partner with others to reduce hunger and malnutrition, and help ensure that all individuals have adequate, safe, and nutritious food to support a healthy and productive life  According to FFP, it works to mobilize resources to predict, prevent, and respond to hunger overseas  FFP’s emergency activities include food assistance to help reduce suffering and support the early recovery of people affected by conflict and natural disaster emergencies  In addition to the individual named above, Mona Sehgal (Assistant Director), Michael Maslowski (Analyst in Charge), Ming Chen, Debbie Chung, Martin de Alteriis, Leia Dickerson, Mark Dowling, Erin Guinn- Villareal, Chris Keblitis, and Benjamin L  Sponholtz made key contributions to this report 

ground_truth: Since 2012, the United States has provided approximately $36 billion in humanitarian assistance to save lives and alleviate human suffering. Much of this assistance is provided in areas plagued by conflict or other issues that increase the risk of financial crimes. The World Bank and others have reported that humanitarian assistance organizations face challenges in accessing banking services that could affect project implementation. GAO was asked to review the possible effects of decreased banking access for nonprofit organizations on the delivery of U.S. humanitarian assistance. In this report, GAO examines (1) the extent to which State and USAID partners experienced banking access challenges, (2) USAID partners' reporting on such challenges, and (3) actions U.S. agencies have taken to help address such challenges. GAO selected four high-risk countries—Syria, Somalia, Haiti, and Kenya—based on factors such as their inclusion in multiple financial risk-related indices, and selected a non-generalizable sample of 18 projects in those countries. GAO reviewed documentation and interviewed U.S. officials and the 18 partners for the selected projects. Implementing partners (partners) for 7 of 18 Department of State (State) and U.S. Agency for International Development (USAID) humanitarian assistance projects that GAO selected noted encountering banking access challenges, such as delays or denials in transferring funds overseas. Of those 7 projects, 1 partner told us that banking access challenges adversely affected its project and 2 additional partners told us that the challenges had the potential for adverse effects. Moreover, the majority of partners (15 out of 18) for the 18 projects noted experiencing banking access challenges on their global portfolio of projects over the previous 5 years. USAID's partners' written reports do not capture potential risks posed by banking access challenges because USAID generally does not require most partners to report in writing any challenges that do not affect implementation. Six of the 7 projects that encountered challenges were USAID-funded. Of those 6 USAID projects, 5 partners told us that these challenges did not rise to the threshold of affecting project implementation that would necessitate reporting, and 1 did not report challenges although its project was adversely affected. Additionally, GAO's review of about 1,300 USAID partner reports found that the few instances where challenges were mentioned lacked sufficient detail for GAO to determine their type, severity, or origin. Without information on banking access challenges that pose potential risks to project implementation, USAID is not aware of the full extent of risks to achieving its objectives. The Department of the Treasury (Treasury) and State have taken various actions to help address banking access challenges encountered by nonprofit organizations (NPO), but USAID's efforts have been limited. Treasury's efforts have focused on engagement between NPOs and U.S. agencies, while State has issued guidance on the topic to its embassies and designated an office to focus on these issues. In contrast, USAID lacks a comparable office, and NPOs stated that it is difficult to find USAID staff to engage with on this topic. Further, GAO found that awareness of specific challenges was generally limited to USAID staff directly overseeing the project. Without communicating these challenges to relevant parties, USAID may not be aware of all risks to agency objectives and may not be able to effectively engage with external entities on efforts to address these challenges. GAO recommends that USAID should take steps to (1) collect information on banking access challenges experienced by USAID's partners and (2) communicate that information both within USAID and with external entities, such as other U.S. agencies and partners. USAID concurred with our recommendations.