DISASTER 

ASSISTANCE

Opportunities to 

Enhance 

Implementation of the 

Redesigned Public 

Assistance Grant 

Program

Report to Congressional Requesters

November 2017

GAO-18-30

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-30, a report to 

congressional requesters

November 2017

DISASTER ASSISTANCE

Opportunities to Enhance Implementation of the

Redesigned Public Assistance Grant Program

What GAO Found

The Federal Emergency Management Agency (FEMA) redesigned the Public 

Assistance (PA) grant program delivery model to address past challenges in 

workforce management, but has not fully assessed future workforce staffing needs. 

GAO and others have previously identified challenges related to shortages in 

experienced and trained FEMA PA staff and high turnover among these staff. These 

challenges often led to applicants receiving inconsistent guidance and to PA project 

delays. As part of its new model, FEMA is creating consolidated resource centers to 

standardize and centralize PA staff responsible for managing grant applications, and 

new specialized positions, such as hazard mitigation liaisons, program delivery 

managers, and site inspectors, to ensure more consistent guidance to applicants.

However, FEMA has not assessed the workforce needed to fully implement the new 

model, such as the number of staff needed to fill certain new positions, or to achieve

staffing goals for supporting hazard mitigation on PA projects. Fully assessing 

workforce needs will help to ensure that FEMA has the people and the skills needed 

to fully implement the new PA model and help to avoid the long-standing workforce

challenges the program encountered in the past. 

FEMA designed a new PA information and case management system—called the 

FEMA Applicant Case Tracker (FAC-Trax)—to address past information sharing 

challenges, such as difficulties in sharing grant documentation among FEMA, state, 

and local officials and tracking the status of PA projects, but additional actions could 

better ensure effective implementation. Both FEMA and state officials involved in 

testing of the new model stated that the new information system allows them to better 

manage and track PA applications and documentation, which could lead to greater 

transparency and efficiencies in the program. Further, GAO found that this new 

system fully addresses two of four key information technology (IT) management 

controls—project planning and risk management—that are necessary to ensure 

systems work effectively and meet user needs. However, GAO found that FEMA has 

not fully addressed the other two controls—requirements development and systems 

testing and integration. By better analyzing progress on high-level user requirements,

for example, FEMA will have greater assurance that FAC-Trax will meet user needs

and achieve the goals of the new delivery model. 

Enhancements to the Federal Emergency Management Agency’s (FEMA) Public Assistance 

Program under the New Delivery Model

View GAO-18-30. For more information, 

contact Chris Currie at (404) 679-1875 or

curryc@gao.gov.

Why GAO Did This Study

FEMA, an agency of the Department of 

Homeland Security (DHS), has 

obligated more than $36 billion in PA 

grants to state, local, and tribal 

governments to help communities 

recover and rebuild after major 

disasters since 2009. Further, costs 

are rising with disasters, such as

Hurricanes Harvey, Irma, and Maria in 

2017. FEMA recently redesigned how 

the PA program delivers assistance to 

state and local grantees to improve 

operations and address past 

challenges identified by GAO and 

others. FEMA tested the new delivery 

model in selected disasters and 

announced implementation in 

September 2017. 

GAO was asked to assess the 

redesigned PA program. This report 

examines, among other things, the 

extent to which FEMA’s new delivery 

model addresses (1) past workforce 

management challenges and assesses 

future workforce needs; and (2) past 

information sharing challenges and key 

IT management controls. GAO 

reviewed FEMA policy, strategy, and 

implementation documents;

interviewed FEMA and state officials,

PA program applicants, and other 

stakeholders; and observed 

implementation of the new model at 

one test location following Hurricane 

Matthew in 2016. 

What GAO Recommends

GAO is making five recommendations, 

including that FEMA assess the 

workforce needed for the new delivery 

model and improve key IT 

management controls for its new 

information sharing and case 

management system, FAC-Trax. DHS 

concurred with all recommendations.
Page i GAO-18-30 Disaster Assistance

Letter 1

Background 7

FEMA Designed the New PA Delivery Model to Address 

Workforce Management Challenges, but Efforts to Support Full 

Implementation Could Be Enhanced 20

FEMA Designed the New PA Information System to Resolve Past 

Challenges, but Opportunities Exist to Fully Implement Key 

Management Controls 28

FEMA’s New PA Model Enhances Hazard Mitigation Staff 

Participation, but Opportunities Exist to Further Promote 

Mitigation 37

Conclusions 42

Recommendations for Executive Action 43

Agency Comments and Our Evaluation 44

Appendix I Selected Prior Work Related to Federal Emergency 

Management Agency’s (FEMA) Public Assistance 

(PA) Program 48

Appendix II Assessment of Information Technology Management 

Controls for the FEMA Applicant Case Tracker (FAC-Trax) 52

Appendix III Comments from the Department of Homeland Security 57

Appendix IV GAO Contact and Staff Acknowledgments 62

Tables

Table 1: Findings and Recommendations from Prior GAO Reports 

Related to the Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program 48

Table 2. Public Assistance (PA) Program Office’s Implementation 

of Key Information Technology Management Controls for 

FAC-Trax 53

Contents
Page ii GAO-18-30 Disaster Assistance

Figures

Figure 1: Federal Emergency Management Agency (FEMA) Public 

Assistance Funds Obligated by County for Disaster 

Declarations from January 2009 to February 2017 8

Figure 2: Summary of Employee Types in the Federal Emergency 

Management Agency (FEMA) Public Assistance (PA) 

Workforce 9

Figure 3: Public Assistance (PA) Grant Application Process 10

Figure 4: Enhancements to the Federal Emergency Management 

Agency’s (FEMA) Public Assistance (PA) Program under 

the New Delivery Model 15

Figure 5: New Delivery Model Changes and Enhancements in the 

Public Assistance (PA) Grant Award Process 17

Figure 6: The Federal Emergency Management Agency’s (FEMA) 

Test Implementations of the New Delivery Model for 

Public Assistance 19
Page iii GAO-18-30 Disaster Assistance

Abbreviations 

CRC Consolidated Resource Center

DHS Department of Homeland Security

EMMIE Emergency Management Mission Integrated 

Environment

FAC-Trax FEMA Applicant Case Tracker

FEMA Federal Emergency Management Agency

FIMA Federal Insurance and Mitigation Administration

IT information technology

JFO Joint Field Office

MOU memorandum of understanding

OIG Office of the Inspector General

PA Public Assistance

PMBOK® Guide Program Management Institute’s Guide to the 

Project Management Body of Knowledge

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-18-30 Disaster Assistance

441 G St. N.W.

Washington, DC 20548

November 8, 2017

Congressional Requesters

In August 2017, Hurricane Harvey caused catastrophic and 

unprecedented flooding across southeast Texas and into Louisiana. 

While federal agencies support the evacuation, rescue, and relief to 

hundreds of thousands of residents, projections of damages exceed $50 

billion. In the weeks that followed, Hurricanes Irma and Maria brought 

winds and storm surge, which caused damage across the U.S. Virgin 

Islands, Puerto Rico, and the southeast United States, adding to the 

projected disaster costs. These events are emblematic of a trend of rising 

costs from natural disasters. In both 2016 and 2017, 15 separate U.S. 

disasters resulted in losses exceeding $1 billion each. Each year, the 

federal government obligates billions of dollars to programs and activities 

that provide assistance to state and local governments, tribes, certain 

nonprofit organizations, and individuals that have suffered injury or 

damages from major disaster or emergency incidents, such as 

hurricanes, tornados, or fires. We reported in 2016 that the federal 

government obligated at least $277.6 billion in disaster assistance during 

fiscal years 2005 through 20141 and have recognized the rise in the 

number—and the increase in severity—of disasters as a key source of 

federal fiscal exposure.2

The Federal Emergency Management Agency (FEMA), a component of 

the Department of Homeland Security (DHS), leads the federal effort to 

mitigate, respond to, and recover from disasters, both natural and 

manmade. FEMA’s Public Assistance (PA) grant program provides 

financial assistance to state, tribal, territorial, and local governments for 

debris removal; emergency protective measures; and the repair, 

replacement, or restoration of disaster-damaged, publicly owned facilities. 

 1

GAO, Federal Disaster Assistance: Federal Departments and Agencies Obligated at 

Least $277.6 Billion during Fiscal Years 2005 through 2014, GAO-16-797 (Washington, 

D.C.: Sept. 22, 2016).

2

The term fiscal exposure refers to the responsibilities, programs, and activities that may 

either legally commit the federal government to future spending or create the expectation 

for future spending. See GAO, Fiscal Exposures: Improving Cost Recognition in the 

Federal Budget, GAO-14-28 (Washington, D.C.: Oct. 29, 2013). Also, see GAO’s Federal 

Fiscal Outlook web page: 

http://www.gao.gov/fiscal_outlook/federal_fiscal_outlook/overview.

Letter
Page 2 GAO-18-30 Disaster Assistance

For example, flooding across northern and central California in early 

February 2017 resulted in substantial property and infrastructure damage, 

including severe damage to the Oroville Dam spillway. Shortly thereafter, 

the governor of California requested federal assistance, and the President 

subsequently issued an emergency declaration that made funding 

available for repairs to the spillway through the PA program.3 PA is 

FEMA’s largest disaster assistance grant program and from fiscal years 

2009 through 2016, the agency obligated more than $36 billion in grants 

for such projects.

PA is a complex and multistep grant program administered through a 

partnership between FEMA and the state grantee, which provides funding 

to local officials who are the subrecipients of a PA grant award. Thus, it 

entails an extensive paperwork and review process between FEMA and 

grantee officials based on specific eligibility rules that outline the types of 

damage that can be reimbursed by the federal government and steps that 

federal, state, and local governments must take in order to document 

eligibility. Due in part to the complexity of the process, we identified a 

number of past challenges in various aspects of the program. Specifically, 

we assessed the PA program in 2008 during the Gulf Coast states’

recovery from Hurricanes Katrina and Rita.4 We identified a number of 

challenges related to FEMA’s management of its PA workforce, including 

lack of training and high turnover among PA staff, which led to project 

delays and other problems. We also identified challenges related to 

information sharing between FEMA and PA grant applicants, which led to 

problems in tracking the status of projects, among other things. Moreover, 

in 2015 we identified challenges in effectively incorporating mitigation into 

PA projects and grant guidance during the recovery from Hurricane 

Sandy in the northeastern United States.5 To address these various 

challenges, we have made a number of recommendations, and FEMA 

 3

FEMA, “California Potential Failure of the Emergency Spillway at Lake Oroville Dam (EM3381),” accessed October 10, 2017, https://www.fema.gov/disaster/3381.

4

GAO, Disaster Recovery: FEMA’s Public Assistance Grant Program Experienced 

Challenges with Gulf Coast Rebuilding, GAO-09-129 (Washington, D.C.: Dec. 18, 2008). 

5

GAO, Hurricane Sandy: An Investment Strategy Could Help the Federal Government 

Enhance National Resilience for Future Disasters, GAO-15-515 (Washington, D.C.: July 

30, 2015). Hazard mitigation is any sustained action taken to reduce or eliminate longterm risk to people and property from natural hazards and their effects. Section 406 of the 

Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended, allows 

FEMA to fund hazard mitigation projects related to the damaged elements receiving PA 

funding. 42 U.S.C. § 5172; 44 C.F.R. § 206.226.
Page 3 GAO-18-30 Disaster Assistance

has taken or is taking various actions to address them, as we discuss 

later in this report.

In recent years, FEMA has taken steps to redesign the PA program to 

address past challenges and make the program easier for FEMA and 

grantee officials to manage. As part of this effort, FEMA redesigned 

processes for developing, reviewing, and approving grant applications. 

The agency is also developing new PA staff positions; implementing a 

centralized and standardized grant processing approach; and developing 

a new information system to better maintain and share grant 

documentation. FEMA officials also report taking steps to better 

incorporate hazard mitigation during the PA grant process. Taken 

together, these efforts represent FEMA’s “new delivery model” for 

managing project development in the PA program, which we refer to as 

the preaward process.6 FEMA has been testing the new delivery model at

certain disaster locations since 2015, in preparation for implementing it 

nationwide for all new disasters.

In light of past challenges and recent changes to the PA program 

preaward process, you asked us to assess FEMA’s progress in 

addressing these challenges and implementing the new delivery model. 

Specifically, this report addresses the extent to which FEMA designed the 

new delivery model to address previously identified challenges related to

1. managing its PA program workforce and the extent that FEMA 

assessed the workforce needed to fully implement the new delivery 

model;

2. information sharing between FEMA and grant applicants and the 

extent that FEMA’s new information sharing system satisfies key 

information technology (IT) management controls; and

3. incorporating hazard mitigation into the PA grant process.

To address all three objectives, we reviewed prior reports from GAO, the 

DHS Office of the Inspector General (OIG), and FEMA’s own internal 

assessments identifying past PA program management challenges 

related to workforce management, information sharing, and hazard 

mitigation. We compared information from these reports to information 

and documentation of FEMA’s efforts to implement the new PA delivery 

 6

This does not include program activities after the grant award, such as grants 

management, closeout, or appeals. 
Page 4 GAO-18-30 Disaster Assistance

model to determine the extent that the new model is being designed to 

address these challenges. We also reviewed program documentation, 

such as after-action reports that FEMA developed after testing the new 

model in disaster locations.7 We conducted 62 semistructured interviews 

with FEMA officials at headquarters and in two selected regions out of the 

10 FEMA regional offices,8 including interviews with members of FEMA’s 

PA workforce at the centralized processing center in Denton, Texas, and 

the Joint Field Office (JFO) in Savannah, Georgia, for Hurricane Matthew 

recovery efforts in the state.9 We identified relevant officials based on job 

title, responsibilities, and referrals from other officials. We asked 

questions to identify their role in the implementation of the new delivery 

model, their experiences with implementation, and their assessment of 

the benefits and challenges of the model as it relates to our objectives 

and scope. We also conducted 11 semistructured interviews with selected 

state officials responsible for PA operations, to include those with and 

without new delivery model experience.10 Lastly, we conducted three 

 7

According to program officials, the new delivery model after-action reports determine the 

strengths, potential best practices, and areas for improvement observed by personnel 

involved in the new delivery model implementation. Officials collected information for 

these reports through direct observation of the operation, by conducting workshops and 

interviews, and by cross-referencing other sources of feedback. 

8

We interviewed PA officials in Regions IV and VI. We selected Region IV officials 

because that region oversees disaster activities in Georgia where officials conducted the 

third test implementation of the new delivery model. We included Region VI because the 

regional officials are located in Denton, Texas; these officials did not manage the colocated centralized processing center, and did not have experience with a new delivery 

model test implementation at the time of our review.

9

We selected the centralized processing center in Texas and PA operations in Savannah, 

Georgia, following Hurricane Matthew because these were the only processing center and 

disaster field office implementing the new delivery model at the time of our review. We 

reviewed documents from prior tests of the new delivery model in Iowa and Oregon and 

spoke to state officials responsible for PA activities in Oregon. We focused our 

assessment on PA operations in the test following Hurricane Matthew because it was the 

first test to include all of the key changes in the new delivery model at the time of our 

review.

10We selected six states without new delivery model experience through a companion 

GAO review of the PA program examining the appeals process, and included states with 

high levels of PA appeals. The six states are Florida, Louisiana, New Jersey, New York, 

Mississippi, and Texas. The responses of the officials from these states are not 

generalizable across all states. In addition, we conducted five interviews with state officials 

with experience in the new delivery model. Four of the five state officials we interviewed 

that had new delivery model experience included state emergency managers and hazard 

mitigation officers for both Oregon and Georgia. The fifth state official we spoke with was 

the director of the National Emergency Management Association, a stakeholder 

throughout the PA reengineering and a professional association representing state and 

local emergency management professionals.
Page 5 GAO-18-30 Disaster Assistance

semistructured interviews with randomly selected applicants who applied 

for PA funding after the Hurricane Matthew disaster in Georgia.11

Although their responses are not generalizable across all applicants, they 

helped inform our understanding of the experiences of recipients using 

the new delivery model for the first time.

To address our first objective, we reviewed FEMA documentation, 

including the 2014 PA Program Realignment report, the PA Cadre 

Training Plan, and after-action reports from different tests of the new 

delivery model implementation to identify key workforce management 

changes under the new model. We also reviewed position descriptions, 

job aids, and training materials developed by FEMA to support new 

workforce roles and responsibilities under the new model. As part of the 

interviews previously described, we interviewed officials managing 

workforce activities under the new delivery model, including a PA 

program coordinator for workforce. We compared FEMA’s workforce 

management efforts under the new model to leading practices we have 

identified for business process reengineering12 and strategic workforce 

management.13

To address our second objective, we reviewed documents related to 

FEMA’s acquisition and development of the new information system for 

the PA program. We interviewed program staff, stakeholders, and officials 

from FEMA’s Recovery Technology Programs Division that are 

responsible for developing the new system, to understand changes to 

information sharing under the new model. We then compared FEMA’s 

development efforts to key IT management control practices in the areas 

of risk management, requirements development, project planning, and 

systems testing and integration to determine the extent to which FEMA’s 

 11Based on a list of applicants and projects provided by FEMA officials, we randomly 

selected applicants from different work categories to gain a diversity of project types, for 

example, including emergency work (such as debris removal) and permanent work 

projects (such as repairing dirt roads). While their views are not generalizable to all 

applicants and projects, they helped inform our understanding of the process.

12GAO, Business Process Reengineering Assessment Guide. GAO/AIMD-10.1.15 

(Washington, D.C.: Apr. 1, 1997). This guide presents nine assessment issues organized 

in three major areas: Part A: Assessing the Agency’s Decision to Pursue Reengineering, 

Part B: Assessing the New Process’ Development, and Part C: Assessing Project 

Implementation and Results. Our evaluation focuses on Part C.

13GAO, FEMA: Workforce Planning and Training Could Be Enhanced by Incorporating

Strategic Management Principles, GAO-12-487 (Washington, D.C.: Apr. 26, 2012).
Page 6 GAO-18-30 Disaster Assistance

efforts met these practices. We drew these key control practices from the 

Software Engineering Institute’s Capability Maturity Model® Integration for 

Acquisition and Development, the Project Management Institute’s Guide 

to the Project Management Body of Knowledge (PMBOK® Guide), and 

the Institute of Electrical and Electronics Engineers’ (IEEE) Standard for 

Software and System Test Documentation.

14

To address our third objective, we reviewed documentation such as 

FEMA PA policies and operations guidance related to incorporating 

hazard mitigation into PA projects, as well as process guides, job aids, 

and training materials developed under the new delivery model, to better 

understand how mitigation is addressed. In addition, we interviewed PA 

program officials; officials from FEMA’s Federal Insurance and Mitigation 

Administration (FIMA), who assist PA officials to incorporate mitigation 

into the recovery process; and state officials involved with the second and 

third test implementations of the new model in Oregon and Georgia. We 

also reviewed after-action reports from the second and third test 

implementations of the new model and new delivery model performance 

measures in the PA New Delivery Model Assessment Plan. We then 

compared the information derived from the documentation and interviews 

to the goals and objectives identified in FEMA strategic plans, the 

National Disaster Recovery Framework, the National Mitigation 

Framework, and Standards for Internal Control in the Federal 

Government, to determine the extent that FEMA’s new delivery model 

incorporates hazard mitigation planning into the PA process and includes 

goals aligned with broader FEMA mitigation goals.15 Also, we obtained 

data from FEMA’s existing PA information system—the Emergency 

Management Mission Integrated Environment (EMMIE)—on the number 

of PA projects that incorporated hazard mitigation in the third test 

implementation of the new delivery model in Georgia. We interviewed PA 

 14Software Engineering Institute, Capability Maturity Model® Integration for Acquisition

(CMMI-ACQ), Version 1.3 (Pittsburgh, Pa.: November 2010) and Capability Maturity 

Model® Integration for Development (CMMI-DEV), Version 1.3 (Pittsburgh, Pa.: 

November 2010); Project Management Institute, Inc., A Guide to the Project Management 

Body of Knowledge (PMBOK® Guide), 5th ed. (Newton Square, Pa.: 2013); Institute of 

Electrical and Electronics Engineers, IEEE Standard for Software and System Test 

Documentation, IEEE Standard 829TM 2008 (New York, N.Y.: July 18, 2008).

15GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014); Department of Homeland Security, National 

Disaster Recovery Framework, 2nd ed. (Washington, D.C.: June 2016); Department of 

Homeland Security, National Mitigation Framework, 2nd ed. (Washington, D.C.: June 

2016).
Page 7 GAO-18-30 Disaster Assistance

program officials, reviewed OIG reviews of the EMMIE system, and 

reviewed related documentation and determined this EMMIE data was 

reliable for describing the rate of hazard mitigation in PA projects.

We conducted this performance audit from July 2016 to November 2017 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Major disaster declarations can trigger a variety of federal response and 

recovery programs for government and nongovernmental entities, 

households, and individuals.16 FEMA’s Office of Response and Recovery 

manages the PA grant program, providing funds to states, territorial 

governments, local government agencies, Indian tribes, authorized tribal 

organizations, and certain private nonprofit organizations in response to 

presidentially declared disaster declarations to repair damaged public 

infrastructure such as roads, schools, and bridges.17 Figure 1 shows the 

total amount of PA funds obligated by county from January 2009 through 

February 2017 for federal disaster declarations.

 16Under the Stafford Act, the governor of a state may request a declaration of a major 

disaster when effective response and recovery are beyond the capabilities of the state and 

affected local governments. See 42 U.S.C. § 5170.

17To be eligible, a private nonprofit applicant must show that it has: a current ruling letter 

from the U.S. Internal Revenue Service granting tax exemption under sections 501(c), (d), 

or (e) of the Internal Revenue Code of 1954; or documentation from the state 

substantiating it is a non-revenue-producing, nonprofit entity organized or doing business 

under state law. 44 C.F.R. § 206.221(f). Additionally, the applicant must own or operate a 

private nonprofit facility, meaning any private nonprofit educational, utility, emergency, 

medical, or custodial care facility, including a facility for the aged or disabled, and other 

facility providing essential governmental type services to the general public, and such 

facilities on Indian reservations. 44 C.F.R. § 206.222(b).

Background

FEMA’s Public Assistance 

Grant Program
Page 8 GAO-18-30 Disaster Assistance

Figure 1: Federal Emergency Management Agency (FEMA) Public Assistance Funds Obligated by County for Disaster 

Declarations from January 2009 to February 2017

Note: This does not reflect total Public Assistance (PA) obligations because it does not include 

instances in which FEMA obligated PA funds to a statewide entity, such as a state department 

providing emergency protective measures, or the limited cases for which data were not available.

To implement the PA program, FEMA’s staff includes a mix of temporary, 

reservist, and permanent employees under two authorities, the Stafford 

Act and Title 5.18 Reservists make up the largest share of the PA 

workforce, which consisted of 1,852 employees––1,041 reservists, 634 

full-time equivalents, and 177 temporary Cadre of On-Call 

 18See 42 U.S.C. § 5149 (providing for the appointment of temporary personnel, experts, 

and consultants to carry out the purposes of the Stafford Act). Generally, Title 5 refers to 

the section of the United States Code that establishes the law for managing human 

resources in the federal government.
Page 9 GAO-18-30 Disaster Assistance

Response/Recovery Employees––as of June 2017, according to PA 

officials. Figure 2 summarizes the key characteristics for each type of 

employee.

Figure 2: Summary of Employee Types in the Federal Emergency Management 

Agency (FEMA) Public Assistance (PA) Workforce

Note: A “cadre” is a group of FEMA employees organized by operational or programmatic functions 

and FEMA Qualification System positions that perform disaster-related activities during FEMA 

disaster operations. Based on their cadre, reservists’ activities can include interviewing disaster 

survivors; conducting and verifying damage assessments; providing administrative, financial, and 

logistical support; and performing a wide variety of other tasks as identified by staffing needs and 

operational requirements. The Public Assistance cadre is one of 23 functional disaster cadres 

supporting FEMA programs.

After a disaster, FEMA sends PA program staff to the affected area to 

work with state and local officials to assess the damage prior to a disaster 

declaration. FEMA officials establish a temporary Joint Field Office (JFO) 

to house staff who will manage response and recovery functions after a 

declared disaster (including operations, emergency response and support 
Page 10 GAO-18-30 Disaster Assistance

teams, planning, administration, finance, and logistics).19 Once the 

President has declared a disaster, PA staff work with grant applicants to 

help them document damages, identify eligible costs and work, and 

prepare requests for PA grant funds by developing project proposals. 

These proposals may include proposals for hazard mitigation if the 

hazard mitigation work is related to the repair of damaged facilities, 

referred to as permanent work projects. Immediate emergency measures, 

such as debris removal, are not eligible for hazard mitigation. Officials 

then review and obtain approval of the projects prior to FEMA obligating 

funds to state grantees. Figure 3 describes the process used to develop, 

review, and obligate PA projects.

Figure 3: Public Assistance (PA) Grant Application Process

In addition to rebuilding and restoring infrastructure to its predisaster 

state, the PA program can be used to fund hazard mitigation measures 

that will reduce future risk to the infrastructure in conjunction with the 

repair of disaster-damaged facilities.20 There is no preset limit to the 

amount of PA funds a community may receive; however, PA hazard 

 19The JFO is a temporary federal multiagency coordination center established locally to 

facilitate field-level domestic incident management activities related to prevention, 

preparedness, response, and recovery when activated by the Secretary of Homeland 

Security. The JFO provides a central location for coordination of federal, state, local, tribal, 

nongovernmental, and private-sector organizations with primary responsibility for activities 

associated with threat response and incident support. For the purposes of this report, we 

examine only PA activities at the JFO. 

20Mitigation measures for disaster-damaged facilities are funded under Section 406 of the 

Stafford Act. 42 U.S.C. § 5172. In contrast, FEMA’s Hazard Mitigation Grant Program 

provides funds under Section 404 of the Stafford Act. Recipients can use Section 404 

mitigation funds to provide protection to undamaged parts of a facility or to prevent or 

reduce damages caused by future disasters. The entire state, not just presidentially 

declared counties, may qualify for 404 mitigation projects. 42 U.S.C. § 5170c.

Hazard Mitigation in the 

PA Program
Page 11 GAO-18-30 Disaster Assistance

mitigation measures must be determined to be cost effective.21 Some 

examples of hazard mitigation measures that FEMA has predetermined to 

be cost effective, if they meet certain requirements, include

• installing shut-off valves on underground pipelines so that damaged 

sections can be isolated during or following a disaster;

• securing a roof using straps, clips, or other anchoring systems in 

locations subject to high winds; and

• installing shutters on windows or replacing glass with impact-resistant 

material.

Applicants can also propose mitigation measures that are separate from 

the damaged portions of a facility, such as constructing floodwalls around 

damaged facilities to avoid future flooding. FEMA evaluates these 

proposals, considering how the proposed measure protects damaged 

portions of a facility and whether the measure is reasonable based on the 

extent of the damage, and determines eligibility on a case-by-case 

basis.22

FEMA’s Federal Insurance and Mitigation Administration (FIMA) deploys 

a cadre of mitigation staff to help coordinate and implement hazard 

mitigation activities during disaster recovery, including PA hazard 

mitigation. A primary task of these staff is to identify and assess 

opportunities to incorporate hazard mitigation into PA projects. Generally, 

if an applicant seeks to incorporate hazard mitigation measures into a PA 

project, FIMA’s hazard mitigation staff develop a hazard mitigation 

proposal.

 21FEMA Public Assistance policy allows three different methods to test for cost-effective 

hazard mitigation. First, under the 15 percent rule, hazard mitigation measures may 

amount to up to 15 percent of the total eligible cost of repair work on a project. Second, 

certain hazard mitigation measures that have been predetermined to be cost-effective 

may qualify under the 100 percent rule, which permits the hazard mitigation as long as it 

does not exceed 100 percent of the eligible cost of the repair work on a project. Third, for 

measures that exceed eligible costs, the grantee or subgrantee must demonstrate that the 

measure is cost effective through an acceptable benefit/cost analysis methodology.

22The PA program also has other programs and policies that allow for or promote the use 

of risk reduction measures. For example, states can also receive funds through the PA 

Alternative Procedures program, under the authority of Stafford Act section 428, which 

provides flexibility and financial incentives, some of which can be used to enhance 

disaster resilience. See 42 U.S.C. § 5189f.
Page 12 GAO-18-30 Disaster Assistance

We, the DHS OIG, and others have reported past challenges with 

FEMA’s management of the PA program related to workforce 

management, information sharing, and hazard mitigation.23 For example, 

we reported in 2008 that the PA program had a shortage of experienced 

and knowledgeable staff, relied on temporary rotating staff, and provided 

limited training to their workforce, which impaired PA program delivery 

and delayed recovery efforts after Hurricanes Katrina and Rita.

24 We 

found that staff turnover, coupled with information sharing challenges, 

delayed projects when applicants had to provide the same information 

each time FEMA assigned new staff and that poorly trained staff provided

incomplete and inaccurate information during their initial meetings with 

applicants or made inaccurate eligibility determinations, which also 

caused processing delays. We recommended that FEMA strengthen 

continuity among staff involved in administering the PA program by 

developing protocols to improve information and document sharing 

among FEMA staff. In response, in 2013 FEMA instituted a PA 

Consistency Initiative, which included hiring new managers for FEMA 

regional offices, stakeholder training on PA program administration, and 

using a newly developed internal website to allow staff to post and share 

information to address continuity and knowledge sharing concerns during 

disaster operations. FEMA also developed the Public Assistance Program 

Delivery Transition Standard Operating Procedure to facilitate the transfer 

of responsibility for PA program activities during cases of staff turnover 

during recovery operations. Despite FEMA’s efforts to implement our 

recommendations, the DHS-OIG, in 2016, found continuing challenges 

after Hurricane Sandy with workforce levels, skills, and performance of 

reservists, who make up the majority of the PA workforce.25

 23Additionally, GAO has identified such challenges with FEMA’s management of the PA 

program since the early 1990s. GAO, Earthquake Recovery: Staffing and Other 

Improvements Made Following Loma Prieta Earthquake, GAO/RCED 92-141 

(Washington, D.C.: July 30, 1992); GAO, Disaster Assistance: Improvements Needed in 

Determining Eligibility for Public Assistance, GAO/RCED-96-113 (Washington, D.C.: May 

23, 1996); and GAO, Disaster Assistance: Improvement Needed in Disaster Declaration 

Criteria and Eligibility Assurance Procedures, GAO-01-837 (Washington, D.C.: Aug. 31, 

2001).

24GAO-09-129.

25Department of Homeland Security, Office of Inspector General, FEMA Can Enhance 

Readiness with Management of Its Disaster Incident Workforce, OIG-16-127-D 

(Washington, D.C.: Sept. 2, 2016).

Previous Challenges and 

Recommendations 

Related to the PA Program
Page 13 GAO-18-30 Disaster Assistance

Regarding information sharing, in 2008, we also identified difficulties 

sharing documents among federal, state, and local participants in the PA 

process and difficulties tracking the status of projects. We recommended 

that FEMA improve information sharing within the PA process by 

identifying and disseminating practices that facilitate more effective 

communication among federal, state, and local entities. In response, 

FEMA proceeded with the implementation of a grant tracking and 

management system, called EMMIE, which was used previously in 2007. 

However, in subsequent years we found weaknesses in how FEMA 

developed the system and the DHS-OIG found that information sharing 

problems similar to the ones identified in our 2008 report persisted.26

Regarding hazard mitigation, we reported in 2015 that state and local 

officials experienced challenges in using PA hazard mitigation during the 

Hurricane Sandy recovery efforts because PA officials did not consistently 

prioritize hazard mitigation, and in some cases discouraged mitigation 

projects during the PA grant application process, among other 

challenges. We recommended that FEMA assess the challenges state 

and local officials reported, including the extent to which they can be 

addressed, and implement corrective actions, as needed.27 In response to 

our recommendation, FEMA developed a corrective action plan that 

included actions and milestones for reviewing, updating, and 

implementing PA hazard mitigation policy.28 FEMA also identified the PA 

new delivery model as a solution for some of the challenges state and 

local officials reported. Previously, the OIG also reported that PA program 

officials did not consistently identify eligible PA hazard mitigation projects, 

and that PA officials did not prioritize the identification of PA hazard 

mitigation opportunities at the onset of recovery efforts after the 2005 Gulf 

 26GAO, Information Technology: FEMA Needs to Address Management Weaknesses to 

Improve Its Systems, GAO-16-306 (Washington, D.C.: Apr. 5, 2016); Department of 

Homeland Security, Office of Inspector General, FEMA’s Process for Tracking Public 

Assistance Insurance Requirements, OIG-12-18 (Washington, D.C.: Dec. 16, 2011); 

FEMA Faces Challenges in Managing Information Technology, OIG-16-10 (Washington, 

D.C.: Nov. 20, 2015).

27GAO-15-515.

28For example, in September 2016, FEMA published the PA Required Minimum 

Standards Policy, which generally requires, as a condition of assistance, that buildings 

eligible for repair, replacement, or construction located in hazard-prone areas will use, at a 

minimum, the hazard-resistant provisions referenced in nationally recognized building 

codes and standards.
Page 14 GAO-18-30 Disaster Assistance

Coast hurricanes.29 See appendix I for a summary of findings and the 

status of our past recommendations on challenges with workforce 

management, information sharing, and hazard mitigation related to the 

PA program since our last review in December 2008.

FEMA’s own internal reviews and outreach efforts have also identified 

similar challenges. For example, at FEMA’s request the Homeland 

Security Studies and Analysis Institute assessed the effectiveness and 

efficiency of the PA program in 2011.30 The institute’s report outlined 3 

key findings and 23 recommendations relating to the PA preaward 

process. For example, the report found that FEMA could enhance training 

programs to develop a skilled and experienced workforce; utilize 

technology and employ web-based tools to support centralized 

processing, transparency, and efficient decision making; and identify and 

address potential special considerations, such as hazard mitigation 

proposals, as early as possible in the preaward process to improve 

consistency. In 2014, PA program officials analyzed the PA grant process 

and used input from agency staff and officials involved in various aspects 

of the program to identify potential improvements. The resulting Public 

Assistance Program Realignment report found that challenges in 

workforce management, information sharing, and hazard mitigation 

continued, and included recommendations for improvement. For example, 

the report concluded that a shortage of qualified staff, high turnover, 

unclear organizational responsibilities, and inconsistent training were 

long-standing and continuing challenges that impaired the PA pre-award 

process. In addition, from January 2015 to April 2015, FEMA conducted 

extensive outreach with more than 260 stakeholders across FEMA 

headquarters, all 10 regions, 43 states, and 4 tribal nations to discuss 

challenges in the PA program and opportunities for improvement. For 

example, stakeholders identified challenges with ineffective information 

collection during the preaward process and suggested identifying special 

considerations, such as hazard mitigation, earlier in the PA process as an 

idea for improvement. In response, FEMA began redesigning the PA

 29Department of Homeland Security, Office of Inspector General, Assessment of FEMA’s 

Public Assistance Program Policies and Procedures, OIG-10-26 (Washington, D.C.: Dec. 

8, 2009); and Gulf Cost Recovery: FEMA’s Management of the Hazard Mitigation 

Component of the Public Assistance Program, OIG-10-28 (Washington, D.C.: Dec. 10, 

2009). 

30Homeland Security Studies and Analysis Institute, Analysis of the FEMA Public 

Assistance (PA) Program, RP10-17-11-03 (Arlington, Va.: Apr. 30, 2011).
Page 15 GAO-18-30 Disaster Assistance

preaward process to operationalize the results of its 2014 report and 

address areas for improvement identified through its outreach efforts.

FEMA awarded a contract for program support to help PA officials 

implement a redesigned PA program in 2015.31 This included a new 

process to develop and review grant applications, and obligate PA funds

to states affected by disasters; new positions, such as a new program 

delivery manager who is the single point of contact throughout the grant 

application process; a new Consolidated Resource Center (CRC) to 

support field operations by supplementing project development, 

validation, and review of proposed PA project applications; and a new 

information system to maintain and share PA grant application 

documents.32 As part of the new process, PA program officials identified 

the need to ensure that staff emphasize special considerations, such as 

hazard mitigation, earlier in the process. Taken together, these efforts 

represent FEMA’s “new delivery model” for awarding PA program grants. 

Enhancements in the PA program under the new delivery model are 

presented in figure 4.

Figure 4: Enhancements to the Federal Emergency Management Agency’s (FEMA) 

Public Assistance (PA) Program under the New Delivery Model

 31PA officials entered into an indefinite-quantity contract for the supplies or services 

provided through five task orders from September 2015 through February 2017. The 

period of performance for the contract ended in August 2017, and the maximum allowable 

cost is approximately $5.5 million.

32While FEMA made changes to the PA process, the laws, regulations, and policies 

underlying the PA program were not changed.

The PA New Delivery 

Model
Page 16 GAO-18-30 Disaster Assistance

Regarding the new delivery model process, FEMA introduced several 

changes to enhance outreach to applicants during the “exploratory call”—

the first contact between FEMA and local officials—and during the first inperson meeting, called the “recovery scoping meeting.” FEMA also 

revised decision points during the process, when program officials can 

request more information from applicants, and applicants can review and 

approve the completion of project development steps. FEMA also 

incorporated special considerations, such as hazard mitigation, earlier in 

the new process during the exploratory calls and recovery scoping 

meetings. The changes and enhancements to the PA grant award 

process in the new delivery model are presented in figure 5.
Page 17 GAO-18-30 Disaster Assistance

Figure 5: New Delivery Model Changes and Enhancements in the Public Assistance (PA) Grant Award Process

a

PA officials conduct peer reviews on 100 percent completed projects depending on the expertise of 

the specialist developing the project. Other specialists at the CRC check to ensure accuracy of the 

scope of work, cost estimates, and supporting documents for the project, and provide feedback on 

ways to improve work on future projects.

b

In the PA program, special considerations include insurance, hazard mitigation, and environmental 

and historic preservation.

The new process divides proposed PA projects based on complexity and 

type of work into three categories—100 percent completed, standard, and 

specialized—that PA staff manage to expedite review or assign skilled 

staff to technical projects as needed. If the applicant has already 

completed work following a disaster, such as debris removal, it is 

considered “100 percent completed” and JFO staff collect the necessary 

documents and provide the information to the CRC staff who complete 
Page 18 GAO-18-30 Disaster Assistance

the development of project applications, validate the information, and 

complete all necessary reviews. Projects that require repairs and further 

assistance from PA program staff at the JFO include “standard” and 

“specialized” projects, which include a site inspection to document 

damages, before the JFO staff provide the information to the CRC. 

Further, PA program officials assign PA staff based on their skills and 

experience to standard projects, which are less technically complex to 

develop, and specialized projects, which are more technically complex 

and costly. We discuss the new workforce positions FEMA developed for 

JFOs and CRCs, the new information system FEMA developed to 

maintain and share PA grant documents with applicants, and FEMA’s 

efforts to incorporate hazard mitigation into PA projects later in this report.

Since 2015, FEMA has invested almost $9 million to redesign the PA 

program through the reengineering and implementation of the new 

delivery model, including about $4.7 million for contract support for 

implementation, and $4 million for acquisition of the new information 

system.33 FEMA tested the new delivery model in a series of selected 

disasters, using a continuous process improvement approach to assess 

and improve the process, workforce changes, and information system 

requirements, prior to implementing the new model for all future 

disasters.34 For example, FEMA first tested the new process in Iowa in 

July 2015 and, in February 2016, PA program officials expanded their test 

to include all of the new staff positions.35 In October 2016, PA program 

officials added the new information system to achieve a comprehensive 

implementation of all of the elements of the new delivery model for the 

agency’s response to Hurricane Matthew in Georgia, two additional 

disasters in Georgia in January 2017, and in Missouri, North Dakota, 

Wyoming, Vermont, and two disasters in New Hampshire from June 

 33According to PA managers, information system maintenance costs from fiscal year 2016 

through fiscal year 2023 would be about $15 million, but total costs for the implementation 

effort are not known because officials involved in the implementation of the new delivery 

model manage these efforts as part of their regularly assigned disaster recovery and 

program management duties.

34FEMA selected the disasters based on the size and location of the disaster, along with 

the timing of its occurrence as it coincided with program officials’ development of the 

elements of the new model. 

35FEMA limited the scope of implementation to three categories of work—debris removal, 

emergency protective measures, and roads and bridges—during the first test 

implementation in Iowa. 

Testing the New Delivery 

Model Prior to Full 

Implementation
Page 19 GAO-18-30 Disaster Assistance

through August 2017. The timeline for PA’s implementation of the new 

delivery model is shown in figure 6.

Figure 6: The Federal Emergency Management Agency’s (FEMA) Test Implementations of the New Delivery Model for Public 

Assistance

Note: FEMA assigns “DR” or declaration numbers to all declared disasters. The format is DR, 

followed by a four-digit number, which reflects the type of disaster declaration, and the two-letter 

abbreviation for the state where the President declared the disaster.

a

FEMA planned to implement the new model for all future disasters beginning in January 2018. 

However, historic disaster activity during hurricane season in 2017 accelerated this timeline.

According to program officials, FEMA planned to implement the new 

model for all future disasters beginning in January 2018. However, 

historic disaster activity during the 2017 hurricane season accelerated full 

implementation. As a result, on September 12, 2017, FEMA officials 

announced that, unless officials determined it would be infeasible in an 
Page 20 GAO-18-30 Disaster Assistance

individual disaster, the program would use the new delivery model in all 

future disasters.36

According to FEMA’s 2014 PA Program Realignment report and other 

program documents, PA officials designed the new delivery model to 

respond to persistent workforce management challenges related to 

identifying the required number of staff and needed skills and training, 

among other things, to improve the efficiency and effectiveness of the PA 

preaward process. To address these challenges, PA program officials 

centralized much of the responsibility for processing PA projects in the 

CRCs, created additional new positions with specialized roles and 

responsibilities in JFOs, and established training and mentoring programs 

to help build the new staffs’ skills.

In 2016, PA program officials centralized some of the project activities 

that otherwise were being carried out at individual JFOs at FEMA’s first 

new CRC in Denton, Texas.37 Officials did so by establishing 18 new 

positions, many of which directly correlated with positions that FEMA 

deployed to individual JFOs in the legacy PA delivery model. According to 

PA officials, centralizing positions will improve standardization in project 

processing, and result in a higher quality work product. As part of the new 

 36According to PA officials, Texas and Florida state officials requested that FEMA use the 

new delivery model in their states following Hurricanes Harvey and Irma. 

37As of May 2017, PA program officials had begun hiring staff for a second CRC in 

Winchester, Virginia, and planned to complete hiring by the end of calendar year 2017.

FEMA Designed the 

New PA Delivery 

Model to Address 

Workforce 

Management 

Challenges, but 

Efforts to Support Full 

Implementation Could 

Be Enhanced

PA’s New Delivery Model 

Was Designed to Respond 

to Previously Identified 

Workforce Challenges

Centralized Roles at CRCs
Page 21 GAO-18-30 Disaster Assistance

delivery model, PA program officials created a new hazard mitigation 

liaison position for PA program staff at the CRC that did not previously 

exist at individual JFOs. The other new positions that PA program officials 

either created or centralized at the CRC included two specialized 

positions responsible for costing and validating PA projects. Previously, 

the PA project specialist deployed to the JFO would complete these tasks 

and others; however, the consistency of project development varied 

across the regions and disasters. In contrast, CRC staff are full-time 

employees who receive training to specialize in completing standardized 

project development steps for PA projects from multiple disasters on an 

ongoing basis.

Program officials anticipate that centralizing new specialized staff at the 

CRCs will also reduce PA administrative costs and staffing levels at the 

JFOs. For example, staff at the CRCs, such as the new hazard mitigation 

liaisons and insurance and costing specialists, could support project 

development for multiple disasters and regions simultaneously, whereas 

PA previously needed to deploy staff to each JFO to fulfill these roles. In 

addition, once JFOs operating under the new model send projects to the 

CRCs for processing and review, FEMA can more rapidly close its JFOs, 

reducing associated administrative costs.38 For example, following 

Hurricane Matthew, FEMA credited the new delivery model, in part, with 

its ability to close the JFO in Georgia sooner than several other JFOs in 

neighboring states not involved in the implementation of the new delivery 

model.39

PA program officials created new positions with more specialized roles 

and responsibilities to help PA staff at JFOs provide more consistency in 

the project development process and guidance to applicants. Program 

officials split the broad responsibilities previously managed at the JFOs 

by PA crew leaders and project specialists, into two new, specialized 

positions—the program delivery manager and site inspector. The program 

 38FEMA officials estimated that, at full implementation, CRCs are expected to reduce 

overall disaster administrative costs in three major areas, including reducing the number 

and duration of deployments. Officials estimated that at least 25 percent and as much as 

65 percent of staff would complete project development work from CRCs, saving on 

deployments costs, which can be as high as $68,000 per year per employee. According to 

the PA New Delivery Model Assessment Plan, officials plan to track data on the number 

and duration of deployments using their Deployment Tracking System, and coordinate 

with the FEMA Office of the Chief Financial Officer for administrative cost data.

39The JFO in Georgia closed on February 13, 2017, and the JFO in South Carolina closed 

on June 23, 2017. The JFOs in Florida and North Carolina were still open as of July 2017.

“The Consolidated Resource Center improves 

the quality of projects and communication, 

allowing field staff to focus on customer 

service.”

–Public Assistance program officials

Source: GAO. | GAO-18-30

Specialized Roles at JFOs

“My program delivery manager was 

exceptional. He answered all my questions 

and helped me with the documentation.” 

–Georgia Public Assistance applicant

Source: GAO. | GAO-18-30
Page 22 GAO-18-30 Disaster Assistance

delivery manager serves as the applicant’s single point-of-contact 

throughout the preaward process, manages communication with the 

applicant, and oversees document collection. All three PA grant 

applicants we spoke to following Hurricane Matthew in Georgia greatly 

appreciated the knowledge and assistance provided by their program 

delivery managers. Site inspectors are responsible for conducting the site 

inspection to document all disaster-related damages; determining the 

applicant’s plans for recovery, coordinating with other specialists, and 

verifying the information collected with the applicant. Officials expect 

deployed staff at JFOs can complete the fieldwork faster and provide 

greater continuity of service to applicants. Further, program officials 

believe that specializing roles will enable them to provide more targeted 

training, and improve employee satisfaction.

PA program officials designed new training and mentoring programs for 

the new positions at the CRCs and JFOs and used a continuous 

feedback process to update and improve the training, position guides, 

and task books throughout the implementation of the new delivery model, 

according to PA officials.40 According to a June 2017 update of the PA 

Cadre Training Plan, training for the new model has five major focuses: 

required training and skills for position qualification; on-site refresher 

training; mentor training; regional-based state, local, tribal, and territorial 

training; and training on the new information system. Specifically, officials 

developed six new training courses, and identified which are required for 

each position under the new delivery model. For example, a program 

delivery manager at the JFO is required to complete both the program 

delivery manager and site inspector specialist courses.41 As of June 

2017, PA program officials had provided at least one new model training 

course to 93 percent of their cadre (including program delivery manager 

training to 366 individuals and site inspector training to 1,172 individuals) 

and planned to provide 28 additional courses through September 2017 to 

the PA cadre. According to regional and CRC officials, the training 

 40The position guides, which PA program officials refer to as “position assists,” are a 

resource for staff members that outline job requirements––tasks and performance 

expectations––of PA positions throughout the preaward process. Task books assign 

indicators of competencies to required tasks and behaviors. PA staff use task books to 

document proficiency in the identified competencies to meet job requirements.

41The six new courses are Site Inspector Specialist, Costing Specialist, Validation 

Specialist, Document Integrity Specialist, Program Delivery Manager, and PA Operations 

Management. 

New Training Courses and 

Mentoring

“Trainers and mentors are critical to helping 

staff learn the new delivery model.” 

–Public Assistance program official

Source: GAO. | GAO-18-30

Site inspection, hazard mitigation, and 

environmental and historic preservation 

specialists, along with a new Public 

Assistance program mentor, conduct a site 

inspection with the applicant to document 

damages to a historic cemetery in Savannah, 

Georgia, following Hurricane Matthew in 

2016. 

Source: GAO. | GAO-18-30
Page 23 GAO-18-30 Disaster Assistance

courses and mentoring from experienced staff helped maximize new 

staff’s capabilities in the new process.

Throughout the third implementation of the new delivery model, JFO and 

CRC staff, as well as regional PA staff, stakeholders, and applicants, 

identified staff skills and training as a key area that needed more attention 

for full implementation of the new delivery model. Our work and FEMA’s 

after-action reports from the third test in Georgia identified problems with 

site inspector skills, which affected the timeliness and accuracy of 

projects. Specialists and managers at the CRC noted that poorly trained 

site inspectors did not consistently provide the necessary information 

from the field, which resulted in delays for the CRC staff to process 

projects, and after-action reports also identified challenges with site 

inspector skills. According to a PA applicant in Georgia, the inconsistency 

of skills and experience of their site inspector resulted in the need to 

conduct a “do-over” site inspection on one of the applicant’s projects, 

causing delays. PA staff and state officials attribute much of the site 

inspectors’ skill gaps to their lack of training and experience in the 

program. According to PA Region officials, providing timely training will be 

a resource-intensive challenge for implementing the new delivery model 

for all future disasters. For example, it can be difficult to train reservists 

before FEMA deploys them to disasters, and many of the program’s 

experienced reservists have retired or resigned, resulting in few mentors 

for the program and a high need to provide training to inexperienced and 

newly hired staff.

PA officials and stakeholders also emphasized the need for FEMA to 

provide additional training for state and local officials to build capacity and 

support the goals of the new delivery model. For example, according to 

JFO officials at the third implementation, the new delivery model 

increases responsibilities for applicants, who will require more applicant 

training than FEMA currently provides. According to state officials, 

applicant capabilities vary, and FEMA should provide training to state and 

local officials on the new delivery model and the information system 

before a disaster. Skill gaps among applicants could result in inconsistent 

implementation of the new process, according to PA staff and 

stakeholders, and PA staff said that training was important to prevent 

applicants from reverting back to the legacy PA grant application process.

To support full implementation of the new delivery model for all disasters, 

PA program officials have updated training courses for PA staff and 

applicants, and planned additional training to address these challenges 

and other lessons learned through the test implementation. For example, 

PA Officials Planned 

Additional Training to 

Address Issues Identified 

during Implementation
Page 24 GAO-18-30 Disaster Assistance

PA officials told us they updated the site inspector training program in 

May 2017 and scheduled a new site inspector training session in August 

2017 to include more hands-on training to help address the skill gaps 

identified for site inspectors. PA officials created a new training course for 

FEMA’s regional offices, in part to enable regional PA staff to provide new 

delivery model training to state and local officials. PA officials also 

planned to develop a self-paced, online course for state and local officials 

by the end of 2017.42

PA officials have not fully assessed the workforce needed for JFO field 

operations, CRC staff, or FIMA’s hazard mitigation staff to support 

implementation of the new delivery model for all future disasters. PA 

program officials developed an initial assessment of the total number of 

staff needed in the field and the CRCs in 2016 to estimate cost savings 

associated with consolidating and specializing positions at the CRCs and 

deploying fewer staff to JFOs. However, the assessment did not identify 

the number of staff required to fill specific positions, including program 

delivery managers and hazard mitigation specialists, needed to support 

the new delivery model for full implementation. In reviewing the test 

implementations of the new delivery model, we found that inadequate 

staffing levels at the JFOs and CRCs, and with FIMA’s hazard mitigation 

staff, affected staffs’ ability to achieve the goals of the new delivery 

model.

• Staff levels at the JFO. We identified challenges with having the right 

number of program delivery managers and site inspection specialists 

to achieve program goals for customer satisfaction, efficiency, and 

quality in test implementations of the new delivery model. For 

example, in the second test implementation of the new delivery model 

in Oregon in 2016, PA did not deploy enough program delivery 

managers to the disaster, which resulted in unmanageable caseloads 

for program delivery managers, according to state and PA officials. 

PA program officials assigned program delivery managers an average 

 42Also, in response to a June 2017 DHS-OIG review of the PA program’s efforts to 

address long-standing challenges with insurance specialists, FEMA noted that it plans to 

develop a course for insurance specialists under the new delivery model, to help 

specialists understand their roles and responsibilities, and track insurance requirements 

within the FAC-Trax information system. Department of Homeland Security, Office of the 

Inspector General, Verification Review: FEMA’s Lack of Process for Tracking Public 

Assistance Insurance Requirements Places Billions of Tax Dollars at Risk, OIG-17-50-VR 

(Washington, D.C.: June 9, 2017).

Opportunities Exist to 

Enhance Workforce 

Assessment in the New 

Delivery Model
Page 25 GAO-18-30 Disaster Assistance

caseload of 12 PA applicants, which was more than they could 

effectively manage, according to PA staff, and program officials aim 

for a caseload of 8 to 10 applicants. According to state officials, local 

officials reported they did not always receive the support they needed 

from program delivery managers who managed caseloads consisting 

of dozens of projects at multiple sites for each applicant during the 

Oregon implementation. As a result of overwhelmed program delivery 

managers, local officials faced challenges understanding their 

responsibilities, such as recognizing when they needed to provide 

information for the project development to proceed, according to state 

officials. PA staff involved with the third test implementation in 

Georgia in 2016 and 2017 said there were not enough site inspectors 

or program delivery managers to fully manage the workload at the 

JFO. Because of the specialization of roles, projects could not move 

forward when there were not enough staff to execute the next step in 

the process. For example, PA staff at the JFO said program delivery 

managers completed recovery scoping meetings rapidly, but faced a 

bottleneck in scheduling site inspections because there were more 

applicants awaiting site inspections than could be fulfilled by the 

number of site inspection specialists available.

• Staff levels at the CRC. Staff at the CRC reported challenges with 

staffing levels during the Oregon and Georgia test implementations, 

and expressed concerns about when PA officials will staff the CRCs 

to support full implementation of the new model for all disasters. 

During the Oregon test implementation, a CRC specialist said there 

were not enough technical specialists to manage the workload and, as 

a result, PA program officials had to redeploy site inspectors from 

their JFO field operations to the CRC to complete costing estimates. 

During the third test in Georgia, quality assurance specialists said that 

their workload resulted in added stress trying to complete the work in 

time while adhering to quality standards. According to CRC specialists 

in Denton, Texas, PA officials had not determined required staff levels 

for full implementation, but agreed that workload was too high and 

program officials needed to determine the appropriate staff levels for 

each CRC to support full implementation. PA officials were still 

evaluating CRC processing times and workload management from the

Oregon and Georgia test implementations to determine staffing 

needs, according to PA officials. Further, PA program officials plan to 

establish a second CRC in Winchester, Virginia, before the end of 

2017, but have not determined the number of additional permanent 
Page 26 GAO-18-30 Disaster Assistance

full-time staff needed to support the CRCs for full implementation of 

the new delivery model.43

• Staff levels for the hazard mitigation specialists. PA officials have 

not identified the number of hazard mitigation specialists in FIMA’s 

hazard mitigation cadre needed for full implementation of the new 

delivery model. According to JFO staff, current hazard mitigation staff 

levels are insufficient to provide the desired in-person participation of 

hazard mitigation staff on all recovery scoping meetings to share 

information on hazard mitigation with applicants and help them 

identify potential mitigation opportunities.44 A PA program official said

officials missed opportunities to pursue hazard mitigation during the 

test implementation after Hurricane Matthew in Georgia due to lack of 

hazard mitigation specialists. In addition, for the test implementation in 

Oregon, there were not enough hazard mitigation specialists to cover 

all site inspections and implement their new delivery model 

responsibilities, according to FEMA’s after-action reports. The 

absence of hazard mitigation specialists in the early stages of PA 

project development may cause delays in officials’ identifying hazard 

mitigation opportunities, according to a FIMA official. PA program 

officials said they did not work with FIMA to determine the appropriate 

levels of hazard mitigation staff under the new delivery model 

because they were refining the new process, but as of June 2017 

were working with FIMA to do so.

One of the key implementation activities in our Business Process 

Reengineering Assessment Guide includes addressing workforce 

management issues. Specifically, this includes identifying how many and 

which employees will be affected by the position changes and 

retraining.45 Further, our prior work has found that high-performing 

organizations identify their current and future workforce needs—including 

 43FEMA planned to establish the Denton and Winchester CRCs at two existing National 

Processing Service Centers, which are the centralized processing centers for FEMA’s 

Individual Assistance Program, to minimize the associated infrastructure costs. Program 

officials planned for the Winchester CRC to be operational by April 2017, but experienced 

delays due to a hiring freeze early in 2017, according to program officials.

44The current workforce strength for the hazard mitigation cadre is approximately 980 

staff, or approximately 45 percent of its workforce structure, with vacancies in about 55 

percent of their cadre, according to officials. As of July 2017, FEMA is reassessing the 

workforce levels in light of the new delivery model and other challenges in the cadre, but 

did not specify when the assessment would be completed, according to PA program 

officials.

45GAO/AIMD-10.1.15.
Page 27 GAO-18-30 Disaster Assistance

the appropriate number and deployment of staff across the organization—

and address workforce gaps, to improve the contribution of critical skills 

and competencies needed for mission success.46

According to a PA program official, their initial workforce assessment was 

not comprehensive because they were still collecting data required to 

make informed decisions. PA officials agreed that updating their 

workforce assessments prior to full implementation could be helpful, and 

acknowledged that program officials needed to be more proactive 

applying the lessons learned as they pivot from testing to full 

implementation of the new delivery model in 2018. FEMA also conducts a 

standard agency wide workforce structure review every 2 to 3 years, 

which helps officials determine the appropriate disaster workforce levels. 

As of June 2017, PA officials were working with other offices within FEMA 

to expedite the agency-wide assessment of the PA and FIMA hazard 

mitigation cadres, but did not know when they would complete the 

assessment. PA officials also acknowledged that they faced an 

aggressive schedule to complete various planned activities for workforce 

management, training, and other efforts, in support of full implementation, 

and that they may not be able to complete all efforts as thoroughly as 

they would like in order to expedite the transition of the PA program to the 

new delivery model.

The gaps in PA workforce assessment in the JFOs, CRCs, and for 

FIMA’s hazard mitigation cadre present a risk that PA program managers 

will not have a sufficient workforce to support the goals of the new 

delivery model. In addition, the timing and implementation of the hiring 

and training activities for new PA program staff could take multiple 

months, and program officials will need to know what staff levels are 

necessary for full implementation of the new delivery model to inform 

resource decisions for the program in coordination with other agency 

offices. According to PA program officials, workforce assessment efforts 

have been delayed as a result of disaster response and recovery efforts

related to Hurricanes Harvey, Irma, and Maria. Completing a workforce 

assessment will help program officials identify gaps in their workforce and 

skills, which could help PA program officials minimize the effects of longstanding workforce staffing and training challenges on the PA program 

delivery and inform full implementation for all disasters.

 46GAO, Human Capital: Key Principles for Effective Workforce Planning, GAO-04-39 

(Washington, D.C.: Dec. 11, 2003).
Page 28 GAO-18-30 Disaster Assistance

As part of its new delivery model, PA developed a new information 

system called the FEMA Applicant Case Tracker (FAC-Trax)—a webbased project tracking and case management system—to supplement 

EMMIE and help resolve long-standing information sharing challenges.47

As described earlier, in 2008 we recommended that FEMA improve 

collaboration and information sharing among federal, state, and local 

participants within the PA process by identifying and disseminating 

practices that facilitate more effective communication.48 FEMA addressed 

our recommendation in 2008 with the implementation of EMMIE, which 

officials designed to facilitate communication among states, applicants, 

and the agency.49 However, PA officials have since found EMMIE to have 

limitations that can delay the project development process and increase 

 47FAC-Trax is a web application, developed from commercially available off-the-shelf 

information technology products that FEMA and the contractor have adapted to meet PA 

program requirements. FEMA awarded the FAC-Trax contract in May 2016. The base 

year period encompasses the initial deployment of the solution through full operational 

capability for the PA program. However, as of May 2017, FAC-Trax has not yet reached 

full operational capability. EMMIE remains FEMA’s system of record for PA grant awards, 

and other disaster grants, until the completion of the agency-wide Grants Management 

Modernization initiative planned for 2020.

48GAO-09-129.

49EMMIE is a web-based application that enables PA grantees and applicants to 

complete, submit, monitor, and manage PA applications online. FEMA first deployed 

EMMIE in December 2007, before using the system for all disasters in 2008. Prior to 

EMMIE, FEMA used the National Emergency Management Information System to 

electronically enter, record, and manage information regarding registered applicants for 

disaster assistance, including PA grant applications. 

FEMA Designed the 

New PA Information 

System to Resolve 

Past Challenges, but 

Opportunities Exist to 

Fully Implement Key 

Management 

Controls

FEMA’s New PA 

Information System Is 

Designed to Resolve 

Long-Standing Information 

Sharing Challenges
Page 29 GAO-18-30 Disaster Assistance

costs. For example, EMMIE does not collect information on all of the 

preaward activities that are part of the PA grant application process. As a 

result, PA program officials said they, and applicants, must use ad hoc 

reports and personal tracking documents to manage and monitor the 

progress of grant applications. PA officials added that EMMIE is not userfriendly and applicants often struggle to access the system. In response 

to these ongoing challenges, PA program officials developed FAC-Trax—

a separate information system from EMMIE—with new capabilities 

designed to improve transparency, efficiency, and management of the PA 

program.

Specifically, FAC-Trax allows FEMA staff (PA Grants Manager) and 

applicants (PA Grants Portal), to review, manage, and track current PA 

project status and documentation. For example, applicants can use FACTrax to submit requests for public assistance, upload required project 

documentation, approve grant application items, and send and receive 

notifications on grant progress and activities. In addition, the FAC-Trax 

system includes standardized forms, as well as required fields and tasks 

that PA program staff and applicants must complete before moving on to 

the next steps in the PA preaward process. According to PA officials, 

these capabilities increase transparency, encourage greater applicant 

involvement, and enhance collaboration and communication between 

FEMA and grant applicants, to improve efficiency in processing and 

awarding grant applications and enhance the quality of project 

development. Further, PA officials said that FAC-Trax could reduce 

challenges associated with staff turnover during the project development 

process because the system stores and maintains applicant information 

and project documentation, making it easier for transitioning staff to assist 

an applicant. They also said they use FAC-Trax to gather and analyze 

data that supports management of the PA process, including measuring 

the timeliness of the grant application process. For example, during the 

test implementation of the new delivery model in Georgia following 

Hurricane Matthew, officials were able to document that, on average, 

program delivery managers took 5 days to conduct the exploratory call 

and 14 days to hold the recovery scoping meeting with applicants, and 

CRC officials took 33 days to develop and review grant proposals. 

Managers use this data to assess staffing needs and identify bottlenecks 

in the PA process, according to PA officials.

Reactions from Public Assistance (PA) 

Program Staff and Stakeholders to the 

New Federal Emergency Management 

Agency (FEMA) Applicant Case Tracker 

(FAC-Trax)

“The new tool [FAC-Trax] makes it easier for 

applicants to be involved in the PA process. 

They can upload their own documents and 

have complete visibility into the project 

formulation process.”

–Program delivery managers from the 

Hurricane Matthew Joint Field Office

“Despite the initial learning curve, FAC-Trax is 

a positive step forward for FEMA because it 

improves accountability and project quality.”

–Georgia Emergency Management Agency 

officials

“FAC-Trax helps field staff transition to the 

new model because it helps guide them 

through the PA preaward process.”

–Denton Consolidated Resource Center

leadership

“FAC-Trax allows for project tracking and 

analysis of program delivery. This capability is 

important because it facilitates learning and 

improvement.”

–PA program official

Source: GAO. | GAO-18-30
Page 30 GAO-18-30 Disaster Assistance

FAC-Trax is critical to the new PA delivery model and will be a primary 

means of sharing grant application documents, tracking ongoing PA 

projects, and ensuring that FEMA staff and applicants follow PA grant 

policies and procedures. Given the importance of developing and testing 

this new information sharing system, we evaluated its development 

against four key IT management controls—(1) project planning; (2) risk 

management; (3) requirements development; and (4) systems testing and 

integration.50 When implemented effectively, these controls provide 

assurance that IT systems will be delivered within cost and schedule and 

meet the capabilities needed by its users. We found that FEMA’s 

development of FAC-Trax fully satisfied best practices for project planning 

and risk management, but additional steps are needed to fully satisfy the 

areas of requirements development and systems testing and integration,

as discussed below. See appendix II for the full assessment of each IT 

management control.

PA program officials fully satisfied all five practices in the project planning 

control area, according to our assessment. Key project planning practices 

are (1) establishing and maintaining the program’s acquisition strategy, 

(2) developing and maintaining the overall project plan and obtaining 

commitment from relevant stakeholders, (3) developing and maintaining 

the program’s cost estimate, (4) establishing and maintaining the 

program’s schedule estimate, and (5) identifying the necessary 

knowledge and skills needed to carry out the program.51 To address the 

first and second practices, program officials established detailed plans 

that describe the acquisition strategy and objectives, the program’s 

scope, and its framework for using an Agile software development 

approach, among other key actions. Agile is a method of software 

development that utilizes an iterative process and constantly improves 

 50GAO-16-306. In this prior review, we identified four key IT management controls based 

on a review of various criteria—the Software Engineering Institute’s Capability Maturity 

Model® Integration for Acquisition, the Project Management Institute’s Guide to the 

Project Management Body of Knowledge, and the Institute of Electrical and Electronics 

Engineers’ Standard for Software and System Test Documentation. We assessed, against 

these four controls, three systems that play a critical role in supporting FEMA’s response 

and recovery efforts: EMMIE, the Disaster Assistance Improvement Program, and the 

Integrated Public Alert and Warning System. Our review of FAC-Trax uses the same key 

IT management controls.

51Capability Maturity Model® Integration for Acquisition, Version 1.3. 

Opportunities Exist to 

More Fully Implement Two 

of Four Key IT 

Management Controls for 

FEMA’s New PA 

Information System

Project Planning
Page 31 GAO-18-30 Disaster Assistance

software based on user needs and feedback.52 Program officials also 

developed a plan detailing the program’s approach to deploy and 

maintain FAC-Trax and established stakeholder groups and an integrated 

product team to support and oversee the development of FAC-Trax. To 

address the third and fourth practices, they developed and maintained a 

master schedule of all implementation tasks and milestones through 

project completion, and developed a life-cycle cost estimate of over $19 

million. Additionally, FAC-Trax’s acquisition performance baseline 

describes the system’s minimum acceptable and desired baselines for 

performance, schedule, and cost. Lastly, in regards to the fifth practice, 

program officials identified the knowledge and skills needed to carry out 

the program in the FAC-Trax Request for Proposal and FAC-Trax 

Capability Development Plan.

PA program officials fully satisfied all four practices in the risk 

management control area, according to our assessment. Key risk 

management practices are (1) identifying risks, threats, and vulnerabilities 

that could negatively affect work efforts, (2) evaluating and categorizing 

each identified risk using defined risk categories and parameters, (3) 

developing risk mitigation plans for selected risks, and (4) monitoring the 

status of each risk periodically and implementing the risk mitigation plan 

as appropriate.53 To address the first and second practices, program 

officials identified key risks that could negatively affect FAC-Trax in a “risk 

register”—an online site used to track risks, issues, and mitigating 

actions.54 As of May 2017, officials had identified 13 risks in the risk 

register—four open and nine closed—and evaluated and categorized the 

identified risks based on the probability of occurrence and scope, 

schedule, and cost impacts. For example, program officials reported that 

two of its open risks have a “medium” risk rating—meaning the risk has 

the potential to slightly affect project cost, schedule, or performance. To 

address the third and fourth practices, program officials developed and 

documented risk mitigation plans for all identified risks. For example, 

 52Office of Management and Budget, U.S. Digital Services, TechFAR: Handbook for 

Procuring Digital Services Using Agile Processes, accessed on July 17, 2017, 

https://playbook.cio.gov/techfar/.

53Capability Maturity Model® Integration for Acquisition, Version 1.3.

54Program officials also identified five technical, cost, and schedule risks in the FAC-Trax 

acquisition plan, one of which they included in the risk register. According to PA officials, 

they managed the other four risks outside of the register and closed them in September 

2016 following the solutions engineering review, which demonstrates the readiness of the 

program to proceed with the procurement.

Risk Management
Page 32 GAO-18-30 Disaster Assistance

program officials planned to mitigate the risk of limited engagement of 

subject matter experts by identifying and engaging with appropriate 

experts through workshops, and monitoring the capability development 

process to identify any issues that may cause project delays. In addition, 

PA program officials documented the responsible officials, reevaluation 

date, and risk status, among other things, for each risk in the register, and 

reviewed and updated risks during weekly and monthly program reviews 

with stakeholders throughout FEMA.55

PA program officials fully satisfied four out of five practices in the 

requirements development control area, according to our assessment. 

Key requirements development practices are (1) eliciting stakeholder 

needs, expectations, and constraints, and transforming them into 

prioritized customer requirements; (2) developing and reviewing 

operational concepts and scenarios to refine and discover requirements; 

(3) analyzing requirements to ensure that they are complete, feasible, and 

verifiable; (4) analyzing requirements to balance stakeholder needs and 

constraints; and (5) testing and validating the system as it is being 

developed.56 To address the first and second practices, program officials 

developed a requirements management plan outlining how officials 

capture, assess, and plan for FAC-Trax enhancements, and established a 

change control process to review, prioritize, and verify user requests for 

changes to the system and feedback. As of May 2017, the PA program 

office received 734 change requests related to FAC-Trax, of which 

program officials completed 420 changes and planned to address an 

additional 277 entries. Program officials also developed a functional 

requirements document outlining the high-level requirements for FACTrax and detailed operational concepts and scenarios for each phase of 

the preaward process in the system’s concept of operations.57 To address 

the fourth practice, program officials created a standard template to 

analyze and document the user needs and acceptance criteria for 

 55In addition to regularly reviewing and updating the risks in the risk register, PA program 

officials documented the risk category, probability, and impact, as well as the responsible 

officials and risk status for the four risks managed and addressed outside of the risk 

register.

56Capability Maturity Model® Integration for Acquisition, Version 1.3.

57The PA program office was able to obtain additional requirements for FAC-Trax through 

customer feedback on a temporary technology tool—an Access database referred to as 

the Public Assistance Recovery Information System—used to support the second test 

implementation of the new delivery model in February 2016.

Requirements Development
Page 33 GAO-18-30 Disaster Assistance

planned system capabilities in March 2017.58 In addition, PA program 

officials identified risks and dependencies for recommended changes to 

FAC-Trax, and balanced the cost and priority of system enhancements as 

part of the change control process. Lastly, regarding the fifth practice, 

program officials tested and evaluated FAC-Trax during development, 

which included validating system enhancements through user acceptance 

testing.

However, program officials did not fully address the third practice—

analyzing requirements to ensure they are complete, feasible, and 

verifiable—because they did not ensure detailed user requirements were 

necessary and sufficient by tracking them back to higher-level 

requirements.59 For example, although program officials reviewed change 

requests for completeness and followed up with users to verify 

requirements, officials did not track system enhancements, made in 

response to detailed user requirements (e.g., allowing users to search PA 

projects by project number), back to the high-level requirements (e.g., 

storing data and information provided by the applicant) identified in the 

FAC-Trax functional requirements document and performance work 

statement. Officials did not track system enhancements back to high-level 

requirements because they did not have a complete understanding of 

basic user needs and system requirements at the beginning of the FACTrax effort, according to the PA program manager. A PA official also said 

the change control process was a way to identify the basic capabilities 

FAC-Trax needed to have and that tracking enhancements back to highlevel requirements could have made the change control process more 

difficult to manage, and reduced user participation if, for example, users 

needed to understand how their change requests related to high-level 

requirements. However, program officials could have tracked 

enhancements back to high-level requirements themselves using the 

change control process without putting any additional burden on users. 

Despite not having a complete understanding of user needs and system 

 58Acceptance criteria specify how a desired feature or capability is to function from the 

customer’s perspective. System users evaluate acceptance criteria for planned system 

capabilities during user acceptance testing and after PA deploys FAC-Trax following 

system enhancements, according to PA program officials. We did not evaluate the quality 

of the acceptance criteria used by PA program officials.

59This reporting criterion includes the following practice and sub-practice from the 

Capability Maturity Model® Integration for Acquisition: analyzing requirements to ensure 

they are necessary and sufficient and determining whether requirements satisfy higherlevel requirements.
Page 34 GAO-18-30 Disaster Assistance

requirements at the beginning of the FAC-Trax effort, analyzing whether 

users’ change requests satisfy higher-level requirements identified in key 

design and planning documents would have provided officials with a basis 

for more detailed and precise requirements throughout project 

development and helped them better manage the project, according to IT 

management controls.60 Further, according to the PMBOK® Guide, 

tracking or measuring system capabilities against approved requirements 

is a key process for managing a project’s scope, measuring project 

completion, and ensuring the project meets user needs and 

expectations.61

Program officials acknowledged the importance of tracking system 

enhancements back to documented system requirements. Ensuring that 

FAC-Trax meets user needs and expectations is especially important 

because the information system is key to the success of the new delivery 

model, according to PA officials. By analyzing progress made on 

documented, high-level requirements, a step that reflects a key IT 

management control for requirements development, the PA program will 

have greater assurance that FAC-Trax will provide functionality that 

meets user needs and expectations.

PA program officials did not fully satisfy either of the two practices in the 

systems testing and integration control area, according to our 

assessment. Key systems testing and integration practices are (1) 

developing test plans and test cases, which include a description of the 

overall approach for system testing, the set of tasks necessary to prepare 

for and perform testing, the roles and responsibilities for individuals or 

groups responsible for testing, and criteria to determine whether the 

system has passed or failed testing; and (2) developing a systems 

integration plan to identify all systems to be integrated, describe how 

integration problems are to be documented and resolved, define roles 

 60Capability Maturity Model® Integration for Acquisition, Version 1.3; Capability Maturity 

Model® Integration for Development, Version 1.3. 

61Project Management Institute, Inc., A Guide to the Project Management Body of 

Knowledge (PMBOK® Guide), 5th ed., 2013. PMBOK is a trademark of Project 

Management Institute, Inc.

Systems Testing and 

Integration
Page 35 GAO-18-30 Disaster Assistance

and responsibilities of all relevant participants, and establish a sequence 

and schedule for every integration step.62

In regards to the first practice, PA program officials and the FAC-Trax 

contractor established a test plan that identifies the method and strategy 

to perform testing, including the necessary tasks, such as responding to 

user feedback and testing errors, and incorporating necessary resolutions 

into future work, testing parameters, and the roles and responsibilities of 

the individuals responsible for testing. However, program officials have 

not developed system testing criteria to evaluate FAC-Trax, which would 

align with the practice described above of using criteria to determine 

whether the system has passed or failed testing. A key feature of Agile 

software development is the “definition of done”—a set of clear, 

comprehensive, and objective criteria, that the government should use to 

evaluate software after each iteration of development. PA program 

officials said they did not establish a definition of done because officials 

initially managing the FAC-Trax effort lacked familiarity with system 

development in the Agile environment.63 Officials acknowledged the 

importance of establishing a definition of done and said they are planning 

to develop one, but have not identified how or when to incorporate it into 

the development process. According to the TechFAR—the government’s 

handbook for procuring digital services using Agile processes—the 

government and vendor should establish this definition after contract 

award at the beginning of each cycle of software development.64 By 

establishing criteria, such as a definition of done, to evaluate the 

system—a step that reflects a key IT management control for system 

testing and is an effective practice for applying Agile to software 

development—the PA program will have greater assurance that FACTrax is usable and responsive to specified requirements.

 62A systems integration plan describes a program’s approach for ensuring that all 

components of a system are appropriately integrated. A critical aspect of system 

integration is identifying and managing internal and external interfaces, including user 

interfaces, internal and external data sources, and other systems that may or may not be 

within the organization’s control, but on which the system relies. IEEE Standard for 

Software and System Test Documentation, IEEE Standard 829TM 2008; Capability 

Maturity Model® Integration for Development, Version 1.3.

63By December 2016, the program management team for FAC-Trax included a program 

manager and staff with Agile experience, according to FEMA officials.

64TechFAR: Handbook for Procuring Digital Services Using Agile Processes. 
Page 36 GAO-18-30 Disaster Assistance

In regards to the second practice, PA program officials developed a 

systems integration plan in June 2017 that identified the potential for 

integration of FAC-Trax with four FEMA systems, including EMMIE.65 In 

addition, program officials included a description of how staff should 

document integration problems and the resolution of problems in FACTrax development and test plans. However, the systems integration plan 

does not define roles and responsibilities of all participants for system 

integration activities or establish a sequence and schedule for every 

integration step for the four FEMA systems. PA officials said that system 

integration planning for FAC-Trax is in the early stages, but 

acknowledged the importance of these elements of system integration 

planning. Officials plan to define roles and responsibilities of all 

participants for system integration activities and develop the sequence 

and schedule for every integration step as they add new systems to the 

FAC-Trax development plan and obtain funding needed for their 

integration. Nonetheless, FEMA has used FAC-Trax for selected PA 

disasters since October 2016 and plans to use FAC-Trax for all future 

disasters. According to IT management controls, agencies should 

establish the systems integration plan early in the project and revise it to 

reflect evolving and emerging user needs.66 By ensuring that the FACTrax systems integration plan defines the roles and responsibilities of 

relevant participants for all integration relationships and establishes a 

sequence and schedule for every integration step, the PA program will 

have greater assurance that FAC-Trax functions properly with other 

systems and meets user needs.

 65According to program officials, the initial estimate to integrate FAC-Trax and EMMIE for 

approximately 3 years is approximately $1 million.

66Capability Maturity Model® Integration for Development, Version 1.3.
Page 37 GAO-18-30 Disaster Assistance

FEMA’s new delivery model enhances participation of hazard mitigation 

staff with the goal of identifying opportunities for mitigation earlier in the 

PA preaward process, according to PA officials. Two key changes related 

to hazard mitigation under the new model include (1) an emphasis on 

engaging with hazard mitigation specialists at the JFO earlier in the PA 

process and involving them in specific PA preaward activities and (2) the 

establishment of the PA program’s hazard mitigation liaison at the CRC. 

For example, position guides direct program delivery managers to 

coordinate with FIMA’s hazard mitigation specialists prior to recovery 

scoping meetings, and site inspectors to coordinate with hazard mitigation 

specialists prior to site inspections to discuss a PA grant applicant’s 

damages and any potential mitigation opportunities. PA program officials 

also developed guidance for conducting the exploratory call and the 

recovery scoping meeting with applicants, which include questions for PA 

staff to ask on the applicant’s interest in or plans for incorporating hazard 

mitigation into potential projects.67 In addition, a new hazard mitigation 

liaison at the CRC is responsible for reviewing PA projects for hazard 

mitigation opportunities and serving as a mitigation subject matter expert 

for the PA program.

According to data provided by FEMA, PA grant applicants incorporated 

hazard mitigation into approximately 18 percent of permanent work 

 67The exploratory call and recovery scoping meeting guides for the new delivery model 

include questions regarding the damage history at a particular facility; an applicant’s plans 

to prevent similar damage in the future; an applicant’s mitigation plan or current mitigation 

projects; and an applicant’s preference for technical assistance to explore mitigation 

opportunities.

FEMA’s New PA 

Model Enhances 

Hazard Mitigation 

Staff Participation, but 

Opportunities Exist to 

Further Promote 

Mitigation

Changes under the New 

Model Include Enhanced 

Participation of Hazard 

Mitigation Staff
Page 38 GAO-18-30 Disaster Assistance

projects for all disasters nationwide from 2012 to 2015.68 During test 

implementation of the new delivery model, state, PA, and FIMA officials 

all reported an increase in the number of hazard mitigation activities on 

PA permanent work projects. For example, state officials who participated 

in the second new model test in Oregon said that effective communication 

and coordination between PA and hazard mitigation staff resulted in 

applicants incorporating hazard mitigation into over 60 percent of 

permanent work projects. Furthermore, PA officials reported an increase 

in hazard mitigation during the third test implementation of the new model 

in Georgia following Hurricane Matthew, where approximately 16 percent 

of permanent work projects included mitigation, as of June 2017. This 

represents an increase compared to the PA program’s estimate for the 

proportion of projects that incorporate hazard mitigation among previous 

PA hurricane disasters in Georgia, which was about 3 percent, according 

to PA officials.69 While PA officials are trying to increase hazard mitigation 

through the new delivery model, not all disasters present the same 

number of opportunities to incorporate hazard mitigation. First, the PA 

program only incorporates hazard mitigation measures for permanent 

work projects, such as repairs to roads, bridges, and buildings. For 

example, as of June 2017, approximately 60 percent of the projects 

FEMA funded in Georgia for the third test implementation after Hurricane 

Matthew were for emergency work, which is not eligible for hazard 

mitigation measures. Second, the PA program only funds mitigation 

measures that officials determine to be cost-effective. In addition, we 

have previously reported on other factors that affect whether applicants 

incorporate hazard mitigation into PA projects, such as their capacity to 

manage and ability to fund hazard mitigation projects.70

 68Officials measure only permanent work projects for hazard mitigation because hazard 

mitigation applies only to permanent work, as opposed to emergency work projects, which 

include debris removal and emergency protective measures, such as flood fighting 

activities, evacuation and sheltering of disaster survivors, and providing medical care and 

transport.

69FEMA officials at the joint field offices for the third and fourth new model test 

implementations in Georgia analyzed all PA disasters in Georgia from 2008 through 2015 

to establish a baseline for evaluating mitigation efforts, and estimated that 3 percent of 

permanent work projects related to hurricane disasters during that time incorporated 

hazard mitigation, according to PA officials.

70GAO-15-515. 
Page 39 GAO-18-30 Disaster Assistance

Although the new model establishes hazard mitigation activities for PA 

and FIMA staff in the preaward process, it does not standardize and 

prioritize hazard mitigation planning at JFOs in the way FEMA has done 

with prior PA program policy. Specifically, FEMA’s 2007 PA program 

policy standardized planning for hazard mitigation across PA recovery 

efforts by stating that agency and state officials should issue a 

memorandum of understanding (MOU) early in the disaster, outlining how 

PA hazard mitigation will be addressed for the disaster, including what 

mitigation measures will be emphasized, and identifying applicable codes 

and standards, and any potential integration with other mitigation grant 

programs.71 However, PA program officials did not include guidance that 

standardizes planning for hazard mitigation, such as encouraging the use 

of an MOU, in FEMA’s 2010 PA program policy, the most recent update 

to the Public Assistance Program and Policy Guide in April 2017, or the 

New Delivery Model Operations Manual. As a result, FIMA officials said 

FEMA and state officials do not consistently issue MOUs that outline how 

FEMA and the state plan to promote PA hazard mitigation during the 

recovery effort, explaining that the use of the MOU is based on the 

preferences and priorities of the FEMA officials involved. When not 

issuing an MOU, FIMA hazard mitigation staff and PA officials at the JFO 

meet to determine the extent which hazard mitigation staff interact directly 

with applicants regarding PA hazard mitigation during the recovery 

process, according to a FIMA official.

Having a consistent approach to planning for and prioritizing hazard 

mitigation across all disasters is important for FEMA, given that FEMA 

experienced challenges consistently prioritizing and integrating hazard 

 71FEMA, Disaster Assistance Policy: Hazard Mitigation Funding Under Section 406 

(Stafford Act), DAP9526.1 (July 30, 2007).

Opportunities to Better 

Promote Hazard Mitigation 

under the New Model

Hazard Mitigation Planning and 

Prioritization

National Planning for Hazard 

Mitigation

In our 2015 report on disaster resilience 

following Hurricane Sandy, we noted that 

disaster affected areas have different threats 

and vulnerabilities, and local stakeholders

make the ultimate determination whether or 

not to incorporate hazard mitigation into a 

project. Further, without a strategic approach 

to making disaster resilience investments, the 

federal government and its nonfederal 

partners may be unable to fully capitalize on 

opportunities for mitigation on the greatest 

known threats and hazards. We 

recommended that the Mitigation Framework 

Leadership Group develop an investment 

strategy to help ensure that federal funds 

expended to enhance disaster resilience 

achieve the goal of reducing the nation’s fiscal 

exposure because of climate change and the 

rise in the number of federal major disaster 

declarations as effectively and efficiently as 

possible. In response, the Federal Emergency 

Management Agency (FEMA) plans to issue a

final National Mitigation Investment Strategy 

in 2018. The goals of this strategy include 

increasing the effectiveness of investments in 

reducing disaster losses and increasing 

resilience, and improving coordination of 

disaster risk management among federal, 

state, local, tribal, territorial, and private 

entities.

Source: GAO-15-515 and FEMA’s Mitigation Framework 

Leadership Group. | GAO-18-30
Page 40 GAO-18-30 Disaster Assistance

mitigation across PA recovery efforts, according to GAO and others.72 For 

example, in our 2015 report on resilience in the Hurricane Sandy 

recovery, we found that state and local officials experienced challenges 

maximizing disaster resilience in the recovery effort because PA officials 

did not consistently prioritize hazard mitigation during project 

development.73

According to FEMA’s National Mitigation Framework, planning is vital for 

mitigation efforts during disaster recovery, and federal, state, and local 

officials should establish procedures that emphasize a coordinated 

delivery of mitigation activities and capitalize on opportunities to reduce 

future disaster losses. Similarly, the Recovery Federal Interagency 

Operational Plan, which supports FEMA’s National Disaster Recovery 

Framework, identifies planning as a key task for identifying mitigation 

opportunities and integrating risk reduction considerations into decisions 

and investments during the recovery process.74 FIMA officials agreed that 

including the development of a formal plan, such as the historical 2007 

PA program policy regarding the use of MOUs, for PA hazard mitigation 

in operations guidance would help program officials plan for and prioritize 

hazard mitigation. They noted that FIMA’s hazard mitigation field 

operations guide includes procedures for implementing proposed MOUs 

to achieve mitigation goals. PA program officials said that, in light of 

changes to the PA process under the new model and subsequent 

 72GAO-15-515; Association of State Floodplain Managers, National Flood Programs and 

Policies in Review (2015) (Madison, Wis.: Feb. 25, 2015). The Association of State 

Floodplain Managers is a professional association and stakeholder group that commented 

on FEMA’s bottom-up review of the PA program. It identified challenges with inconsistent 

integration of hazard mitigation in the PA process, and recommended that operational 

goals for a disaster recovery effort equally value the effective delivery of hazard mitigation 

programs. In addition, see Department of Homeland Security, OIG-10-26 and OIG-10-28.

73GAO defined disaster resilience as actions taken to mitigate vulnerabilities to the effects 

of severe weather and to adapt to effects of climate change. GAO-15-515.

74The Recovery Federal Interagency Operational Plan provides guidance to implement 

the National Disaster Recovery Framework, which establishes a comprehensive structure 

to enhance the nation’s ability to work together, both before and after a disaster, to 

effectively deliver recovery assistance through the coordinated efforts of federal, state, 

local, and tribal governments and nongovernmental organizations. The National Mitigation 

Framework addresses how the nation will develop, employ, and coordinate hazard 

mitigation capabilities to reduce loss of life and property by lessening the impact of 

disasters. It also established the Mitigation Framework Leadership Group, an 

intergovernmental coordinating body, to integrate federal efforts and promote a national 

culture shift that incorporates risk management and hazard mitigation in all planning, 

decision making, and development to the extent practicable.
Page 41 GAO-18-30 Disaster Assistance

updates to program policies, the MOU policy from the 2007 PA program 

policy was outdated. But officials agreed that planning for and prioritizing 

hazard mitigation at the operational level is important and said they were 

examining additional ways to incorporate these activities early in the PA 

process. As FEMA continues to implement the new model, establishing 

procedures to standardize hazard mitigation planning for each disaster, 

as it did through prior policy, could improve the prioritization of hazard 

mitigation in PA recovery efforts and increase the effectiveness of 

mitigation for reducing disaster losses and increasing resilience.

PA program officials developed performance objectives and measures for 

hazard mitigation in the new delivery model, but could add measures to 

better align performance assessment for the PA program with FEMA’s 

broader strategic goals for hazard mitigation. In its strategic plan for 

2014–2018, FEMA established an agency-wide goal to increase the 

percentage of FEMA-funded disaster projects, such as those under the 

PA program, that provide mitigation above local, state, and federal 

building code requirements by 5 percentage points by the end of fiscal 

year 2018. For example, local building codes may require measures for 

new construction to mitigate against future damage. To align with FEMA’s 

strategic goal, PA officials would also need to measure the number of PA 

projects that included mitigation measures that bring any repaired 

infrastructure to a level above applicable building codes.

75 However, 

under the new model, FEMA officials developed performance objectives 

(and associated measures) to increase the number of projects that 

include hazard mitigation by 5 percent, and increase the total dollars 

spent on hazard mitigation by 2 percent. While these measures could 

help to incentivize mitigation, they are not tied to building codes and do 

not include specific information that FEMA could use to continually 

assess the PA program’s contributions to meeting the agency’s strategic 

goal.

According to Standards for Internal Control in the Federal Government, 

agency management should design control activities, such as 

establishing and reviewing performance measures, to achieve the 

 75FEMA generally requires that all permanent work projects meet, at a minimum, the 

hazard-resistant provisions referenced in nationally recognized building codes and 

standards, even if they exceed local codes or standards or in instances where 

communities have not adopted a building code or standard. In some cases, FEMA will 

also provide PA funding for the increased cost associated with meeting locally adopted 

natural hazard resistant building codes or standards that exceed the nationally recognized 

building codes and standards.

New Delivery Model 

Performance Objectives and 

Measures Could Better Align 

with FEMA’s Strategic Goal for 

Hazard Mitigation
Page 42 GAO-18-30 Disaster Assistance

agency’s objectives.76 In addition, our work on leading public sector 

organizations has found that such organizations assess the extent to 

which their programs and activities contribute to meeting their mission 

and desired outcomes, and strive to establish clear hierarchies of 

performance goals and measures. A clear connection between 

performance measures and program offices helps to both reinforce 

accountability and ensure that, in their day-to-day activities, managers 

keep in mind the outcomes their organization is striving to achieve.77

FEMA’s ability to evaluate and report on PA hazard mitigation data is 

constrained, but officials are addressing this challenge through the 

development of data reporting and analytics capabilities for the PA 

program’s new information system, according to PA officials. PA program 

officials developed measures they could use to evaluate the new model 

during test implementation and compare new model performance to the 

legacy PA process, and agreed that aligning PA program hazard 

mitigation goals with FEMA’s agency-wide strategic goals would be 

helpful. As FEMA continues to develop and implement the new model, 

developing performance measures and objectives to better inform and 

support the agency’s broader strategic goals could help to ensure that 

FEMA capitalizes on hazard mitigation opportunities in PA recovery 

efforts.

FEMA’s Public Assistance grant program is a complicated, multi-billion 

dollar program that is critical to helping state and local communities 

rebuild and recover after a major disaster. In recent years, FEMA has 

undertaken a major reengineering effort to make the PA preaward 

process simpler and more efficient for applicants and to address 

challenges encountered during recovery from past disasters. FEMA’s new 

delivery model represents a significant opportunity to strengthen the PA 

program and address these past challenges, and growing pains are to be 

expected when implementing any large reengineering effort. Further, 

FEMA officials work to implement these changes while supporting 

response and recovery following disasters, including the catastrophic 

flooding from Hurricane Harvey in August 2017 and widespread damages 

from Hurricanes Irma and Maria in September 2017. As such, it is critical 

that feedback obtained and lessons learned while testing the new model 

inform decisions and actions as FEMA proceeds with full implementation 

 76GAO-14-704G.

77GAO/GGD-96-118.

Conclusions
Page 43 GAO-18-30 Disaster Assistance

for all disasters, including the complex recovery efforts in the states and 

territories affected by Hurricanes Harvey, Irma, and Maria.

FEMA has redesigned the PA delivery model to address various 

challenges related to workforce management, information sharing with 

state and local grantees, and incorporating hazard mitigation into PA 

projects. FEMA has developed new workforce processes, training, and 

positions to address past challenges, but completing a workforce 

assessment that identifies the number of staff needed will inform 

workforce management and resource allocation decisions to help FEMA 

ensure a more successful implementation. This is particularly important 

as FEMA is using the new model for the long-term recovery from the 

2017 hurricanes, and FEMA faces capacity challenges as its workforce is 

stretched thin. Further, FEMA’s new FAC-Trax information sharing 

system provides FEMA and state and local applicants and grantees with 

better capabilities to address past challenges in managing and tracking 

PA projects. In developing FAC-Trax, FEMA implemented many of the 

key IT management controls that can help ensure that new IT systems 

are implemented effectively. However, additional steps are needed to fully 

satisfy the areas of requirements development and systems testing and 

integration. Finally, FEMA has taken some actions to better promote 

hazard mitigation as part of its new PA model. However, more consistent 

planning for hazard mitigation following a PA disaster and developing 

specific performance measures and objectives that better align with and 

support the agency’s broader strategic goals related to hazard mitigation 

could help to ensure that mitigation is incorporated into recovery efforts,

which presents an opportunity to encourage disaster resilience and 

reduce federal fiscal exposure from recurring catastrophic natural 

disasters.

We are making the following five recommendations to FEMA’s Assistant

Administrator for Recovery:

• The FEMA Assistant Administrator for Recovery should complete a 

workforce staffing assessment that identifies the appropriate number 

of staff needed at joint field offices, Consolidated Resource Centers, 

and in FIMA’s hazard mitigation cadre to implement the new delivery 

model nationwide. (Recommendation 1)

• The FEMA Assistant Administrator for Recovery should establish 

controls for tracking FAC-Trax capabilities to the system’s functional 

and operational requirements to more fully satisfy requirements 

Recommendations for 

Executive Action
Page 44 GAO-18-30 Disaster Assistance

development controls and ensure that the new information system 

provides capabilities that meets users’ needs and expectations. 

(Recommendation 2)

• The FEMA Assistant Administrator for Recovery should establish 

system testing criteria, such as a “definition of done,” to assess FACTrax as it is developed; define the roles and responsibilities of all 

participants; and develop the sequence and schedule for integration 

of other systems with FAC-Trax to more fully satisfy systems testing 

and integration controls. (Recommendation 3)

• The FEMA Assistant Administrator for Recovery, in coordination with 

the Associate Administrator of the Federal Insurance and Mitigation 

Administration, should implement procedures to standardize planning 

for addressing PA hazard mitigation at the joint field offices, for 

example, by requiring FEMA and state officials to develop a 

memorandum of understanding outlining how they will prioritize and 

address hazard mitigation following a disaster as it did through prior 

policy. (Recommendation 4)

• The FEMA Assistant Administrator for Recovery, in coordination with 

the Associate Administrator of the Federal Insurance and Mitigation 

Administration, should develop performance measures and 

associated objectives for the new delivery model to better align with 

FEMA’s strategic goal for hazard mitigation in the recovery process. 

(Recommendation 5)

We provided a draft of this report to DHS and FEMA for review and 

comment. DHS provided written comments, which are reproduced in 

appendix III. In its comments, DHS concurred with our recommendations 

and described actions planned to address them. FEMA also provided 

technical comments, which we incorporated as appropriate. 

With regard to our first recommendation, that FEMA complete a workforce 

staffing assessment that identifies the number of staff needed at joint field 

offices, Consolidated Resource Centers, and FIMA’s hazard mitigation 

cadre, DHS stated that PA, in coordination with the Field Operations 

Directorate and FIMA, will continue to refine and evaluate staffing needs 

and update the cadre force structures under the new delivery model. DHS 

estimated that this effort would be completed by June 28, 2019. This 

action, if fully implemented, should address the intent of the 

recommendation. 

Agency Comments 

and Our Evaluation
Page 45 GAO-18-30 Disaster Assistance

With regard to our second recommendation, that FEMA establish controls 

for tracking FAC-Trax capabilities to ensure the new information system 

meets users’ needs, DHS stated that Recovery program managers will 

update the FAC-Trax Requirements Management Plan and the FAC-Trax 

Release Plan to ensure the tracking and traceability of FAC-Trax 

functional and operational requirements. DHS estimated that this effort 

would be completed by January 31, 2018. This action, if fully 

implemented, should address the intent of the recommendation.

With regard to our third recommendation, that FEMA establish systems 

testing criteria to assess the development of FAC-Trax; and define the 

roles and responsibilities, and sequence and schedule for system 

integration, DHS stated that Recovery program managers will update the 

FAC-Trax System Integration Plan to include integration with the 

Deployment Tracking System, Enterprise Data Warehouse, Preliminary 

Damage Assessment interface, and State Grants Management system 

interface. DHS estimated that this effort would be completed by June 29, 

2018. This action, if fully implemented, should address the intent of the 

recommendation.

With regard to our fourth recommendation, that FEMA implement 

procedures to standardize planning for addressing PA hazard mitigation 

at the JFO, DHS stated that PA will update current process documents or 

develop new documents to better incorporate mitigation into the 

operational planning phase of the new delivery model. DHS estimated 

that this effort would be completed by July 31, 2018. This action, if fully 

implemented, should address the intent of the recommendation.

With regard to our fifth recommendation, that PA coordinate with FIMA to 

develop performance measures and associated objectives for the new 

delivery model that better align with FEMA’s strategic goals for hazard 

mitigation in the recovery process, DHS stated that PA will reconvene the 

PA-Mitigation working group to develop and refine PA related hazard 

mitigation performance measures. DHS estimated that this effort would 

be completed by June 29, 2018. This action, if fully implemented, should 

address the intent of the recommendation.
Page 46 GAO-18-30 Disaster Assistance

We are sending copies of this report to the Secretary of Homeland 

Security and interested congressional committees.

If you or your staff have any questions about this report, please contact 

me at (404) 679-1875 or CurrieC@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix IV.

Chris P. Currie

Director, Homeland Security and Justice
Page 47 GAO-18-30 Disaster Assistance

List of Requesters

The Honorable Ron Johnson

Chairman

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Thomas R. Carper

Ranking Member

Permanent Subcommittee on Investigations

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Bill Shuster

Chairman

The Honorable Peter DeFazio

Ranking Member

Committee on Transportation and Infrastructure

House of Representatives
Appendix I: Selected Prior Work Related to 

Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program

Page 48 GAO-18-30 Disaster Assistance

Table 1: Findings and Recommendations from Prior GAO Reports Related to the Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program

Report Findings Recommendations Status Progress

FEMA: Opportunities 

Exist to Strengthen 

Oversight of 

Administrative Costs for 

Major Disasters

(GAO-15-65) -

December 17, 2014

Although FEMA created 

administrative cost 

targets, FEMA does not 

require those targets to 

be met. FEMA lacks an 

integrated plan with 

time frames and 

milestones to hold 

senior officials 

accountable for 

achieving its goals to 

reduce and more 

effectively control costs. 

FEMA does not track 

administrative costs by 

major disaster program, 

such as Individual or 

Public Assistance, and 

has not assessed the 

costs versus the 

benefits of tracking 

such information.

FEMA should (1) 

develop an integrated 

plan to better control 

and reduce its 

administrative costs for 

major disasters, (2) 

assess the costs versus 

the benefits of tracking 

FEMA administrative 

costs by Disaster Relief 

Fund program, and (3) 

clarify the agency’s 

guidance and minimum 

documentation 

requirements for direct 

administrative costs.

Closed -

Implemented

FEMA (1) developed and issued an 

integrated plan to manage 

administrative costs, setting a goal 

in its 2014–2018 Strategic Plan to 

lower these costs, and establishing 

administrative cost targets in its 

integrated plan; (2) selected an 

approach to track administrative 

cost data based on a costs and 

benefits analysis; and (3) issued a 

Public Assistance Guidance 

document with clarifying guidance 

on costs eligibility, direct 

administrative costs, and checklists 

on documentation requirements. In 

addition, on February 29, 2016, the 

President signed into law the 

Directing Dollars to Disaster Relief 

Act of 2015, requiring FEMA to 

implement an integrated plan to 

control its costs, assess the costs 

versus the benefits of tracking 

FEMA’s administrative cost data for 

major disasters by program and 

track such data if feasible, and 

clarify its guidance and minimum 

documentation requirements for a 

direct administrative cost claimed 

by a PA grantee or subgrantee. 

This law also requires FEMA to 

report these efforts in annual 

reports for the next 7 years.1

 1

Pub. L. No. 114-132, 130 Stat. 293 (2016).

Appendix I: Selected Prior Work Related to 

Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program
Appendix I: Selected Prior Work Related to 

Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program

Page 49 GAO-18-30 Disaster Assistance

Report Findings Recommendations Status Progress

FEMA: Additional 

Planning and Data 

Collection Could Help 

Improve Workforce 

Management Efforts

(GAO-15-437) -

July 9, 2015

FEMA faces challenges 

in implementing and 

managing its two new 

workforce components: 

the Surge Capacity 

Force and the FEMA 

Corps. FEMA does not 

have a plan for how it 

will increase the 

number of volunteers to 

meet its staffing target 

goals. GAO found that 

FEMA does not collect 

full cost information, 

including the costs of 

FEMA Corps 

background 

investigations and the 

salaries and benefits of 

Surge Capacity Force 

volunteers who are paid 

by Department of 

Homeland Security 

components while they 

are deployed. FEMA 

does not assess all 

aspects of program 

performance because it 

does not have 

performance measures 

that correspond to all 

program goals. The 

agency also does not 

collect reliable 

performance data, or 

have an automated 

system for comparing 

performance against 

FEMA Corps project 

goals. 

We recommended that, 

among other things, 

FEMA develop a plan to 

increase Surge 

Capacity Force 

volunteer recruitment 

and collect additional 

cost and performance 

information for its two 

new workforce 

components. 

Closed -

Implemented

FEMA officials provided information 

or documentation of: plans to 

increase Surge Capacity Force 

registrations, cost calculations of 

FEMA Corps background checks 

for 2016 and estimated total staff 

cost for supervision of FEMA 

Corps, an analysis of salary and 

benefit information of Surge 

Capacity Force volunteers from 

other DHS components, program 

performance measures to use for 

future assessments of the FEMA 

Corps program, a new exit survey 

to provide program performance 

data, benchmarks for the 

completion of the Corporation for 

National and Community Service 

information system development 

project, program performance 

measures including rates of 

deployment of Surge Capacity 

Force members during disaster 

response, and a revised Surge 

Capacity Force survey instrument 

designed to include a data field that 

captures additional feedback 

(positive or negative) concerning 

the end of the deployment.
Appendix I: Selected Prior Work Related to 

Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program

Page 50 GAO-18-30 Disaster Assistance

Report Findings Recommendations Status Progress

Hurricane Sandy: An 

Investment Strategy 

Could Help the Federal 

Government Enhance 

National Resilience for 

Future Disasters

(GAO-15-515) -

July 30, 2015

State and local officials 

experienced challenges 

with disaster resilience 

opportunities related to: 

implementation 

challenges with PA and 

the Hazard Mitigation 

Grant Program, 

limitations on 

comprehensive risk 

reduction approaches in 

a postdisaster 

environment, and local 

ability and willingness 

to participate. In 

addition, there is no 

comprehensive, 

strategic approach to 

identifying, prioritizing 

and implementing 

investments for disaster 

resilience. The 

emphasis on the 

postdisaster 

environment can create 

a reactionary and 

fragmented approach 

where disasters 

determine when and for 

what purpose the 

federal government 

invests in disaster 

resilience. 

FEMA should assess 

the challenges state 

and local officials 

reported and implement 

corrective actions as 

needed. The Mitigation 

Framework Leadership 

Group (MitFLG)–

created to help 

coordinate hazard 

mitigation efforts of 

relevant local, state, 

tribal, and federal 

organizations–should 

establish an investment 

strategy to identify, 

prioritize, and 

implement federal 

investments in disaster 

resilience.

In progress In April 2017, FEMA officials 

provided a corrective action plan 

that included interim actions and 

milestones leading to the 

establishment of procedures and 

training to assist in implementing

policy changes through the end of 

calendar year 2016. In September 

2016, FEMA issued new policies to 

establish minimum standards for 

Public Assistance projects that are 

intended to promote resilience and 

achieve risk reduction. The April 

2017 update indicates that FEMA 

plans to complete actions to 

implement this recommendation in 

2017. In addition, in March 2016, 

officials from FEMA’s Federal 

Insurance and Mitigation 

Administration told us they were 

working with the Office of 

Management and Budget to 

implement this recommendation 

and shared a high-level work plan 

designed to guide MitFLG through 

the creation of a disaster resilience 

investment strategy. According to 

this plan, the strategy is to be 

complete in 2017.
Appendix I: Selected Prior Work Related to 

Federal Emergency Management Agency’s 

(FEMA) Public Assistance (PA) Program

Page 51 GAO-18-30 Disaster Assistance

Report Findings Recommendations Status Progress

Information Technology: 

FEMA Needs to Address 

Management 

Weaknesses to 

Improve Its System 

(GAO-16-306) -

April 5, 2016

FEMA faces challenges 

in ensuring that its 

information technology 

(IT) programs 

adequately support the 

agency’s ability to 

respond to major 

disasters in several 

areas: governance and 

oversight, IT 

modernization, and 

workforce planning. 

None of the three 

emergency 

management programs 

GAO selected for this 

review had fully 

implemented key IT 

management controls in 

the areas of risk 

management, 

requirements 

development, project 

planning, and systems 

testing and integration. 

Specifically, the three 

selected emergency 

management programs 

inconsistently 

implemented these 

practices by, for 

example, not always 

developing adequate 

risk mitigation plans, 

establishing processes 

for requirements 

management, 

developing and 

updating schedules and 

cost estimates, and 

ensuring complete and 

adequate system 

testing along with 

systems integration 

plans. 

FEMA should fully 

define its investment 

board’s roles and 

responsibilities and 

procedures for selecting 

and overseeing 

investments, update its 

strategic plan and 

complete plans for IT 

modernization, and 

establish time frames 

for completing 

workforce planning 

efforts. FEMA should 

also establish policies 

and guidance for 

implementing key IT 

management controls. 

In progress FEMA is in the process of 

implementing these 

recommendations. FEMA has 

established an IT Governance 

Board that serves as the primary 

structure for FEMA’s IT decisionmaking process, implemented a 

risk management process to 

identify potential problems before 

they occur, and implemented a 

requirements management process 

to ensure requirements are defined 

and user needs met. FEMA is still 

taking action to update its IT 

Modernization Plan, assess skills 

required to staff and sustain IT 

modernization efforts, implement 

program management plans and 

system integration plans, and 

ensure that FEMA policy for 

managing IT programs includes 

guidance for implementing key 

management practices. 

Source: GAO. | GAO-18-30

Note: We selected GAO reports published after our December 2008 review of the Public Assistance 

program that found challenges with workforce management, information sharing, and hazard 

mitigation related to the Public Assistance program. We summarized FEMA’s actions taken or 

planned to address GAO recommendations for each selected report. See GAO, Disaster Recovery: 

FEMA’s Public Assistance Grant Program Experienced Challenges with Gulf Coast Rebuilding, 

GAO-09-129 (Washington, D.C.: Dec. 18, 2008).
Appendix II: Assessment of Information 

Technology Management Controls for the 

FEMA Applicant Case Tracker (FAC-Trax)

Page 52 GAO-18-30 Disaster Assistance

Table 2 shows details on the Federal Emergency Management Agency 

(FEMA) Public Assistance (PA) program office’s implementation of key 

practices across four information technology (IT) management control 

areas for its new information system, the FEMA Applicant Case Tracker 

(FAC-Trax). PA developed FAC-Trax as a web-based project tracking 

and case management system to supplement the Emergency 

Management Mission Integrated Environment (EMMIE) and help resolve 

long-standing information sharing challenges. To determine the extent to 

which the FAC-Trax program office implemented IT management 

controls, we reviewed documentation from the FAC-Trax program and 

compared it to key management best practices, including the Software 

Engineering Institute’s Capability Maturity Model® Integration for 

Acquisition and Development, the Project Management Institute’s Guide 

to the Project Management Body of Knowledge (PMBOK® Guide), and 

the Institute of Electrical and Electronics Engineers’ Standard for 

Software and System Test Documentation.

1 We assessed the program as 

having fully implemented a practice if the agency provided evidence that it 

fully addressed the practice; partially implemented if the agency provided 

evidence that it addressed some, but not all, portions of the practice; and 

not implemented if the agency did not provide any evidence that it 

addressed the practice.

 1

Software Engineering Institute, Capability Maturity Model® Integration for Acquisition

(CMMI-ACQ), Version 1.3 (Pittsburgh, Pa.: November 2010) and Capability Maturity 

Model® Integration for Development (CMMI-DEV), Version 1.3 (Pittsburgh, Pa.: 

November 2010); Project Management Institute, Inc., A Guide to the Project Management 

Body of Knowledge (PMBOK® Guide), 5th ed., 2013; Institute of Electrical and Electronics 

Engineers, IEEE Standard for Software and System Test Documentation, IEEE Standard 

829TM 2008 (New York, N.Y.: July 18, 2008).

Appendix II: Assessment of Information

Technology Management Controls for the 

FEMA Applicant Case Tracker (FAC-Trax)
Appendix II: Assessment of Information 

Technology Management Controls for the 

FEMA Applicant Case Tracker (FAC-Trax)

Page 53 GAO-18-30 Disaster Assistance

Table 2. Public Assistance (PA) Program Office’s Implementation of Key Information Technology Management Controls for 

FAC-Trax

Key practices GAO assessment

Project planning 

Establishing and maintaining the 

program’s acquisition strategy

PA program officials developed an acquisition plan for FAC-Trax identifying the 

capabilities the system is intended to deliver, the acquisition approach, and acquisition 

objectives. Additionally, program officials developed a capability development plan 

outlining a strategy for the program to obtain approval to acquire FAC-Trax. Lastly, 

program officials developed a systems engineering plan describing the program’s 

scope and its framework for using an Agile development approach, as well as a 

deployment, support, and maintenance plan for FAC-Trax. 

●

Developing and maintaining the 

program’s cost estimate

PA program officials developed an acquisition program baseline detailing FAC-Trax’s 

cost parameters and a life-cycle cost estimate for the system. As of May 2017, the lifecycle cost estimate for FAC-Trax through fiscal year (FY) 2023 is approximately $19.3 

million. PA program officials updated the life-cycle cost estimate for FYs 2016 and 

2017 after price negotiations with the FAC-Trax contractor, and will continue to update 

the estimate as annual budgets are approved, according to the Integrated Logistic 

Support Plan. The contracting officer’s representative for FAC-Trax performs a cost 

review at the end of each month, according to program officials. Furthermore, the 

contractor’s weekly status report includes information on the number of hours worked 

and the percent of contract value spent. Program officials also review program costs 

with Office of Response and Recovery, PA, Office of the Chief Information Officer 

(OCIO), and other program office stakeholders during a weekly program review.

●

Establishing and maintaining the 

program’s schedule estimate

PA program officials developed an acquisition program baseline detailing FAC-Trax’s 

schedule parameters, as well as an integrated master schedule for the system. The 

integrated master schedule identifies tasks, major milestones, and task dependencies. 

The PA program manager reviews and updates the integrated master schedule on a 

weekly basis. Program officials also review FAC-Trax’s schedule with Office of 

Response and Recovery, PA, OCIO, and other program office stakeholders during a 

weekly program review.

●

Identifying the necessary knowledge 

and skills needed to carry out the 

program

PA program officials identified the knowledge and skills needed to carry out the 

program in FAC-Trax contract documentation and the capability development plan. 

Specifically, program officials included an attachment to the FAC-Trax contract listing 

the required labor categories and corresponding functional position descriptions. 

Program officials also described the role, position type, minimum grade, and minimum 

certification for required personnel resources for the acquisition, development, and 

implementation of FAC-Trax. 

●

Developing and maintaining the 

overall project plan, and obtaining 

commitment from relevant 

stakeholders

PA program officials developed, reviewed, and maintained project planning documents 

and obtained commitment from relevant stakeholders. For example, program officials 

reviewed and updated the integrated master schedule and costs on a weekly and 

monthly basis, respectively. Further, program officials reviewed the status of project 

elements, such as the schedule, quality and technical issues, stakeholders, staffing, 

cost, and risks, with Office of Response and Recovery, PA, OCIO, and other program 

office stakeholders during a weekly program review. PA program officials also 

established tactical, functional, and stakeholder groups, as well as an Integrated 

Product Team to support and oversee the development of FAC-Trax. 

●
Appendix II: Assessment of Information 

Technology Management Controls for the 

FEMA Applicant Case Tracker (FAC-Trax)

Page 54 GAO-18-30 Disaster Assistance

Key practices GAO assessment

Risk management

Identifying risks, threats, and 

vulnerabilities that could negatively 

affect work efforts

FEMA’s Recovery Technology Programs Division (RTPD) has a division-level risk 

management plan that serves as guidance for all Recovery systems, including FACTrax. Program officials identified key risks that could negatively affect FAC-Trax work 

efforts in RTPD’s “risk register”—an online site used to track risks, issues, and 

mitigating actions for the division and each program office. Program officials also 

identified five technical, cost, and schedule risks in the FAC-Trax acquisition plan. 

Program officials included one of these risks in the risk register, while the remaining 

four were managed outside of the register. As of May 2017, program officials had 

identified 13 risks in its risk register—four open and nine closed. The four open risks 

were (1) limited subject matter expert engagement during requirements development, 

(2) vacancies in program management office support positions, (3) unresolved service 

level agreement support and funding issues, and (4) the loss of the authority to 

operate due to a Trusted Internet Connection that is not compliant with Department of 

Homeland Security security policy.

●

Evaluating and categorizing each 

identified risk using defined risk 

categories and parameters, such as 

likelihood and consequence, and 

determining each risk’s relative 

priority

Program officials evaluated and categorized the identified risks based on the 

probability of occurrence and scope, schedule, and cost impacts. These four points of 

measurement are used to calculate an overall risk score. The risk score helps program 

officials determine a risk’s risk rating—low, medium, or high. For example, program 

officials reported that two of its open risks have a “medium” risk rating—meaning the 

risk has the potential to slightly impact project cost, schedule, or performance. In 

addition, program officials detailed the risk category, probability, and impact for the five 

risks identified in the FAC-Trax acquisition plan.

●

Developing risk mitigation plans for 

selected risks to proactively reduce 

the potential impact of risk 

occurrence

Program officials developed risk mitigation and contingency plans for each risk in the 

risk register. For example, program officials planned to mitigate the open risk 

concerning subject matter expert engagement, by identifying and engaging with 

appropriate subject matter experts through requirements development workshops 

scheduled in advance of the sprint they are to support, and monitoring the 

development of user stories to identify any issues that may cause delays. In addition, 

program officials described the risk management plan and responsible officials for the 

five risks identified in the FAC-Trax acquisition plan.

●

Monitoring the status of each risk 

periodically and implementing the risk 

mitigation plan as appropriate

PA program officials review and update program risks during a monthly program 

meeting. Program officials also review program risks with Office of Response and 

Recovery, PA, OCIO, and other program office stakeholders during a weekly program 

review. Furthermore, the FAC-Trax contractor provides a weekly status update which 

includes a section on identified risks. Program officials established re-evaluation dates 

and recorded updates, including any actions taken, for each risk in the risk register. In 

addition, program officials were able to provide updates on the four risks identified in 

the FAC-Trax acquisition plan and managed outside of the register. According to PA 

officials, these risks were addressed and closed by the approval of program planning 

documents, such as the mission needs statement, concept of operations, and 

operational requirements document, following the solutions engineering review, which 

demonstrates the readiness of the program to proceed with the procurement, in 

September 2016.

●
Appendix II: Assessment of Information 

Technology Management Controls for the 

FEMA Applicant Case Tracker (FAC-Trax)

Page 55 GAO-18-30 Disaster Assistance

Key practices GAO assessment

Requirements development

Eliciting stakeholder needs, 

expectations, and constraints, and 

transforming them into prioritized 

customer requirements

Program officials established a requirements management plan outlining how it 

captures, assesses, and plans for FAC-Trax enhancements, and established a change 

control process to review, prioritize, and verify user requests for changes to the system 

and feedback. As of May 2017, the PA program office received 734 change requests 

related to FAC-Trax, of which program officials completed 420 changes and planned 

to address an additional 277 entries. PA program officials also facilitated workshops to 

gather requirements for specific user groups and obtained additional requirements for 

FAC-Trax through customer feedback on a temporary technology tool— an Access 

database referred to as the Public Assistance Recovery Information System—used to 

support an early stage of the new model implementation. Further, program officials 

developed a functional requirements document outlining the high-level functional and 

operational requirements for FAC-Trax.

●

Developing and reviewing operational 

concepts and scenarios to refine and 

discover requirements

PA program officials developed a concept of operations for FAC-Trax detailing 

operating concepts and scenarios for each phase of the PA preaward process. 

Program officials also detailed the workflow, phases, business functions, and data 

inputs and outputs for the re-engineered PA process in FAC-Trax’s functional 

requirements document. In March 2017, program officials developed a standard 

template to describe the process, tasks, and data inputs and outputs for specific 

system capabilities. 

●

Analyzing requirements to ensure 

that they are complete, feasible, and 

verifiable

As part of the change control process, PA program officials meet three times a week to 

discuss and prioritize change requests. Specifically, program officials review 

submissions to the change control form to ensure completeness, validate impacts and 

root cause, and research details for incoming requests. PA program officials also 

follow up with users to understand and verify requirements. In March 2017, program 

officials developed a standard template to capture acceptance criteria for specific 

requirements. However, PA program officials do not track system enhancements back 

to the high-level requirements identified in FAC-Trax’s operational and functional 

requirements documentation and performance work statement. 

◐

Analyzing requirements to balance 

stakeholder needs and constraints

PA program officials identified system requirements and constraints in the FAC-Trax 

concept of operations and functional and operational requirements documents. 

Further, through its change control process, program officials collect suggestions, 

issues, and feedback on FAC-Trax and system enhancements from stakeholders, 

identify risks for change requests, and balance prioritized requirements and estimated 

level of efforts with projected costs prior to each sprint. In March 2017, program 

officials developed a standard template to analyze and document the urgency and 

need for specific requirements. 

●

Testing and validating the system as 

it is being developed

PA program officials and the FAC-Trax contractor established a testing and evaluation 

plan for the system, developed acceptance criteria for user stories, and obtained 

feedback from users during and after testing. The testing process concludes with user 

acceptance testing (UAT). If a change request fails during UAT or a new requirement 

is discovered during development, the PA program will capture the failed request or 

new requirement in the product backlog for implementation in a future product release.

●
Appendix II: Assessment of Information 

Technology Management Controls for the 

FEMA Applicant Case Tracker (FAC-Trax)

Page 56 GAO-18-30 Disaster Assistance

Key practices GAO assessment

Systems testing and integration

Developing test plans and test cases PA program officials and the FAC-Trax contractor tested and evaluated the system 

during development. The FAC-Trax test plan identifies the method and strategy to 

perform the testing, including the necessary tasks, testing parameters, and the roles 

and responsibilities of the individuals responsible for testing. However, program 

officials did not develop system testing criteria to evaluate FAC-Trax. A key feature of 

Agile software development is the “definition of done”—a set of clear, comprehensive, 

and objective criteria, that the government should use to evaluate software after each 

iteration of development.

◐

Developing a systems integration 

plan

PA program officials developed a systems integration plan in June 2017 that identifies 

potential integration of FAC-Trax and four FEMA systems, including the Emergency 

Management Mission Integrated Environment. Specifically, the plan includes data 

requirements and standards; descriptions of the four systems FEMA plans to integrate 

with FAC-Trax and the proposed relationship for each connection; and security and 

access management requirements. In addition, program officials included a description 

of how integration problems are to be documented and resolved in FAC-Trax 

development and test plans. However, the systems integration plan does not define 

roles and responsibilities of all participants for system integration activities or establish 

a sequence and schedule for every integration step for the four FEMA systems. 

◐

Legend:

● Fully implemented: The agency provided evidence that it fully addressed this practice.

◐ Partially implemented: The agency provided evidence that it addressed some, but not all, portions of this practice.

◌ Not implemented: The agency did not provide any evidence that it addressed this practice.

Source: GAO analysis of FEMA documentation. | GAO-18-30

Note: Key IT management practices are from the following sources: Software Engineering Institute, 

Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 (Pittsburgh, Pa.: 

November 2010) and Capability Maturity Model® Integration for Development (CMMI-DEV), Version 

1.3 (Pittsburgh, Pa.: November 2010); Project Management Institute, Inc., A Guide to the Project 

Management Body of Knowledge (PMBOK® Guide), 5th ed., 2013; Institute of Electrical and 

Electronics Engineers, IEEE Standard for Software and System Test Documentation, IEEE Standard 

829TM 2008 (New York, N.Y.: July 18, 2008).
Appendix III: Comments from the Department 

of Homeland Security

Page 57 GAO-18-30 Disaster Assistance

Appendix III: Comments from the 

Department of Homeland Security
Appendix III: Comments from the Department 

of Homeland Security

Page 58 GAO-18-30 Disaster Assistance
Appendix III: Comments from the Department 

of Homeland Security

Page 59 GAO-18-30 Disaster Assistance
Appendix III: Comments from the Department 

of Homeland Security

Page 60 GAO-18-30 Disaster Assistance
Appendix III: Comments from the Department 

of Homeland Security

Page 61 GAO-18-30 Disaster Assistance
Appendix IV: GAO Contact and Staff 

Acknowledgments

Page 62 GAO-18-30 Disaster Assistance

Chris P. Currie, at (404) 679-1875 or CurrieC@gao.gov

In addition to the contact named above, Chris Keisling (Assistant 

Director), Amanda R. Parker (Analyst-in-Charge), Mathew Bader, Allison 

Bawden, Anthony Bova, Eric Hauswirth, Susan Hsu, Rianna Jansen, 

Justin Jaynes, Tracey King, Matthew T. Lowney, Heidi Nielson, Claire 

Peachey, Brenda Rabinowitz, Ryan Siegel, Martin Skorczynski, Niti 

Tandon, Walter K. Vance, James T. Williams, and Eric Winter made key 

contributions to this report.

Appendix IV: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgements

(101154)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.