Port Security Grant Program: Risk Model, Grant Management, and Effectiveness Measures Could Be Strengthened
Published: 2011-11-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: From fiscal years 2006 through 2010, the Department of Homeland Security (DHS) has awarded nearly $1.7 billion dollars to port areas through its Port Security Grant Program (PSGP) to protect critical maritime infrastructure and the public from terrorist attacks. The Federal Emergency Management Agency (FEMA)--a DHS component agency--is the agency responsible for distributing grant funds. GAO was asked to evaluate the extent to which DHS has (1) allocated PSGP funds in accordance with risk; (2) encountered challenges in administering the grant program and what actions, if any, DHS has taken to overcome these challenges; and (3) evaluated the effectiveness of the PSGP. To address these objectives, GAO reviewed the PSGP risk model, funding allocation methodology, grant distribution data, and program documents, such as PSGP guidance. Additionally, GAO interviewed DHS and port officials about grant processes, funding distribution, and program challenges, among other things.
section_title: What GAO Found
paragraphs: In 2010 and 2011, PSGP allocations were based largely on port risk and determined through a combination of a risk analysis model and DHS implementation decisions. DHS uses a risk analysis model to allocate PSGP funding to port areas that includes all three elements of risk--threat, vulnerability, and consequence--and DHS made modifications to enhance the model's vulnerability element for fiscal year 2011. For example, DHS modified the vulnerability equation to recognize that different ports can have different vulnerability levels. However, the vulnerability equation is not responsive to changes in port security--such as the implementation of PSGP-funded security projects. Additionally, the vulnerability equation does not utilize the most precise data available in all cases. DHS addressed prior GAO recommendations for strengthening the vulnerability element of grant risk models, but the PSGP model's vulnerability measure could be further strengthened by incorporating the results of past security investments and by refining other data inputs. FEMA has faced several challenges in distributing PSGP grant funds, and FEMA has implemented specific steps to overcome these challenges. Only about one-quarter of awarded grant funding has been drawn down by grantees, and an additional one-quarter remains unavailable (see table below). Funding is unavailable--meaning that grantees cannot begin using the funds to work on projects--for two main reasons: federal requirements have not been met (such as environmental reviews), or the port area has not yet identified projects to fund with the grant monies. Several challenges contributed to funds being unavailable. For example, DHS was slow to review cost-share waiver requests--requests from grantees to forego the cost-share requirement. Without a more expedited waiver review process, grant applicants that cannot afford the cost-share may not apply for important security projects. Other challenges included managing multiple open grant rounds, complying with program requirements, and using an antiquated grants management system. FEMA has taken steps to address these challenges. For example FEMA and DHS have, among other things, increased staffing levels, introduced project submission time frames, implemented new procedures for environmental reviews, and implemented phase one of a new grants management system. However, it is too soon to determine how successful these efforts will be in improving the distribution of grant funds. FEMA is developing performance measures to assess its administration of the PSGP but it has not implemented measures to assess PSGP grant effectiveness. Although FEMA has taken initial steps to develop measures to assess the effectiveness of its grant programs, it does not have a plan and related milestones for implementing measures specifically for the PSGP. Without such a plan, it may be difficult for FEMA to effectively manage the process of implementing measures to assess whether the PSGP is achieving its stated purpose of strengthening critical maritime infrastructure against risks associated with potential terrorist attacks.
section_title: What GAO Recommends
paragraphs: GAO recommends that DHS strengthen its methodology for measuring vulnerability in ports by accounting for how past security investments reduce vulnerability and by using the most precise data available. GAO also recommends that DHS evaluate the cost-share waiver review process and take steps to expedite the process where appropriate and develop a plan with milestones for implementing performance measures for the PSGP. DHS concurred with GAO's recommendations.

section_title: Letter
paragraphs: Since the terrorist attacks of September 11, 2001, the nation’s ports have  been viewed as potential targets of attack for many reasons. According to  the Department of Homeland Security (DHS), ports, waterways, and  vessels are part of an economic engine handling more than $700 billion in  merchandise annually, and an attack on this system could have a  widespread impact on global shipping, international trade, and the global  economy. Additionally, ports often are not only gateways for the  movement of goods, but also industrial hubs and close to population  centers, presenting additional opportunities for terrorists intending to harm  U.S. interests. They are also potential conduits for weapons prepared  elsewhere and concealed in cargo designed to move quickly to many  locations beyond the ports themselves. Further, cruise ships, tankers, and  cargo ships present potentially desirable terrorist targets given the  potential for loss of life, environmental damage, or disruption of  commerce. Balancing security concerns with the need to facilitate the free  flow of people and commerce remains an ongoing challenge for the public  and private sectors alike.
To strengthen the security of the nation’s ports against risks associated  with potential terrorist attacks, DHS administers the Port Security Grant  Program (PSGP) through its component agency, the Federal Emergency  Management Agency (FEMA). The Coast Guard provides subject matter  expertise to FEMA on the maritime industry to inform grant award  decisions. The PSGP is to provide funding to the nation’s highest risk port  areasdomain awareness; to train and exercise; to expand port recovery and  resiliency capabilities; and to further capabilities to prevent, detect,   to support increased portwide risk management; to enhance  respond to, and recover from attacks involving improvised explosive  devices and other nonconventional weapons. Since the program’s  inception in fiscal year 2002, the federal government has provided almost  $2.5 billion in PSGP funding to state, local, and private entities to  increase portwide risk management, enhance domain awareness, and  improve recovery and resiliency through the development of security  plans, the purchase of security equipment, and the provision of security  training to employees.
You requested that we evaluate the PSGP, including DHS’s methodology  for determining risk, funding levels for U.S. ports, and the management of  the program. Our report addresses the extent to which DHS:   1.  has allocated PSGP funds in accordance with risk;   2.  has encountered challenges in administering the PSGP and what  actions, if any, it has taken to overcome these challenges; and   3.  has evaluated the effectiveness of the PSGP.
To assess the extent to which PSGP funds were allocated based on risk,  we analyzed DHS documents, including those related to the grant model  DHS uses to evaluate port risk and allocate grant money, PSGP  guidance, and PSGP priorities. Our review of the PSGP risk analysis  model focused on the fiscal year 2011 model, the most recent available.  To provide a basis for examining DHS’s efforts to carry out risk  management principles, we compared the PSGP risk analysis model to  DHS’s overall risk management approach as identified in the National  Infrastructure Protection Plan (NIPP), which it issued in June 2006 and   We also reviewed the steps that FEMA took to  updated in January 2009.ensure the reliability of the risk model by interviewing officials responsible  for managing the model as well as reviewing DHS’s documentation on the  model. We determined that the model’s inputs and results were  sufficiently reliable for our purposes.
To determine whether DHS has encountered challenges in administering  the PSGP and what actions, if any, it has taken to overcome these  challenges, we reviewed PSGP guidance, applicable laws, financial data  for the program as a whole for fiscal years 2006 through 2010, and  project data from FEMA for all seven Group I port areas—the highest risk  port areas that receive the most grant funding. To verify the reliability of  the project funding amounts for Group I port areas as provided by FEMA,  we compared them to the total funding provided to each region and found  that these amounts aligned. We did not include project-level data for  Group II port areas due to data reliability concerns. Additionally, we did  not include project-level data for Group III and the All Other Port Areas  Group because these groups receive a small share of available grant  funding and follow a different type of funding model. For the purposes of  our report, we concluded that FEMA’s financial data for the program as a  whole and FEMA’s project data for Group I port areas were sufficiently  reliable. We also gathered information from FEMA on the environmental  and historical preservation (EHP) review process—a key grant  requirement—to determine the length of time needed to complete this  required review. However, FEMA was unable to provide complete data on  the EHP process, so we were unable to comment on the length of time  spent completing this requirement. Additionally, we conducted site visits  at, or held teleconferences with, a total of 11 port areas, including all 7  Group I port areas and 4 selected Group II port areas. For these  meetings, we interviewed and collected documents from PSGP fiduciary  agents—entities that serve as the principal point of contact with FEMA for  the application, management, and administration of Group I and II grant  awards. In some cases, we also interviewed and collected documents  from U.S. Coast Guard officials, who provide subject matter expertise for  the maritime industry in their port areas. We used specific criteria to  select these port areas, including levels of grant funding, stakeholder  recommendations, and geographic diversity. While the information we  obtained from these 11 port areas cannot be generalized to all port areas,  it provides comprehensive coverage of Group I port areas. Additionally, it  enhanced our understanding of the types of projects initiated using PSGP  funds, the amount of funds allocated, awarded, and distributed for these  port areas, and the challenges faced. Due to significant changes in PSGP  management in the fiscal year 2007 supplemental funding round— including the introduction of the fiduciary agent model in Group I and II  port areas—our review of program management issues focused on fiscal  years 2007 supplemental through 2011. However, to ensure a complete  analysis of PSGP grant funds that are currently available for use, our  discussion of the amount of PSGP funding distributed and on-hold  includes fiscal years 2006 through 2010.
To determine the extent to which DHS has evaluated the effectiveness of  the PSGP, we analyzed available or in-progress performance data and  measures related to the grant program. To determine what performance  measurement data had been collected or what measures FEMA might  use to understand the progress of the PSGP, we interviewed grant  officials from FEMA’s Grant Programs Directorate (GPD) and FEMA’s  National Preparedness Directorate.
We conducted this performance audit from October 2010 through  November 2011 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform  the audit to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions based on our audit  objectives. We believe the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Overview of U.S. Port Security
paragraphs: The United States has approximately 360 commercial sea and river ports.  While no two ports in the United States are exactly alike, many share  certain characteristics that make them vulnerable to terrorist attacks: they  are sprawling, easily accessible by water and land, close to crowded  metropolitan areas, and interwoven with complex transportation networks  designed to move cargo and commerce as quickly as possible (see fig 1).  They contain not only terminals where goods bound for import or export  are unloaded or loaded onto vessels, but also other facilities critical to the  nation’s economy, such as refineries, factories, and power plants. To  reduce the opportunity for terrorists to exploit port vulnerabilities, port  stakeholders are taking mitigation steps. For example, port stakeholders  have installed fences, hired security guards, and purchased cameras to  reduce the potential for unauthorized entry and help prevent  vulnerabilities from being exploited.
To help defray some of the costs of implementing security at ports around  the United States, the PSGP was established in January 2002 when the  Transportation Security Administration (TSA) was appropriated $93.3  million to award grants to critical national seaports. In November 2002,  the Maritime Transportation Security Act (MTSA), which codified the  program, was enacted. Since the supplemental appropriations act for  fiscal year 2002, the appropriations acts have provided annual  appropriations for the PSGP. FEMA is responsible for designing and  operating the administrative mechanisms needed to implement and  manage the grant program. The Coast Guard—which is generally the  lead federal agency for port security—provides subject matter expertise  for the maritime industry and participates in project award decisions.  From fiscal year 2002 through fiscal year 2011, nearly $2.5 billion has  been allocated to the PSGP, as shown in table 1.
In recent years, we, the Congress, the President, the Secretary of  Homeland Security, and others have endorsed risk management as a  way to direct finite resources to areas that are most at risk of terrorist  attack. Risk management is a continuous process that includes the  assessment of threats, vulnerabilities, and consequences to determine  what actions should be taken to reduce one or more of these elements of  risk. One way in which DHS has applied risk management principles to  the PSGP is through the use of a risk model to assess the relative risk  posed to ports throughout the nation and to help determine PSGP  eligibility and funding levels. The PSGP risk methodology is similar to the  methodology used to determine funding eligibility for other DHS state and  local grant programs. The model consists of three variables: threat (the  relative likelihood of an attack occurring), vulnerability (the relative  exposure to an attack), and consequence (the relative expected impact of  an attack). Data for each of these variables are collected from offices and  components throughout DHS, as well as from other data sources, and  then, using the model, each port is ranked against one another and  assigned a relative risk score. At the recommendation of the Coast  Guard, DHS considers some ports as a single cluster—known as a port  area—due to geographic proximity, shared risk, and a common waterway.  Based on risk, each port area is placed into one of three funding groups—  Ports not identified in Group I, II, or III are  Group I, Group II, or Group III.eligible to apply for funding as part of the “All Other Port Areas” Group.Figure 2 below shows the location of port areas for groups I and II—the  two highest risk groups that receive the bulk of grant funding.
To promote a regional approach to risk management in the highest risk  port areas, FEMA required—beginning with the fiscal year 2007  supplemental guidance—that all Group I and II port areas—the highest  risk port areas—develop and implement a Portwide Risk Mitigation Plan  (PRMP). The primary goal of a PRMP is to provide a port area with a  mechanism for considering its entire port system strategically as a whole,  and to identify and execute a series of actions designed to effectively  mitigate risks to the system’s maritime critical infrastructure.
section_title: Overview of PSGP Grant Cycle
paragraphs: DHS creates PSGP grant guidance annually which provides the funding  amounts for each group, eligible applicants, and the application materials  for funding under the program. As shown in figure 3, there are three  stages of the PSGP grant cycle: allocation, award, and distribution.
Each port area’s allocation is driven by the results of the PSGP risk  analysis model. However, the allocation process varies among groups as  described below.
Groups I and II: The risk model determines the port areas at high risk  of a terrorist attack and DHS places them in either Group I (highest  risk group) or Group II (next highest risk group). In fiscal year 2011,  there were 7 port areas in Group I and 48 port areas in Group II. Each  port area in these groups is allocated a specific amount of funding  based on its risk score.
Group III: Group III ports represent the next risk grouping of port  areas based on the risk model scores. For fiscal year 2011, there  were 35 port areas in Group III. However, unlike Groups I and II,  these port areas do not receive a specific allocation based on risk.  Instead, DHS allocates a set amount of funding to Group III as a  whole and port areas within Group III compete against each other for  this funding based on risk and project effectiveness.
All Other Port Areas: Port areas not evaluated using the risk model,  but which operate under an Area Maritime Security Plan (AMSP),are eligible to compete for funding with the All Other Port Areas  Group––in a manner similar to Group III, but without using risk scores  as a factor in project selection.
After DHS announces the allocation amounts for all of the groups through  the release of the grant guidance, applicants must apply for funding–– either through the fiduciary agent or directly to FEMA––within 45 days of  the release of the grant guidance. Applicants are entities within a port  area—such as port authorities, facility operators, and state and local  government agencies—that provide port security services. During the  award process, DHS and the U.S. Department of Transportation (DOT)  evaluate the port areas’ projects and determine which projects to fund.  Before the projects reach DHS and DOT for review they are vetted  locally. The local evaluation process––known as field-level review––for  Groups I and II differs from that of Group III and All Other Port Areas  Group as described below.
Groups I and II: Beginning with the fiscal year 2007 supplemental  guidance, port areas in Groups I and II received a single direct  funding allocation based on risk. Once the allocation is made,  stakeholders in the port area then undergo a collaborative process to  determine the projects to fund with the grant allocation. To help  manage the new direct allocation process, DHS introduced the use of  fiduciary agents to help manage the PSGP at the local level and  ensure that all port partners were incorporated into the planning and  grant allocation processes. For Group I and II port areas, FEMA  awards the port area allocation to each port area’s selected fiduciary  agent. According to the grant guidance, while the fiduciary agent acts  as the principal point of contact with FEMA for application,  management, and administration of the Group I and II grant awards,  the fiduciary agent is not the sole decision maker regarding the use of  the PSGP grants. Instead, a field-level review process is conducted  by the applicable Coast Guard Captain of the Port (COTP) in  coordination with DOT, the Maritime Administration, and appropriate  personnel from the Area Maritime Security Committee (AMSC)  including federal, state, and local agencies. At the completion of the  field-level review process, the COTP—through the fiduciary agent— submits to FEMA a prioritized list of projects for funding ranked from  highest to lowest in terms of their contributions to risk reduction and  cost effectiveness. Once the COTP submits this information, DHS  begins its national review process for Group I and II port areas.
Group III and All Other Port Areas: Unlike Groups I and II, grant  projects in Group III and the All Other Port Areas Group are  determined through a competitive process. Port entities in these two  groups submit their project proposals directly to DHS for review. DHS  reviews the projects for eligibility, and approved projects are grouped  by port area and sent to the corresponding COTP for further review.  At this point, the process mirrors the Group I and II process.
Before grant awards are finalized, project proposals undergo a national  review process conducted by the National Review Panel (NRP), a group  of subject matter experts from DHS and DOT. During the national review  process, the NRP reviews all submitted projects for eligibility, and makes  a final funding recommendation to the Secretary of Homeland Security.
PSGP funds cannot be distributed to grantees to begin projects until DHS  ensures the grantee’s compliance with federal grant management  requirements. FEMA’s GPD is responsible for ensuring that all grant  projects adhere to federal grant requirements, including all EHP  requirements. For example, the National Environmental Policy Act  requires DHS to analyze the possible environmental impacts of each  project funded by a DHS grant. In addition to federal requirements, DHS  also directs all applicants to provide detailed budgets for the requested  funds at the time of application. Until FEMA is satisfied that all  requirements have been met, no grant funding can be distributed to begin  projects—rather the grant funding is considered “unavailable.” Once  FEMA makes funds available to grantees, port entities must complete the  grant project within the designated 3-year performance period. For  example, for fiscal year 2009 projects, the performance period began on  June 1, 2009. During this grant period, the City of Houston received  approval for the second phase of a radio system project. By the time the  project cleared local and federal review and funds were made available it  was March 16, 2011––leaving the city about 14 months to implement the  project before the performance period end date of May 31, 2012.
section_title: DHS Allocated PSGP Funds Based Largely on Risk, but the Risk Model Can Be Further Strengthened
subsections: section_title: PSGP Allocations Were Largely Based on Port Risk and DHS Implementation Decisions
paragraphs: For fiscal years 2010 and 2011, DHS allocations of PSGP funds were  based on DHS’s risk model and implementation decisions, and were  made largely in accordance with risk. For example, we found that  allocations to port areas were highly positively correlated to port risk, as  calculated by the risk model. In addition to the risk scores of the port  areas, DHS made two implementation decisions when finalizing grant  allocations for fiscal year 2011. First, DHS opted to direct the majority of  available funding to the highest risk port areas. Second, DHS chose to  limit fluctuations in grant funding from year to year to any given port  area.available grant funding to the 7 Group I port areas in fiscal year 2011,   Overall, as shown in table 2 below, DHS directed 60 percent of  which represented about 54 percent of the total risk for port areas,  according to the model’s determination of risk.
In fiscal year 2010, Group I was allocated 60 percent of grant funding and accounted  for 43.5 percent of the risk. Group II was allocated 30 percent of grant funding and  accounted for 53 percent of the risk. Group III was allocated 5 percent of grant funding  and accounted for the remaining 3.5 percent of the risk. their group for a portion of the group’s total funding—which was about  $11.8 million for each group in fiscal year 2011.
In addition to directing the majority of available grant money to the highest  risk port areas, DHS also opted to provide stability in the funding levels of  Group I and II port areas through another implementation decision. To  achieve this stability, DHS utilized funding “floors” in the fiscal year 2011  risk model, which limited how much a port area allocation could decrease  from year to year, despite changes in risk identified by the model. A  senior FEMA official reported that floors were used in the fiscal year 2011  PSGP risk model to mitigate wide fluctuations in funding so that port  areas could better plan for long-term security improvements. This official  also noted that floors have been used in the PSGP risk model since fiscal  year 2008 and were also used in the fiscal year 2011 Homeland Security  Grant Program (HSGP) risk model.
In the fiscal year 2011 model, DHS set the funding floor for Group I port  areas at 25 percent—meaning that the port area’s funding level could not  decrease by more than 25 percent from its fiscal year 2010 allocation  regardless of how much its risk profile changed. Similarly, for fiscal year  2011, DHS set the funding floor for Group II port areas at 50 percent— meaning that the port area’s allocation could not decrease by more than  50 percent from its fiscal year 2010 allocation regardless of changes in  risk. According to FEMA data, if the floors had not been used in fiscal  year 2011, the allocations to 3 Group I port areas would have fallen by  more than 25 percent and the allocations to 8 Group II port areas would  have fallen by more than 50 percent. However, due to the use of funding  floors, these 11 port areas collectively received fiscal year 2011  allocations that were about $11.6 million—or about 26 percent—higher  than their risk profiles would have indicated. See table 3 below.
In fiscal year 2011, DHS modified how port vulnerability—the relative  exposure to an attack—is calculated in the PSGP risk model, but  additional changes could improve how vulnerability is measured in the  model. Prior to fiscal year 2011, the PSGP risk model held vulnerability  constant, rather than accounting for differences across ports. We have  reported on the value of measuring vulnerability in risk analysis models in   In June 2008, we reported that DHS chose to hold  two prior reports.vulnerability constant and consider all states and urban areas equally  vulnerable in the HSGP risk analysis model, which reduced the value of  the model in estimating risk.In June 2009, we reported that DHS also  chose to consider all transit agencies equally vulnerable in its Transit  Security Grant Program (TSGP) risk analysis model. Regarding both  models—which are similar in structure to the PSGP risk model—we  recommended that DHS formulate a method to measure vulnerability in a  manner that captures variations across jurisdictions, and apply this  vulnerability measure in future iterations of the grant allocation model. To  respond to these recommendations and other external feedback  regarding the grant programs, and to produce a more complete risk  picture, DHS modified the vulnerability index in the fiscal year 2011 PSGP  model such that vulnerability is no longer held constant. Instead, the  new vulnerability index recognizes that different ports can have different  vulnerability levels. In the fiscal year 2011 PSGP model, port vulnerability  is assessed using four data components thought to influence a port’s  vulnerability to attack, as shown below in table 4. The fiscal year 2011  PSGP risk model is provided in full in appendix II.
Although FEMA has taken the first step towards improving how port  vulnerability is measured in the PSGP risk model, further improvements  are needed to ensure that the vulnerability score for a specific port is  responsive to changes in security that may occur in that port—such as  the implementation of new security measures. The fiscal year 2011  vulnerability index does not provide a mechanism to account for how new  security measures—such as the installation of cameras or the provision of  additional training to security officials —affect a port’s vulnerability, even if  those security measures were funded using PSGP grant dollars. This  limitation is due to the fact that the data elements within the vulnerability  index are counts of activities, which recognize the number of activities  that may occur—such as how many ferry passengers board a ferry—but  do not account for the protective actions taken to secure them. For  example, if a port installed security cameras throughout a ferry system to  monitor vessel or ferry passenger activity, one would expect to reduce the  ferry system’s vulnerability to attack. However, because the “ferry  passenger” data element within the model’s vulnerability index is simply a  count of passengers utilizing the ferry system and is not a reflection of the  security measures in place to protect the ferry system, the new camera  system would not reduce the port’s vulnerability score as calculated by  the risk model. Thus, with this type of measure, in this example, a port  could only reduce its vulnerability score by reducing the number of  passengers utilizing the ferry system. The model’s robustness is thereby  limited because activity counts do not reflect improvements made to port  security.
It is important to note that some security improvements may be captured  by the inclusion of the Coast Guard’s Maritime Security Risk Analysis  Model (MSRAM) results in the PSGP risk model.which are updated annually—provide information to the model on the  percentage of national high-risk assets that reside within each port.  However, MSRAM does not account for all types of security  improvements because it is an asset-based model that assesses  improvements to individual port assets such as a ferry terminal or a  chemical plant. As such, MSRAM is not designed, for example, to  evaluate security projects that may affect multiple assets in a port.
The National Infrastructure Protection Plan states that when measuring  vulnerability, one should describe all protective measures in place and  how they reduce vulnerability. FEMA officials reported that capturing data  on all security improvements would be challenging due to the need to  collect and validate data for all ports included in the PSGP risk model.  However, FEMA officials acknowledged the importance of incorporating  completed security projects as part of the vulnerability component of the  risk model and stated that FEMA will continue to refine its vulnerability  assessments. Without accounting for the reductions in vulnerability  achieved through new security measures implemented in a port, including  those funded through the PSGP, the robustness of the risk model may be  limited and not accurately reflect the relative risk of port areas throughout  the nation. Instead, the risk model would likely continue to recognize the  same ports as the highest risk, regardless of the security improvements  made in those ports. In addition, by not accounting for security  improvements resulting from PSGP grants, the security benefits of the  PSGP are also not recognized. Incorporating completed security projects  into the vulnerability component of the risk model could help increase its  robustness and more accurately direct allocations to the highest risk port  areas.
While FEMA officials reported that developing an improved vulnerability  index that incorporates the effect of security improvements would be a  challenging process, there are interim measures that FEMA could take to  ensure that the most precise data available are being used to populate  the existing vulnerability index. FEMA made some progress in this regard  by modifying how the HAZMAT Population data component was  calculated in the fiscal year 2011 model. Rather than measuring only  hazardous materials imports, as was done in the fiscal year 2010 and  prior models, the modified measure also accounts for the transit of  hazardous materials through a port where the port is not their final  destination, providing added precision to the model. However, there are  more precise data available that FEMA is not currently utilizing for at least  one additional data component within the vulnerability index—foreign  vessel calls.
The Coast Guard established its High-Interest Vessel (HIV) Program to address  increased U.S. maritime security requirements in the aftermath of the terrorist events of  September 11, 2001. The program targets HIVs, or those that might pose high relative  security risks to U.S. ports. frequencies of high-risk vessel arrivals, although it would require the  Coast Guard to extract data from multiple sources to conduct a port-by- port analysis. The National Infrastructure Protection Plan states that DHS  is responsible for using the best available information to conduct risk  analysis and risk management activities. FEMA officials reported that they  considered using HIV data in fiscal year 2011 but determined that due to  time constraints, it would be more straightforward to use a count of  foreign-flagged vessels during the first iteration of the vulnerability index.  However, FEMA officials reported that they will continue to research  additional data elements for inclusion in future year risk models. Using  data from the HIV Program—which the Coast Guard already collects—in  future iterations of the risk model could position FEMA to better capture  the vulnerability of port areas posed by vessels arriving from foreign ports  and thereby improve the precision of allocations to high-risk port areas.
section_title: Most Grant Funding Is Available, but $400 Million Is Unavailable Due to Various Challenges—Which FEMA Has Begun to Address
paragraphs: FEMA awarded nearly $1.7 billion in port security grants in fiscal years  2006 through 2010. As shown in figure 4 below, grantees have “drawn  down” about one-quarter of funds—or about $395 million. Further, about  half of the funds are “available” to grantees to begin work on projects.  However, about one-quarter of funds are “unavailable” to grantees.
As shown in table 5 below, FEMA awarded nearly $1.7 billion in port  security grants in fiscal years 2006 through 2010; however, less than 24  percent—or about $395,000 million—had been drawn down as of  September 2011.
Although draw down rates are often cited as a measure of progress in  improving port security, FEMA officials stated that draw down rates are  not an accurate reflection of progress made in improving port security  because grantees do not always draw down their funds promptly. Thus,  even though progress may be underway in improving port security, until  the grantee draws down their funds, this progress is not evident. FEMA  officials reported that grantees may not draw down their grant funds right  away for two main reasons. First, as a reimbursement grant program,  grantees are not eligible to draw down awarded PSGP funds until they  have incurred a cost. FEMA officials reported that costs for PSGP grants  are often not incurred until late in the grant performance period. For  example, grantees may choose to wait until project completion before  paying contractors to ensure that the project is completed according to  the terms of the contract. Thus, the draw down of grant funds would occur  late in the performance period, after project completion. Second, grantees  may choose not to draw down funds immediately after incurring a cost.  Instead, the grantee might choose to wait until the end of the performance  period to draw down funds or choose to draw down funds at select points  throughout the year. Often, according to FEMA officials, this delay is due  to the parameters of local accounting systems or the need to seek  approval from local government entities before requesting  reimbursement. As a result of these two factors, grantees have likely  made more progress towards implementing grant projects to improve port  security than is reflected in the draw down numbers, according to FEMA  officials.
To encourage grantees to draw down funds more promptly, FEMA’s GPD  released an information bulletin in January 2011 requesting that  whenever possible, grantees draw down funds no less than on a quarterly  basis. According to the information bulletin, more frequent draw downs  would provide a more accurate representation of FEMA grant fund  usage. According to FEMA data on monthly draw down rates over time,  there was an initial increase in draw down rates for some grant years  after the information bulletin was released, but draw down rates have  since leveled off.
subsections: section_title: One-Quarter of Awarded PSGP Grant Funding Is Unavailable to Grantees Due to Various Challenges
paragraphs: Of the nearly $1.7 billion in port security grants that FEMA awarded to  port areas in fiscal years 2006 through 2010, more than $400 million—or  about 24 percent—remained unavailable to grantees as of September  2011, as shown in table 6 below. Grantees cannot use unavailable funds  to begin work on security projects.
There are two types of unavailable funds—funds that are “unused” and  funds that are “on-hold.” Unused funds—which exist only in Group I and II  port areas—are funds which the port area has been awarded but has not  yet used for specific projects. For example, as shown in table 6 above,  approximately $242 million in grant funding awarded to Group 1 port  areas was unavailable as of September 2011. Of this, about $116  million—or 48 percent—was unavailable because the funds have not  been used for specific projects.on-hold funds—exist in all four funding groups, and result when FEMA  has approved the use of grant funding for a specific grant project, but  compliance with postaward requirements—such as environmental and   The second type of unavailable funds— budgetary reviews—has not been completed.requirements are met, these grant funds remain “on-hold.” Each type of  unavailable funding—unused and on-hold—results from a different set of  challenges, as discussed below.
One challenge that PSGP program officials reported contributed to delays  in using awarded grant funds was the implementation of the Port-Wide  Risk Mitigation Plan (PRMP) requirement. This PRMP requirement was  announced in August 2007 for the fiscal year 2007 supplemental grant  round and was part of a broader FEMA effort to shift the grant program  from supporting asset-specific projects—such as fences around a  facility—that benefited just one facility, to supporting more regional,  portwide projects—such as interoperable communication systems—that  would benefit an entire port area. This new requirement caused delays  because port areas were not eligible to submit specific projects to FEMA  for approval until their PRMP was approved, and many PRMP  submissions and approvals were delayed. The fiscal year 2007  supplemental grant guidance included a time line and specific  deliverables to guide port areas in the plan development and approval  process.finalized by May 2008. However, only 3 of the 11 port areas we  interviewed had an approved plan in place by this time. Plans for the  remaining 8 port areas were approved between July 2008 and September  2009. In June 2011, a senior FEMA official told us that FEMA did not hold  stakeholders to the time lines for plan development because the time  lines were unreasonably aggressive for some port areas. Another senior  FEMA official stated that FEMA did not want to rush the plan  development process because that could have been detrimental to the  quality of the plans. Due to the delayed plan submissions, FEMA faced  challenges in approving draft plans. For example, the senior FEMA official   Based on this time line, all port area PRMPs should have been  reported that it was difficult to convene the review panel to approve plans  on a sporadic basis. Thus, rather than hold weekly or biweekly meetings  to discuss one or two plans, which would pose a burden on their federal  partners on the review panel, FEMA instead held review panel meetings  every 2 months. As a result, the official reported that it took longer than  expected to approve risk mitigation plans which then delayed the  submission of grant projects from port areas. Until a port area’s PRMP  was approved, it was not eligible to submit projects to FEMA for approval.  As a result, the delays associated with PRMP approval contributed to  delays in the use of grant funds. For example, the PRMP for the  Columbia-Snake River System was not approved until September 2009,  meaning that the port area could not submit projects to FEMA for  approval for more than 2 years after the fiscal year 2007 supplemental  grant guidance was released, creating delays in the use of grant funds in  this port area.
Fiduciary agents and FEMA officials reported that the initial delays  resulting from delays in PRMP approval were exacerbated by the fact that  multiple grant rounds—beginning with the fiscal year 2007 supplemental  grant round when the PRMP requirement was announced—were  underway by the time port area PRMPs were approved and that these  grant rounds had varying cost-share requirements. In the case of all 11  port areas in our review, multiple grant rounds had been announced— through the release of grant guidance—before the port area’s PRMP was  approved, as shown in figure 5.
For example, both the fiscal year 2007 supplemental and the fiscal year  2008 grant rounds had been announced—in August 2007 and February  2008 respectively—before the first PRMPs—for the New York-New  Jersey port area and the New Orleans port areas—were approved in April  2008. In some cases, additional grant rounds were announced before  port area PRMPs were approved. For example, as shown in figure 5, four  grant rounds (fiscal year 2007 supplemental, fiscal year 2008, fiscal year  2009, and ARRA) were announced before the Columbia-Snake River Port  Area’s PRMP was approved in September 2009.
With multiple grant rounds open, applicants could choose under which  grant year to apply for funding. Fiduciary agents and FEMA officials  reported that the cost-share requirement was a significant factor in  applicant decisions regarding under which grant year to apply for  funding.
As shown in table 7 below, the PSGP has traditionally required a cost- match, but this requirement has been modified or waived in numerous  grant rounds as a result of legislative action.
Fiduciary agents in 8 of 11 port areas in our review reported a lessened  demand for grant funds in grant years where there was a cost-share  requirement, particularly for fiscal years 2008 and 2009. Fiduciary agents  cited a variety of challenges with the cost-share requirement, including:  (1) applicants were aware of long delays in the distribution of grant funds  and faced difficulty preserving the cost-share obligation in their entity’s  budget while pending receipt of awarded grant funds, (2) facility owners  who were compliant with security requirements under MTSA were  hesitant to invest their own money for additional security projects beyond  the requirements, and (3) applicants were unable to afford the cost-share  requirement due to the economic downturn. For example, one fiduciary  agent reported that while she generally supports a cost-share  requirement because it ensures stakeholder buy-in, the cost-share  requirement has been challenging due to the poor economic environment.  As a result of the cost-share, this fiduciary agent reported conducting  three distinct rounds of project solicitations in the fiscal year 2008 grant  round in order to generate enough demand to spend the port area’s entire  allocation. We reported in October 2010 that a cost-share requirement is  a key factor for effective federal grants because it ensures that federal  grants supplement—rather than substitute for— stakeholder spending.  We further reported that a cost-share requirement is reasonable given  that grant benefits can be highly localized.
As a result of the inconsistent cost-share requirement, several fiduciary  agents told us that applicants were more likely to request funding under  the grant rounds with the most lenient cost-share requirement or delay  project submission while waiting to learn whether or not the next round of  grants would include the cost-share requirement. This uncertainty about  the cost-share requirement created a disincentive for grant applicants to  request funding during cost-share years. For example, the fiduciary agent  in one port area told us that the port area received project proposals  totaling twice the port area’s total allocation for fiscal year 2011. Thus,  projects had to be denied for fiscal year 2011 funding during the field- level review, even though more than $9 million in fiscal year 2008 and  2009 grant money remained unused. As shown in table 8 below, a  greater portion of money from cost-share years remains unused as  compared to money from non-cost-share years, even though cost-share  grant years preceded the non-cost-share grant year. For example, about  22 percent of grant funding awarded to Group 1 port areas during cost- share years remains unused, as compared to less than 4 percent during  fiscal year 2010, when the cost-share requirement was waived.
Fiduciary agents reported that the lengthy cost-share waiver process— used by applicants seeking an exemption from the required cost-share— further exacerbated the impact of the cost-share requirement under the  PSGP. Grant applicants unable to meet the cost-share requirement are  eligible to apply for a waiver. The waiver approval process requires 22  steps—which include approval by leadership within FEMA’s GPD,  approval by FEMA’s Administrator, and finally, approval by the Secretary  of Homeland Security. According to statute, the Secretary can grant a  waiver of the cost-share requirement if she determines that a proposed  project is meritorious but cannot be undertaken without additional federal  support. However, 5 of the 11 fiduciary agents we interviewed told us  that they had concerns with the cost-waiver request process—including  with the length of time required for a decision. For example, one fiduciary  agent—who oversaw a cost-waiver application that took about 7 months  to be approved—told us that the cost-waiver request process was time- consuming and confusing. According to FEMA officials, an unknown  portion of this 7-month approval process was spent ensuring that the  fiduciary agent had submitted all of the required documentation and thus,  the actual approval time once the request was finalized was less than 7  months.
The cost-share requirement was waived for all applicants under the  ARRA, fiscal year 2010, and fiscal year 2011 grant cycles. However,  grant applicants may continue to submit cost-share waiver requests for  new projects to be funded under the fiscal year 2007 supplemental, fiscal  year 2008, and fiscal year 2009 grant cycles—which were cost-share  years—if money in their port area remains unused from those years. As  shown earlier in table 8, about $110 million in PSGP funds awarded to  Group I port areas from fiscal year 2007 through 2009—years in which  the cost-share was required—remains unused. As port areas solicit  projects for these unused funds, some applicants may submit cost-share  waiver requests as well. For example, one fiduciary agent from a Group 1  port area reported that her port area recently completed the field-review  process to identify projects to fund using their unused fiscal year 2009  grant monies. As a result, the port area submitted 10 projects to FEMA for  approval in October 2011, of which 8 projects include a cost-share waiver  request.
Although FEMA has taken steps to improve the cost-waiver process, it  continues to be lengthy and additional efforts may help expedite these  reviews. In July 2009, FEMA issued an information bulletin to clarify the  process that grantees should follow when submitting cost-share waiver  requests. Since the issuance of this information bulletin, FEMA has  received a total of 31 cost-share waiver requests—of which, 22 were  approved. In November 2009, following a Fiduciary Agent Workshop,  FEMA released written responses to questions posed at the workshop. In  this document, FEMA stated that a decision on a waiver request could be  expected approximately 30 days after all documentation was provided to  FEMA in accordance with the process outlined in the July 2009  information bulletin. However, according to FEMA records, for cost-share  waivers reviewed since December 2009 DHS took—on average—126  days to approve a request once all of the required information had been  received. Approval time lines ranged between 55 days and 268 days for  these waiver requests. Of the 126 days, on average, it took 74 days from  the date requests were considered complete to achieve approval by  GPD’s leadership. It took an additional 52 days, on average, to complete  the remaining 11 steps of the waiver process—including approval at the  Administrator of FEMA level and the Secretary of Homeland Security  level. According to DHS, due diligence requires both component and  department level clearances, including secretarial clearance, in order to  responsibly award funding. This process ensures that PSGP projects  meet program goals and objectives. However, FEMA records show that  no approval recommendations from GPD leadership were overturned as  a result of the additional 52 days, on average, of required review. Further,  only 1 of the 31 waiver requests submitted since the July 2009  information bulletin was issued has been denied—and it was denied at  the GPD level.
Standards for Internal Control in the Federal Government state that  “pertinent information should be identified, captured, and distributed in a  form and time frame that permits people to perform their duties  efficiently.” FEMA officials told us that FEMA has taken internal actions  to improve the review process such as meeting with other key offices  involved in the waiver process in the spring of 2011 to discuss and  standardize information requirements for the waiver package. FEMA  officials reported that they believe that this effort has helped improve  some aspects of the process, but further action may be required to  streamline the process. Additionally, fiduciary agents remain wary of the  cost-waiver request process. For example, one fiduciary agent told us  that its field review team—including the COTP—would be unlikely to  recommend a project for funding if that project relies on a cost-share  waiver. Another fiduciary agent told us that there is little interest in the  fiscal year 2009 funds due in part to the lengthy waiver review process.  Without a more efficient review process, certain grant applicants that  cannot fund the cost-match requirement may not receive grant funds to  implement their projects, or may not even apply for funds. Evaluating the  waiver review process could help to ensure that the process is completed  in a timely manner.
In addition to funding that is unavailable because it is unused, some  funding is also unavailable because it is on-hold due to delays in  achieving compliance with postaward requirements and challenges with  FEMA’s grant management system. After FEMA approves the use of  grant funds for a specific project, stakeholders reported that additional  delays in making funds available resulted from compliance with  postaward requirements. FEMA cannot make grant funds available to  grantees to begin work on approved projects until all postaward  requirements, including budgetary and environmental reviews, are met.  One cause of delay was inefficiency in the reviews conducted pursuant to  the National Environmental Policy Act, which requires a review of the  impacts of proposed actions as well as reasonable alternatives to those  actions. Grantees submit Environmental and Historical Preservation  (EHP) information to the Grant Program Directorate––Environmental and  Historical Preservation (GPD-EHP) office for review. If the project does  not require a detailed EHP analysis, it can be reviewed and approved by  a GPD analyst. However, projects that require a more detailed analysis  are reviewed either by the GPD-EHP team or passed to a FEMA regional  environmental officer depending on the scope of the review.
Fiduciary agents we interviewed in 5 of 11 port areas reported that slow  EHP reviews caused delays. During a July 2009 FEMA-sponsored  stakeholder conference, participating port areas stated that the EHP  submission and review process associated with the PSGP was causing  delays, which increased project costs and limited what grantees could  accomplish with grant funds. The group requested the establishment of a  more structured postaward time line, including deadlines for EHP reviews,  so that grantees would be better able to plan their projects. A senior  FEMA official reported that delays in EHP reviews were due to the fact  that prior to 2008, GPD had not historically conducted EHP reviews on  preparedness projects and thus, had no established program for doing  so. This official further reported that creating an “EHP Team” within GPD  with the assistance of subject matter specialists via technical support  contract and standardizing the format for project submittals has helped  expedite EHP reviews.
According to FEMA officials, the delays caused by inefficient review  processes have been amplified by FEMA’s reliance on an antiquated data  management system. As we reported in our June 2009 report on the  Transit Security Grant Program, FEMA did not have a mechanism for  systematically collecting data on the status of individual grant projects  through the review process. For example, although FEMA has systems  to track the financial information related to its grants programs, these  systems did not allow FEMA to track the status of grant reviews, such as  EHP reviews. According to FEMA, the data management system used to  manage the Transit Security Grant Program is also used to manage the  PSGP and no changes have been made to the system since our 2009  report. As such, GPD officials reported that each PSGP program analyst  maintained separate spreadsheets that tracked the grants for which they  were responsible. Using numerous data systems and spreadsheets  resulted in inefficiencies and, in some cases, lost data, as program  analysts had to search across systems for information or were reliant on  systems––such as the Homeland Security Information Network––that lost  application information. The overall result was a data system that did  not provide information in a timely manner and that could not be used  effectively to manage the grant lifecycle.
section_title: DHS and FEMA Have Taken Steps to Address Unavailable Balances
paragraphs: DHS and FEMA have taken a number of steps to address unavailable  balances. To ensure that grant awards were used for specific projects in a  timely manner, FEMA implemented project submission deadlines  beginning in fiscal year 2010. Prior to this, FEMA did not have deadlines  for submitting projects which resulted in money being unused for projects  and therefore unavailable until the port area could identify enough  projects to fund––a process that, in some cases, took years to complete.  Starting in fiscal year 2010, port areas had 45 days from the initial  fiduciary agent application deadline to submit specific project proposals.  In fiscal year 2011, FEMA took an additional step to shorten application  time frames by requiring all Group I and II port areas to submit specific  project proposals at the time of the fiduciary agent’s application.  According to FEMA officials, this change will ensure that grant money  allocated in the future will be immediately used, which will expedite the  grant distribution process.
DHS has also taken a number of steps to address the delays in the EHP  review process that contributed to funds being on-hold. See table 9 for a  list of key DHS actions:  As a result of these changes, some fiduciary agents reported  improvement in the EHP review process; however, these views could not  be verified using FEMA data. Specifically, 5 of 11 fiduciary agents  reported that the EHP review process has improved. For example, 1  fiduciary agent believed that the EHP process has improved primarily  because of FEMA’s categorization of projects according to the amount of  expected impact they would create. However, due to data reliability  issues with FEMA’s EHP data––there were too many missing EHP dates  for an accurate analysis––we were not able to confirm whether the EHP  process was improving. Because of limitations with FEMA’s existing grant  management system, all EHP data are managed on separate  spreadsheets maintained by program analysts and these spreadsheets  have varying levels of completeness. FEMA officials acknowledged the  limitations with their data, including the omission of key dates in the EHP  review process, such as the date when the EHP information was  submitted for review or the date when the project’s EHP review was  approved. However, FEMA officials noted that the evolution of the Non  Disaster Grants (ND Grants) system, which is discussed below, may  allow for better tracking of EHP submissions and approvals in the future.
To address challenges exacerbated by the antiquated data management  system used to manage the PSGP, DHS took the first step towards  consolidating its data management system in fiscal year 2011 by  implementing the first of two planned phases of the ND Grants system.  According to FEMA, the ND Grants system is intended to consolidate  FEMA’s disparate data systems and improve the ability of FEMA grant  managers to track grants through the review and approval process. In  February 2011, FEMA anticipated that the ND Grants system would be  fully completed by the end of fiscal year 2014. Given the early stages of  this process, it is too early to assess the extent to which the ND Grants  system will alleviate data management challenges.
section_title: FEMA Is Developing Measures to Assess PSGP Administration but Does Not Have Measures to Assess Effectiveness
paragraphs: In July 2011, during the course of our review, FEMA finalized eight  performance measures designed to track how well FEMA GPD  administers and manages the PSGP. According to FEMA documents,  these measures include the percent of: (1) grant funds released to  grantees within 300 days, (2) grant awards programmatically monitored  annually, (3) grant funds programmatically monitored annually, (4) grant  awards financially monitored annually, (5) grant funds financially  monitored annually, (6) corrective actions completed within the fiscal year  issued, (7) preparedness grant awards processed within 150 days, and  (8) grant closeouts completed within 120 days from the end of the period  of performance. According to FEMA officials, data collection for these  eight measures will begin in the fiscal year 2012 grant cycle and the 2012  baseline data will be used to develop targets for each measure beginning  with the fiscal year 2013 grant cycle. For more information on these  measures, see appendix V. In addition to these eight measures, FEMA  officials reported that four additional measures are under development.  By implementing these internal measures, FEMA officials should be  better positioned to determine whether the changes they have made in  recent months are sufficient to better ensure more efficient grant  administration going forward or whether additional actions are required.  However, since targets for the eight measures will not be established until  at least fiscal year 2013, and the four additional measures remain under  development, it is too early to know how effective they will be in helping  FEMA to assess its performance and improve its grant management.
FEMA has not evaluated the effectiveness of this program in  strengthening critical maritime infrastructure against risks associated with  potential terrorist attacks because it has not implemented measures to  track progress toward achieving program goals. In 2006, the Department  of Homeland Security’s Office of Inspector General reported that as the  PSGP continues to evolve, an important challenge DHS should undertake  is the measurement of its impact. The Inspector General also reported  that DHS has raised the overall bar of preparedness through the port  security grants but it is not clear that DHS knows how much actual risk  reduction has been achieved. Four years later, in January 2010, FEMA  formed a task force to develop draft performance measures for the  PSGP. This task force conceptualized 11 potential measures of  effectiveness for the PSGP; however, baseline data needed to implement  the measures did not exist for all 11 draft measures. According to FEMA  documentation, baseline data existed for 2 of the 11 measures, additional  data collection would be needed to populate 3 measures, and 6  measures would require further refinement or coordination with federal  partners.
In December 2010, FEMA transferred responsibility for developing  performance measures from GPD to FEMA’s National Preparedness  Directorate, specifically the National Preparedness Assessment Division  (NPAD).the development of effectiveness measures within the directorate  containing assessment experts. However, this may have contributed to  delays in developing performance measures because the staff at NPAD,  including the new Director, who began in March 2011, needed time to  familiarize themselves with the grant program and draft measures. In July  2011, a senior NPAD official told us that the division was briefed on the   FEMA officials report that this change was made to consolidate  draft measures developed by the GPD task force, but they were  considering developing different measures as well. In October 2011, the  same official told us that the division had developed a number of  prospective performance measures for the PSGP, but that FEMA was still  reviewing the draft measures. As a result, the official told us that it has not  been determined whether the performance measures will be included in  the fiscal year 2012 guidance. Additionally, FEMA did not have a plan in  place, with milestones, to ensure the implementation of such measures.  According to best practices for project management, the development of  a project management plan—which defines how the project is executed,  monitored and controlled, and closed—is a key element of project  management. Best practices for project management also call for  milestone dates, among other factors, in carrying out a project  successfully. As a result, FEMA’s progress toward implementing  measures to assess whether the program is achieving its stated purpose  remains unclear.
section_title: Conclusions
paragraphs: Port areas have unique characteristics—they are centers of commerce,  hubs of transportation, and often close to major population centers. These  characteristics result in specific vulnerabilities that must be addressed to  avoid the human or economic losses that would result from a terrorist  attack. The Port Security Grant Program (PSGP)—administered by FEMA  and supported with subject matter expertise from the Coast Guard—is  one tool DHS uses to protect critical maritime infrastructure from these  risks. Risk management has been endorsed by the federal government to  help direct finite resources to areas of greatest risk and grant programs  have provided substantial resources toward this effort. We found that  PSGP allocations were highly correlated to risk for the grant years we  examined and DHS has taken steps to strengthen the PSGP risk  allocation model by improving the quality and precision of the data inputs.  However, additional efforts—such as accounting for how new security  measures affect port vulnerability and using the most precise data  available in the risk model—could further strengthen the model and build  upon the progress made. While the allocation process has been risk- based, FEMA has faced significant challenges administering the grant  program. For example, FEMA awarded nearly $1.7 billion in port security  grants for fiscal years 2006 through 2010; however, draw down levels for  the PSGP are low—with about one-quarter of fiscal year 2006 through  2010 grant monies drawn down as of September 2011. While FEMA may  not consider draw down levels to be an accurate measure of progress  made in improving port security, this measure has become the de facto  yardstick for assessing progress in securing our ports because no other  measures exist. Additionally, about a quarter of the awarded funding  remains unavailable due to delays in using grant funds, challenges with  the cost-match and associated waiver process, and challenges that  grantees have had complying with postaward requirements. As a result,  about $400 million in awarded grant funding remains unavailable to  grantees for port security projects.
FEMA has taken steps to improve the availability of funds and has  developed internal performance measures to begin evaluating its  administration of the grant program. However, FEMA has not evaluated  the effectiveness of the program because it does not have measures to  track progress towards achieving program goals. To establish a more  accurate measurement of grant effectiveness, FEMA should expedite its  efforts to implement performance measures for the PSGP. Initial steps  have been taken to develop performance measures for the PSGP, but the  time frame for implementing them is unclear. Without a plan, there is little  assurance that these measures will be implemented in a timely way to  assess the program’s effectiveness in ensuring that critical port  infrastructure is protected.
section_title: Recommendations for Executive Action
paragraphs: We are making four recommendations to help strengthen the  implementation and oversight of the PSGP. To strengthen DHS’s  methodology for measuring vulnerability in ports, and to improve the  precision of grant allocations to high-risk port areas, we recommend that  the Secretary of Homeland Security direct the FEMA Administrator to:
Develop a vulnerability index that accounts for how security  improvements affect port vulnerability, and incorporate these changes  into future iterations of the PSGP risk model.
Coordinate with the Coast Guard to determine the most precise data  available to populate the data elements within the vulnerability index  and to utilize these data as an interim measure, until a revised  vulnerability index is developed.
To ensure that waiver requests—including those submitted under  previous cost-share years in which money remains unassigned and those  that may be submitted in future grant rounds if a cost-share requirement  is applied—are evaluated promptly, we recommend that the FEMA  Administrator—in conjunction with the Office of the Secretary of  Homeland Security—evaluate the waiver review process to identify  sources of delay and take measures to expedite the process.
To strengthen the administration, oversight, and internal controls of the  PSGP, and to streamline processes, we recommend that the Secretary of  Homeland Security direct the FEMA Administrator to develop—in  collaboration with the Coast Guard—time frames and related milestones  for implementing performance measures to monitor the effectiveness of  the PSGP.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for review and comment. DHS  provided written comments on November 14, 2011, which are reproduced  in full in appendix VI. DHS concurred with the findings and  recommendations in the report, and stated that FEMA is taking actions to  implement our recommendations.
DHS concurred with our first recommendation that it develop a  vulnerability index that accounts for how security improvements affect  port vulnerability, and incorporate these changes into future iterations of  the PSGP risk model. DHS stated that although incorporating the effects  of completed security projects on vulnerability is complex, the inclusion of  this type of metric remains a key goal of the PSGP risk methodology and  is revisited annually. However, DHS did not provide details regarding its  plan to implement this recommendation.
DHS concurred with our second recommendation that FEMA coordinate  with the Coast Guard to determine the most precise data available to  populate the data elements within the vulnerability index and to utilize this  data as an interim measure until a revised vulnerability index is  developed. Specifically, DHS stated that FEMA will continue to coordinate  with subject matter experts, including the Coast Guard, to determine the  best data available for use in the vulnerability index. Further, DHS stated  that FEMA and the Coast Guard will continue discussions regarding data  elements to be used in future grant years, and that these meetings will  focus on what data elements are currently available for use as an interim  measure while additional enhancements to the vulnerability component  are developed. Such action should address the intent of this  recommendation.
DHS concurred with our third recommendation that FEMA evaluate the  cost-share waiver request process in conjunction with the Office of the  Secretary of Homeland Security to identify sources of delay and take  measures to expedite the process. Specifically, it reported that FEMA and  DHS are exploring the best solution to reduce delays and expedite the  cost-share waiver request evaluation process and will work to implement  appropriate process improvements as they are identified. Such action,  when implemented, should address the intent of this recommendation.
Finally, DHS concurred with the fourth recommendation that it develop  time frames and related milestones for implementing performance  measures to monitor the effectiveness of the PSGP. Specifically, DHS  stated that FEMA’s Grant Programs Directorate (GPD) is in the process  of developing external measures to determine how effective grantees are  in managing and administering the grants and that these external  measures will be completed by January 1, 2012. DHS also stated that  specific measures to monitor the performance of the PSGP are being  developed within FEMA. Further, DHS stated that FEMA is also  developing performance objectives for core capabilities, as required by  Presidential Policy Directive 8 and the new National Preparedness Goal,  and will be reviewing all prevention and protection measures, including  those for PSGP. Finally, DHS stated that FEMA’s National Preparedness  Directorate will work with GPD and the Coast Guard in fiscal year 2012 to  develop some specific measures towards building and sustaining  capabilities. These efforts, as described above, are important steps  towards implementing this recommendation.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of  Homeland Security, appropriate congressional committees and other  interested parties. In addition, this report will be available at no charge on  the GAO website at http://www.gao.gov. If you or your staff have any  further questions about this report, please contact David C. Maurer at  (202) 512-9627 or MaurerD@gao.gov or Stephen L. Caldwell at (202)   512-9610 or CaldwellS@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last  page. Key contributors are listed in appendix VII.
section_title: Appendix I: Port Security Grant Program (PSGP) Allocations to Funding Groups, by Year
paragraphs: This appendix provides information on the percentage of total PSGP  grant funding directed at each funding group since fiscal year 2007, the  first year in which Department of Homeland Security (DHS) categorized  port areas into funding groups. Table 10 shows that the percentage of  funding directed at Group I port areas and all other port areas has been  relatively stable over time, whereas this percentage has changed more  drastically for Group II and Group III port areas. As discussed in the  report, DHS allocations to individual port areas were made largely in  accordance with risk, and were based on DHS’s risk analysis and  implementation decisions. DHS’s decision to direct the majority of PSGP  funding to the highest risk port areas—as shown in table 10—was one  such implementation decision. The second decision involved the use of  funding “floors” to limit fluctuations in individual port area funding from  year to year.
section_title: Appendix II: PSGP Risk Analysis Model, Fiscal Year 2011
paragraphs: This appendix provides information on the fiscal year 2011 PSGP risk  model, which DHS uses to assess the relative risk posed to ports  throughout the nation and to help determine PSGP eligibility and funding  levels. As discussed in the report, DHS modified how port vulnerability— the relative exposure to an attack—was calculated in the PSGP risk  model in fiscal year 2011. Rather than holding vulnerability constant, as  was done in fiscal year 2010, DHS chose to modify the vulnerability index  in fiscal year 2011 to recognize that different ports can have different  vulnerability levels. The current vulnerability component—as shown in  figure 6—considers how port vulnerability is affected by ferry and cruise  ship ridership, foreign vessel calls, and hazardous material transits.  However, as discussed in the report, further improvements are needed to  ensure that the vulnerability score for a specific port is responsive to  changes in security that may occur in that port—such as the  implementation of new security measures—and that the vulnerability  index is populated using the most precise data available.
section_title: Appendix III: Financial Status of PSGP Awarded Funds, Fiscal Years 2006 through 2010
paragraphs: This appendix provides information on the financial status of PSGP funds  awarded during fiscal years 2006 through 2010. As discussed in the  report, DHS awarded nearly $1.7 billion in grant funds to port areas  throughout the nation for fiscal years 2006 through 2010. As shown in  table 11, grantees have drawn down about 24 percent—or about $395  million—of this funding, as of September 2011. An additional 52 percent  of the awarded funding—about $873 million—is available to grantees.  About one-quarter of awarded grant funding—or about $408 million—is  unavailable, meaning that port areas have not identified specific projects  to fund with these monies or compliance with postaward requirements is  pending.
section_title: Appendix IV: PSGP Cost-Share Waiver Approval Process
paragraphs: This appendix contains information on the review and approval process  for PSGP cost-share waivers, which grantees can request from DHS if  they are unable to meet the cost-share requirement. As discussed in the  report and shown in figure 7 below, the waiver approval process requires  22 steps—which include approval by leadership within FEMA’s Grants  Program Directorate (GPD), approval by FEMA’s Administrator, and  finally, approval by the Secretary of Homeland Security. In November  2009, FEMA told fiduciary agents that a decision on a waiver request  could be expected within 30 days. However, under the review process  outlined in figure 7, DHS took—on average—126 days to approve a cost- share waiver once all of the required information had been received.  Evaluating the waiver review process could help ensure that the process  is completed in a timely manner.
section_title: Appendix V: FEMA’s Internal Performance Measures
paragraphs: This appendix provides descriptive information on the suite of internal  performance measures that FEMA developed to track how well it  administers and manages the PSGP. As discussed in the report, data  collection for these measures—which were finalized in July 2011—will  begin in the fiscal year 2012 grant cycle and the 2012 baseline data will  be used to develop targets for each measure beginning in the fiscal year  2013 grant cycle. However, as discussed in the report, it is too early to  know how effective these measures will be in helping FEMA to assess its  performance and improve its grant management.
section_title: Appendix VI: Comments from the Department of Homeland Security
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts above, Dawn Hoff, Assistant Director, and Dan  Klabunde, Analyst-in-Charge, managed this assignment. Chuck Bausell,  David Lutter, Sophia Payind, and Katy Trenholme made significant  contributions to this report. Charlotte Gamble, Adam Hoffman, and Grant  Sutton provided assistance with interviews. David Alexander assisted with  design, methodology, and data analysis. Tracey King provided legal  assistance. Jessica Orr provided assistance with report development and  Robert Robinson provided graphic support.