Following Hurricane Katrina in 2005, the Post-Katrina Act required FEMA to develop a national preparedness system and assess preparedness capabilities to determine the nation’s disaster preparedness. In September 2011, DHS issued the National Preparedness Goal: a secure and resilient nation with the capabilities required across the whole community to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk. The National Preparedness Goal also defined the “whole community” as individuals and communities, the private and nonprofit sectors, faith-based organizations, and all governments (local, regional/metropolitan, state, tribal, territorial, insular area, and federal). The National Preparedness Goal identifies and defines 32 core capabilities across five broad mission areas. These capabilities form the foundation for measuring overall national preparedness and assisting the nation in allocating resources to fill identified preparedness gaps. Three of the 32 core capabilities affect all mission areas and are considered to be “crosscutting” (see fig. 1). The five broad mission areas are: Prevention. Preventing an imminent threat, or actual act of terrorism. Protection. Protecting citizens, residents, visitors, and assets in a manner that allows interests, aspirations, and way of life to thrive. Mitigation. Mitigating the loss of life and property by lessening the impact of future disasters. Response. Responding quickly to save lives, protect property and the environment, and meet basic human needs in the immediate aftermath of an incident. Recovery. Recovering through a focus on the timely restoration, strengthening, and revitalization of infrastructure, housing, and a sustainable economy, as well as the health, social, cultural, historic, and environment fabric of communities affected by an incident. Since 2012, DHS has produced a National Preparedness Report annually, which assesses progress toward the National Preparedness Goal of achieving a secure and resilient nation. A key element of the National Preparedness Report is that it evaluates and measures the extent to which jurisdictions have strengthened their 32 core capabilities. From 2012 to 2017, all 50 states, District of Columbia, and 5 territories were required to assess the preparedness levels of their 32 capabilities by providing a rating of 1 to 5, with 5 being the highest preparedness rating. Emergency management capabilities with a rating of 1 or 2 are considered to have the largest capability gaps. FEMA used this assessment process to inform the National Preparedness Report by illustrating which threats and hazards occurred in the past and which capabilities have the largest gaps. FEMA’s National Preparedness Directorate, which includes the National Preparedness Assessment Division, is responsible for assisting communities in becoming more resilient by developing the capabilities needed to prevent, protect against, respond to, recover from, and mitigate against all threats and hazards. The Directorate provides guidance, programs, and processes to assist communities in completing the requirements associated with the National Preparedness System. To help jurisdictions more comprehensively assess their gaps, FEMA required they complete the Threat and Hazard Identification and Risk Assessment (THIRA) and Stakeholders Preparedness Review (SPR). The THIRA is conducted by jurisdictions every 3 years to, in part, identify threats and hazards that are both reasonably likely to affect the community and would most challenge the community’s ability to deliver one or more of its capabilities; and estimate and describe the potential impacts of those threats and hazards. The types of threats and hazards are defined as (1) natural hazards or acts of nature; (2) technological hazards that are accidents or failures of systems and structures; and (3) human-caused incidents resulting from intentional actions. Jurisdictions are to conduct the SPR annually to, among other things, identify capability gaps by assessing the capabilities against the types of threats and hazards identified in the THIRA. In 2012-2013, FEMA issued its initial guidance to jurisdictions to help them understand how to identify the threats and hazards through the THIRA, and assess their core capabilities. In 2018, FEMA issued new guidance for the THIRA and SPR requiring jurisdictions to change the methodology, moving away from proficiency-based ratings to a process that relies more on quantitative data to measure gaps across the core capabilities. In 2018, FEMA required jurisdictions to begin using the new methodology to assess the core capabilities within the response and recovery mission areas. Beginning in 2019, FEMA required jurisdictions to begin using the new methodology to assess the core capabilities across all mission areas. FEMA’s 10 regions provide technical assistance and training to help jurisdictions become more proficient in completing these capability assessments. FEMA also sponsors exercises with states, territories, tribes, and localities to help them assess their emergency management capabilities. In addition to the jurisdictions’ THIRAs and SPRs, in 2019, FEMA initiated an effort to assess the federal government’s emergency management capacity. According to FEMA, the effort is intended to provide a national THIRA and SPR that assesses the federal government’s capabilities against the nation’s threats and hazards. The Disaster Recovery Reform Act of 2018 (DRRA) requires FEMA, among other things, to provide congressional committees updates every 6 months on its progress in completing a national preparedness assessment until the assessment is complete. In July 2019, FEMA issued its 2019 National Threat and Hazard Identification and Risk Assessment (National THIRA): Overview and Methodology, describing its approach to completing a national-level risk assessment (i.e., a National THIRA). According to FEMA, the National THIRA was completed in 2020, and will be included in the 2020 National Preparedness Report. DHS, through FEMA, provides jurisdictions preparedness grants, which are used, in part, to strengthen the 32 core capabilities across the five mission areas. FEMA has traditionally provided three primary preparedness grants that jurisdictions can use to strengthen their emergency management core capabilities. Two of the three grants, the State Homeland Security Grant Program and the Urban Area Security Initiative, were established after the terrorist attacks of September 11, 2001. As established by federal law, these grants are intended to help states and localities prevent, prepare for, protect against, and respond to acts of terrorism. State Homeland Security Grant Program. Provides funding to assist state, local, and tribal governments in preventing, preparing for, protecting against, and responding to acts of terrorism. Helps support states’ implementation of homeland security strategies to address the identified planning, organization, equipment, training, and exercise needs at the state and local levels. In fiscal year 2019, the total funding available to all 50 states, District of Columbia and 5 territories was $415 million. Urban Area Security Initiative. Provides federal assistance to address the unique needs of high-threat, high-density urban areas, and assists the areas in building a capacity to prevent, prepare for, protect against, and respond to acts of terrorism. In fiscal year 2019, the total funding available to the 31 urban areas was $590 million. Emergency Management Performance Grant. Provides federal assistance to states to assist state, local, and tribal governments in preparing for all hazards. The program plays a valuable role in strengthening and sustaining the 32 core capabilities across the five mission areas. In fiscal year 2019, the total funding available to states, local governments, and tribes was $315 million. The National Preparedness System and associated preparedness grants have helped jurisdictions strengthen and sustain their emergency management capabilities. More specifically, according to National Preparedness Reports since calendar year 2012, states and territories generally have rated their capabilities within the prevention and response mission areas, as well as their crosscutting capabilities—which involve all five mission areas, as having the highest preparedness levels. By contrast, states and territories generally have rated their capabilities in the recovery and protection mission areas as having lower preparedness levels, and these ratings showed little to no improvement from 2013 to 2017. Additionally, since 2013, jurisdictions have directed nearly 87 percent of their FEMA preparedness grants toward sustaining or strengthening capabilities in the crosscutting, prevention, and response mission areas, and around 13 percent on enhancing or sustaining capabilities in the protection, mitigation, and recovery mission areas. FEMA has encouraged jurisdictions to invest future preparedness grants to strengthen their capabilities that have lower preparedness ratings and to address emerging threats, such as cybersecurity. However, FEMA officials told us their efforts to help jurisdictions enhance their capabilities, including the distribution of existing preparedness grants, will likely not be sufficient to address the capability gaps that have been identified by jurisdictions. States and territories’ 2017 preparedness data showed that eight core capabilities in the response and crosscutting mission areas had the highest level of preparedness (a rating of 4 or 5 on a 5-point scale). For example, as shown in figure 2 below, over 50 percent of the assessment ratings by the states and territories identified crosscutting capabilities, such as public information and warning and operational coordination, in the highest category of preparedness. Similarly, 57 percent of the assessment ratings by states and territories identified on-scene security, protection, and law enforcement capabilities within the response mission area in the highest preparedness categories. In our discussions with local officials who were impacted by the 2017 and 2018 hurricanes, they told us that the operational coordination and public information and warning capabilities were effective during their response efforts. For example, Craven County, NC, officials told us that in response to the flooding from Hurricane Florence, their emergency operations center was instrumental in communicating with first responders. In doing so, they were able to keep county wells running while working with utility companies to prioritize areas that needed electrical power, such as hospitals and grocery stores. Additionally, Onslow County, NC officials said their emergency operations center was instrumental in communicating and coordinating the rescue operations of around 700 residents through the use of the county’s swift water rescue teams, with assistance from the U.S. Marine Corps, North Carolina’s National Guard, and the local fire and police departments. In addition, Brazoria County, TX, officials told us that in response to Hurricane Harvey they used videos and social media to get warning messages out to the residents and businesses about evacuation assistance as well as information on hurricane preparedness. Supply chain integrity and security Hurricane Florence caused significant flooding in and around New Hanover County, North Carolina. County officials told us the state’s National Guard high wheel clearance trucks had to be used to transport food, water, fuel, and generators throughout the flooded areas to isolated communities because the county did not have the capability to deliver these commodities. According to the North Carolina National Guard, the high-water vehicles were also used to evacuate citizens to shelters and transport essential civilian personnel such as nurses, doctors, and first responders. Preparedness data from 2017 show that almost 40 percent of jurisdictions’ ratings identified five capabilities in the recovery and protection mission areas in the lowest category of preparedness (a rating of a 1-2 on a 5-point scale). For example, within the recovery mission area, 51 percent of the ratings identified disaster housing in the lowest category of preparedness. Similarly, within the protection mission area, 46 percent of the assessment ratings identified cybersecurity in the lowest category. Additionally, these capabilities have been consistently rated in the lowest preparedness categories from 2013 through 2017 and have shown little-to-no change. For example, under the recovery mission area, 56 percent of the assessment ratings by states and territories identified disaster housing in the lowest category in 2013, with minimal changes through 2017. Some of the capabilities that had the lowest preparedness ratings in 2013 were: Economic recovery. The ability to return economic and business activities (including agricultural) to a state of health and develop new economic opportunities that result in a sustainable and economically viable community. Natural and cultural resources. The ability to preserve, conserve, rehabilitate, and restore historic property consistent with post-disaster community priorities and best practices and in compliance with environmental and historic preservation laws and executive orders. Disaster housing. The ability to address pre- and post-disaster housing issues and coordinate the delivery of federal resources and activities to assist local, state, tribal, territorial, and insular area governments as they rehabilitate and reconstruct destroyed and damaged housing. Supply chain integrity and security. The ability to secure and make resilient key nodes, methods of transport between nodes, and materials in transit between a supplier and consumer. Table 1 shows the percentages of the lowest-rated capabilities from 2013 through 2017. While the National Preparedness System may help jurisdictions assess their preparedness using emergency preparedness capability assessments, jurisdictional officials we spoke with told us that real-life disasters sometimes show jurisdictions to be less prepared than their capability assessments previously indicated. As a result, some states have lowered their preparedness ratings in subsequent capability assessments following a disaster. For example, after the 2017 and 2018 hurricanes, some states told us they lowered their preparedness rating in their 2019 assessments for disaster housing because they realized the capability gap was larger than they previously believed. Officials from the North Carolina Division of Emergency Management said that in 2018, they lowered their preparedness rating for housing because their housing capacity was not able to meet the needs of disaster victims who needed immediate housing assistance. From fiscal years 2013 through 2018, jurisdictions received approximately $8.3 billion in preparedness grants funds primarily from the State Homeland Security Program, Urban Area Security Initiative, and the Emergency Management Performance Grant. Of this amount, jurisdictions directed about $7.3 billion—or about 87 percent of the funds—to capabilities in the crosscutting, prevention, and response mission areas, which constitute the highest-rated mission areas. For example, in California, $1.9 million in Urban Area Security Initiative grants were used to strengthen crosscutting and prevention capabilities by providing situational awareness to first responders and emergency managers working on active threats to infrastructure. Additionally, in Florida, up to $2.8 million of the State Homeland Security grant was used to create a system intended to strengthen crosscutting and prevention capabilities by enabling the state’s law enforcement agencies to more easily share information. Of the $8.3 billion in preparedness grant funding from fiscal years 2013 through 2018, about $1.1 billion—or about 13 percent—was directed to capabilities in the mitigation, protection, and recovery mission areas, which constitute the lowest-rated mission areas. During this time, jurisdictions directed the least amount of preparedness grant funds on the recovery mission area—$78 million, or about 1 percent (see fig. 3). Jurisdictions also directed about 5 percent of the $1.1 billion to capabilities within the mitigation mission area, though preparedness ratings in the mitigation mission area generally showed improvements each year. In 2017, 43 percent of the assessment ratings by states and territories rated three of the four mitigation-related capabilities in the highest category. Improvements in the mitigation mission area could be, in part, attributable to FEMA providing jurisdictions with grant funds other than preparedness grants, such as post-disaster grants, which include Hazard Mitigation Grant Program funds. Further, state and local decisions on how to prioritize preparedness grant awards resulted in about 1 percent—$78 million—being directed to capabilities within the recovery mission area between 2013 and 2018. As shown in figure 4, jurisdictions directed approximately 79 percent of the $78 million (about $62 million) in the recovery mission area to the infrastructure systems capability, which is intended to, in part, allow jurisdictions to re-establish critical infrastructure in disaster-impacted areas to support life sustainment activities, ongoing emergency response operations, and to help facilitate recovery efforts. Additionally, about 3 percent of the $78 million—about $2.4 million—was directed to disaster housing capabilities, such as implementing housing solutions that effectively support the temporary housing needs of an impacted jurisdiction. State officials from New York and North Carolina, as well as officials from five localities, said they often prioritize and use preparedness grants to maintain existing capabilities within the crosscutting, prevention, and response capabilities, rather than enhancing capabilities where gaps are known to exist, such as those in the recovery and protection areas. In addition, state officials from Texas, as well as officials from two localities told us that they need to use portions of their limited grant funds— especially from Emergency Management Performance Grant funds—to hire and retain local emergency management personnel, which leaves fewer funds for them to devote to enhancing lower-rated emergency management capabilities. For example, some county governments may not have the resources necessary to fund a single emergency manager, which requires them to use Emergency Management Performance Grant funds to hire and retain necessary staff. Another reason why jurisdictions do not use more of the grants toward lower-rated mission areas is because some view certain capabilities in the recovery and mitigation mission areas to be the responsibility of the federal government. Both FEMA and state officials told us that sometimes jurisdictions do not use these grants to strengthen capabilities such as housing because they consider the federal government responsible for filling the gaps. For example, preparedness data from 2013 to 2017 showed the percent of jurisdictions identifying the federal government as responsible for providing housing solutions to disaster survivors increased from 46 to 53 percent. According to state officials from North Carolina, it would not be a prudent use of grant funds for the state to purchase and store temporary housing units that may not be needed inside the borders of the state for several years. Following a major disaster declaration, FEMA coordinates with jurisdictions to provide disaster housing assistance to people displaced from their homes. For example, following Hurricane Florence, FEMA provided financial rental assistance and grants under its Individuals and Households program to help make repairs to damaged homes. In addition, FEMA, in coordination with the state of North Carolina, delivered travel trailers and manufactured housing units (i.e., mobile homes) to displaced disaster victims through FEMA’s Direct Temporary Housing Assistance program. FEMA has encouraged jurisdictions to make investments in core capabilities that have the largest preparedness gaps (i.e., the lowest preparedness scores). From 2013 to 2018, DHS identified investment priorities in its annual announcements of preparedness grant funding opportunities. The priorities focused on select capabilities where jurisdictions had reported lower preparedness scores, such as cybersecurity, disaster housing, economic recovery, natural and cultural resources, and supply chain integrity and security. Specifically, FEMA officials told us cybersecurity remains a high priority for all jurisdictions for 2020 and has identified areas from lessons learned where cybersecurity could be strengthened. Jurisdictions are considering investments in cybersecurity such as adding more information technology equipment and hiring personnel with cybersecurity expertise. However, according to state officials from New York and Texas, jurisdictions often lack the resources necessary to hire and retain personnel skilled enough to prepare for, respond to, and recover from cyberattacks. Preparedness grants, in general, are designed to allow jurisdictions discretion to spend the funds as they see fit on projects that meet eligibility requirements. While FEMA encourages jurisdictions to invest grant funds to address their capability gaps, it does not require or direct jurisdictions to spend grant funding in a certain area. In light of these challenges, FEMA has taken a number of other steps to try to address these capability gaps. FEMA proposed creating a new National Priorities Security Grant in the President’s 2019 and 2020 budget proposals, which could be used to address new and emerging threats and gaps, such as those in cybersecurity. FEMA proposed that the program’s priorities be assessed frequently and shift as needed to address emerging threats and capability gaps. In fiscal years 2019 and 2020, the President’s budget proposed $522 and $430 million respectively. The proposed grant program was not approved by Congress. In 2019, FEMA established the Regional Catastrophic Preparedness Grant Program to help jurisdictions address known capability gaps in disaster housing as well as logistics and supply chain management. In fiscal year 2019, FEMA awarded $10 million in these grants to eight local governments. In 2019, FEMA began implementing the Building Resilient Infrastructure and Communities (BRIC) program to provide jurisdictions with funding to make their infrastructure more resilient in future disasters. According to FEMA, grant recipients could use future funding to strengthen capability gaps in the recovery and mitigation mission areas. FEMA plans to issue a Notice of Funding Opportunity in the summer of 2020, followed by an application period. Based on historical disaster expenditures, FEMA anticipates BRIC will be funded between $300 million and $500 million per year on average. It is too early to assess the extent to which this program will help address capability gaps. While FEMA is taking steps to encourage jurisdictions to enhance their lower-rated capabilities, FEMA officials told us their efforts combined with existing preparedness grants, will likely not be sufficient to fully address jurisdictions’ capability gaps. Specifically, FEMA officials told us that the current suite of preparedness grants lacks the flexibility needed to address some of the long-standing capability gaps, in part, because the grants are required to be spent on capabilities that have a nexus to terrorism. In addition, as described earlier, one state official, and two local officials, suggested that the level of funding for the Emergency Management Performance Grant will likely not allow states and localities to hire and retain local emergency management personnel while also making the investments needed to address the capability gaps identified through the National Preparedness System. For example, one emergency management official from a county explained that without using the Emergency Management Performance Grant to offset his own salary, the county would not have an emergency management department with the capability to complete many of the FEMA requirements associated with receiving disaster assistance. In addition to the steps FEMA has already taken to attempt to address the capability gaps, FEMA has developed a new methodology for assessing national preparedness capabilities that uses more quantitative methods. According to FEMA, such methods could enable jurisdictions to more tangibly define what resources are needed to fill identified gaps. We describe this methodology in more detail below. FEMA has taken steps to enhance its methodology for assessing jurisdictions’ emergency management capabilities by requiring jurisdictions to collect more quantitative preparedness data to support their capability ratings. We reported in March 2011 that FEMA needed to improve its oversight of preparedness grants by establishing a framework with measurable performance objectives for assessing urban area, state, territory, and tribal capabilities to identify gaps and prioritize investments. Specifically, we recommended that FEMA complete a national preparedness assessment of capability gaps at each level of government based on tiered, capability-specific performance objectives to enable prioritization of grant funding. We also reported in March 2013 that FEMA has made some progress in assessing its preparedness capabilities, but continued to face challenges developing a national preparedness system that could assist FEMA in prioritizing preparedness grant funding. FEMA’s issuance of the 2020 National Preparedness Report could provide an assessment of capability gaps at each level of government—including an assessment of the federal government’s capabilities for the first time—and help FEMA address the intent of the 2011 recommendation. However, as discussed before, prioritizing jurisdictions’ preparedness grant funding alone may not effectively address the nation’s emergency management capability gaps. An assessment that also considers the federal government’s emergency management capabilities could help determine what capabilities federal agencies could provide to assist in the wake of disasters when jurisdictions’ capabilities become overwhelmed or are not otherwise available. Once the assessment is completed, FEMA and its federal budgeting stakeholders (i.e., Congress and the Office of Management and Budget) could use such an assessment to identify the potential costs of establishing and maintaining capabilities, not only at the jurisdictional level, but also at the federal level. FEMA has continued to take steps to implement the 2011 recommendation, but has not yet fully addressed it as of January 2020. For example, FEMA published new guidance in May 2018 to update the methodology for how jurisdictions are to evaluate their preparedness levels when completing THIRAs and SPRs. The intent was to allow communities to collect more specific, quantitative data to compare their capability targets to current capabilities, thereby more accurately defining their capability gaps. Beginning in 2018, jurisdictions used the new methodology to assess their capabilities in the crosscutting, response, and recovery mission areas. Beginning in 2019, jurisdictions were required to use the new methodology to assess the capabilities across all five mission areas: prevention, protection, mitigation, response, and recovery. According to FEMA, this new methodology improves on the prior one because the new methodology will allow jurisdictions to more accurately determine what amount of resources are needed to address specific threats and hazards. Specifically, as a result of using more quantitative data, such as the specific number of disaster victims able to be sheltered following a disaster, jurisdictions may be able to better define their capability gaps when compiling their SPRs. For example, if jurisdictions are able to understand that their current capability is less than their needed capability target, they will be able to define their capability gaps in quantitative terms. According to FEMA officials, the new methodology, if implemented successfully, will allow jurisdictions to know what additional resources and capabilities—beyond their own current capabilities—may be needed during future disasters. Table 2 shows an example of how FEMA’s updated methodology provides a more quantitative assessment to more accurately define their capabilities. In 2019, FEMA began working on its first National Threat and Hazard Identification and Risk Assessment (National THIRA) to identify what federal government capabilities will be needed to address the greatest threats to the nation. According to FEMA, the results of this effort are expected to be included in FEMA’s annual National Preparedness Report in 2020, which is expected to be published late in calendar year 2020. FEMA’s effort is intended to provide a quantitative assessment of federal capabilities, which when combined with state, territory, urban area, and tribal THIRAs and SPRs, could provide a more meaningful assessment of the nation’s overall preparedness. Figure 5 below shows how national and jurisdiction risk assessments are intended to work together to provide a collective picture of overall capability gaps. As subsequent iterations of the National THIRA and National SPR are produced, FEMA intends to consolidate them with the THIRA and SPR assessments submitted by jurisdictions to provide a comprehensive overview of national preparedness. FEMA officials told us that they have begun to assess and measure the federal government’s capabilities in the crosscutting, response, and recovery mission areas. In conducting the 2019 National THIRA—that FEMA officials told us will be included in the 2020 National Preparedness Report—FEMA coordinated with over a dozen federal departments and agencies, as well as selected national laboratories and the White House to solicit feedback on the most challenging threats and hazards facing the nation. The 2019 National THIRA consists of nine catastrophic incident scenarios and 22 capability targets across the crosscutting, response, and recovery mission areas. For example, FEMA used catastrophic scenarios, such as a pandemic (see sidebar) or New Madrid Earthquake, to assess the nation’s emergency management capacity. Pandemic Scenario In early October, the Centers for Disease Control and Prevention (CDC) reports a new strain of influenza virus in the National Capital Region. Less than 2 weeks after the first confirmed case is identified at a local hospital, the illness causes hundreds of fatalities and thousands of people seeking medical attention. As the virus spreads, approximately 30 percent of the population across the United States and other countries becomes severely ill. Conventional flu vaccines are ineffective against the current strain, and the CDC estimates that a new vaccine could be months away from mass production. Because of the pandemic, social distancing is in widespread effect. Utilities, police, fire, government, and other essential services are disrupted due to social distancing and employee absenteeism. Businesses close, resulting in a large-scale loss of services across the region (e.g. banking, food stores, gas stations). There is a shortage of medical supplies, equipment, beds, and healthcare workers as hospitals are quickly overwhelmed, with up to millions of individuals seeking outpatient medical care and millions more requiring hospitalization. Civil disorder contributes to the high rate of absenteeism and the overcrowding of hospitals and medical centers. how quickly power service can be restored to customers; how quickly life-sustaining commodities can be delivered to people; how quickly emergency sheltering, food, and water can be provided to how quickly affected healthcare facilities can restore function. In the aftermath of the sequential 2017 disasters, FEMA’s 2017 Hurricane Season FEMA After-Action Report recognized the need to more effectively scale response efforts for concurrent, complex incidents. As a result, in addition to the nine catastrophic scenarios, the National THIRA considered the challenges associated with managing concurrent incidents. To examine the potential impacts of managing concurrent incidents, FEMA developed a set of “plausible concurrent operations.” FEMA acknowledged that the agency and its federal partners “will almost certainly be engaged in ongoing disaster operations at the time of any catastrophic-level incident” and gathered data from historical incidents from recent years, including the sequential disasters that took place in 2017; three large hurricanes and wildfires in California, among others. FEMA found that combining the impacts of a National THIRA scenario with the set of plausible concurrent operations more accurately reflects the challenges the nation would need to address should one of the threat scenarios identified in the National THIRA occur. However, given that FEMA has yet to finalize inclusion of the National THIRA into the 2020 National Preparedness Report, it is too early to determine the extent to which it helps FEMA more accurately define the nation’s emergency management capability gaps and results in the nation being better prepared for future catastrophic disasters. As discussed above, the National Preparedness System has identified gaps in jurisdictions’ emergency management capabilities since 2012. While jurisdictions have used preparedness grants to strengthen select capabilities, preparedness data shows that they have not used the grants to address capability gaps across all the mission areas. Furthermore, while FEMA has encouraged jurisdictions to use grant funding to address capabilities that have the largest capability gaps, such as those in the recovery and cybersecurity areas, they do not require that jurisdictions do this. However, if FEMA were to require jurisdictions to use their grant funds to address lower-rated capabilities, it could affect jurisdictions’ ability to sustain other core capabilities—or to fund emergency management personnel in select jurisdictions, some of which only have one full-time employee. As FEMA implements its new methodology and begins to more fully assess both federal and jurisdictional capabilities, the agency is expected to have better and more quantitative information on capability gaps in order to better prioritize grant funds and resources. According to FEMA, the agency and its partners will better understand the extent of the nation’s emergency management capability gaps when they issue the National Preparedness Report by December 2020. While these actions may allow FEMA to address our 2011 recommendation and better measure the nation’s overall preparedness, the agency has yet to determine what additional actions may be needed to close the remaining gaps once the 2020 National Preparedness Report is issued. Further, while FEMA has taken some steps to close the gaps jurisdictions have identified since 2012, such as proposing the National Priorities Security Grant, this program has not been approved by Congress, and thus, will not help to address the gaps. According to FEMA officials, preparedness grants alone are unlikely to address the gaps in an effective manner. In addition, the National Preparedness Goal states that analyzing current performance against intended capabilities allows the emergency management community the opportunity to determine necessary resource levels, inform resource allocation, and help guide federal investments in preparedness. Such information could help inform budget decisions across the preparedness enterprise and help prioritize limited resources. For example, determining what steps need to be taken, following the issuance of the 2020 National Preparedness Report, could help FEMA inform key decision makers, such as Congress and the Office of Management and Budget, about the necessary level of resources—including the allocation of resources—that are needed to address the nation’s capability gaps. Such an effort could be a significant step toward enhancing the capability gaps that have been identified since 2012 and help determine the nation’s overall preparedness levels, as called for in the Post-Katrina Act. The Post-Katrina Act requires FEMA to analyze real-world events to identify and disseminate lessons learned and best practices, and to generate and disseminate, as appropriate, after-action reports to participants after real-world events. After major disasters occur, FEMA’s policy is to conduct an after-action review that identifies strengths, areas for improvement, and potential best practices identified during response and recovery efforts. Lessons learned from past disasters are to provide collective knowledge and diverse experiences for improving disaster response and recovery. Further, FEMA’s 2018-2022 Strategic Plan calls for sharing lessons learned from disasters and exercises with the whole community to help prioritize investments and anticipate known challenges during future disasters. In July 2018, FEMA published its 2017 Hurricane Season After-Action Report, which discussed findings and recommendations based on a review of the agency’s preparation for, immediate response to, and initial recovery operations for Hurricanes Harvey, Irma, and Maria. According to FEMA, the agency is implementing recommendations to address the challenges outlined in the after-action report, which include the following focus areas: scaling and staffing for concurrent complex incidents; improving logistics capabilities during response; improving response to long-term infrastructure outages; and, improving mass care to initial disaster housing operations based on innovations developed during the 2017 hurricane season. According to FEMA, the agency has taken a number of actions in response to this after-action report. For example, it increased its incident management workforce strength by 19 percent since Hurricane Harvey and updated hurricane plans, annexes, and procedures for the continental United States and for states and territories outside the continental United States, among other things. FEMA’s Continuous Improvement Program is responsible for collecting observations and conducting after-action reviews after disasters. The program is intended to consolidate feedback and information from regional, headquarters, and field operations staff and provide information to FEMA leadership and program offices to improve the efficiency and effectiveness of the agency’s disaster operations. The regional role in the Continuous Improvement Program is to identify lessons learned and best practices from disaster events in their regions, conduct after-action reviews, and track corrective actions and improvement plans applicable to the region through Continuous Improvement Working Groups. FEMA officials told us that after-action report findings that cannot be resolved at the regional level are elevated to headquarters for resolution. According to FEMA officials, FEMA headquarters reviews completed after-action reports to identify any areas for improvement that may need to be addressed through changes in policies and procedures. Although FEMA’s policy requires after-action reviews be conducted after every presidentially-declared major disaster, we found that the agency does not consistently conduct after-action reviews after all major disasters and has not instituted time frames for following up on incomplete after- action reviews. As of January 2020 FEMA had completed after-action reviews for 29 percent of disasters since January 2017, with 43 percent pending or in the process of being completed, and 27 percent having been deferred (i.e., not completed or status unknown), as shown in figure 6. Our review of relevant policy indicates that FEMA does not specify time frames for when after-action reviews are to be completed. This is consistent with what we heard from FEMA officials who explained they do not have any time frames for when a certain region is to complete after- action reviews. FEMA has recently updated its Continuous Improvement Program. For example, in 2019, FEMA updated the Continuous Improvement Directive to formalize an annual Summary of Findings that consolidates the field, regional, and headquarters’ observations from the year’s incidents in order to identify the strengths, best practices, and lessons learned that should be addressed the following year. However, FEMA officials noted that this had only been done once in 2019, and would be completed in future years. Officials from FEMA’s Continuous Improvement Program in one region cited challenges with capacity, staffing, and the number of on-going after- action reviews as reasons for not being able to complete all of their after- action reports. According to FEMA officials, in 2017 each region was assigned one to two continuous improvement advisors who are responsible for developing the region’s after-action reviews. However, FEMA officials in one region said that in 2019, they faced challenges in having the staff resources necessary to operate the Continuous Improvement Program due to competing priorities, such as responding to active disasters. In addition, FEMA officials stated that due to limited staff, the regions have to prioritize which after-action reviews they can complete based on the severity and impact of the disaster. For example, in 2017, FEMA focused resources on reviewing the agency’s response and recovery for Hurricanes Harvey, Irma, and Maria. According to FEMA regional and headquarters officials, competing priorities, such as responding to active disasters, often result in staff being unavailable to conduct after-action reviews. While we acknowledge staffing is limited and that FEMA may need to prioritize completing some after-action reviews over others, FEMA officials have not established a process or framework by which regional offices are to prioritize after-action reviews. Based on our analysis of the after-action reviews since 2017 and discussions with FEMA headquarters and regional staff, we found that FEMA does not have a formal process to prioritize after-action reviews and has not established general time frames for how long following a disaster an after-action review should be completed, or followed-up on. FEMA officials agreed that having a formal process to prioritize after-action reviews, including establishing time frames for following up on incomplete after-action reviews, could provide the agency additional opportunities to improve response and recovery operations for future disasters. According to FEMA Regional officials, timely after-action reviews are useful. For example, as a result of the 2017 Hurricanes Season After-Action Report, Region II was able to update response plans for Puerto Rico, which could prove to be beneficial for future disasters. According to The Standards for Program Management, agencies should collect, measure, and disseminate performance information, analyze program trends, and point to areas in need of adjustment. In addition, leading practices for program management indicate that project schedules should be developed to define project milestones and identify and sequence activities in order to determine start and end dates for each activity. Additionally, in other branches of FEMA, the agency provides time frames for completing after-action reports. For example, states and territories are expected to submit after-action reports within 90 days of exercises that are funded by the Homeland Security Grant Program. . Similarly, FEMA policy requires Urban Search and Rescue teams to submit after-action reports 30 days after returning from deployment. Developing a process by which regional offices are to prioritize after- action reviews could help FEMA ensure that regions have a common framework to work from when determining what disasters should be prioritized for review and could help FEMA prioritize staff resources more effectively across the Continuous Improvement Program. Furthermore, establishing time frames for following up on incomplete after-action reviews could provide FEMA with greater assurance that the reviews will be conducted in a timely fashion, so that other FEMA Regions and key stakeholders can benefit from the lessons learned. As described earlier, FEMA regional offices Continuous Improvement Working Groups are responsible for developing and tracking, to the extent possible, corrective actions and best practices identified through after- action reviews. These working groups are to elevate to FEMA headquarters any issues that cannot be resolved at the regional-level. However, FEMA does not have a formal mechanism at the headquarters level for documenting and tracking best practices, lessons learned, and corrective actions that have been elevated from the regional working groups. According to FEMA, it has taken steps to track best practices and lessons learned through a serious of Microsoft Excel files, but it is not a long term or ideal operating solution due to its lack of accessibility, ease of use, and ability to be queried. In February 2016, we recommended that FEMA implement a process to document, track, and analyze recommendations and implement lessons learned after disaster deployments. FEMA concurred with this recommendation and implemented the recommendation by using the Department of Defense’s Joint Lessons Learned Information System as its primary system to capture and manage lessons learned data. However, according to FEMA officials, as of July 2019, it no longer uses the system to capture lessons learned data. FEMA officials also said the Joint Lessons Learned Information System was not user-friendly. FEMA officials stated that they hold a quarterly meeting, as required by FEMA Directive 107-1, with FEMA’s Associate Administrators to review national priorities and issues that have been elevated to headquarters for resolution. According to FEMA officials, this group performs the function that a Continuous Improvement Working Group does at the regional level by monitoring issues that need adjudication by senior management officials. While the quarterly meeting may be helpful, it does not serve as a mechanism, such as a data system, for documenting and tracking best practices, lessons learned, and corrective actions identified after a major disaster. Additionally, continuous improvement coordinators from the regions we interviewed stated that once a finding is elevated to FEMA’s headquarters, in general the region does not have visibility into what steps, if any, FEMA headquarters is taking or plans to take to address the issue. Having a mechanism, such as a database, to record after-action report findings, such as corrective actions or best practices, could help FEMA facilitate awareness across the agency about the status of FEMA’s efforts to address them. According to the Post-Katrina Act, FEMA should conduct remedial action tracking and long-term trend analysis. Furthermore, the National Response Framework specifies that evaluation and continual process improvement are cornerstones of effective preparedness. The framework notes that effective practices with continuity planning ensures the capabilities contained in the framework can continue to be executed regardless of the threat or hazard. Without a mechanism to document and track best practices, lessons learned, and corrective actions identified through after-action reviews across the regions and headquarters, FEMA may not be able to provide assurance that it is effectively leveraging best practices and lessons learned or taking corrective actions to improve its response and recovery programs. As described earlier, the Post-Katrina Act requires FEMA to generate and disseminate, as appropriate, after-action reports to participants in exercises and real-world events. In addition, FEMA’s stated policy on knowledge sharing after disasters is to collaborate with public and private sector partners to share insights on critical issues facing emergency management, promote best practices, and discuss ways in which FEMA itself can improve. However, based on a query of FEMA’s website for after-action reports on disasters, since January 1, 2017, FEMA has placed on-line one after-action report on the 2017 hurricane season. In addition, state officials from Florida, as well as officials from ten localities told us that there has been no communication from FEMA specifically in regards to its 2017 Hurricane Season After-Action Report to ask jurisdictions to provide feedback on the final product or its findings. In addition to FEMA not communicating with jurisdictions about its final product or its findings, state and local officials we spoke with said that FEMA does not consistently share after-action reports with affected jurisdictions. For example, officials from the state of Florida and four localities told us that FEMA does not consistently share its reports after each disaster, while officials from the state of California stated that FEMA has regularly shared after-action reports from disasters. One FEMA regional official noted that it would be helpful to know who, when, and to what extent lessons learned should be shared with external partners. Further, according to FEMA, knowledge sharing allows communities impacted by disasters to prioritize investments and anticipate known challenges during disasters. According to The Standards for Program Management, agencies should collect, measure, and disseminate performance information and analyze program trends, and point to areas in need of adjustment. FEMA has guidance for sharing after-action reports internally within the agency, but according to FEMA officials has not developed guidance for when after-action reports, or findings from after-action reports, should be shared with external stakeholders. According to some state and local officials we spoke with, having access to disaster after-action reports could be useful to FEMA’s external stakeholders. For example, because FEMA’s 2017 Hurricanes Season After-Action Report was accessible, New York City officials said they were able to be proactive in areas that needed to be strengthened in the event of delayed federal assistance, such as providing disaster housing services. Lessons learned can be produced through after-action reports and are relevant to key stakeholders, such as state and local governments, which are instrumental in disaster preparedness, response, and recovery, and would play a key role in any future disasters. However, without guidance to help officials determine when it is appropriate to share after-action reports, FEMA may miss opportunities to share lessons learned. Further, FEMA’s Strategic Plan states that building a culture of preparedness requires continued learning, improvement, innovative ideas, and engagement of the whole community. As such, all sectors of society, including governments, nonprofit organizations, and the private sector, will need to be involved in preparedness for future disasters. The plan further states that insights can be gained through observations from after- action reports and through feedback from stakeholders. A FEMA official from one of the region’s Continuous Improvement Program agreed that developing guidance to determine when it is appropriate to share after- action reports, could help stakeholders better prepare for future disasters. By developing guidance for sharing after-action reports or their relevant findings—when appropriate—with key external stakeholders, FEMA could help communities better prepare for future disasters through knowledge sharing. FEMA has taken numerous steps to continue to strengthen national preparedness, such as distributing grant funds. However, FEMA has not fully defined the capability gaps and determined what steps are needed to enhance capabilities across all levels of government. Informing key stakeholders, such as the Office of Management and Budget and Congress, about what resources will be necessary to address the gaps— across all levels of government—will be critical in addressing the nation’s emergency management capability gaps. In addition, opportunities exist to enhance FEMA’s after-action review process. More specifically, until FEMA prioritizes when—and for what disasters—after-action reviews should be completed and establishes time frames for following up on incomplete after-action reports, the agency will not be able to guarantee that FEMA and its stakeholders can leverage lessons learned from recent disasters and apply corrective actions before future disasters occur. Further, without a mechanism to document and track best practices, lessons learned, and corrective actions throughout the agency, FEMA may not be able to effectively leverage best practices and lessons learned or implement corrective actions to improve its response and recovery operations. By addressing areas needing improvement (i.e., corrective actions) once after-action reviews are completed, FEMA could improve response and recovery operations in the wake of future disasters. In addition, FEMA could help communities better prepare for future disasters by developing guidance to share its after- action reports or findings from its after-action reports—when appropriate—with key stakeholders, allowing them to provide feedback on the findings or adjust their own operational plans to be better prepared to work with FEMA during future disasters. We are making the following four recommendations to the FEMA Administrator: Following the completion of the 2021 National Preparedness Report, determine what steps are needed to address the nation’s emergency management capability gaps across all levels of government and inform key stakeholders, such as the Office of Management and Budget and Congress, about what level of resources will be necessary to address the known gaps. (Recommendation 1) Develop guidance to help determine which after-action reviews should be prioritized based on factors, such as the severity of disasters and availability of staff and resources to conduct the review, and implement time frames for following up on incomplete after-action reports. (Recommendation 2) Develop a mechanism to consistently track best practices, lessons learned, and corrective actions that have been elevated to headquarters for resolution. (Recommendation 3) Develop guidance on sharing after-action reports and their relevant findings with external stakeholders, when appropriate. (Recommendation 4) We provided a draft of this report to the Department of Homeland Security (DHS) for their review and comment. DHS provided written comments, which are reproduced in appendix I. In its comments, DHS concurred with the four recommendations and described actions under way or planned to address them by March 31, 2022. DHS provided technical comments, which we incorporated as appropriate. DHS concurred with our first recommendation to determine what steps are needed to address the nation's emergency management capability gaps across all levels of government and inform key stakeholders about what level of resources will be necessary to address the known gaps. According to DHS, this recommendation is consistent with the requirements outlined in the Disaster Recovery Reform Act of 2018 (DRRA) noting that FEMA complete a national preparedness assessment of capability gaps at each level based on tiered, capability-specific performance objectives to enable prioritization of grant funding; and identify the potential costs for establishing and maintaining those capabilities at each level and determine what capabilities federal agencies should provide. DHS also stated that while the 2020 National Preparedness Report will include a nation-wide assessment of community capability against national capability targets to help understand gaps and inform grant investments, it will not include data on federal capabilities. The collection of that information, through the National Stakeholder Preparedness Report, was scheduled to begin in 2020 but was delayed due to response operations for the COVID-19 pandemic. According to DHS, this information will be incorporated into the 2021 National Preparedness Report, helping to form a more complete picture of national capabilities. FEMA stated that the costs to address the nation’s resource gaps cannot be estimated without first accounting for existing federal capabilities. According to DHS, the anticipated date for the 2020 National Preparedness Report, pending response operations to the COVID-19 pandemic, is October 30, 2020, and the 2021 National Preparedness Report is planned to be released in October 2021. DHS stated that once the 2021 National Preparedness Report is released, FEMA will develop and socialize a plan to work with the federal interagency to identify resources needed to address the national gaps identified in the 2021 National Preparedness Report. If implemented effectively, these actions combined with the steps taken to inform key stakeholders could meet the intent of our recommendation. Due to the impacts of the COVID-19 pandemic and the need to finalize the 2021 National Preparedness Report prior to being able to account for the federal government’s existing capabilities, we are adjusting the wording of this recommendation to follow the issuance of the 2021 National Preparedness Report. DHS estimates the expected completion date to be March 2022. DHS concurred with our second recommendation to develop guidance to help determine which after-action reviews should be prioritized and implement timeframes for following up on incomplete after-action reports. According to DHS, FEMA will address the prioritization of disaster after- action reports as the Continuous Improvement Program’s first priority for 2020. Additionally, FEMA plans to identify and develop timeframes for following up on after-action reports as part of a broader program evaluation effort in 2020. These actions, if implemented effectively, could meet the intent of our recommendation. While FEMA originally anticipated completing this guidance during 2020, the COVID-19 response extended this timeline. DHS estimates the expected completion date to be March 31, 2021. DHS concurred with our third recommendation to develop a formal mechanism to consistently track best practices, lessons learned, and corrective actions. DHS stated that FEMA, in December 2019, implemented an issue elevation and resolution system for tracking best practices, lessons learned, and corrective actions that are elevated to FEMA headquarters level for resolution, as appropriate. However, according to FEMA in April 2020, the agency has taken steps to track best practices and lessons learned through a serious of Microsoft Excel files, but this is not considered to be a long term or ideal operating solution due to its lack of accessibility, ease of use, and ability to be queried. Further, in April 2020, FEMA stated that it is working to identify resources to build an actual application that will be used for this purpose. These actions, if implemented effectively, could meet the intent of our recommendation. DHS concurred with our fourth recommendation that FEMA develop guidance on sharing after-action reports and their relevant findings with external stakeholders, when appropriate. According to DHS, FEMA is drafting program guidance for the Continuous Improvement Program to address the sharing of after action reports and their relevant findings with external stakeholders. These actions, if implemented effectively, could meet the intent of the recommendation. Due to the ongoing COIVD-19 pandemic, FEMA estimates its completion date to be March 31, 2021. We are sending copies of this report to the Secretary of Homeland Security, the FEMA Administrator, and the appropriate congressional committees. If you or your staff have any questions about this report, please contact me at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. In addition to the contact named above, Aditi Archer (Assistant Director), Robert Denton Herring (Analyst-in-Charge), Erin Guinn-Villareal, James Lawson, Ben Ayres, Eric Hauswirth, Tracey King, Amanda Miller, Kevin Reeves, and Minette Richardson made significant contributions to this report.

Summary: FEMA uses the National Preparedness System to help assess the nation's emergency management capabilities in preparing for disasters and, in part, to help prioritize federal preparedness grants it provides to state and local jurisdictions. Since 2002, FEMA has provided over $52 billion in such grants intended to enhance preparedness capabilities. GAO was asked to examine national preparedness. This report examines the extent to which: (1) FEMA's National Preparedness System and associated preparedness grants have assisted jurisdictions in preparing for disasters; (2) FEMA has strengthened the National Preparedness System and what steps remain; and (3) FEMA is using after-action reports to identify lessons learned and strengthen future preparedness. GAO evaluated agency guidance, analyzed 2013 to 2017 capability data—the most current available; conducted site visits to five states; and interviewed FEMA, state, and local emergency management officials. The Federal Emergency Management Agency's (FEMA) National Preparedness System and associated grants have helped build some emergency management capabilities, but gaps remain. Capabilities fall in five mission areas: (1) prevention—preventing imminent acts of terrorism, (2) protection—protecting citizens and assets, (3) mitigation—mitigating the loss of life and property, (4) response—responding quickly to save lives, and (5) recovery—timely restoration of infrastructure and housing, among other things. From fiscal years 2013 through 2018, jurisdictions directed almost 90 percent of FEMA preparedness grants ($7.3 of $8.3 billion) to capabilities in the crosscutting (i.e., benefit all five mission areas), response, and prevention areas (figure below). Jurisdictions reported a higher level of preparedness in these areas compared to capabilities in the other mission areas—recovery, mitigation, and protection. Jurisdictions have consistently rated select capabilities in these three mission areas—such as disaster housing and cybersecurity—in the lowest category since 2013. FEMA does not limit jurisdictions' use of preparedness grants for select capabilities, but it has encouraged jurisdictions to address the known gaps. FEMA is taking steps to strengthen the national preparedness system, but has yet to determine what steps are needed to address the nation's capability gaps across all levels of government. Specifically, FEMA is implementing a new methodology to collect more quantitative data on capabilities at the state, territory, and local levels—as GAO recommended in 2011—and also plans to begin assessing the federal government's capabilities. Including the federal government in such an assessment would enable FEMA and jurisdictions to assess national preparedness capabilities collectively. While these are positive steps that could meet the intent of the 2011 recommendation, FEMA has yet to determine what steps are needed to address the capability gaps once they are identified, including jurisdictions' capability gaps that have been known since 2012. By determining these steps and informing key stakeholders, such as Congress, about what resources will be needed across all levels of government, FEMA will be better positioned to address the nation's capability gaps. FEMA after-action reports have identified areas for improvement and lessons learned following disasters, but has completed after-action reviews for only 29 percent of disasters from 2017 through 2019. FEMA lacks a formal mechanism to track corrective actions and does not have guidance on sharing after-action reports with key external stakeholders, as appropriate. GAO is making four recommendations that FEMA (1) determine what steps are needed to address emergency management capability gaps, and communicate it to key stakeholders (2) prioritize completion of after-action reviews, 3) track corrective actions, and (4) develop guidance on sharing findings externally. The Department of Homeland Security concurred and FEMA is taking actions in response.