This work was done in conjunction with a separate review of the Port Security Grant Program. See GAO-12-47. and Training. However, since its creation in April 2007, FEMA’s GPD has been responsible for the program management of DHS’s preparedness grants. GPD consolidated the grant business operations, systems, training, policy, and oversight of all FEMA grants and the program management of preparedness grants into a single entity. GPD works closely with other DHS entities to manage several grants, including the USCG for the PSGP and TSA for the TSGP. From fiscal years 2002 through 2011, DHS distributed approximately $20.3 billion through four grant programs: SHSP, UASI, PSGP, and TSGP. See table 1 for a breakdown of the funding for these programs. Federal grants, including SHSP, UASI, PSGP, and TSGP generally follow the grant life cycle shown in figure 1 of announcement, application, award, postaward, and closeout. A grant program may be established through legislation––which may specify particular objectives, eligibility, and other requirements—and a program may also be further defined by the grantor agency. For competitive grant programs, the public is notified of the grant opportunity through an announcement, and potential grantees must submit applications for agency review. In the application and award stages, the agency identifies successful applicants or legislatively defined grant recipients and awards funding to them. The postaward stage includes payment processing, agency monitoring, and grantee reporting, which may include financial and performance information. The closeout phase includes preparation of final reports and any required accounting for property. Audits may occur multiple times during the life cycle of the grant and after closeout. SHSP, UASI, PSGP, and TSGP are specific grant programs nested under a larger framework of national preparedness. The broader initiatives described below, some of which are in development, are intended to help determine preparedness goals and the capabilities necessary to achieve these goals. Grants programs such as the four we reviewed can then help facilitate specific investments to close identified capability gaps. The purpose and status of the larger preparedness framework affects SHSP, UASI, PSGP, and TSGP in a number of ways, including the development of grant performance metrics to assess the effectiveness of the programs. In December 2003, the President issued Homeland Security Presidential Directive-8 (HSPD-8), which called on the Secretary of Homeland Security to coordinate federal preparedness activities and coordinate support for the preparedness of state and local first responders, and directed DHS to establish measurable readiness priorities and targets. In October 2006, the Post-Katrina Emergency Management Reform Act was enacted, which requires FEMA to develop specific, flexible, and measurable guidelines to define risk-based target preparedness capabilities and to establish preparedness priorities that reflect an appropriate balance between the relative risks and resources associated with all hazards. In September 2007, DHS published the National Preparedness Guidelines. The purposes of the guidelines are to: organize and synchronize national—including federal, state, local, tribal, and territorial—efforts to strengthen national preparedness; guide national investments in national preparedness; incorporate lessons learned from past disasters into national preparedness priorities; facilitate a capability-based and risk-based investment planning process; and establish readiness metrics to measure progress and a system for assessing the nation’s overall preparedness capability to respond to major events, especially those involving acts of terrorism. Each of the grant programs in our review has specific strategies that are aligned with the overall federal national preparedness guidelines, as the following examples illustrate. State and Urban Area Homeland Security Strategies (all four grants): These strategies are designed to (1) provide a blueprint for comprehensive, enterprise wide planning for homeland security efforts; and (2) provide a strategic plan for the use of related federal, state, local, and private resources within the state and/or urban area before, during, and after threatened or actual domestic terrorist attacks, major disasters, and other emergencies. State and urban area homeland security strategies are required by FEMA for receiving SHSP and UASI funding. Port-Wide Risk Mitigation Plan (PSGP): The primary goal of these plans is to provide a port area with a mechanism for considering its entire port system strategically as a whole, and to identify and execute a series of actions designed to effectively mitigate risks to the system’s maritime critical infrastructure. FEMA requires a Port-Wide Risk Mitigation Plan for receiving PSGP funding for the high-risk ports, known as Groups I and II, as discussed in table 2. Regional Transit Security Strategy (TSGP): These strategies serve as the basis on which funding is allocated to address regional transit security priorities, and are the vehicles through which transit agencies may justify and access other funding and available resources. TSA requires a Regional Transit Security Strategy for receiving TSGP funding. On March 30, 2011, the President issued Presidential Policy Directive-8 (PPD-8), which directs the development of a national preparedness goal and the identification of the core capabilities necessary for preparedness. PPD-8 replaces HSPD-8. FEMA officials noted that the National Preparedness System affirms the all- hazards risk-based approach to national preparedness. FEMA officials further noted that PPD-8 looks to build on the efforts already in place, including those that supported the Post-Katrina Emergency Management Reform Act and the 2009 National Infrastructure Protection Plan. PPD-8 has specific deadlines for deliverables: 180 days for the National Preparedness Goal, 240 days for a description of the National Preparedness System, and 1 year for a National Preparedness Report. The four grant programs in our review—SHSP, UASI, PSGP, and TSGP—have overlapping goals, project types, and funding jurisdictions, which increases the risk of duplication among the programs. Although the specifics of the four programs vary, they share the overarching goal of enhancing the capacity of state and local emergency responders to prevent, respond to, and recover from a terrorism incident involving chemical, biological, radiological, nuclear, or other explosive devices, or cyber attacks. More specifically, each program funds similar projects such as training, planning, equipment, and exercises. For example, the four programs have overlapping lists of allowable costs, so certain types of equipment, such as communication radios, may be purchased through each grant program. Further, although the programs target different constituencies, such as states and counties, urban areas, and port or transit stakeholders, there is overlap across recipients. For example, each state and eligible territory receives a legislatively mandated minimum amount of SHSP funding to help ensure that all areas develop a basic level of preparedness, while UASI explicitly targets urban areas most at However, many jurisdictions within designated risk of terrorist attack.UASI areas also apply for and receive SHSP funding. Similarly, a port stakeholder in an urban area could receive funding for patrol boats through both PSGP and UASI funding streams, and a transit agency could purchase surveillance equipment with TSGP or UASI dollars. More broadly, any designated high-risk urban area located near major waterways can receive funding through SHSP, UASI, PSGP, and TSGP sources. In March 2011, we reported that overlap among government programs or activities can be harbingers of unnecessary duplication. Further, we commented on FEMA’s full suite of 17 fiscal year 2010 preparedness programs, including the four programs in this review, and noted that FEMA needed to improve oversight and coordination of its grant awards. ensure that these four grant programs, which distributed over $20 billion dollars in funding to grant recipients from fiscal years 2002 through 2011, are allocating resources effectively. Table 2 below describes the basic purposes, the types of projects funded, and the eligible applicants of the SHSP, UASI, PSGP, and TSGP programs. GAO-11-318SP. Urban Areas Security Initiative (UASI) UASI provides federal assistance to address the unique needs of high- threat, high-density urban areas, and assists them in building an enhanced and sustainable capacity to prevent, protect, respond to, and recover from acts of terrorism. Port Security Grant Program (PSGP) PSGP provides federal assistance to strengthen the security of the nation’s ports against risks associated with potential terrorist attacks by supporting increased port wide risk management, enhanced domain awareness, training and exercises, and expanded port recovery capabilities. Transit Security Grant Program (TSGP) TSGP provides funds to owners and operators of transit systems (which include intracity bus, commuter bus, ferries, and all forms of passenger rail) to protect critical surface transportation infrastructure and the traveling public from acts of terrorism and to increase the resilience of transit infrastructure. SAA/ 50 states, DC, and territories. Port Areas: Groups I and II (highest risk); Group III and “All Other Port Areas” (lower risk). Selected transit agencies and ferry systems within high risk urban areas. allocate UASI funds to port and transit stakeholders In fiscal year 2011, Tier I UASI areas included the 11 highest risk urban areas and were allocated about 82 percent of the total UASI funding available; Tier II included the other 20 candidate areas and were allocated the remaining 18 percent funding. Tier I and II Urban Area are determined using a DHS risk model that incorporates threat, vulnerability, and consequence. A DHS risk model determines the port areas at high risk of a terrorist attack and DHS places them in either Group I (highest risk group), Group II (next highest risk group) or Group III. In fiscal year 2011, there were 7 port areas in Group I and 48 port areas in Group II. Port areas in Group I are considered to be the highest risk port areas in the nation. Ports not identified in Group I, II, or III are eligible to apply for funding as part of the All Other Port Areas Group. For additional information on the PSGP and port area groups, see GAO-12-47. FEMA’s ability to track which projects receive funding among the four grant programs is varied because the project-level information FEMA has available to make award decisions—including grant funding amounts, grant recipients, and grant funding purposes—also varies by program. This is due to differences in the grant programs’ administrative processes. For example, in some cases, FEMA relies on stakeholders to review and recommend projects for grant funding—adding layers to the review process. Delegating administrative duties to stakeholders reduces FEMA’s administrative burden, but also contributes to FEMA having less visibility over some grant applications, specifically those funded via SHSP and UASI. A combination of federal statutes and DHS policy determine specific grant allocation mechanisms and the federal partners involved in grants administration. Figure 2 below describes the federal agencies involved, the path of the grant funds to the final recipient, and the application and award process for each grant, as of fiscal year 2011. As depicted in figure 2, grant funding follows a different path to final recipients depending on the program’s administrative process. For example, grant awards made under SHSP and UASI go through three steps before the money reaches the final grant recipient. First, DHS awards SHSP and UASI funds through FEMA to a designated SAA— typically a state homeland security or emergency management office. The SAA then passes funds to subrecipients, such as county or city governments or designated urban areas. These subrecipients/local governments may then further distribute SHSP and UASI funds to other entities, including individual law enforcement agencies. It is these other entities that will ultimately spend the grant funds to implement security projects. Because state governments are required by the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act) to have a role in the application process and distribution of SHSP and UASI funding, and because of the thousands of individual projects that comprise these programs, FEMA relies on the SAAs to administer the awards to smaller entities. In delegating significant grants administration duties to the SAA for the larger SHSP and UASI programs, FEMA officials recognized the trade-off between decreased visibility over grant funding, subrecipients, and specific project-level data in exchange for their reduced administrative burden. For these two programs, the SAA, as the official grant recipient, assumes responsibility for holding subrecipient entities accountable for their use of funding, including ensuring that recipients use grant funds to pay costs that are allowable (e.g., reasonable and necessary for proper performance of the award). states’ capacities to effectively administer and coordinate their grants vary considerably. Among other requirements, grant funds may only be used for allowable costs. Allowable costs are those that, among other things, are reasonable and necessary for proper and efficient performance and administration of federal awards, and a cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost. See 2 C.F.R. pt. 225. In this report, potential “overlap” and “duplication” generally refer to two or more SHSP, UASI, PSGP, or TSGP projects that address the same preparedness need and could be redundant or unnecessary if not coordinated. In contrast, FEMA receives far fewer applications for TSGP and PSGP funds and awards grant funding more directly to the final grant recipients, with one and two steps, respectively, rather than three steps. As a result, FEMA has a greater ability to track grant funding, specific funding recipients, and funding purposes for these two smaller grant programs. Beginning in fiscal year 2009, appropriations acts required FEMA to award TSGP funds directly to transit authorities instead of through SAAs. Per FEMA policy, the agency distributes PSGP funds to local FAs who then distribute grants to local entities within the port area, but FEMA is directly involved in this process. Due to the legal and departmental policies that establish a more direct award process for PSGP and TSGP, along with the smaller scope of those programs, FEMA has more information and is better able to track these grants through to the end user of the grant monies. Differences in administrative processes among each of the four grant programs also impact the extent to which federal, state and local entities share responsibility for prioritizing and selecting the individual preparedness projects that will ultimately receive funding. Due to its greater involvement with the PSGP and TSGP project selection at the local level, DHS generally has more information on specific PSGP and TSGP projects than SHSP and UASI projects. For example, DHS components—USCG and TSA—are involved with the PSGP and TSGP selection process, which provides DHS with additional information over the use of grant funds. For instance, TSGP projects from fiscal years The 2007 through 2010 were selected by regional working groups. regional groups based their project selection on Regional Transit Security Strategies that each transit region had developed. For this grant program TSA had better information about the funding as well as influence over the project selection because TSA set the parameters for and approved the transit security strategies, and final project selection was based on TSA approval. The regional working groups choose projects for the highest risk Tier 1 regions. The remaining transit regions’—Tier 2 regions—projects are fully competitive. Similarly, the USCG, and in particular the Captain of the Port, exerts influence over the PSGP project selection process, given the agency’s maritime security expertise and role in the PSGP award process. PSGP project applications also undergo a second national review facilitated by FEMA that includes the USCG, the Department of Transportation’s Maritime Administration, and other stakeholders. Along with federal stakeholders, numerous local stakeholders are involved with the PSGP selection process and in many locations are required to base their grant award decisions largely on FEMA-required port security mitigation strategies. These strategies also require FEMA approval before PSGP grants can be awarded to port areas. Thus, for these projects, FEMA is more involved and has greater information on which to base award decisions. In contrast, local officials select SHSP and UASI projects with less federal involvement, although the projects must comport with various program rules, such as those related to allowable activities or costs, and address any funding priorities stipulated in the grant guidance. For SHSP, FEMA awards funds to states for certain broad purposes, such as interoperable communications, but federal law and DHS policies allow states to distribute these funds to individual projects or jurisdictions using different mechanisms, given different local conditions and needs. One state may choose to use a consensus-based approach to disburse the funds to counties, for example, while another may distribute funding equally to all of its jurisdictions. For example, in Washington State, SHSP grant applications are reviewed by four distinct entities––the state’s homeland security committee, the all-hazards statewide emergency council, the state’s domestic security executive group, and the governor’s office–– prior to the state making risk-informed allocation decisions. In contrast, one regional government council in Texas allocated SHSP funds equally to all eligible jurisdictions within its region regardless of their risk level. For UASI grants, FEMA requires each region to create its own UAWG, but does not participate in these groups. The UAWGs convene to select individual projects for UASI funding based on the FEMA-identified grant priorities for that grant year that are also consistent with the area’s grant application and state and urban area strategic plans. For example, in 2009 the New York City UAWG identified protecting critical infrastructure and key resources as one of eight goals in its homeland security strategic plan, received UASI funding for this purpose, and selected and allocated funds to specific projects in the urban area related to this goal. FEMA approves all applications and strategic plans, which give the agency a broad idea of what grant applicants intend to accomplish at the state and local level. However, selection of specific projects occurs through local- level working groups. As a result of the differing levels of DHS involvement in project selection for each of the grants programs, DHS generally has more project information for specific PSGP and TSGP projects than SHSP and UASI projects. When making preparedness grant awards, FEMA decisions are based on less specific project-level information for SHSP and UASI programs than for PSGP and TSGP, which puts the agency at greater risk of funding unnecessarily duplicative projects across all programs. In our prior work on overlap and duplication, we identified challenges agencies face in collecting and analyzing the information needed to determine whether unnecessary duplication is occurring. For example, we identified 44 federal employment and training programs that overlap with at least 1 other program in that they provide at least one similar service to a similar population. However, our review of 3 of the largest 44 programs showed that the extent to which individuals actually receive the same services from these programs is unknown due to program data limitations. We found similar data limitations in this review as FEMA bases its awards for SHSP, UASI, PSGP, and TSGP in part upon IJs which contain limited information. For the SHSP and UASI programs, states and eligible urban areas submit IJs for each program with up to 15 distinct investment descriptions that contain general proposals to address capability gaps in wide-ranging areas such as interoperability communications or critical infrastructure protection. Each IJ may encompass multiple specific projects to different jurisdictions or entities, but project-level information, such as a detailed list of subrecipients or equipment costs, is not required by FEMA. According to FEMA, data system limitations, the high volume of individual SHSP and UASI projects, and the desire to give states and urban areas increased flexibility to add or modify specific projects after the award period contributed to less detailed IJs. In contrast, FEMA makes PSGP and TSGP award decisions based on federal reviews of IJs that contain information about specific projects, providing FEMA officials with more detailed knowledge of what is being requested and what is being funded by these programs. Furthermore, before awards are made, FEMA directs PSGP and TSGP applicants to submit detailed budget summaries, but does not call for such information from SHSP and UASI applicants. The 9/11 Commission Act establishes minimum application requirements for SHSP and UASI, such as a description of how funds will be allocated, but the act does not call for specific project data. For example, with SHSP, the statute requires states to include in their grant applications the purpose for the grant funds, a description of how they plan to allocate funds to local governments and Indian tribes, and a budget showing how they intend to expend the funds. FEMA officials stated that the SHSP and UASI IJ format meet these statutory requirements, albeit at “a high summary level.” To improve the level of information that FEMA has available for making grant award decisions, FEMA is considering collecting more detailed information on proposed grant projects. In May 2011, a FEMA report based on the work of a Reporting Requirements Working Group recommended collecting additional project information at the application stage. Specifically, the FEMA report recommended that the agency modify the IJ format for SHSP and UASI applications to include a detailed project list. This project list would contain information that is currently collected through the BSIR later in the grant cycle after FEMA makes grant awards.collecting additional information at the application stage could be initiated in the fiscal year 2013 grant cycle, according to FEMA. Although collecting this additional information may be useful to FEMA, we determined that the level of information contained in the BSIR alone would not provide sufficient project information to identify and prevent potentially unnecessary duplication within or across grant programs. If this recommendation is implemented, the policy of To make this determination, we reviewed the type of information that FEMA would have available at the application stage if it implemented the report recommendation. Specifically, we reviewed IJ and BSIR information for the 1,957 grant projects awarded through the four grant programs to five urban areas––Houston, Jersey City/Newark, New York City, San Francisco, and Seattle––for fiscal years 2008 through 2010. Our analysis determined that 140 of the projects, or 9.2 percent of the overall funding associated with these projects––about $183 million–– lacked sufficient detail to determine whether these projects were unnecessarily duplicative or had involved coordination during the state’s planning or selection processes to prevent any unnecessary duplication. Table 3 further illustrates the challenge that FEMA would face in identifying potential duplication using the BSIR data for SHSP and UASI as recommended by the report. For example, table 3 contains SHSP, UASI, and PSGP project information from a single jurisdiction in one of the five urban areas we reviewed and shows the level of detail that FEMA would have available to compare projects. The overlap in the descriptions of the project types and titles suggest that duplication could be occurring among three of the four grant programs, and warranted further analysis. After identifying the projects that appeared to be potentially duplicative, we contacted the SAA and FA for this state, and officials provided us with extended narratives, coordination details, and subrecipient lists. It was not until we reviewed this additional, more detailed information that we could ascertain that these four projects were not duplicative, but rather were part of a larger, coordinated public safety interoperability and video initiative taking place in the region. Table 4 below contains a second example of project data associated with BSIR and IJ information from a single jurisdiction in one of the five urban areas we reviewed. Again, we identified the potential for duplication because of the similarities in funded projects for both the SHSP and TSGP. Both of the projects identified below are related to the purchase of chemical, biological, radiological, and nuclear detection equipment (CBRNE). However, upon examining additional state-provided information and the TSGP IJ, we had sufficient information to determine that these projects were distinct and involved separate equipment. However, as with the previous example in table 3, FEMA would not be able to make these determinations using only BSIR data. Based on our analysis using BSIR and IJ project data, we were able to ascertain that over 90 percent of the projects we reviewed had sufficient detail to determine that the projects (1) were substantively different and not likely duplicative, or (2) involved coordination to prevent any unnecessary duplication. Furthermore, our subsequent analysis using additional information from state and local grant recipients indicated that none of these projects were duplicative. Nonetheless, we believe that more detailed project information could be of value to FEMA in its grant review process since, as demonstrated above, the information currently being considered does not always allow for the necessary differentiation between projects funded by the four grant programs. Moreover, FEMA–– through its own internal analysis––and the OIG have both separately concluded in recent years that FEMA should use more specific project- level data in making grant award decisions, especially for SHSP and UASI, in order to identify and mitigate potential duplication. Specifically, in a March 2010 report, the OIG noted that the level of detail in IJs and in other grant program applications was not sufficient for FEMA to identify duplication and redundancy. In its written comments to the OIG, the DHS Office of Infrastructure Protection concurred with this assessment, noting that a SHSP IJ “was little more than a checklist of previous funding with a brief strategy narrative.” Further, Standards for Internal Control in the Federal Government state that program managers need operational and financial data to determine whether they are meeting their goals for accountability for effective and efficient use of resources. FEMA has acknowledged the agency’s difficulties in effectively using grants data and is taking steps to improve its data collection and utilization through resolving staffing shortages by filling key grants management personnel vacancies, and taking steps to implement a new data management system. As part of this effort, FEMA introduced a new non disaster grant management system (ND Grants) for the fiscal year 2011 grant cycle, and the system is scheduled for completion by fiscal year 2014. Agency officials stated that this system, once completed, will help FEMA to manage all of its preparedness grants, and has an explicit goal of enhancing project-level data collection. In addition, the ND Grants system is anticipated to consolidate data from multiple systems and facilitate greater utilization and sharing of information. according to FEMA documentation, FEMA has not yet determined all of its specific data needs for ND Grants. As FEMA continues to develop the ND Grants system it will be important that it collects the level of data needed to compare projects across grant programs to limit the risk of funding duplicative projects. This system will replace the 13 legacy grant data systems and other processes that FEMA inherited from agencies that previously administered homeland security preparedness grants, such as the Department of Justice. We believe that the recommendation of the FEMA report to better use more specific project-level data through the BSIR, for the SHSP and UASI programs, is a step in the right direction, although our analysis demonstrated BSIR data alone do not include enough detail needed to identify potential duplication. The Director of GPD’s Preparedness Grants Division reported in September 2011 that the report recommendations were still under consideration and thus FEMA had not yet determined the specifics of future data requirements. Thus, the agency’s goal to improve data collection by collecting project-level information through its ND Grants system is a worthwhile action. This effort could provide the level of detail that FEMA needs to identify possible unnecessary duplication within and across all four grant programs. We recognize that collecting more detailed project information through ND Grants could involve additional costs. However, collecting information with this level of detail could help FEMA better position itself to assess applications and ensure that it is using its resources effectively. FEMA, as well as state and local stakeholders, have taken steps to improve coordination in selecting and administering the four grant programs, but additional FEMA action could help reduce the risk of duplication among these programs. Federal efforts to improve coordination range from improving visibility across grants to gathering additional information about grant spending. The Director of GPD’s Preparedness Grants Division discussed multiple projects that FEMA had initiated to potentially improve coordination in the grants management area. He told us that at the federal level, there is an effort within FEMA to increase planning and training exercises in order to increase its ability to track what projects are being funding by which grants. He added that this FEMA-led initiative is currently assessing public information on grants to reduce the risk of duplication. FEMA has a variety of reporting tools and guidelines that FEMA personnel have recently been working with to improve coordination and linkages between programs. For example, FEMA has started using Threat and Hazard Identification Risk Assessments (THIRA) as a way to increase FEMA’s ability to link spending at the local and federal levels.Preparedness Grants Division said that the guidance for reporting this linkage to the local level is still being discussed, with NPD taking the lead, as it currently is only required at the state level. The Director of GPD’s Officials in four of the five states we visited had taken steps to improve coordination across grant programs. State steps to improve coordination range from tracking equipment purchases to enhancing administrative tools. For example, in Texas, jurisdictions must register all deployable equipment purchased through a homeland security grant and costing more than $5,000 on a statewide registry known as the Texas Regional Response Network. The purpose of the network is to raise awareness about the assets that neighboring jurisdictions might have available for use by another jurisdiction during an emergency. According to a Texas official familiar with the initiative, the registry was established with the recognition that sharing deployable equipment would be cost effective since it would be difficult for every jurisdiction to maintain every piece of equipment that might be needed in an emergency. In New Jersey, the SAA’s office developed a Grants Tracking System, a web-enabled application to capture and track each subgrantee’s state-approved Homeland Security Grant Program–funded projects which includes SHSP and UASI. The Grant Tracking System is the state’s primary oversight mechanism to monitor the progress of each county, city, and state agency toward completing or procuring their budgeted projects or equipment. The system permits the SAA to review every program that receives funding, which allows for increased coordination across grants and efficiencies in procurement and helps alleviate the risk of funding duplicative grants. The system was included as a best practice in the OIG’s 2011 audit of New Jersey’s grant programs. Officials in all five localities we visited commented that they rely on informal structures to coordinate or identify potential unnecessary duplication––such as having the USCG Captain of the Port involved in a UAWG committee. Additionally, officials from three locations we visited also noted having tried to set up more formal coordination structures. For example, the UAWG in one Texas locality set up a peer-to-peer network with other UASI regions around the state to exchange information. A county official from a UAWG in Washington State reported that they have set up monthly small group meetings with officials from surrounding counties who deal with SHSP and UASI in an effort to exchange information and improve coordination. While FEMA, states, and local government have taken steps to improve coordination, our review of FEMA’s internal coordination showed that the agency lacks a process to coordinate reviews across the four grant programs. GPD has divided the administration of the grant programs into two separate branches: UASI and SHSP are administered by the Homeland Security Grant Program branch while PSGP and TSGP are administered by the Transportation Infrastructure Security branch. The result of this structure is that grant applications are reviewed separately by program but are not compared across each other to determine where possible unnecessary duplication may occur. As we noted earlier, each grant program we reviewed has similar goals, allowable costs, and geographic proximity. Due to this structure, these four programs share applicants as state and local entities seek to maximize grant dollars for their projects. However, since the review process for grant applications falls within each separate branch and grant program––and since there is no process in place to ensure that grant information is exchanged in the review process—FEMA cannot identify whether grant monies are being used for any unnecessary duplicative purposes. Similarly, in 2010, the OIG noted that FEMA does not have an overarching policy to coordinate grant programs and outline roles and responsibilities for coordinating applications across grant programs. Standards for Internal Control in the Federal Government call for agencies to have the information necessary to achieve their objectives and determine whether they are meeting their agencies’ strategic goals. FEMA’s strategic goals for fiscal years 2009 through 2011 included teaming with internal and external stakeholders to build partnerships and increase communication, and to streamline, standardize, and document key processes to promote collaboration and consistency across regions and programs. Because the four grant programs are being reviewed by two separate divisions, yet have similar allowable costs, coordinating the review of grant projects internally could allow FEMA to have more complete information about grant applications across the four different programs. This is necessary to identify overlap and mitigate the risk of duplication across grant applications. One of FEMA’s section chiefs noted that the primary reasons for the current lack of coordination across programs are the sheer volume of grant applications that need to be reviewed and FEMA’s lack of resources to coordinate the grant review process. She added that FEMA reminds grantees not to duplicate grant projects; however, due to volume and the number of activities associated with grant application reviews, FEMA lacks the capabilities to cross-check for unnecessary duplication. We recognize the challenges associated with reviewing a large volume of grant applications, but to help reduce the risk of funding duplicative projects, FEMA could benefit from exploring opportunities to enhance its coordination of project reviews while also taking into account the large volume of grant applications it must process. DHS implemented some performance measures for SHSP and UASI in the fiscal year 2011 grant guidance, but has not yet implemented comparable measures for PSGP and TSGP. Moreover, the type of measures DHS published in the SHSP and UASI guidance do not contribute to DHS’s ability to assess the effectiveness of these grant programs, but instead provide DHS with information to help it measure completion of tasks or activities. DHS has efforts underway to develop additional measures to help it assess grant program effectiveness; however, until these measures are implemented, it will be difficult for DHS to determine the effectiveness of grant-funded projects, which totaled $20.3 billion from fiscal years 2002 through 2011. As a part of its risk management framework, the National Infrastructure Protection Plan calls for agencies to measure progress in security improvements against sector goals using both output measures, which track the progression of tasks associated with a program or activity, and outcome measures, which help an agency evaluate the extent to which a program achieves sector goals and objectives—that is, their effectiveness. The measures that DHS implemented for SHSP and UASI through the fiscal year 2011 guidance are output measures. For example, some of the output measures implemented for SHSP and UASI include: (1) the percentage of fusion center analysts that require secret clearances that have them (or have submitted requests for them); (2) the percentage of SHSP and UASI funded personnel who are engaged in the Nationwide Suspicious Activity Reporting Initiative and have completed the training; and, (3) the approval of a State Hazard Mitigation Plan that includes a THIRA that has been coordinated with UASI(s) located in the state. Implementing output measures for the SHSP and UASI grant programs provides value and is a step in the right direction because they allow FEMA to track grant-funded activities. However, outcome measures would be more useful to FEMA in determining the effectiveness of these grant programs. As of February 2012, DHS had not implemented outcome measures for any of the four grant programs in our review. Our previous work has underscored how the absence of outcome measures has negatively impacted DHS’s ability to assess the achievement of desired program outcomes to further homeland security preparedness goals. agencies to track progress towards strategic goals and objectives by measuring results or outcomes, and it states that aligning outcome measures to goals and objectives is the key to performance management. As shown in table 5 below, FEMA had efforts under way in 2010 and 2011 to develop outcome measures for the four grant programs in our review. GAO, DHS Improved its Risk-Based Grant Programs' Allocation and Management Methods, But Measuring Programs' Impact on National Capabilities Remains a Challenge, GAO-08-488T (Washington D.C.: Mar. 11, 2008). Initiative description The Redundancy Elimination and Enhanced Performance for Preparedness Grants Actdirected the Administrator of FEMA to enter into a contract with NAPA to assist the administrator in studying, developing, and implementing performance measures to assess the effectiveness of SHSP and UASI, among other things. Expected result Three to seven proposed measures and an implementation roadmap. Status NAPA began work on this project in January 2011, with performance measure implementation scheduled for December 2011. In October 2011, NAPA provided FEMA with a copy of the final report, according to FEMA officials. As of December 2011, FEMA officials stated that the results of the NAPA study are under review within FEMA and no measures have been implemented. In January 2010, GPD formed a task force to develop measures to assess the effectiveness of PSGP and TSGP. In December 2010, this effort was transferred to NPD. Development of program-specific performance measures for PSGP and TSGP. As of December 2011, the Director of the National Preparedness Assessment Division (NPAD) within NPD told us that NPD had developed draft performance measures for the PSGP and TSGP and that those measures were undergoing review within FEMA. As a result, the official told us that it is unclear if FEMA would include these measures in its fiscal year 2012 grant guidance. For more information about FEMA’s efforts to measure the effectiveness of the PSGP, see GAO-12-47. On February 17, 2012, FEMA released the fiscal year 2012 Funding Opportunity Announcement for the PSGP and TSGP. However, this guidance did not contain performance measures. FEMA has taken steps to develop outcome-based measures through these initiatives; however, as of February 2012, FEMA had not completed its efforts. According to FEMA officials, DHS leadership has identified performance measurement as a high priority issue, and is developing a more quantitative approach for using grant expenditure data to monitor program effectiveness. Further, senior FEMA officials have noted challenges to measuring preparedness. For example, they have noted that SHSP and UASI fund a wide range of different preparedness activities, which makes it difficult to devise applicable measures. Thus, if measures are too broad they are meaningless and if too narrow they may not adequately capture the effectiveness of a range of activities. Senior FEMA officials noted another challenge in that grant program goals are purposefully broad to accommodate a broad constituency. For example, SHSP is administered in all states. However, the security conditions and preparedness needs of a state such as North Dakota are very different from those of New York, yet the grant goals, guidance, and measures would be the same for both locales. FEMA provided us with its Performance Measure Implementation Plan, an internal plan that FEMA uses for developing measures for all preparedness grants; however, this plan provides insufficient detail to guide these efforts. This plan identifies the output measures that were included in the fiscal year 2011 guidance for SHSP and UASI. Further the plan notes that NPD’s National Preparedness Assessment Division (NPAD) has developed new performance measures that seek to better capture the outcomes and overall effectiveness of preparedness grants, rather than the outputs captured by current measures; however, it does not specify what outcome measures were developed. Instead, the implementation plan provides a general approach to performance measurement as well as a list of key milestones to implement the new performance measures and refine existing measures. In addition, the implementation plan notes that it is NPAD’s goal to develop one or two measures per grant program that are both output and outcome based. However, the associated activities and milestones listed in the plan do not reference specific grant programs or project details. As a result, it is unclear what grants, or what measures, are being addressed for each milestone. According to FEMA’s current implementation plan, all performance measures should have been implemented in December 2011; however, FEMA officials reported in December 2011 that outcome measures for the four programs had not yet been implemented. According to the Project Management Institute, best practices for project management call for a variety of inputs and outputs when developing a project schedule, including the basis for date estimates, a breakdown of the work to be conducted for each program, resource capabilities and availability, and external and internal dependencies. FEMA’s implementation plan does not contain this level of detail and as a result, it remains unclear what measures will be implemented for each grant program and when this implementation will occur. Establishing performance measures for these four programs is important given their relatively large size and scope. We recognize the difficulties inherent in developing outcome-based performance measures to assess the effectiveness of these grant programs. However, DHS should continue to work towards the development of these measures to improve its ability to assess the effectiveness of these grant programs. Until DHS does so it will be difficult for it to determine the extent to which its investment through these programs––$20.3 billion from 2002 through 2011—is effectively enhancing homeland security. A revised implementation plan that includes more specific project schedule information and accurate timelines for implementation could help guide efforts and keep the development of these measures on track for successful and timely implementation. Apart from developing performance measures for each grant program, DHS also has several initiatives under way to measure the collective effectiveness of its grant programs in achieving shared program goals, as shown in table 6 below. As shown above, FEMA’S efforts to measure the collective effectiveness of its grants programs are recent and ongoing and thus it is too soon to evaluate the extent to which these initiatives will provide FEMA with the information it needs to determine whether these grant programs are effectively improving the nation’s security. While each grant program strives to identify and mitigate security concerns within its specific authority, improving the nation’s overall preparedness is dependent upon collectively addressing capability and security gaps across all programs and authorities. Thus, it is important to evaluate effectiveness across the four grant programs to determine the extent to which the security of the nation as a whole has improved and to better ensure the effective use of scarce resources. From fiscal years 2002 through 2011, DHS has distributed about $20.3 billion through four homeland security preparedness grants that specifically target state, urban, port, and transit security. We recognize that even when programs overlap, they may have meaningful differences in their eligibility criteria or objectives, or they may provide similar types of services in different ways. However, because the four DHS programs in our review have similar goals, fund similar types of projects, and are awarded in many of the same urban areas, it will be important for FEMA to take additional measures to help ensure that the risk of duplication is mitigated. FEMA has delegated significant administrative duties to the SAA for the larger SHSP and UASI programs, and FEMA officials recognize the trade-off between decreased visibility over these grants and the reduced administrative burden on FEMA. However, the limited project-level information on how funds are being used and the lack of coordinated reviews of grant applications across programs, increases the risk that FEMA could fund duplicative projects. Additional action could help mitigate this risk. For example, as FEMA develops the ND Grants system, it will be important for the agency to ensure that information collected for all grant programs provides enough detail to allow for project comparisons in order to identify any unnecessary duplication. In addition, while some steps have been taken at the federal, state, and local levels to improve coordination in administering the four grant programs, additional actions could also help reduce the risk of duplication. For example, without a process to coordinate reviews across the four grant programs, FEMA lacks the information necessary to identify whether grant monies are being used for duplicative purposes, especially since all four grant programs are being reviewed separately, yet have similar allowable costs. Thus, to reduce the risk of duplication, FEMA could benefit from exploring opportunities to enhance its coordination of project reviews across grant programs. Additionally, since DHS’s existing output-based performance measures for the SHSP and UASI programs do not provide DHS with the information it needs to assess grant effectiveness and FEMA has not yet implemented outcome-based performance measures for any of the four programs, it will be difficult for FEMA to fully assess the effectiveness of these grant programs. Because the project plan FEMA has in place to guide its efforts to develop measures does not provide adequate information to determine what measures will be implemented for each grant program and when this implementation will occur, FEMA does not have reasonable assurance that these measures will be implemented in a timely way to help assess the programs’ effectiveness. We are making three recommendations for the four grant programs. Two actions are recommended to help reduce the risk of duplication by strengthening DHS’s administration and oversight of these programs, and one action is recommended to better assess the effectiveness of these programs. To better identify and reduce the risk of duplication through improved data collection and coordination, we recommend that the FEMA Administrator: take steps, when developing ND Grants and responding to the May 2011 FEMA report recommendations on data requirements, to ensure that FEMA collects project information with the level of detail needed to better position the agency to identify any potential unnecessary duplication within and across the four grant programs, weighing any additional costs of collecting these data; and explore opportunities to enhance FEMA’s internal coordination and administration of the programs in order to identify and mitigate the potential for any unnecessary duplication. To better assess the effectiveness of these programs, we recommend that the FEMA Administrator: revise the agency’s Performance Measure Implementation Plan to include more specific project schedule information and accurate timelines in order to guide the timely completion of ongoing efforts to develop and implement outcome-based performance measures for the SHSP, UASI, PSGP, and TSGP grant programs. We provided a draft of this report to DHS for comment. We received written comments on the draft report, which are reprinted in appendix II. DHS concurred with all three recommendations, and requested that the first two recommendations be considered resolved and closed. While we believe that DHS’s planned actions, if implemented, address the intent of each recommendation, it is too soon to close any recommendation as implemented. Specifically: DHS agreed with the recommendation that FEMA take steps to ensure that it collects sufficient project information to better identify any potential unnecessary duplication, and asked that, based on actions currently under way and other proposed changes, the recommendation be closed. DHS cited the elimination of seven programs in fiscal year 2012 and the proposed restructuring of most programs under a single National Preparedness Grant Program in fiscal year 2013 as steps to eliminate unnecessary duplication. DHS also cited modifying one reporting requirement in fiscal year 2012 to better capture program-specific performance measures. While we agree that program restructuring and the cited reporting requirement change could offer FEMA the opportunity to improve its grants data and thus its visibility across programs and projects, it is too soon to assess any positive impact, especially given that the outcome of the proposed fiscal year 2013 program restructuring is uncertain and is reliant on future congressional action. Furthermore, consolidating programs alone will not guarantee that the level of project-level detail collected by FEMA will be sufficient to identify unnecessary duplication of similar efforts in the same geographic areas. We will review the status of these efforts and additional supporting evidence in the future before closing this recommendation. DHS agreed with the recommendation that FEMA explore opportunities to enhance internal coordination and administration of the programs to identify and mitigate the potential for any unnecessary duplication, and asked that, based on ongoing actions and plans, the recommendation be closed. For example, DHS stated that FEMA officials participate in an Intra-agency Grants Task Force to provide strategic links among FEMA grant programs, as well as a DHS-level task force to improve grants management across the department. DHS also stated that FEMA has formal memoranda of understanding with partner agencies/offices related to various grants administration roles and responsibilities, and continues to develop additional formal agreements. We view these as positive steps in coordinating grants administration within DHS and FEMA. However, it is not clear at this time that the various groups or formal agreements have specifically addressed preventing potential unnecessary duplication across programs or projects, or that this is a goal of the initiatives. We will review the status of these efforts and additional supporting evidence in the future before closing this recommendation. DHS agreed with the recommendation to revise the agency’s Performance Measure Implementation Plan and stated that new performance measures and a plan for data collection are in draft form. DHS also stated it will provide an update to the plan when decisions are finalized, and that these decisions will be informed by the outcome of the agency’s proposed changes to the fiscal year 2013 grant programs. DHS also provided technical comments which we incorporated into the report where appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Homeland Security, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (201) 512-9627 or maurerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs can be found on the last page of this report. Key contributors to this report are listed in appendix III. Appendix I: FEMA Grants Portfolio SHSP, UASI, Metropolitan Medical Response System, Operation Stonegarden, and Citizen Corps Program collectively make up what FEMA terms the Homeland Security Grant Program. The 5 interconnected programs shared the same grant guidance in fiscal year 2011, but each program had a separate funding allocation. In addition to the contacts above, Dawn Hoff, Assistant Director, and Dan Klabunde, Analyst-in-Charge, managed this assignment. Chuck Bausell, Juli Digate, David Lutter, Sophia Payind, and Katy Trenholme made significant contributions to this report. David Alexander assisted with design, methodology, and data analysis. Linda Miller and Jessica Orr provided assistance with report development, Muriel Brown and Robert Robinson provided graphic support, and Tracey King provided legal assistance.

Summary: From fiscal years 2002 through 2011, the Department of Homeland Securitys (DHS) Federal Emergency Management Agency (FEMA) distributed approximately $20.3 billion to four grant programs: the State Homeland Security Program, Urban Areas Security Initiative, Port Security Grant Program, and Transit Security Grant Program. These programs are intended to enhance the capacity of state and local first responders to prevent, respond to, and recover from a terrorism incident. GAO was asked to evaluate the extent to which: (1) overlap and other factors among these programs could impact the risk of duplication; (2) mechanisms exist that enhance coordination and reduce the risk of duplication and how they are being implemented; and (3) DHS has implemented performance measures to evaluate the effectiveness of these programs. To address these objectives, GAO reviewed grant guidance and funding allocation methodologies. GAO also interviewed DHS officials, and grant administrators in five urban areasselected because they receive funding from all four grant programs in this reviewabout grant processes and program challenges, among other things. Multiple factors contribute to the risk of duplication among four FEMA grant programs that GAO studiedthe State Homeland Security Program (SHSP), Urban Areas Security Initiative (UASI), Port Security Grant Program, and Transit Security Grant Program. Specifically, these programs share similar goals, fund similar projects, and provide funds in the same geographic regions. Further, DHSs ability to track grant funding, specific funding recipients, and funding purposes varies among the programs, giving FEMA less visibility over some grant programs. Finally, DHSs award process for some programs bases decisions on high-level, rather than specific, project information. Although GAOs analysis identified no cases of duplication among a sample of grant projects, the above factors collectively put FEMA at risk of funding duplicative projects. FEMA officials stated that there is a trade-off between enhancing management visibility and reducing administrative burden, but also recogized that FEMA should use more specific project-level information for award decisions and have taken initial steps towards this goal. For example, FEMA is considering how to better use existing grant information and has also begun to phase in a grants management system that includes an explicit goal of collecting project-level information. However, FEMA has not determined all of its specific data requirements. As FEMA determines these requirements, it will be important to collect the level of information needed to compare projects across grant programs. Given the limitations in currently collected information, FEMA would benefit from collecting information with greater detail as this could help FEMA better position itself to assess applications and ensure that it is using its resources effectively. FEMA, as well as state and local stakeholders, have taken steps to improve coordination in administering the four programs, but FEMA could take further action. For example, FEMA does not internally coordinate application reviews across the four programs. Specifically, the programs are managed by two separate FEMA divisions which review grant applications for each program separately and there is no process in place to ensure that application information is shared among the programs during this process. Thus, it is difficult for FEMA to identify whether grant monies are being used for the same or similar purposes. FEMA could benefit from further examining its internal grant coordination process, while considering the large volume of grant applications it must process. FEMA introduced some performance measures for the UASI and SHSP programs in 2011 that add value, but these measures do not assess program effectiveness. FEMA has efforts under way to develop outcome measuresthat will focus on program effectivenessfor each of the four grant programs in this review, but has not completed these efforts. Further, the FEMA project plan that guides these efforts does not provide information on what measures will be implemented for each grant program and when this will occur. A revised project plan that includes more specific schedule information and accurate implementation timelines could help guide these efforts. DHS also has several efforts under way to measure the collective effectiveness of its grant programs in achieving shared program goals, but these efforts are recent and ongoing. Thus, it is too soon to evaluate the extent to which these initiatives will provide FEMA with the information it needs to determine whether these grant programs are effectively improving the nations security. GAO recommends that DHS: (1) collect project information with the level of detail needed to identify any unnecessary duplication; (2) explore opportunities for enhanced internal coordination in grant administration; and (3) revise its plan to ensure the timely implementation of performance measures to assess the effectiveness of these grants. DHS concurred with all recommendations.