Risk management has been endorsed by the Congress, the President, and Secretary of DHS as a way to direct finite resources to those areas that are most at risk of terrorist attack under conditions of uncertainty. The purpose of risk management is not to eliminate all risks, as that is an impossible task. Rather, given limited resources, risk management is a structured means of making informed trade-offs and choices about how to use available resources effectively and monitoring the effect of those choices. Thus, risk management is a continuous process that includes the assessment of threats, vulnerabilities, and consequences to determine what actions should be taken to reduce or eliminate one or more of these elements of risk. Risk management includes a feedback loop that continually incorporates new information, such as changing threats or the effect of actions taken to reduce or eliminate identified threats, vulnerabilities, and/or consequences. Because we have imperfect information for assessing risks, there is a degree of uncertainty in the information used for risk assessments (e.g., what the threats are and how likely they are to be realized). As a result, it is inevitable that assumptions and policy judgments must be used in risk analysis and management. It is important that key decision makers understand the basis for those assumptions and policy judgments and their effect on the results of the risk analysis and the resource decisions based on that analysis. Since fiscal year 2006, DHS has applied a three-step process which incorporates analyses of risk and effectiveness, to select eligible urban areas and allocate UASI and SHSP funds (see fig. 1): 1. Implementation of a risk analysis model to calculate scores for states and urban areas, defining relative Risk, as the product of Threat, Vulnerability, and Consequences. 2. Implementation of an effectiveness assessment, including a peer review process, to assess and score the effectiveness of the proposed investments submitted by the eligible applicants. 3. Calculation of a final allocation of funds based on states’ and urban areas’ risk scores as adjusted by their effectiveness scores. As a result of the Post-Katrina Emergency Reform Act, FEMA is now responsible for the nation’s homeland security preparedness effort to define what needs to be done, where, and by whom (roles and responsibilities); how it should be done; and how well it should be done— that is, according to what standards. This is a complex but critically important responsibility. The principal national documents designed to address each of these are, respectively, the National Response Framework (and its associated annexes), the National Incident Management System, and the National Preparedness Guidelines. To develop preparedness goals and determine the tasks and capabilities needed by first responders on a nationwide basis, DHS used an approach known as capabilities-based planning to develop the national Target Capabilities List. The list includes specific goals, requirements, and metrics for 36 capabilities needed at the local, state, or federal level to prepare for, respond to, and recover from natural or man-made disasters. DHS defined these capabilities generically and expressed them in terms of desired operational outcomes and essential characteristics, rather than dictating specific, quantifiable responsibilities to the various jurisdictions. Because no single jurisdiction or agency would be expected to perform every task, possession of a target capability could involve enhancing and maintaining local resources, ensuring access to regional and federal resources, or some combination of the two. The original list has since been refined, and FEMA released the most recent version of the list, with 37 capabilities, in September 2007. The Implementing Recommendations of the 9/11 Commission Act (9/11 Act) of 2007 further defined FEMA’s role and coordination processes for working with states and urban areas in awarding homeland security grants. For example, the 9/11 Act requires FEMA to provide eligible metropolitan areas with the opportunity to submit relevant information prior to FEMA’s initial assessment of the relative threat, vulnerability, and consequences each area faces from acts of terrorism. This opportunity is to allow potential grantees to correct any erroneous or incomplete information that will be the basis of FEMA’s initial assessment. DHS has used an evolving risk-based methodology to identify the states and urban areas eligible for HSGP grants and the amount of funds they receive. For example, the fiscal year 2005 risk analysis model largely relied on measures of population and population density to determine the relative risk of potential grant recipients. The fiscal year 2006 process introduced assessments of threat, vulnerability and consequences of a terrorist attack in assessing risk. The fiscal year 2006 risk analysis model estimated relative risk from two perspectives—asset-based and geographic—then combined the assessments, assigning twice as much weight to geographic as asset-based risk. In DHS’s view, asset-based and geographic risks are complementary and provide a “micro- and macro-” perspective of risk, respectively. In calculating these relative risk scores and addressing the uncertainties in estimating relative risk, policy and analytic judgments were required. For example, according to DHS officials, DHS made the judgment to assign geographic risk a weight of 1.0 and asset-based risk a weight of 0.5, since a potential loss of lives within an area would contribute to how geographic risk is assessed. Some of the factors used in the fiscal year 2006 risk analysis model included: the number of specific types of reports or events, such as reports of suspicious incidents; the number of visitors a state or urban area received from countries of interest; and population. In addition to modifications to DHS’s risk analysis model, DHS adopted an effectiveness assessment for fiscal year 2006 to determine the anticipated effectiveness of the various risk mitigation investments urban areas proposed, which affected the final amount of funds awarded to eligible areas. The risk analysis method for fiscal year 2007—which is largely unchanged for fiscal year 2008, according to our ongoing work—was changed substantially from the fiscal year 2006 process, and further exemplifies the continuing evolution in DHS’s approach to its risk methodology for grant allocation. Given the uncertainties inherent in risk assessment, the methodology uses a combination of empirical data (e.g., population, asset location) and policy judgment (e.g., the nature of the threat for specific areas and the weights to be assigned to specific variables in the model such as critical infrastructure, and population and population density). According to DHS officials, the fiscal year 2007 risk analysis model integrates the separate analyses for asset-based and geographic-based risk used in fiscal year 2006, and includes more sensitivity analysis in determining what the final results of its risk analysis should be. DHS officials said the primary goal was to make the process more transparent and more easily understood, focusing on key variables and incorporating comments from a variety of stakeholders regarding the fiscal year 2006 process. Figure 2 provides an overview of the factors included in the risk analysis model for fiscal year 2007 and, according to our ongoing work, for fiscal year 2008 and their relative weights. The maximum relative risk score possible for a given area was 100. The Threat Index accounted for 20 percent of the total risk score; Vulnerability and Consequences accounted for 80 percent. For the purposes of the model, DHS considered all areas of the nation equally vulnerable to attack and assigned every state and urban area a vulnerability score of 1.0. Thus, as a practical matter, the final risk score for fiscal years 2007 and 2008 is determined by the threat and consequences scores. Threat: The Threat Index accounted for 20 percent of the total risk score, which was calculated by the intelligence community by assessing threat information for multiple years (generally, from 9/11 forward) for all candidate urban areas and categorizing urban areas into one of four tiers. Tier I included those at highest threat, relative to the other areas, and tier IV included those at lowest threat relative to the others. DHS’s Office of Intelligence and Analysis performed this review and provided these threat assessments and corresponding threat values for each urban area. In contrast, for the 2006 grant cycle, DHS used total counts of threats and suspicious incidents and incorporated these into its model. The final threat assessments are approved by the intelligence community—the Federal Bureau of Investigation, Central Intelligence Agency, National Counter- Terrorism Center, and the Defense Intelligence Agency—along with the DHS Under Secretary for Intelligence & Analysis and the Secretary of DHS, according to DHS officials. Vulnerability and Consequences: Vulnerability and Consequences accounted for 80 percent of the total risk score and were represented by the following four indices: Population Index (40 percent): This variable included nighttime population and military dependant populations for states and urban areas, based upon U.S. Census Bureau and Department of Defense inputs. In addition, for urban areas, population density, commuters, and visitors were also factored into this variable, using data from private entities. Economic Index (20 percent): This variable considered the economic value of the goods and services produced in either a state or an urban area. For states, this index was calculated using U.S. Department of Commerce data on their percentage contribution to Gross Domestic Product. For UASI urban areas, a parallel calculation of Gross Metropolitan Product was incorporated. National Infrastructure Index (15 percent): This variable focused on over 2,000 Tier I and Tier II critical infrastructure/key resource assets that were identified by DHS’s Office of Infrastructure Protection. Tier I assets or systems are those that if attacked could trigger major national or regional impacts similar to those experienced during Hurricane Katrina or 9/11. Tier II assets are other highly consequential assets with potential national or regional impacts if attacked. National Security Index (5 percent): This variable considered the presence of three key national security factors: whether military bases are present in the state or urban area; how many critical defense industrial base facilities are located in the state or urban area; and the total number of people traversing international borders. Information on these inputs comes from the Department of Defense and DHS. To assess vulnerability and consequences, DHS specifically wanted to capture key land and sea ports of entry into the United States and the location of defense industrial base facilities and nationally critical infrastructure facilities. For fiscal year 2007 and, according to our ongoing work, for fiscal year 2008, DHS considered most areas of the country equally vulnerable to a terrorist attack, given freedom of movement within the nation; and focused on the seriousness of the consequences of a successful terrorist attack. Nationwide more than 2,000 critical infrastructure assets were included in the risk model and selected on the basis of analysis by DHS infrastructure protection analysts, sector- specific federal agencies, and the states. According to DHS, these critical infrastructure assets were grouped into two tiers: Tier 1 assets encompassed those that if attacked could cause major national or regional impacts similar to those from Hurricane Katrina or 9/11, while Tier 2 assets were those with potential national or regional impacts if attacked. On the basis of DHS’s Office of Infrastructure Protection analysis, Tier I assets were weighted using an average value three times as great as Tier II assets. According to DHS officials, defense industrial base assets were included in the national security index and all other assets in the national infrastructure index. Effectiveness Assessment Used to Adjust Risk Scores Since fiscal year 2006, DHS has also implemented an Effectiveness Assessment to assess and score the effectiveness of the proposed investments submitted by grant applicants in addition to determining relative risk using the risk analysis model. This effectiveness assessment process has remained largely unchanged since it was first introduced by DHS. To assess the anticipated effectiveness of the various risk mitigation investments that states and urban areas proposed, DHS required states and urban areas to submit investment justifications as part of their grant application. The investment justifications included up to 15 “investments” or proposed solutions to address homeland security needs, which were identified by the states and urban areas through their strategic planning process. DHS used subject-matter experts as peer reviewers to assess these investment justifications. The criteria reviewers used to score the investment justifications included the following categories: relevance to the National Preparedness Guidance and to state and local homeland security plans, anticipated impact, sustainability, regionalism, and the implementation of each proposed investment. Reviewers on each panel assigned scores for these investment justifications, which according to DHS officials were averaged to determine a final effectiveness score for each state and urban area applicant. DHS then used these effectiveness assessment scores to calculate the final allocation of funds to states and urban areas. According to DHS officials and HSGP grant assistance documents we reviewed, DHS communicates with its state and local stakeholders by: (1) providing to each state and urban area the individual threat assessments that DHS is using to calculate the risk analysis model’s Threat Index; (2) validating the nonpublic, critical infrastructure assets that comprise the risk analysis model’s National Infrastructure Index; (3) providing midpoint reviews of states’ and urban areas’ draft investment justification proposals that are later reviewed during DHS’s effectiveness assessment process; (4) providing technical assistance as states and urban areas prepare the documentation for their grant applications; and (5) convening conferences to solicit stakeholder feedback. DHS provides threat assessments for state and urban areas. DHS’s Office of Intelligence and Analysis (I&A) officials said they develop and provide threat assessments to the states’ and urban areas’ grant applicants prior to the grant application process for their review. State and urban area strategic planning and grant planning officials use this information to develop their grant investment justifications, according to DHS officials. I&A officials said they provide secret and nonsecret versions of the information so that state or urban area officials who do not have the appropriate clearances required to view the secret version of their threat assessments will still have access to some of the threat information. They said they are working with local law enforcement agencies on a way to address such clearance issues. DHS validates the nonpublic, critical infrastructure assets used in the risk analysis model. DHS officials also said that the agency uses a collaborative, multistep process to create a list of national critical infrastructure assets for use in the National Infrastructure Index, one of the four indices that comprise the Vulnerability and Consequences component of the risk analysis model. According to DHS officials, they use a step-by-step process to identify the nation’s Tier 1 and Tier 2 critical infrastructure assets. First, DHS’s Office of Infrastructure Protection (OIP) works with sector-specific agencies to develop criteria used to determine which assets should be placed in a threat tier. Second, private-sector companies vet the criteria through sector-specific councils that review the criteria and provide feedback to DHS OIP. Third, the infrastructure office finalizes the criteria list and provides the list to the sector-specific agencies and asks states to nominate assets within their jurisdictions that match the criteria. Finally, the infrastructure office and the sector-specific agencies review nominated assets to decide which assets comprise the final Tier 1/Tier 2 list. In 2007, DHS began to allow sector-specific agencies to resubmit for reconsideration assets that are not initially selected for the list to ensure the consideration of potential critical infrastructure assets in future years. Enacted in August 2007, the 9/11 Act required DHS to provide eligible metropolitan areas with the opportunity to submit information that they believe to be relevant to the determination of the threat, vulnerability, and consequences they face from acts of terrorism, prior to FEMA conducting each initial assessment, so that any erroneous or incomplete information can be corrected. According to FEMA officials, DHS implemented this provision mainly through the outreach and communication efforts described above. DHS provides midpoint reviews of states’ and urban areas’ investment proposals. FEMA officials said that, for the fiscal year 2007 effectiveness assessment process, DHS offered a midpoint technical review of states’ and urban areas’ draft 2007 Investment Justifications prior to the formal submission of these proposals to FEMA’s peer review process. DHS officials said that they performed an after-action analysis of this effort and found states and urban areas that made use of the midpoint reviews had effectiveness scores that on average were 6 percent higher than those for states and urban areas that did not take advantage of this DHS service. DHS provides technical assistance as states and urban areas prepare investment documentation. DHS also provides Program Management Technical Assistance, and Investment Planning Technical Assistance workshops to assist states and urban areas. For example, the Program Management Technical Assistance service is designed to help the State Administrative Agency with day-to-day program management in planning, managing, and evaluating state programs in the context of the National Preparedness Guidance, according to DHS. They said Program Management Technical Assistance helps state administrators use DHS’s Program Management Handbook to manage programs that span agencies, jurisdictions, and disciplines, including the private sector. DHS also offers guidance on how to enhance existing state and urban area Homeland Security Strategies and Enhancement Plans. DHS convenes conferences to solicit stakeholder feedback. Finally, DHS has convened conferences in an effort to solicit stakeholder feedback after the fiscal years 2006 and 2007 grants were awarded. In July 2006, DHS convened a Homeland Security Grant Program After-Action conference to gather feedback on the UASI grant award process. DHS also assembled working groups to discuss and assess homeland security planning, the HSGP guidance and application, the risk assessment, and the effectiveness assessment. DHS officials told us that the conference provided a feedback loop intended to bolster stakeholder support and promote transparency. The state and local partners who participated in the working groups at the conference developed 32 recommendations to improve the HSGP process. For example, one of the risk assessment working group’s recommendations was that DHS should provide detailed briefings to state and local partners on the core components of the risk methodology used in the fiscal year 2006 process as one step to improve the transparency of the risk analysis process. DHS also convened a similar after-action conference in early August 2007 to solicit stakeholder feedback on the fiscal year 2007 HSGP and hosted three regional conferences in the fall of 2007 to foster collaboration among regional partners and seek additional feedback. From fiscal years 2002 through 2007, DHS obligated about $19.6 billion in grants, the purpose of which was to strengthen the capabilities of state, local, and tribal governments and others to prepare for and respond to major disasters of any type or cause. About $7 billion of this total was unexpended as of January 2008. As might be expected, the more recent the fiscal year, the higher the unexpended balance (see fig. 3). For example, the Homeland Security and UASI grant awards are announced in May or June of each year—or about 3 to 4 months before the end of the fiscal year. The awards for fiscal year 2007 were announced in May 2007. Thus, one would expect large unexpended balances for the most recent fiscal year because the grant recipients would have had only a few months to use their funds prior to the end of the fiscal year. In 2005, we reported on DHS’s efforts to distribute grants and found that the Congress, DHS, states, and localities had acted to expedite grant awards and distribution by setting time limits for the grant application, award, and distribution processes and by instituting other procedures. We concluded that the ability of states and localities to spend grant funds expeditiously was complicated by the need to fulfill state and local legal and procurement requirements, which in some cases added months to the purchasing process. We also reported that some states had modified their procurement practices and DHS was identifying best practices to aid in the effort, but challenges remained, such as continuing legal and procurement requirements that slowed the process. For example, once the grant funds are awarded to the states and then subgranted to the local jurisdictions or urban areas, certain legal and procurement requirements may have to be met, such as a city council’s approval to accept grant awards. Or, if the state legislature must approve how the grant funds will be expended and is not in session when the grant funds are awarded, it could take as long as 4 months to obtain state approval to spend the funds. We reported a variety of steps that had been taken by states, DHS, and the Congress to streamline the expenditure of grant funds. For example: Some states, in conjunction with DHS, had modified their procurement practices to expedite the procurement of equipment and services by establishing centralized purchasing systems that allow equipment and services to be purchased by the state on behalf of local jurisdictions, freeing them from some local legal and procurement requirements. Several states had developed statewide procurement contracts that allow local jurisdictions to buy equipment and services using a prenegotiated state contract. DHS had enhanced equipment procurement options through agreements with the U.S. Department of Defense’s Defense Logistics Agency and the Marine Corps Systems Command, to allow state and local jurisdictions to purchase equipment directly from their prime vendors. These agreements provide an alternative to state and local procurement processes and, according to DHS, often result in a more rapid product delivery at a lower cost. The fiscal year 2005 DHS appropriations legislation included a provision that exempted formula-based grants (e.g., the State Homeland Security Grant Program grants) and discretionary grants, including the Urban Areas Security Initiative and other grants, from requirements in the Cash Management Improvement Act that provide for reimbursement to states and localities only after they have incurred an obligation, such as a purchase order, to pay for goods and services. Subsequent DHS guidance allowed states and localities to draw down funds up to 120 days prior to expenditure. We do not know the extent to which the actions that states and localities have taken to address the obstacles that affected their ability to use funds expeditiously (but effectively) have succeeded. We were unable to examine trends in expended and unexpended obligations for individual grants across fiscal years due to limitations in the budget data provided by FEMA for this hearing. For example, we were unable to track HSGP funding data across multiple fiscal years, such as the amount of fiscal year 2005 funds that were expended in fiscal years 2005, 2006, and 2007. In addition, we found that reporting categories were not consistent across fiscal years. Grant program data were collapsed in one fiscal year and compiled differently in another year. According to one DHS official, while the consolidation of all DHS grant programs into FEMA provides FEMA with an opportunity to standardize and enhance its management of grant allocation and distribution, this administrative transition has also resulted in some reorganization of accounting functions, and institutionalizing the maintenance of grant funding data is still being addressed at this time. Whatever the cause, the inconsistency in reporting on grant expenditures across fiscal years could hinder FEMA’s ability to provide the Congress with information on trends in expenditures over time for specific grants. As part of our ongoing work in reviewing DHS grant allocation and management efforts, we plan to determine whether the data FEMA maintains on grant expenditures across fiscal years allows FEMA to analyze trends in grant obligations and expenditures. While DHS has distributed over $19 billion in federal emergency preparedness funding to states, localities, and territories since fiscal year 2002, and taken steps to gather information, establish goals and measures, and measure progress, we still know little about how states have used federal funds to build their capabilities or reduce risks. Nor do we know how effective this national investment has been because DHS’s monitoring of homeland security grant expenditures does not provide a means to measure the achievement of desired program outcomes to strengthen the nation’s homeland security capabilities. In March 2007, we testified before this Committee that a comprehensive and in-depth oversight agenda requires assessing state and local capabilities and the use of federal grants in building and sustaining those capabilities. However, all levels of government are still struggling to define and act on the answers to basic— but hardly simple—questions about emergency preparedness and response: What is important (that is, what are our priorities)? How do we know what is important (e.g., risk assessments, performance standards)? How do we measure, attain, and sustain success? On what basis do we make necessary trade-offs, given finite resources? DHS has limited information on which to base the answers to these questions. We have identified the need for such capabilities-based assessment and reporting of the effectiveness of federal grant investments in several DHS grant programs. For example, in our review of cargo tanker emergency response in December 2007, we recommended that the Secretary of Homeland Security work with federal, state, and local stakeholders to develop explicit performance measures for emergency response capabilities and use them in risk-based analyses to set priorities for DHS grant programs in acquiring needed response resources. DHS responded that it was taking the recommendation under advisement and was exploring approaches to address our recommendation. Similarly, in our review of DHS’s efforts to improve interoperable communications in April 2007, we reported that no process has been established for ensuring that states’ grant requests are consistent with their statewide plans and long- term objectives for improving interoperability. We recommended that DHS assess how states’ grant requests support their statewide communications plans and include the assessment as a factor in making DHS grant allocation decisions. Although DHS did not comment on this recommendation at the time, in August 2007 DHS officials told us they were working to ensure that all grant funding is tied to statewide interoperable communications plans. In a May 2007 testimony, we noted that more immediate congressional attention might focus on evaluating the construction and effectiveness of the National Preparedness System, which is mandated under the Post- Katrina Reform Act. DHS has taken steps to develop and issue key components of the system, including a national domestic all-hazards preparedness goal and readiness metrics and standards for preparedness in the form of target capabilities. Specifically, in September 2007, DHS issued a goal for national preparedness, now referred to as the National Preparedness Guidelines. According to DHS, the guidelines establish “a vision for national preparedness and provide a systematic approach for prioritizing preparedness efforts across the Nation,” and generally define a goal for the National Preparedness system. The guidelines are based on a capability-based planning process that identified target capabilities that are to be then used to establish measures for preparedness. According to DHS officials, one way DHS is attempting to monitor the development of emergency preparedness capabilities is through the Effectiveness Assessment described above, that began as part of DHS’s fiscal year 2006 HSPG grant guidance. According to program requirements, eligible recipients must provide an “investment justification” with their grant application that links their investments to the initiatives outlined in their state’s Program and Capability Enhancement Plan. DHS officials have said that they cannot yet assess how effective the actual investments from grant funds are in enhancing preparedness and mitigating risk because they do not yet have the metrics to do so and there is insufficient historical information from the grant monitoring process to assess the extent to which states and urban areas are building capabilities. The Post-Katrina Reform Act established a requirement to create another source of information on state capabilities. The act calls for an annual preparedness report from all states by January 4, 2008, and annually thereafter, but FEMA has extended the deadline for this requirement. In December 2007, FEMA extended the State Preparedness Report deadline from January 4 to March 31, 2008 and requested that each state administrative agency submit a brief letter providing a status update on its State Preparedness Report by early this year. The state reports are to include assessments of: State compliance with the national preparedness system, the National Response Framework, the National Incident Management System, and other related plans and strategies. Current capability levels and a description of target capability levels. Resource needs to meet the preparedness priorities established in conjunction with the Target Capabilities List, including (1) an estimate of the amount of expenditure required to attain the preparedness priorities, and (2) the extent to which the use of federal assistance during the preceding fiscal year achieved the preparedness priorities. Beginning in October 2007, DHS is also responsible for an annual federal preparedness report that is to include, among other things, an assessment of the extent to which the use of federal assistance during the preceding fiscal year achieved the preparedness priorities established under the act. Since 2005, DHS has produced an Annual Report on Preparedness Funding, which includes data on the obligation, expenditure status, and use of funds for all major federal preparedness grants—including non-DHS grants—awarded to states, localities, and other nonfederal entities. According to DHS, this effort is designed to provide decision makers with critical preparedness funding information as they determine how to best allocate resources to achieve target levels of capability to prevent, prepare, respond to, and recover from major events, especially terrorism. However, the report notes the information is of limited usefulness because federal departments and agencies interpret and define the terms obligation, expenditure status, and use of funds differently. The report provides a national-level summary of the use of grant funds such as equipment or training, rather than an assessment of state capability enhancements provided as a result of federal grant funding. According to DHS, subsequent reports may provide more detailed analysis and findings, as consistent procedures and definitions are implemented across grant programs and departments. The task of enhancing first responder capabilities across the nation is a complex and daunting one. DHS must continue to support FEMA’s efforts to work with state, local, and tribal governments, and the private sector on the tasks it has begun. At the same time, these stakeholders must recognize that the process is iterative, will include periodic adjustments and refinements, and that risks are not equally distributed across the nation. As the principal federal agency now responsible for preparedness and response, FEMA has a unique opportunity to evaluate how it can most effectively target and integrate grants with its other efforts to enhance the nation’s all-hazard disaster preparedness and response system. This can best be done by viewing these grants collectively, rather than individually. It is also important that FEMA and grant recipients be able to assess and report on how the grants have been used to enhance emergency preparedness and response capabilities and reduce risk. We look forward to working constructively with this Committee, FEMA, and DHS in the future to continue to build a national emergency preparedness system that we all want and our nation deserves. Mr. Chairman, this concludes my statement. I would be pleased to answer any questions that you or other members of the Subcommittees may have at this time. For further information about this statement, please contact William O. Jenkins Jr., Director, Homeland Security and Justice Issues, on (202) 512- 8777 or jenkinswo@gao.gov. In addition to the contact named above, the following individuals from GAO’s Homeland Security and Justice Team also made major contributors to this testimony: Chris Keisling, Assistant Director; John Vocino, Analyst- in-Charge; Michael Blinde, Analyst; and Linda Miller, Communications Analyst. Department of Homeland Security: Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington, D.C.: August 17, 2007. Homeland Security: Observations on DHS and FEMA Efforts to Prepare for and Respond to Major and Catastrophic Disasters and Address Related Recommendations and Legislation. GAO-07-1142T. Washington, D.C.: July 31, 2007. Homeland Security: Observations on DHS and FEMA Efforts to Prepare for and Respond to Major and Catastrophic Disasters and Address Related Recommendations and Legislation, GAO-07-835T Washington, D.C.: May 15, 2007. Homeland Security: Observations on DHS and FEMA Efforts to Prepare for and Respond to Major and Catastrophic Disasters and Address Related Recommendations and Legislation. GAO-07-835T. Washington, D.C.: May 15, 2007. First Responders: Much Work Remains to Improve Communications Interoperability, GAO-07-301 Washington, D.C.: Apr. 2, 2007. Homeland Security: Preparing for and Responding to Disasters. GAO-07- 395T. Washington, D.C.: March 9, 2007. Passenger Rail Security: Federal Strategy and Enhanced Coordination Needed to Prioritize and Guide Security Efforts. GAO-07-583T. Washington, D.C.: March 7, 2007. Homeland Security: Applying Risk Management Principles to Guide Federal Investments. GAO-07-386T. Washington, D.C.: February 7, 2007. Homeland Security Grants: Observations on Process DHS Used to Allocate Funds to Selected Urban Areas. GAO-07-381R. Washington, D.C.: February 7, 2007. Homeland Security First Responder Grants: Cash Management Improvement Act Exemption and Cash Advance Funding Require Additional DHS Oversight. GAO-07-68. Washington, D.C.: December 22, 2006. Emergency Preparedness and Response: Some Issues and Challenges Associated with Major Emergency Incidents. GAO-06-467T. Washington, D.C.: February 23, 2006. Homeland Security: Managing First Responder Grants to Enhance Emergency Preparedness in the National Capital Region. GAO-05-889T. Washington, D.C.: July 14, 2005. Homeland Security: DHS’ Efforts to Enhance First Responders’ All- Hazards Capabilities Continue to Evolve. GAO-05-652. Washington, D.C.: July 11, 2005. Homeland Security: Management of First Responder Grant Programs and Efforts to Improve Accountability Continue to Evolve. GAO-05-530T . Washington, D.C.: April 12, 2005. Homeland Security: Management of First Responder Grant Programs Has Improved, but Challenges Remain. GAO-05-121. Washington, D.C.: February 2, 2005. Homeland Security: Effective Regional Coordination Can Enhance Emergency Preparedness. GAO-04-1009. Washington, D.C.: September 15, 2004. Homeland Security: Federal Leadership Needed to Facilitate Interoperable Communications Between First Responders. GAO-04-1057T . Washington, D.C.: September 8, 2004. Homeland Security: Coordinated Planning and Standards Needed to Better Manage First Responder Grants in the National Capital Region. GAO-04- 904T. Washington, D.C.: June 24, 2004. Homeland Security: Management of First Responder Grants in the National Capital Region Reflects the Need for Coordinated Planning and Performance Goals. GAO-04-433. Washington, D.C.: May 28, 2004. Emergency Preparedness: Federal Funds for First Responders. GAO-04- 788T. Washington, D.C.: May 13, 2004. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Since 2002, the Department of Homeland Security (DHS) has distributed over $19 billion in homeland security grants to enhance the nation's preparedness and response capabilities. The Federal Emergency Management Agency (FEMA) is responsible for all preparedness efforts including allocating and managing these grants. This testimony examines (1) the process and methods to allocate homeland security grants to state and local governments, (2) how DHS communicates with states and localities in making grant allocation decisions, (3) what challenges affect the expeditious spending of DHS grant funds by states and localities; and (4) the extent that DHS measured program outcomes as part of its efforts to monitor the expenditure of grant dollars. GAO's testimony is based on products issued from April 2005 through July 2007 on DHS's grant management system, and on GAO's ongoing mandated work related to FEMA's risk-based grant distribution processes for fiscal years 2007 and 2008. To conduct this work, GAO reviewed relevant documents on FEMA's risk analysis model and interviewed agency officials. DHS uses an evolving risk-based methodology to identify the urban areas eligible for homeland security grants and the amount of funds states and urban areas receive. DHS designed the methodology to measure the relative risk of a given state or urban area using a risk analysis model that defined Risk as the product of Threat times Vulnerability and Consequences (R = T * (V & C)). Given the uncertainties inherent in risk assessment, the methodology uses a combination of empirical data (e.g., population, asset location) and policy judgment (e.g., the nature of the threat for specific areas and the weights to be assigned to specific variables in the model such as critical infrastructure, population, and population density). According to FEMA officials and GAO's review of homeland security grant assistance documents, FEMA communicates with its state and local stakeholders by (1) providing individual threat assessments that DHS is using for its risk analysis model to each state and urban area, (2) validating the nonpublic national infrastructure data that are also part of the risk analysis model, (3) reviewing states' and urban areas' draft investment proposals that are later submitted and rated during DHS's effectiveness assessment process, (4) providing technical assistance as states and urban areas prepare grant applications, and (5) holding post-award conferences to solicit stakeholder feedback. In April 2005, GAO reported that the ability of states and localities to spend grant funds expeditiously was complicated by the need to fulfill legal and procurement requirements, which in some cases added months to the purchasing process. GAO also reported a variety of steps that had been taken by states, DHS, and the Congress to streamline the expenditure of grant funds. However, GAO was unable to examine trends in obligations and expenditures for grant programs across fiscal years because the budget data FEMA provided did not specify grant expenditures by fiscal year and reporting categories were not consistent across fiscal years. Although DHS has taken some steps to establish goals, gather information, and measure progress, its monitoring of homeland security grant expenditures does not provide a means to measure the achievement of desired program outcomes. FEMA's current efforts do not provide information on the effectiveness of those funds in improving the nation's capabilities or reducing risk. DHS leadership has identified this issue as a high priority, and is trying to develop a more quantitative approach to accomplish the goal of using this information for the more strategic purpose of monitoring the achievement of program goals, according to FEMA officials.