The United States has approximately 360 commercial sea and river ports. While no two ports in the United States are exactly alike, many share certain characteristics that make them vulnerable to terrorist attacks: they are sprawling, easily accessible by water and land, close to crowded metropolitan areas, and interwoven with complex transportation networks designed to move cargo and commerce as quickly as possible (see fig 1). They contain not only terminals where goods bound for import or export are unloaded or loaded onto vessels, but also other facilities critical to the nation’s economy, such as refineries, factories, and power plants. To reduce the opportunity for terrorists to exploit port vulnerabilities, port stakeholders are taking mitigation steps. For example, port stakeholders have installed fences, hired security guards, and purchased cameras to reduce the potential for unauthorized entry and help prevent vulnerabilities from being exploited. To help defray some of the costs of implementing security at ports around the United States, the PSGP was established in January 2002 when the Transportation Security Administration (TSA) was appropriated $93.3 million to award grants to critical national seaports. In November 2002, the Maritime Transportation Security Act (MTSA), which codified the program, was enacted. Since the supplemental appropriations act for fiscal year 2002, the appropriations acts have provided annual appropriations for the PSGP. FEMA is responsible for designing and operating the administrative mechanisms needed to implement and manage the grant program. The Coast Guard—which is generally the lead federal agency for port security—provides subject matter expertise for the maritime industry and participates in project award decisions. From fiscal year 2002 through fiscal year 2011, nearly $2.5 billion has been allocated to the PSGP, as shown in table 1. In recent years, we, the Congress, the President, the Secretary of Homeland Security, and others have endorsed risk management as a way to direct finite resources to areas that are most at risk of terrorist attack. Risk management is a continuous process that includes the assessment of threats, vulnerabilities, and consequences to determine what actions should be taken to reduce one or more of these elements of risk. One way in which DHS has applied risk management principles to the PSGP is through the use of a risk model to assess the relative risk posed to ports throughout the nation and to help determine PSGP eligibility and funding levels. The PSGP risk methodology is similar to the methodology used to determine funding eligibility for other DHS state and local grant programs. The model consists of three variables: threat (the relative likelihood of an attack occurring), vulnerability (the relative exposure to an attack), and consequence (the relative expected impact of an attack). Data for each of these variables are collected from offices and components throughout DHS, as well as from other data sources, and then, using the model, each port is ranked against one another and assigned a relative risk score. At the recommendation of the Coast Guard, DHS considers some ports as a single cluster—known as a port area—due to geographic proximity, shared risk, and a common waterway. Based on risk, each port area is placed into one of three funding groups— Ports not identified in Group I, II, or III are Group I, Group II, or Group III.eligible to apply for funding as part of the “All Other Port Areas” Group.Figure 2 below shows the location of port areas for groups I and II—the two highest risk groups that receive the bulk of grant funding. To promote a regional approach to risk management in the highest risk port areas, FEMA required—beginning with the fiscal year 2007 supplemental guidance—that all Group I and II port areas—the highest risk port areas—develop and implement a Portwide Risk Mitigation Plan (PRMP). The primary goal of a PRMP is to provide a port area with a mechanism for considering its entire port system strategically as a whole, and to identify and execute a series of actions designed to effectively mitigate risks to the system’s maritime critical infrastructure. DHS creates PSGP grant guidance annually which provides the funding amounts for each group, eligible applicants, and the application materials for funding under the program. As shown in figure 3, there are three stages of the PSGP grant cycle: allocation, award, and distribution. Each port area’s allocation is driven by the results of the PSGP risk analysis model. However, the allocation process varies among groups as described below. Groups I and II: The risk model determines the port areas at high risk of a terrorist attack and DHS places them in either Group I (highest risk group) or Group II (next highest risk group). In fiscal year 2011, there were 7 port areas in Group I and 48 port areas in Group II. Each port area in these groups is allocated a specific amount of funding based on its risk score. Group III: Group III ports represent the next risk grouping of port areas based on the risk model scores. For fiscal year 2011, there were 35 port areas in Group III. However, unlike Groups I and II, these port areas do not receive a specific allocation based on risk. Instead, DHS allocates a set amount of funding to Group III as a whole and port areas within Group III compete against each other for this funding based on risk and project effectiveness. All Other Port Areas: Port areas not evaluated using the risk model, but which operate under an Area Maritime Security Plan (AMSP),are eligible to compete for funding with the All Other Port Areas Group––in a manner similar to Group III, but without using risk scores as a factor in project selection. After DHS announces the allocation amounts for all of the groups through the release of the grant guidance, applicants must apply for funding–– either through the fiduciary agent or directly to FEMA––within 45 days of the release of the grant guidance. Applicants are entities within a port area—such as port authorities, facility operators, and state and local government agencies—that provide port security services. During the award process, DHS and the U.S. Department of Transportation (DOT) evaluate the port areas’ projects and determine which projects to fund. Before the projects reach DHS and DOT for review they are vetted locally. The local evaluation process––known as field-level review––for Groups I and II differs from that of Group III and All Other Port Areas Group as described below. Groups I and II: Beginning with the fiscal year 2007 supplemental guidance, port areas in Groups I and II received a single direct funding allocation based on risk. Once the allocation is made, stakeholders in the port area then undergo a collaborative process to determine the projects to fund with the grant allocation. To help manage the new direct allocation process, DHS introduced the use of fiduciary agents to help manage the PSGP at the local level and ensure that all port partners were incorporated into the planning and grant allocation processes. For Group I and II port areas, FEMA awards the port area allocation to each port area’s selected fiduciary agent. According to the grant guidance, while the fiduciary agent acts as the principal point of contact with FEMA for application, management, and administration of the Group I and II grant awards, the fiduciary agent is not the sole decision maker regarding the use of the PSGP grants. Instead, a field-level review process is conducted by the applicable Coast Guard Captain of the Port (COTP) in coordination with DOT, the Maritime Administration, and appropriate personnel from the Area Maritime Security Committee (AMSC) including federal, state, and local agencies. At the completion of the field-level review process, the COTP—through the fiduciary agent— submits to FEMA a prioritized list of projects for funding ranked from highest to lowest in terms of their contributions to risk reduction and cost effectiveness. Once the COTP submits this information, DHS begins its national review process for Group I and II port areas. Group III and All Other Port Areas: Unlike Groups I and II, grant projects in Group III and the All Other Port Areas Group are determined through a competitive process. Port entities in these two groups submit their project proposals directly to DHS for review. DHS reviews the projects for eligibility, and approved projects are grouped by port area and sent to the corresponding COTP for further review. At this point, the process mirrors the Group I and II process. Before grant awards are finalized, project proposals undergo a national review process conducted by the National Review Panel (NRP), a group of subject matter experts from DHS and DOT. During the national review process, the NRP reviews all submitted projects for eligibility, and makes a final funding recommendation to the Secretary of Homeland Security. PSGP funds cannot be distributed to grantees to begin projects until DHS ensures the grantee’s compliance with federal grant management requirements. FEMA’s GPD is responsible for ensuring that all grant projects adhere to federal grant requirements, including all EHP requirements. For example, the National Environmental Policy Act requires DHS to analyze the possible environmental impacts of each project funded by a DHS grant. In addition to federal requirements, DHS also directs all applicants to provide detailed budgets for the requested funds at the time of application. Until FEMA is satisfied that all requirements have been met, no grant funding can be distributed to begin projects—rather the grant funding is considered “unavailable.” Once FEMA makes funds available to grantees, port entities must complete the grant project within the designated 3-year performance period. For example, for fiscal year 2009 projects, the performance period began on June 1, 2009. During this grant period, the City of Houston received approval for the second phase of a radio system project. By the time the project cleared local and federal review and funds were made available it was March 16, 2011––leaving the city about 14 months to implement the project before the performance period end date of May 31, 2012. For fiscal years 2010 and 2011, DHS allocations of PSGP funds were based on DHS’s risk model and implementation decisions, and were made largely in accordance with risk. For example, we found that allocations to port areas were highly positively correlated to port risk, as calculated by the risk model. In addition to the risk scores of the port areas, DHS made two implementation decisions when finalizing grant allocations for fiscal year 2011. First, DHS opted to direct the majority of available funding to the highest risk port areas. Second, DHS chose to limit fluctuations in grant funding from year to year to any given port area.available grant funding to the 7 Group I port areas in fiscal year 2011, Overall, as shown in table 2 below, DHS directed 60 percent of which represented about 54 percent of the total risk for port areas, according to the model’s determination of risk. In fiscal year 2010, Group I was allocated 60 percent of grant funding and accounted for 43.5 percent of the risk. Group II was allocated 30 percent of grant funding and accounted for 53 percent of the risk. Group III was allocated 5 percent of grant funding and accounted for the remaining 3.5 percent of the risk. their group for a portion of the group’s total funding—which was about $11.8 million for each group in fiscal year 2011. In addition to directing the majority of available grant money to the highest risk port areas, DHS also opted to provide stability in the funding levels of Group I and II port areas through another implementation decision. To achieve this stability, DHS utilized funding “floors” in the fiscal year 2011 risk model, which limited how much a port area allocation could decrease from year to year, despite changes in risk identified by the model. A senior FEMA official reported that floors were used in the fiscal year 2011 PSGP risk model to mitigate wide fluctuations in funding so that port areas could better plan for long-term security improvements. This official also noted that floors have been used in the PSGP risk model since fiscal year 2008 and were also used in the fiscal year 2011 Homeland Security Grant Program (HSGP) risk model. In the fiscal year 2011 model, DHS set the funding floor for Group I port areas at 25 percent—meaning that the port area’s funding level could not decrease by more than 25 percent from its fiscal year 2010 allocation regardless of how much its risk profile changed. Similarly, for fiscal year 2011, DHS set the funding floor for Group II port areas at 50 percent— meaning that the port area’s allocation could not decrease by more than 50 percent from its fiscal year 2010 allocation regardless of changes in risk. According to FEMA data, if the floors had not been used in fiscal year 2011, the allocations to 3 Group I port areas would have fallen by more than 25 percent and the allocations to 8 Group II port areas would have fallen by more than 50 percent. However, due to the use of funding floors, these 11 port areas collectively received fiscal year 2011 allocations that were about $11.6 million—or about 26 percent—higher than their risk profiles would have indicated. See table 3 below. In fiscal year 2011, DHS modified how port vulnerability—the relative exposure to an attack—is calculated in the PSGP risk model, but additional changes could improve how vulnerability is measured in the model. Prior to fiscal year 2011, the PSGP risk model held vulnerability constant, rather than accounting for differences across ports. We have reported on the value of measuring vulnerability in risk analysis models in In June 2008, we reported that DHS chose to hold two prior reports.vulnerability constant and consider all states and urban areas equally vulnerable in the HSGP risk analysis model, which reduced the value of the model in estimating risk.In June 2009, we reported that DHS also chose to consider all transit agencies equally vulnerable in its Transit Security Grant Program (TSGP) risk analysis model. Regarding both models—which are similar in structure to the PSGP risk model—we recommended that DHS formulate a method to measure vulnerability in a manner that captures variations across jurisdictions, and apply this vulnerability measure in future iterations of the grant allocation model. To respond to these recommendations and other external feedback regarding the grant programs, and to produce a more complete risk picture, DHS modified the vulnerability index in the fiscal year 2011 PSGP model such that vulnerability is no longer held constant. Instead, the new vulnerability index recognizes that different ports can have different vulnerability levels. In the fiscal year 2011 PSGP model, port vulnerability is assessed using four data components thought to influence a port’s vulnerability to attack, as shown below in table 4. The fiscal year 2011 PSGP risk model is provided in full in appendix II. Although FEMA has taken the first step towards improving how port vulnerability is measured in the PSGP risk model, further improvements are needed to ensure that the vulnerability score for a specific port is responsive to changes in security that may occur in that port—such as the implementation of new security measures. The fiscal year 2011 vulnerability index does not provide a mechanism to account for how new security measures—such as the installation of cameras or the provision of additional training to security officials —affect a port’s vulnerability, even if those security measures were funded using PSGP grant dollars. This limitation is due to the fact that the data elements within the vulnerability index are counts of activities, which recognize the number of activities that may occur—such as how many ferry passengers board a ferry—but do not account for the protective actions taken to secure them. For example, if a port installed security cameras throughout a ferry system to monitor vessel or ferry passenger activity, one would expect to reduce the ferry system’s vulnerability to attack. However, because the “ferry passenger” data element within the model’s vulnerability index is simply a count of passengers utilizing the ferry system and is not a reflection of the security measures in place to protect the ferry system, the new camera system would not reduce the port’s vulnerability score as calculated by the risk model. Thus, with this type of measure, in this example, a port could only reduce its vulnerability score by reducing the number of passengers utilizing the ferry system. The model’s robustness is thereby limited because activity counts do not reflect improvements made to port security. It is important to note that some security improvements may be captured by the inclusion of the Coast Guard’s Maritime Security Risk Analysis Model (MSRAM) results in the PSGP risk model.which are updated annually—provide information to the model on the percentage of national high-risk assets that reside within each port. However, MSRAM does not account for all types of security improvements because it is an asset-based model that assesses improvements to individual port assets such as a ferry terminal or a chemical plant. As such, MSRAM is not designed, for example, to evaluate security projects that may affect multiple assets in a port. The National Infrastructure Protection Plan states that when measuring vulnerability, one should describe all protective measures in place and how they reduce vulnerability. FEMA officials reported that capturing data on all security improvements would be challenging due to the need to collect and validate data for all ports included in the PSGP risk model. However, FEMA officials acknowledged the importance of incorporating completed security projects as part of the vulnerability component of the risk model and stated that FEMA will continue to refine its vulnerability assessments. Without accounting for the reductions in vulnerability achieved through new security measures implemented in a port, including those funded through the PSGP, the robustness of the risk model may be limited and not accurately reflect the relative risk of port areas throughout the nation. Instead, the risk model would likely continue to recognize the same ports as the highest risk, regardless of the security improvements made in those ports. In addition, by not accounting for security improvements resulting from PSGP grants, the security benefits of the PSGP are also not recognized. Incorporating completed security projects into the vulnerability component of the risk model could help increase its robustness and more accurately direct allocations to the highest risk port areas. While FEMA officials reported that developing an improved vulnerability index that incorporates the effect of security improvements would be a challenging process, there are interim measures that FEMA could take to ensure that the most precise data available are being used to populate the existing vulnerability index. FEMA made some progress in this regard by modifying how the HAZMAT Population data component was calculated in the fiscal year 2011 model. Rather than measuring only hazardous materials imports, as was done in the fiscal year 2010 and prior models, the modified measure also accounts for the transit of hazardous materials through a port where the port is not their final destination, providing added precision to the model. However, there are more precise data available that FEMA is not currently utilizing for at least one additional data component within the vulnerability index—foreign vessel calls. The Coast Guard established its High-Interest Vessel (HIV) Program to address increased U.S. maritime security requirements in the aftermath of the terrorist events of September 11, 2001. The program targets HIVs, or those that might pose high relative security risks to U.S. ports. frequencies of high-risk vessel arrivals, although it would require the Coast Guard to extract data from multiple sources to conduct a port-by- port analysis. The National Infrastructure Protection Plan states that DHS is responsible for using the best available information to conduct risk analysis and risk management activities. FEMA officials reported that they considered using HIV data in fiscal year 2011 but determined that due to time constraints, it would be more straightforward to use a count of foreign-flagged vessels during the first iteration of the vulnerability index. However, FEMA officials reported that they will continue to research additional data elements for inclusion in future year risk models. Using data from the HIV Program—which the Coast Guard already collects—in future iterations of the risk model could position FEMA to better capture the vulnerability of port areas posed by vessels arriving from foreign ports and thereby improve the precision of allocations to high-risk port areas. FEMA awarded nearly $1.7 billion in port security grants in fiscal years 2006 through 2010. As shown in figure 4 below, grantees have “drawn down” about one-quarter of funds—or about $395 million. Further, about half of the funds are “available” to grantees to begin work on projects. However, about one-quarter of funds are “unavailable” to grantees. As shown in table 5 below, FEMA awarded nearly $1.7 billion in port security grants in fiscal years 2006 through 2010; however, less than 24 percent—or about $395,000 million—had been drawn down as of September 2011. Although draw down rates are often cited as a measure of progress in improving port security, FEMA officials stated that draw down rates are not an accurate reflection of progress made in improving port security because grantees do not always draw down their funds promptly. Thus, even though progress may be underway in improving port security, until the grantee draws down their funds, this progress is not evident. FEMA officials reported that grantees may not draw down their grant funds right away for two main reasons. First, as a reimbursement grant program, grantees are not eligible to draw down awarded PSGP funds until they have incurred a cost. FEMA officials reported that costs for PSGP grants are often not incurred until late in the grant performance period. For example, grantees may choose to wait until project completion before paying contractors to ensure that the project is completed according to the terms of the contract. Thus, the draw down of grant funds would occur late in the performance period, after project completion. Second, grantees may choose not to draw down funds immediately after incurring a cost. Instead, the grantee might choose to wait until the end of the performance period to draw down funds or choose to draw down funds at select points throughout the year. Often, according to FEMA officials, this delay is due to the parameters of local accounting systems or the need to seek approval from local government entities before requesting reimbursement. As a result of these two factors, grantees have likely made more progress towards implementing grant projects to improve port security than is reflected in the draw down numbers, according to FEMA officials. To encourage grantees to draw down funds more promptly, FEMA’s GPD released an information bulletin in January 2011 requesting that whenever possible, grantees draw down funds no less than on a quarterly basis. According to the information bulletin, more frequent draw downs would provide a more accurate representation of FEMA grant fund usage. According to FEMA data on monthly draw down rates over time, there was an initial increase in draw down rates for some grant years after the information bulletin was released, but draw down rates have since leveled off. Of the nearly $1.7 billion in port security grants that FEMA awarded to port areas in fiscal years 2006 through 2010, more than $400 million—or about 24 percent—remained unavailable to grantees as of September 2011, as shown in table 6 below. Grantees cannot use unavailable funds to begin work on security projects. There are two types of unavailable funds—funds that are “unused” and funds that are “on-hold.” Unused funds—which exist only in Group I and II port areas—are funds which the port area has been awarded but has not yet used for specific projects. For example, as shown in table 6 above, approximately $242 million in grant funding awarded to Group 1 port areas was unavailable as of September 2011. Of this, about $116 million—or 48 percent—was unavailable because the funds have not been used for specific projects.on-hold funds—exist in all four funding groups, and result when FEMA has approved the use of grant funding for a specific grant project, but compliance with postaward requirements—such as environmental and The second type of unavailable funds— budgetary reviews—has not been completed.requirements are met, these grant funds remain “on-hold.” Each type of unavailable funding—unused and on-hold—results from a different set of challenges, as discussed below. One challenge that PSGP program officials reported contributed to delays in using awarded grant funds was the implementation of the Port-Wide Risk Mitigation Plan (PRMP) requirement. This PRMP requirement was announced in August 2007 for the fiscal year 2007 supplemental grant round and was part of a broader FEMA effort to shift the grant program from supporting asset-specific projects—such as fences around a facility—that benefited just one facility, to supporting more regional, portwide projects—such as interoperable communication systems—that would benefit an entire port area. This new requirement caused delays because port areas were not eligible to submit specific projects to FEMA for approval until their PRMP was approved, and many PRMP submissions and approvals were delayed. The fiscal year 2007 supplemental grant guidance included a time line and specific deliverables to guide port areas in the plan development and approval process.finalized by May 2008. However, only 3 of the 11 port areas we interviewed had an approved plan in place by this time. Plans for the remaining 8 port areas were approved between July 2008 and September 2009. In June 2011, a senior FEMA official told us that FEMA did not hold stakeholders to the time lines for plan development because the time lines were unreasonably aggressive for some port areas. Another senior FEMA official stated that FEMA did not want to rush the plan development process because that could have been detrimental to the quality of the plans. Due to the delayed plan submissions, FEMA faced challenges in approving draft plans. For example, the senior FEMA official Based on this time line, all port area PRMPs should have been reported that it was difficult to convene the review panel to approve plans on a sporadic basis. Thus, rather than hold weekly or biweekly meetings to discuss one or two plans, which would pose a burden on their federal partners on the review panel, FEMA instead held review panel meetings every 2 months. As a result, the official reported that it took longer than expected to approve risk mitigation plans which then delayed the submission of grant projects from port areas. Until a port area’s PRMP was approved, it was not eligible to submit projects to FEMA for approval. As a result, the delays associated with PRMP approval contributed to delays in the use of grant funds. For example, the PRMP for the Columbia-Snake River System was not approved until September 2009, meaning that the port area could not submit projects to FEMA for approval for more than 2 years after the fiscal year 2007 supplemental grant guidance was released, creating delays in the use of grant funds in this port area. Fiduciary agents and FEMA officials reported that the initial delays resulting from delays in PRMP approval were exacerbated by the fact that multiple grant rounds—beginning with the fiscal year 2007 supplemental grant round when the PRMP requirement was announced—were underway by the time port area PRMPs were approved and that these grant rounds had varying cost-share requirements. In the case of all 11 port areas in our review, multiple grant rounds had been announced— through the release of grant guidance—before the port area’s PRMP was approved, as shown in figure 5. For example, both the fiscal year 2007 supplemental and the fiscal year 2008 grant rounds had been announced—in August 2007 and February 2008 respectively—before the first PRMPs—for the New York-New Jersey port area and the New Orleans port areas—were approved in April 2008. In some cases, additional grant rounds were announced before port area PRMPs were approved. For example, as shown in figure 5, four grant rounds (fiscal year 2007 supplemental, fiscal year 2008, fiscal year 2009, and ARRA) were announced before the Columbia-Snake River Port Area’s PRMP was approved in September 2009. With multiple grant rounds open, applicants could choose under which grant year to apply for funding. Fiduciary agents and FEMA officials reported that the cost-share requirement was a significant factor in applicant decisions regarding under which grant year to apply for funding. As shown in table 7 below, the PSGP has traditionally required a cost- match, but this requirement has been modified or waived in numerous grant rounds as a result of legislative action. Fiduciary agents in 8 of 11 port areas in our review reported a lessened demand for grant funds in grant years where there was a cost-share requirement, particularly for fiscal years 2008 and 2009. Fiduciary agents cited a variety of challenges with the cost-share requirement, including: (1) applicants were aware of long delays in the distribution of grant funds and faced difficulty preserving the cost-share obligation in their entity’s budget while pending receipt of awarded grant funds, (2) facility owners who were compliant with security requirements under MTSA were hesitant to invest their own money for additional security projects beyond the requirements, and (3) applicants were unable to afford the cost-share requirement due to the economic downturn. For example, one fiduciary agent reported that while she generally supports a cost-share requirement because it ensures stakeholder buy-in, the cost-share requirement has been challenging due to the poor economic environment. As a result of the cost-share, this fiduciary agent reported conducting three distinct rounds of project solicitations in the fiscal year 2008 grant round in order to generate enough demand to spend the port area’s entire allocation. We reported in October 2010 that a cost-share requirement is a key factor for effective federal grants because it ensures that federal grants supplement—rather than substitute for— stakeholder spending. We further reported that a cost-share requirement is reasonable given that grant benefits can be highly localized. As a result of the inconsistent cost-share requirement, several fiduciary agents told us that applicants were more likely to request funding under the grant rounds with the most lenient cost-share requirement or delay project submission while waiting to learn whether or not the next round of grants would include the cost-share requirement. This uncertainty about the cost-share requirement created a disincentive for grant applicants to request funding during cost-share years. For example, the fiduciary agent in one port area told us that the port area received project proposals totaling twice the port area’s total allocation for fiscal year 2011. Thus, projects had to be denied for fiscal year 2011 funding during the field- level review, even though more than $9 million in fiscal year 2008 and 2009 grant money remained unused. As shown in table 8 below, a greater portion of money from cost-share years remains unused as compared to money from non-cost-share years, even though cost-share grant years preceded the non-cost-share grant year. For example, about 22 percent of grant funding awarded to Group 1 port areas during cost- share years remains unused, as compared to less than 4 percent during fiscal year 2010, when the cost-share requirement was waived. Fiduciary agents reported that the lengthy cost-share waiver process— used by applicants seeking an exemption from the required cost-share— further exacerbated the impact of the cost-share requirement under the PSGP. Grant applicants unable to meet the cost-share requirement are eligible to apply for a waiver. The waiver approval process requires 22 steps—which include approval by leadership within FEMA’s GPD, approval by FEMA’s Administrator, and finally, approval by the Secretary of Homeland Security. According to statute, the Secretary can grant a waiver of the cost-share requirement if she determines that a proposed project is meritorious but cannot be undertaken without additional federal support. However, 5 of the 11 fiduciary agents we interviewed told us that they had concerns with the cost-waiver request process—including with the length of time required for a decision. For example, one fiduciary agent—who oversaw a cost-waiver application that took about 7 months to be approved—told us that the cost-waiver request process was time- consuming and confusing. According to FEMA officials, an unknown portion of this 7-month approval process was spent ensuring that the fiduciary agent had submitted all of the required documentation and thus, the actual approval time once the request was finalized was less than 7 months. The cost-share requirement was waived for all applicants under the ARRA, fiscal year 2010, and fiscal year 2011 grant cycles. However, grant applicants may continue to submit cost-share waiver requests for new projects to be funded under the fiscal year 2007 supplemental, fiscal year 2008, and fiscal year 2009 grant cycles—which were cost-share years—if money in their port area remains unused from those years. As shown earlier in table 8, about $110 million in PSGP funds awarded to Group I port areas from fiscal year 2007 through 2009—years in which the cost-share was required—remains unused. As port areas solicit projects for these unused funds, some applicants may submit cost-share waiver requests as well. For example, one fiduciary agent from a Group 1 port area reported that her port area recently completed the field-review process to identify projects to fund using their unused fiscal year 2009 grant monies. As a result, the port area submitted 10 projects to FEMA for approval in October 2011, of which 8 projects include a cost-share waiver request. Although FEMA has taken steps to improve the cost-waiver process, it continues to be lengthy and additional efforts may help expedite these reviews. In July 2009, FEMA issued an information bulletin to clarify the process that grantees should follow when submitting cost-share waiver requests. Since the issuance of this information bulletin, FEMA has received a total of 31 cost-share waiver requests—of which, 22 were approved. In November 2009, following a Fiduciary Agent Workshop, FEMA released written responses to questions posed at the workshop. In this document, FEMA stated that a decision on a waiver request could be expected approximately 30 days after all documentation was provided to FEMA in accordance with the process outlined in the July 2009 information bulletin. However, according to FEMA records, for cost-share waivers reviewed since December 2009 DHS took—on average—126 days to approve a request once all of the required information had been received. Approval time lines ranged between 55 days and 268 days for these waiver requests. Of the 126 days, on average, it took 74 days from the date requests were considered complete to achieve approval by GPD’s leadership. It took an additional 52 days, on average, to complete the remaining 11 steps of the waiver process—including approval at the Administrator of FEMA level and the Secretary of Homeland Security level. According to DHS, due diligence requires both component and department level clearances, including secretarial clearance, in order to responsibly award funding. This process ensures that PSGP projects meet program goals and objectives. However, FEMA records show that no approval recommendations from GPD leadership were overturned as a result of the additional 52 days, on average, of required review. Further, only 1 of the 31 waiver requests submitted since the July 2009 information bulletin was issued has been denied—and it was denied at the GPD level. Standards for Internal Control in the Federal Government state that “pertinent information should be identified, captured, and distributed in a form and time frame that permits people to perform their duties efficiently.” FEMA officials told us that FEMA has taken internal actions to improve the review process such as meeting with other key offices involved in the waiver process in the spring of 2011 to discuss and standardize information requirements for the waiver package. FEMA officials reported that they believe that this effort has helped improve some aspects of the process, but further action may be required to streamline the process. Additionally, fiduciary agents remain wary of the cost-waiver request process. For example, one fiduciary agent told us that its field review team—including the COTP—would be unlikely to recommend a project for funding if that project relies on a cost-share waiver. Another fiduciary agent told us that there is little interest in the fiscal year 2009 funds due in part to the lengthy waiver review process. Without a more efficient review process, certain grant applicants that cannot fund the cost-match requirement may not receive grant funds to implement their projects, or may not even apply for funds. Evaluating the waiver review process could help to ensure that the process is completed in a timely manner. In addition to funding that is unavailable because it is unused, some funding is also unavailable because it is on-hold due to delays in achieving compliance with postaward requirements and challenges with FEMA’s grant management system. After FEMA approves the use of grant funds for a specific project, stakeholders reported that additional delays in making funds available resulted from compliance with postaward requirements. FEMA cannot make grant funds available to grantees to begin work on approved projects until all postaward requirements, including budgetary and environmental reviews, are met. One cause of delay was inefficiency in the reviews conducted pursuant to the National Environmental Policy Act, which requires a review of the impacts of proposed actions as well as reasonable alternatives to those actions. Grantees submit Environmental and Historical Preservation (EHP) information to the Grant Program Directorate––Environmental and Historical Preservation (GPD-EHP) office for review. If the project does not require a detailed EHP analysis, it can be reviewed and approved by a GPD analyst. However, projects that require a more detailed analysis are reviewed either by the GPD-EHP team or passed to a FEMA regional environmental officer depending on the scope of the review. Fiduciary agents we interviewed in 5 of 11 port areas reported that slow EHP reviews caused delays. During a July 2009 FEMA-sponsored stakeholder conference, participating port areas stated that the EHP submission and review process associated with the PSGP was causing delays, which increased project costs and limited what grantees could accomplish with grant funds. The group requested the establishment of a more structured postaward time line, including deadlines for EHP reviews, so that grantees would be better able to plan their projects. A senior FEMA official reported that delays in EHP reviews were due to the fact that prior to 2008, GPD had not historically conducted EHP reviews on preparedness projects and thus, had no established program for doing so. This official further reported that creating an “EHP Team” within GPD with the assistance of subject matter specialists via technical support contract and standardizing the format for project submittals has helped expedite EHP reviews. According to FEMA officials, the delays caused by inefficient review processes have been amplified by FEMA’s reliance on an antiquated data management system. As we reported in our June 2009 report on the Transit Security Grant Program, FEMA did not have a mechanism for systematically collecting data on the status of individual grant projects through the review process. For example, although FEMA has systems to track the financial information related to its grants programs, these systems did not allow FEMA to track the status of grant reviews, such as EHP reviews. According to FEMA, the data management system used to manage the Transit Security Grant Program is also used to manage the PSGP and no changes have been made to the system since our 2009 report. As such, GPD officials reported that each PSGP program analyst maintained separate spreadsheets that tracked the grants for which they were responsible. Using numerous data systems and spreadsheets resulted in inefficiencies and, in some cases, lost data, as program analysts had to search across systems for information or were reliant on systems––such as the Homeland Security Information Network––that lost application information. The overall result was a data system that did not provide information in a timely manner and that could not be used effectively to manage the grant lifecycle. DHS and FEMA have taken a number of steps to address unavailable balances. To ensure that grant awards were used for specific projects in a timely manner, FEMA implemented project submission deadlines beginning in fiscal year 2010. Prior to this, FEMA did not have deadlines for submitting projects which resulted in money being unused for projects and therefore unavailable until the port area could identify enough projects to fund––a process that, in some cases, took years to complete. Starting in fiscal year 2010, port areas had 45 days from the initial fiduciary agent application deadline to submit specific project proposals. In fiscal year 2011, FEMA took an additional step to shorten application time frames by requiring all Group I and II port areas to submit specific project proposals at the time of the fiduciary agent’s application. According to FEMA officials, this change will ensure that grant money allocated in the future will be immediately used, which will expedite the grant distribution process. DHS has also taken a number of steps to address the delays in the EHP review process that contributed to funds being on-hold. See table 9 for a list of key DHS actions: As a result of these changes, some fiduciary agents reported improvement in the EHP review process; however, these views could not be verified using FEMA data. Specifically, 5 of 11 fiduciary agents reported that the EHP review process has improved. For example, 1 fiduciary agent believed that the EHP process has improved primarily because of FEMA’s categorization of projects according to the amount of expected impact they would create. However, due to data reliability issues with FEMA’s EHP data––there were too many missing EHP dates for an accurate analysis––we were not able to confirm whether the EHP process was improving. Because of limitations with FEMA’s existing grant management system, all EHP data are managed on separate spreadsheets maintained by program analysts and these spreadsheets have varying levels of completeness. FEMA officials acknowledged the limitations with their data, including the omission of key dates in the EHP review process, such as the date when the EHP information was submitted for review or the date when the project’s EHP review was approved. However, FEMA officials noted that the evolution of the Non Disaster Grants (ND Grants) system, which is discussed below, may allow for better tracking of EHP submissions and approvals in the future. To address challenges exacerbated by the antiquated data management system used to manage the PSGP, DHS took the first step towards consolidating its data management system in fiscal year 2011 by implementing the first of two planned phases of the ND Grants system. According to FEMA, the ND Grants system is intended to consolidate FEMA’s disparate data systems and improve the ability of FEMA grant managers to track grants through the review and approval process. In February 2011, FEMA anticipated that the ND Grants system would be fully completed by the end of fiscal year 2014. Given the early stages of this process, it is too early to assess the extent to which the ND Grants system will alleviate data management challenges. In July 2011, during the course of our review, FEMA finalized eight performance measures designed to track how well FEMA GPD administers and manages the PSGP. According to FEMA documents, these measures include the percent of: (1) grant funds released to grantees within 300 days, (2) grant awards programmatically monitored annually, (3) grant funds programmatically monitored annually, (4) grant awards financially monitored annually, (5) grant funds financially monitored annually, (6) corrective actions completed within the fiscal year issued, (7) preparedness grant awards processed within 150 days, and (8) grant closeouts completed within 120 days from the end of the period of performance. According to FEMA officials, data collection for these eight measures will begin in the fiscal year 2012 grant cycle and the 2012 baseline data will be used to develop targets for each measure beginning with the fiscal year 2013 grant cycle. For more information on these measures, see appendix V. In addition to these eight measures, FEMA officials reported that four additional measures are under development. By implementing these internal measures, FEMA officials should be better positioned to determine whether the changes they have made in recent months are sufficient to better ensure more efficient grant administration going forward or whether additional actions are required. However, since targets for the eight measures will not be established until at least fiscal year 2013, and the four additional measures remain under development, it is too early to know how effective they will be in helping FEMA to assess its performance and improve its grant management. FEMA has not evaluated the effectiveness of this program in strengthening critical maritime infrastructure against risks associated with potential terrorist attacks because it has not implemented measures to track progress toward achieving program goals. In 2006, the Department of Homeland Security’s Office of Inspector General reported that as the PSGP continues to evolve, an important challenge DHS should undertake is the measurement of its impact. The Inspector General also reported that DHS has raised the overall bar of preparedness through the port security grants but it is not clear that DHS knows how much actual risk reduction has been achieved. Four years later, in January 2010, FEMA formed a task force to develop draft performance measures for the PSGP. This task force conceptualized 11 potential measures of effectiveness for the PSGP; however, baseline data needed to implement the measures did not exist for all 11 draft measures. According to FEMA documentation, baseline data existed for 2 of the 11 measures, additional data collection would be needed to populate 3 measures, and 6 measures would require further refinement or coordination with federal partners. In December 2010, FEMA transferred responsibility for developing performance measures from GPD to FEMA’s National Preparedness Directorate, specifically the National Preparedness Assessment Division (NPAD).the development of effectiveness measures within the directorate containing assessment experts. However, this may have contributed to delays in developing performance measures because the staff at NPAD, including the new Director, who began in March 2011, needed time to familiarize themselves with the grant program and draft measures. In July 2011, a senior NPAD official told us that the division was briefed on the FEMA officials report that this change was made to consolidate draft measures developed by the GPD task force, but they were considering developing different measures as well. In October 2011, the same official told us that the division had developed a number of prospective performance measures for the PSGP, but that FEMA was still reviewing the draft measures. As a result, the official told us that it has not been determined whether the performance measures will be included in the fiscal year 2012 guidance. Additionally, FEMA did not have a plan in place, with milestones, to ensure the implementation of such measures. According to best practices for project management, the development of a project management plan—which defines how the project is executed, monitored and controlled, and closed—is a key element of project management. Best practices for project management also call for milestone dates, among other factors, in carrying out a project successfully. As a result, FEMA’s progress toward implementing measures to assess whether the program is achieving its stated purpose remains unclear. Port areas have unique characteristics—they are centers of commerce, hubs of transportation, and often close to major population centers. These characteristics result in specific vulnerabilities that must be addressed to avoid the human or economic losses that would result from a terrorist attack. The Port Security Grant Program (PSGP)—administered by FEMA and supported with subject matter expertise from the Coast Guard—is one tool DHS uses to protect critical maritime infrastructure from these risks. Risk management has been endorsed by the federal government to help direct finite resources to areas of greatest risk and grant programs have provided substantial resources toward this effort. We found that PSGP allocations were highly correlated to risk for the grant years we examined and DHS has taken steps to strengthen the PSGP risk allocation model by improving the quality and precision of the data inputs. However, additional efforts—such as accounting for how new security measures affect port vulnerability and using the most precise data available in the risk model—could further strengthen the model and build upon the progress made. While the allocation process has been risk- based, FEMA has faced significant challenges administering the grant program. For example, FEMA awarded nearly $1.7 billion in port security grants for fiscal years 2006 through 2010; however, draw down levels for the PSGP are low—with about one-quarter of fiscal year 2006 through 2010 grant monies drawn down as of September 2011. While FEMA may not consider draw down levels to be an accurate measure of progress made in improving port security, this measure has become the de facto yardstick for assessing progress in securing our ports because no other measures exist. Additionally, about a quarter of the awarded funding remains unavailable due to delays in using grant funds, challenges with the cost-match and associated waiver process, and challenges that grantees have had complying with postaward requirements. As a result, about $400 million in awarded grant funding remains unavailable to grantees for port security projects. FEMA has taken steps to improve the availability of funds and has developed internal performance measures to begin evaluating its administration of the grant program. However, FEMA has not evaluated the effectiveness of the program because it does not have measures to track progress towards achieving program goals. To establish a more accurate measurement of grant effectiveness, FEMA should expedite its efforts to implement performance measures for the PSGP. Initial steps have been taken to develop performance measures for the PSGP, but the time frame for implementing them is unclear. Without a plan, there is little assurance that these measures will be implemented in a timely way to assess the program’s effectiveness in ensuring that critical port infrastructure is protected. We are making four recommendations to help strengthen the implementation and oversight of the PSGP. To strengthen DHS’s methodology for measuring vulnerability in ports, and to improve the precision of grant allocations to high-risk port areas, we recommend that the Secretary of Homeland Security direct the FEMA Administrator to: Develop a vulnerability index that accounts for how security improvements affect port vulnerability, and incorporate these changes into future iterations of the PSGP risk model. Coordinate with the Coast Guard to determine the most precise data available to populate the data elements within the vulnerability index and to utilize these data as an interim measure, until a revised vulnerability index is developed. To ensure that waiver requests—including those submitted under previous cost-share years in which money remains unassigned and those that may be submitted in future grant rounds if a cost-share requirement is applied—are evaluated promptly, we recommend that the FEMA Administrator—in conjunction with the Office of the Secretary of Homeland Security—evaluate the waiver review process to identify sources of delay and take measures to expedite the process. To strengthen the administration, oversight, and internal controls of the PSGP, and to streamline processes, we recommend that the Secretary of Homeland Security direct the FEMA Administrator to develop—in collaboration with the Coast Guard—time frames and related milestones for implementing performance measures to monitor the effectiveness of the PSGP. We provided a draft of this report to DHS for review and comment. DHS provided written comments on November 14, 2011, which are reproduced in full in appendix VI. DHS concurred with the findings and recommendations in the report, and stated that FEMA is taking actions to implement our recommendations. DHS concurred with our first recommendation that it develop a vulnerability index that accounts for how security improvements affect port vulnerability, and incorporate these changes into future iterations of the PSGP risk model. DHS stated that although incorporating the effects of completed security projects on vulnerability is complex, the inclusion of this type of metric remains a key goal of the PSGP risk methodology and is revisited annually. However, DHS did not provide details regarding its plan to implement this recommendation. DHS concurred with our second recommendation that FEMA coordinate with the Coast Guard to determine the most precise data available to populate the data elements within the vulnerability index and to utilize this data as an interim measure until a revised vulnerability index is developed. Specifically, DHS stated that FEMA will continue to coordinate with subject matter experts, including the Coast Guard, to determine the best data available for use in the vulnerability index. Further, DHS stated that FEMA and the Coast Guard will continue discussions regarding data elements to be used in future grant years, and that these meetings will focus on what data elements are currently available for use as an interim measure while additional enhancements to the vulnerability component are developed. Such action should address the intent of this recommendation. DHS concurred with our third recommendation that FEMA evaluate the cost-share waiver request process in conjunction with the Office of the Secretary of Homeland Security to identify sources of delay and take measures to expedite the process. Specifically, it reported that FEMA and DHS are exploring the best solution to reduce delays and expedite the cost-share waiver request evaluation process and will work to implement appropriate process improvements as they are identified. Such action, when implemented, should address the intent of this recommendation. Finally, DHS concurred with the fourth recommendation that it develop time frames and related milestones for implementing performance measures to monitor the effectiveness of the PSGP. Specifically, DHS stated that FEMA’s Grant Programs Directorate (GPD) is in the process of developing external measures to determine how effective grantees are in managing and administering the grants and that these external measures will be completed by January 1, 2012. DHS also stated that specific measures to monitor the performance of the PSGP are being developed within FEMA. Further, DHS stated that FEMA is also developing performance objectives for core capabilities, as required by Presidential Policy Directive 8 and the new National Preparedness Goal, and will be reviewing all prevention and protection measures, including those for PSGP. Finally, DHS stated that FEMA’s National Preparedness Directorate will work with GPD and the Coast Guard in fiscal year 2012 to develop some specific measures towards building and sustaining capabilities. These efforts, as described above, are important steps towards implementing this recommendation. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Homeland Security, appropriate congressional committees and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any further questions about this report, please contact David C. Maurer at (202) 512-9627 or MaurerD@gao.gov or Stephen L. Caldwell at (202) 512-9610 or CaldwellS@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page. Key contributors are listed in appendix VII. This appendix provides information on the percentage of total PSGP grant funding directed at each funding group since fiscal year 2007, the first year in which Department of Homeland Security (DHS) categorized port areas into funding groups. Table 10 shows that the percentage of funding directed at Group I port areas and all other port areas has been relatively stable over time, whereas this percentage has changed more drastically for Group II and Group III port areas. As discussed in the report, DHS allocations to individual port areas were made largely in accordance with risk, and were based on DHS’s risk analysis and implementation decisions. DHS’s decision to direct the majority of PSGP funding to the highest risk port areas—as shown in table 10—was one such implementation decision. The second decision involved the use of funding “floors” to limit fluctuations in individual port area funding from year to year. This appendix provides information on the fiscal year 2011 PSGP risk model, which DHS uses to assess the relative risk posed to ports throughout the nation and to help determine PSGP eligibility and funding levels. As discussed in the report, DHS modified how port vulnerability— the relative exposure to an attack—was calculated in the PSGP risk model in fiscal year 2011. Rather than holding vulnerability constant, as was done in fiscal year 2010, DHS chose to modify the vulnerability index in fiscal year 2011 to recognize that different ports can have different vulnerability levels. The current vulnerability component—as shown in figure 6—considers how port vulnerability is affected by ferry and cruise ship ridership, foreign vessel calls, and hazardous material transits. However, as discussed in the report, further improvements are needed to ensure that the vulnerability score for a specific port is responsive to changes in security that may occur in that port—such as the implementation of new security measures—and that the vulnerability index is populated using the most precise data available. This appendix provides information on the financial status of PSGP funds awarded during fiscal years 2006 through 2010. As discussed in the report, DHS awarded nearly $1.7 billion in grant funds to port areas throughout the nation for fiscal years 2006 through 2010. As shown in table 11, grantees have drawn down about 24 percent—or about $395 million—of this funding, as of September 2011. An additional 52 percent of the awarded funding—about $873 million—is available to grantees. About one-quarter of awarded grant funding—or about $408 million—is unavailable, meaning that port areas have not identified specific projects to fund with these monies or compliance with postaward requirements is pending. This appendix contains information on the review and approval process for PSGP cost-share waivers, which grantees can request from DHS if they are unable to meet the cost-share requirement. As discussed in the report and shown in figure 7 below, the waiver approval process requires 22 steps—which include approval by leadership within FEMA’s Grants Program Directorate (GPD), approval by FEMA’s Administrator, and finally, approval by the Secretary of Homeland Security. In November 2009, FEMA told fiduciary agents that a decision on a waiver request could be expected within 30 days. However, under the review process outlined in figure 7, DHS took—on average—126 days to approve a cost- share waiver once all of the required information had been received. Evaluating the waiver review process could help ensure that the process is completed in a timely manner. This appendix provides descriptive information on the suite of internal performance measures that FEMA developed to track how well it administers and manages the PSGP. As discussed in the report, data collection for these measures—which were finalized in July 2011—will begin in the fiscal year 2012 grant cycle and the 2012 baseline data will be used to develop targets for each measure beginning in the fiscal year 2013 grant cycle. However, as discussed in the report, it is too early to know how effective these measures will be in helping FEMA to assess its performance and improve its grant management. In addition to the contacts above, Dawn Hoff, Assistant Director, and Dan Klabunde, Analyst-in-Charge, managed this assignment. Chuck Bausell, David Lutter, Sophia Payind, and Katy Trenholme made significant contributions to this report. Charlotte Gamble, Adam Hoffman, and Grant Sutton provided assistance with interviews. David Alexander assisted with design, methodology, and data analysis. Tracey King provided legal assistance. Jessica Orr provided assistance with report development and Robert Robinson provided graphic support.

Summary: From fiscal years 2006 through 2010, the Department of Homeland Security (DHS) has awarded nearly $1.7 billion dollars to port areas through its Port Security Grant Program (PSGP) to protect critical maritime infrastructure and the public from terrorist attacks. The Federal Emergency Management Agency (FEMA)--a DHS component agency--is the agency responsible for distributing grant funds. GAO was asked to evaluate the extent to which DHS has (1) allocated PSGP funds in accordance with risk; (2) encountered challenges in administering the grant program and what actions, if any, DHS has taken to overcome these challenges; and (3) evaluated the effectiveness of the PSGP. To address these objectives, GAO reviewed the PSGP risk model, funding allocation methodology, grant distribution data, and program documents, such as PSGP guidance. Additionally, GAO interviewed DHS and port officials about grant processes, funding distribution, and program challenges, among other things. In 2010 and 2011, PSGP allocations were based largely on port risk and determined through a combination of a risk analysis model and DHS implementation decisions. DHS uses a risk analysis model to allocate PSGP funding to port areas that includes all three elements of risk--threat, vulnerability, and consequence--and DHS made modifications to enhance the model's vulnerability element for fiscal year 2011. For example, DHS modified the vulnerability equation to recognize that different ports can have different vulnerability levels. However, the vulnerability equation is not responsive to changes in port security--such as the implementation of PSGP-funded security projects. Additionally, the vulnerability equation does not utilize the most precise data available in all cases. DHS addressed prior GAO recommendations for strengthening the vulnerability element of grant risk models, but the PSGP model's vulnerability measure could be further strengthened by incorporating the results of past security investments and by refining other data inputs. FEMA has faced several challenges in distributing PSGP grant funds, and FEMA has implemented specific steps to overcome these challenges. Only about one-quarter of awarded grant funding has been drawn down by grantees, and an additional one-quarter remains unavailable (see table below). Funding is unavailable--meaning that grantees cannot begin using the funds to work on projects--for two main reasons: federal requirements have not been met (such as environmental reviews), or the port area has not yet identified projects to fund with the grant monies. Several challenges contributed to funds being unavailable. For example, DHS was slow to review cost-share waiver requests--requests from grantees to forego the cost-share requirement. Without a more expedited waiver review process, grant applicants that cannot afford the cost-share may not apply for important security projects. Other challenges included managing multiple open grant rounds, complying with program requirements, and using an antiquated grants management system. FEMA has taken steps to address these challenges. For example FEMA and DHS have, among other things, increased staffing levels, introduced project submission time frames, implemented new procedures for environmental reviews, and implemented phase one of a new grants management system. However, it is too soon to determine how successful these efforts will be in improving the distribution of grant funds. FEMA is developing performance measures to assess its administration of the PSGP but it has not implemented measures to assess PSGP grant effectiveness. Although FEMA has taken initial steps to develop measures to assess the effectiveness of its grant programs, it does not have a plan and related milestones for implementing measures specifically for the PSGP. Without such a plan, it may be difficult for FEMA to effectively manage the process of implementing measures to assess whether the PSGP is achieving its stated purpose of strengthening critical maritime infrastructure against risks associated with potential terrorist attacks. GAO recommends that DHS strengthen its methodology for measuring vulnerability in ports by accounting for how past security investments reduce vulnerability and by using the most precise data available. GAO also recommends that DHS evaluate the cost-share waiver review process and take steps to expedite the process where appropriate and develop a plan with milestones for implementing performance measures for the PSGP. DHS concurred with GAO's recommendations.