NFIP was established in the National Flood Insurance Act of 1968 to provide policyholders with some insurance coverage for flood damage, as an alternative to disaster assistance, and to try to reduce the escalating costs of repairing flood damage. NFIP has mapped flood risks, assigning a flood zone designation based on the risk level for flooding (see table 1 for examples), which is a factor in determining premium rates. To participate in NFIP, communities agree to enforce regulations for land use and new construction in high-risk flood zones. As of May 2007, more than 20,300 communities across the United States and its territories participated in NFIP by adopting and agreeing to enforce state and community floodplain management regulations to reduce future flood damage. Although community participation in the program is voluntary, homeowners with mortgages from federally regulated lenders on properties in special high-risk, flood hazard areas are required to purchase flood insurance on their dwellings for at least the outstanding mortgage amount, up to the maximum policy limit of $250,000. Optional, lower-cost coverage also is available under NFIP to protect homes in areas of moderate- to low-risk. In addition, owners of properties built before NFIP officially mapped a community (known as pre-FIRM properties, referring to the Flood Insurance Rate Map) pay premiums that do not reflect their true risk because Congress authorized subsidized insurance rates to be made available for policies covering certain structures to encourage communities to join the program. To insure other personal property items against flood damage, homeowners may purchase separate NFIP personal property (or “contents”) coverage, up to the maximum coverage limit of $100,000. In addition to mapping and categorizing flood risk zones, FEMA also has developed two estimates of potential losses to help set rates and develop information relating to losses. FEMA introduced the concept of the average historical loss year—the purpose of which is to estimate the amount of premium that would be sufficient to pay for losses resulting from the type of loss years that previously occurred. According to FEMA, this estimate is used as one indicator in setting subsidized premium rates. FEMA also prepares a catastrophic loss year estimate, usually every other year, to provide Congress with an informal guide on the losses that could occur in the event of a storm that would have 0.1 percent chance of occurring in a given year (a 1 in a 1,000 year event). For more than a decade, FEMA has pursued a variety of strategies to reduce the number of repetitive loss properties, which are insurable buildings for which NFIP paid two or more claims of more than $1,000 within any rolling 10-year period. For example, NFIP funds three mitigation programs, the FMA program, the RFC program, and the SRL pilot program. The purpose of the FMA program is to fund activities that reduce or eliminate the long-term risk of flood damage to buildings and other structures insured by NFIP, such as property acquisition. The FMA program requires applicants to provide a portion of the funds for the proposed mitigation activities. If the applicant cannot secure funding for the proposed activities, FEMA may contribute 100 percent of the funding through the RFC program, which is specifically designed to mitigate repetitive loss properties (structures insured by NFIP that have had one or more claim payments for flood damages). Finally, the SRL program is designed for repetitive loss properties that have at least four claim payments of more than $5,000 each. See table 2 for more information on these mitigation programs. NFIP staff are located at FEMA headquarters in Washington, D.C., and 10 regional offices. Their functions include tasks for administering mitigation grant programs such as processing applications for grant funds and distributing the funds to eligible applicants. While FEMA establishes policies and procedures for NFIP, and has some staff dedicated to the management of the program, FEMA relies on contractors to administer key aspects of the program. Contractors collect NFIP data, market the program, and sell specific flood-insurance policies. Private insurance companies that participate in FEMA’s Write Your Own (WYO) program largely are responsible for insurance sales and claims adjustment. At the time of our work, there were four major ongoing contracts in place for NFIP, two of which we reviewed in this report. For example, FEMA awards a contract for a BSA, which is responsible for conducting financial and statistical reporting based upon data submissions from the 92 WYO companies, developing forms and information related to NFIP, and providing various data analyses. The BSA contract that was effective from September 2005 through December 2007 was valued at $38 million. FEMA also awards a contract for a DSA, which is responsible for selling and servicing standard and group insurance for policies that are not sold through WYOs. For that agent, the value of the contract in effect from September 2003 to September 2008 is $26.5 million. Two offices in FEMA are responsible for contracts and contract oversight (see fig. 1). A Contracting Officer in the Acquisition Operations Branch awards contracts related to NFIP and has responsibility for determining the adequacy of a contractor’s performance. The Program Management Office also has responsibilities for overseeing each contractor’s performance. A COTR is assigned to each contract. The COTR is authorized to act on behalf of the Contracting Officer to monitor the contract. However, the COTR is not authorized to make any contractual commitments or contractual changes on behalf of FEMA; any changes that the contractor deems may affect the contract, price, terms, or conditions are referred to the Contracting Officer in the Acquisition Operations Branch for action. Each COTR is assisted by monitors, who review and report on technical aspects of the contractor’s performance such as compliance with specific contract terms. Overall, data relating to the number of NFIP policies and amount of insurance coverage indicated upward trends for the period we reviewed and most losses were paid for hurricane-related claims, primarily due to losses from the 2005 hurricane season. The number of policies in force increased 36 percent and the average amount of coverage increased 78 percent from 1997 through 2006, consistent with average rising home values. The average premium per flood-insurance policy decreased 3 percent, but when analyzed by flood risk zone, average premiums increased in the high-risk coastal flood zone, from about $1,039 in 1997 to more than $1,400 in 2006. Over this period, total losses fluctuated from a low of $302 million in 2000 to a high of $2 billion in 2004 before reaching more than $17.7 billion in 2005. In 5 of the 10 years reviewed, less than 10 percent of losses paid out were linked to hurricane-related damage, and over the 10-year period cumulative losses for repetitive loss properties increased from $3.7 billion to $7.9 billion. FEMA’s estimates for average historical loss and catastrophic loss increased over this 10-year period. Finally, analysis by occupancy type shows more than 90 percent of policyholders owned residential properties (single and two-four family homes) or condominiums, and the majority of these properties were found in zones that FEMA designated as high risk. For additional statistical and trend data, see appendixes II-VI. The number of federal flood insurance policies in force increased from 3.96 million in 1997 to 5.40 million at the end of 2006, an increase of 36 percent. The number of policies increased from 1 to 6 percent each year from 1997 through 2005, but increased 12 percent the year after the Gulf Coast hurricanes (see fig. 2). While the number of policies in force has increased, a 2006 study commissioned by FEMA estimated that about half of the single-family homes in special flood hazard areas nationwide do not have flood insurance policies. Moreover, the study estimated that market penetration outside of special flood hazard areas is about 1 percent. The average amount of insurance coverage per policy in force increased from about $158,000 in 1997 to almost $214,000 at the end of 2006, an increase of 78 percent (see table 3). While we did not attempt to determine the reason that the average amount of insurance purchased increased, we note that this increase coincides with the increase in average home values over this period. The average annual premium per policy in force decreased from $489 in 1997 to $475 at the end of 2006, a decrease of almost 3 percent (see table 3). According to FEMA, the average premium has been influenced by changes in two types of flood zones. First, the average premium has been strongly influenced by changes in the moderate- to low-risk flood zones, where policies as a percentage of the total policies in force have increased greatly primarily due to increased sales of Preferred Risk Policies, FEMA’s lowest-cost flood insurance policy. Second, average annual premium per policy has been influenced by the steep increase in the average premium of high-risk coastal zone policies, but because they make up a smaller percent of policies in force, this increase did not drive up the average policy premium. As figure 3 illustrates, the average premium increased in the high-risk coastal zone the most (41 percent), from about $1,039 in 1997 to more than $1,400 at the end of 2006. With the exception of 2005, the amount that FEMA paid out in losses over the 10- year period fluctuated between a low of $302 million in 2000 and a high of $2 billion in 2004 (see fig. 4). Losses refer to the amount that FEMA paid to settle flood insurance claims and are recorded for the year in which the loss occurred. For example, if a flood damaged an insured property in 2005, but the claim was not paid until 2006, the amount paid out would be recorded as a 2005 loss. For 2005, as a result of the Gulf Coast hurricanes, FEMA paid out more than $17.7 billion in losses. From 1997 through 2006, 79 percent of the funds paid out in losses were for hurricane-related claims, but the percentages in individual years varied widely (correlating to hurricane activity). As shown in figure 5, in five of the years reviewed, less than 10 percent of losses were attributable to hurricanes, and in four other years, more than 60 percent of losses were attributable to hurricanes. In 2005, the Gulf Coast hurricanes accounted for 97 percent of all losses paid. Moreover, the 2005 hurricanes accounted for 65 percent of the losses paid during the 10-year period we reviewed. As we have previously reported, it is highly unlikely that NFIP, as currently funded, could generate revenues to repay the amount borrowed from Treasury to pay for claims from the 2005 hurricane season. From 1997 through 2006, the net cumulative amount that FEMA paid to settle claims filed for repetitive loss properties increased from $3.7 billion to $7.9 billion. Congress has noted that repetitive loss properties constitute a significant drain upon NFIP. While FEMA has tried to decrease the portfolio of repetitive loss properties, during this same period, the net cumulative number of repetitive loss properties increased approximately 64 percent, from 76,000 to 125,000 (see fig. 6). Clearly, repetitive loss properties continue to be a problem for NFIP. While these repetitive loss properties account for about 1 percent of NFIP-insured properties, they account for between 25 and 30 percent of all flood claims. We could not determine the extent to which losses paid in a given year were attributable to repetitive loss properties because FEMA collects net cumulative, not annual, data on such losses. However, as shown in figure 6, the cumulative totals have continued to increase, in particular in the past 3 years, as the number of repetitive loss properties has increased. FEMA’s average historical loss estimate increased from $622 million in 1997 to $1 billion in 2005, or about 62 percent. As previously noted, FEMA uses this estimate to calculate the premium that would be sufficient to pay for the average level of losses that occurred in past years and help set the rate level for subsidized flood insurance policies. The estimate is also part of the calculation that FEMA uses to determine the minimum subsidy price that should be charged for pre-FIRM flood insurance policies. When this calculation is used, it ensures that sufficient premiums are collected, in aggregate, to cover at least the average annual loss as determined by historical data (see app. II). This estimate increased from 1997 to 2005 because it is annually updated with the previous years’ flooding activity. To date, FEMA has not determined how it will use the 2005 catastrophic losses from Hurricanes Katrina, Rita, and Wilma in its 2006 or subsequent average historical loss year calculations. FEMA’s estimates (in ranges) for probable maximum loss in the event of a catastrophic loss year gradually increased from $6–9 billion in 1998 (the first year the estimate was made) to $8–11 billion in 2000, $9–12 billion in 2002, and to $11–15 billion in 2005. According to FEMA, the estimate increased over this period due to inflation and the increased policyholder base. Estimates of a catastrophic loss year are designed to provide Congress with an informal guide on the loss potential of a catastrophic event—an event that has a 0.1 percent chance of occurring in any given year. According to FEMA, these estimates generally are done every other year due to the slow growth in policies in force, limited actuarial staff, and the imprecision of such estimates. Analysis of policies in force, average insurance per policy, average premium per policy, and losses by two occupancy types—residential and condominium—from 1997 through 2006 indicates the following: More than 90 percent of the insured properties annually were residential (single- and two-four family) or condominium properties from 1997 through 2006. Specifically, more than 70 percent of the insured properties were residential properties, and more than 20 percent were condominiums. For residential properties, the average amount of insurance purchased per flood insurance policy ranged from about $170,000 in 1997 to about $235,000 in 2006. For condominiums, the average amount of flood insurance per policy increased from about $98,000 in 1997 to $121,000 in 2006. As mentioned previously, this is consistent with the increase in house values during this period. For residential properties, the average premium decreased from about $522 in 1997 to about $494 in 2006. For condominiums, the average premium decreased from about $216 in 1997 to $201 in 2006. Premiums may have decreased because the number of policies in the moderate- and low-risk zones, which have more affordable premiums, have increased at a greater rate than in other zones—even though the average amount of insurance was increasing. Residential and condominium losses accounted for 82.5 percent and 3 percent, respectively, of all flood insurance losses that occurred from 1997 through 2006. Losses paid out for residential properties ranged from a low of $185 million in 2000 to a high of $15.5 billion in 2005, a result of the Gulf Coast hurricanes. Losses paid out for condominiums ranged from $6.6 million in 2002 to $395 million in 2004, which were largely driven by the 2004 Florida hurricanes. The average loss per claim (for building-only, contents-only, and building and contents policies) was higher for condominiums than for residential properties because the data for condominium includes losses for entire condominium structures, not just individual units. For example, if an insured condominium building flooded, the (building) claim amount would be for the whole building and not for the average amount per unit. See appendix IV for additional detail about policies in force by dwelling type, amount of insurance purchased, average premium, and losses by occupancy type. Funding for NFIP mitigation programs that can be used to acquire properties that are at risk of repetitive flooding has increased from 1997 through 2006, but FEMA’s ability to track the effectiveness of these programs is limited because it does not track property acquisitions real time. As we mentioned earlier, property acquisition is one of the tools that FEMA uses to reduce losses from flood-damaged and repetitive loss properties. FEMA acquires these properties out of funds appropriated for mitigation programs. Three of these programs are funded by the NFIP: the FMA program, the RFC program, and the SRL pilot program. Since 1997, annual funding for FMA more than doubled, while funding for the RFC program and the SRL pilot program remained the same from 2006, the first year of funding, to 2007. While overall funding for mitigation has increased, the total number of properties that have been acquired through the mitigation programs that have expended funds—the FMA and RFC programs—is unknown. As a result, FEMA’s ability to evaluate the effectiveness of the programs, such as the extent to which repetitive loss properties have been acquired, is limited. For the FMA and RFC programs, FEMA does not have real-time property acquisition data because the agency does not require its regional staff to report the status of individual property-level acquisitions to headquarters before a project closes—a process that can take several years—and its current grants management system does not have the capability to capture and track such data. As a result, FEMA management cannot readily access information on the current status of property acquisitions, limiting their ability to evaluate the effectiveness of these programs on a real-time basis. The purpose of the FMA program is to fund activities that reduce or eliminate the long-term risk of flood damage to buildings and other structures insured by NFIP. FEMA data shows that, for the FMA program, funding increased from $12.5 million in fiscal year 1997 to $31 million in fiscal year 2007 (see table 4). During this period, nearly $229 million was appropriated to reduce or eliminate the long-term risk of flood damage to buildings, manufactured homes, and other structures insured under NFIP. For each of fiscal years 2006 and 2007, Congress appropriated $50 million for the RFC and SRL programs. In fiscal year 2006, Congress apportioned $10 million specifically for the RFC program and $40 million for the SRL pilot program. For fiscal year 2007, Congress appropriated a sum of $50 million for the two programs, which FEMA apportioned the same way. RFC funds are intended to assist states and communities in reducing flood damages to insured properties that have had one or more claims of more than $1,000 to NFIP. While funding for the SRL pilot program has been made available since 2006, the application period did not open until January 2008 when program guidance was published. The purpose of the SRL program is to provide grant funds for mitigation projects that reduce or eliminate the long term risk of flood damage to severe repetitive loss residential structures insured under NFIP. According to FEMA data, the FMA program acquired 35 percent of the properties approved for acquisition from fiscal years 1997 through 2007, and the RFC program acquired 19 percent of the properties approved for acquisition from 2006 through 2007. However, FEMA headquarters cannot readily account for the actual number of properties acquired through each of these programs because it does not require real-time reporting of individual acquisitions, and its grant management system does not record purchase information. According to FEMA data, as of October 2007, FEMA approved the acquisition of 980 properties through the FMA program from 1997 through the end of fiscal year 2007. However, FEMA does not routinely track how many of these properties have been acquired until a project closes, which can take several years. According to FEMA’s records, 342 of the 980 properties (35 percent) approved through the FMA program have been acquired through acquisition-only projects, or mixed mitigation projects, which involve acquisition and at least one other type of mitigation, such as relocation, elevation, or floodproofing. Of the 980 properties FEMA approved for acquisition, 952 were approved as acquisition-only projects. As of October 2007, 331 of the 952 properties approved for acquisition were recorded as acquired. However, this number is likely understated because FEMA does not account for property acquisitions until the projects are closed, and no projects have been recorded as closed since 2003 (see table 5). Based on FEMA data provided on properties acquired through the FMA program, the average acquisition amount for acquisition-only projects was more than $55,000. According to FEMA, the remaining 28 of 980 properties approved through the FMA program were approved as mixed mitigation projects. Of the 28 properties approved since 1997, 11 were recorded as acquired (see table 6). However, FEMA headquarters cannot reliably account for the actual number of properties acquired because it does not collect data on individual acquisitions until a project closes, and no mixed mitigation projects have been reported as closed since 1999. FEMA has approved the acquisition of 79 properties through the RFC program since 2006. As of October 2007, FEMA regional offices confirmed that mitigation activities for 15 properties (19 percent) were completed, although none of these projects have been closed officially. According to FEMA officials, the data on property acquisitions are limited because they include only data for completed, or closed, projects. The completion of a mitigation project, which can include mitigation activities for multiple properties, may take several years. The officials stated that a variety of factors can slow or hinder property acquisitions including historic preservation concerns or environmental issues. However, FEMA officials stated that the agency does not require FEMA regional offices to record property acquisitions until an entire project closes. Internal control standards for the federal government direct that transactions be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. While FEMA guidance for mitigation programs requires grantees to submit quarterly performance reports on significant activities, whether work will be completed within the performance period, and cost information, this guidance does not explicitly require the reporting of property acquisitions. The lack of an explicit requirement for FEMA regional offices to record property acquisitions data in a consistent and timely manner hinders FEMA’s ability to account for the extent to which flood-damaged and repetitive loss properties have been acquired through its mitigation programs (thereby decreasing the inventory of these properties). In addition to lacking a requirement to record acquisition data promptly, the information system that FEMA currently uses for the NFIP mitigation programs does not record property acquisition data at all. Prior to 2004, FEMA regional staff recorded data on properties acquired through closed projects into FEMA’s National Emergency Management Information System (NEMIS). In 2004, FEMA transitioned from NEMIS to the Electronic Grants Management System (eGrants) in an effort to meet the intent of the Electronic Government (eGovernment) initiative. While eGrants was envisioned to help manage all phases of grants, the system currently assists in the front end of the grant life cycle by providing grant applicants the ability to electronically search and apply for grants. The eGrants system does not have the capability to capture any acquisition data. That is, eGrants records neither ongoing nor completed property acquisition data for FEMA’s mitigation programs. According to FEMA officials, FEMA is in the process of consolidating all nondisaster grants into one information system that will support the entire grants life cycle from solicitation through closeout. The enhanced information system will track property acquisitions in real-time and will have project closeout capabilities; however, this information system is not scheduled to be completed until 2010. Until the nondisaster grants management system is developed, FEMA will continue to manage grants using eGrants, despite its limited capabilities. While FEMA’s headquarters officials explained that, since 2004 their regional staff have used paper files and electronic spreadsheets to maintain information on property acquisitions for closed projects, FEMA did not provide information on project closures that have occurred since 2004 for the FMA program because they could not easily collect the information from their regional offices. Specifically, when we requested property acquisition data for the 10-year period of our review, FEMA was able to provide data on closed projects for 1997 through 2003 (6 of 10 years) for the FMA program, and for 2006, the first year of the RFC program. FEMA had to collect data from at least two information systems for the FMA program and from paper files for the RFC program. GAO has previously reported on the continued lack of standardization and other inefficiencies in grant administration across agencies, including not aligning federal grant processes with typical grantees’ business processes, inadequate advance information on potential grant availability, and unexplained delays in grant awards. However, a lack of standardization does not preclude FEMA from having a mechanism that allows it to effectively track real-time property acquisition data. As a result of the limitations of eGrants in capturing property acquisition data, FEMA cannot readily determine the extent to which NFIP-funded mitigation programs have been reducing or eliminating the risk of losses from repetitive loss properties, a key measure needed to determine the effectiveness of the program. Coupled with lack of a requirement for staff to consistently and promptly record acquisitions data, the lack of comprehensive data impedes FEMA’s ability to account for the properties acquired through its mitigation programs and hinders its ability to provide Congress with timely information with which to assess the impact of these programs on mitigating losses to NFIP and ensure that limited resources are appropriately allocated. FEMA makes extensive use of contractors who perform critical functions to implement the NFIP. Contractors perform functions such as the collection and reporting of all financial and statistical data and the selling and servicing of some flood insurance policies. While FEMA relies upon contractors to implement the NFIP, our review of FEMA’s monitoring documentation for the BSA contract showed that FEMA did not consistently follow its own monitoring procedures for preparing, maintaining, and reviewing monitoring reports, and was unable to provide copies of the majority of the monitoring reports we requested. Moreover, key FEMA offices that have responsibilities for addressing contractor deficiencies did not coordinate information and actions related to deficiencies identified for the BSA and DSA contractors. As a result, FEMA could not ensure adherence to contract requirements and lacked information critical for effective oversight on key NFIP contractors. Our review found that FEMA staff did not consistently follow monitoring procedures related to the submission, documentation, and review of monitoring reports for the BSA contract. In assessing the extent to which FEMA staff followed their contract-specific procedures, we focused on monitoring of the BSA contractor, which is responsible for all financial and statistical reporting related to NFIP. FEMA lacked comprehensive monitoring policies and procedures for all NFIP-related contracts during the period of our review; instead, FEMA’s procedures were summarized in individual contracts, and, for the BSA contract we reviewed, in a “surveillance plan” that specified monitoring roles and responsibilities. According to the BSA contract, in effect from October 2005 through December 2007, FEMA monitors were to review the BSA’s performance in 10 specific performance areas. FEMA assigned five monitors including a COTR to the BSA contract, and each was required to prepare monitoring reports containing the results of their specific surveillance activities. The reports were to indicate clearly the performance area monitored and whether the performance standard was met, according to an official from the Program Management Office. The surveillance plan also specified that reports were to be submitted in a timely fashion to the COTR and maintained by the COTR for the life of the contract in a quality assurance file. Both the COTR and the Program Management Office were supposed to review the monitoring reports. In March 2008, FEMA provided GAO with a set of contract monitoring procedures that are applicable to all Risk-Insurance NFIP contracts that have performance requirements. However, these procedures were not scheduled to be implemented until May 1, 2008. FEMA did not clearly or consistently follow the requirements to submit a monitoring report as specified in both the BSA contract and the surveillance plan. Seven of these performance areas were to be monitored monthly, one was to be monitored quarterly, and two were to be monitored annually. For the time period we reviewed (from October 2005 through May 2007), FEMA monitors should have produced 380 monthly monitoring reports. In response to our request for all of these monitoring reports, FEMA made 145 available for our review. While monitors stated that some of the missing reports were submitted to either the COTR or the Program Management Office, the monitor, COTR, and the Program Management Office were not able to produce evidence of these reports or their findings. FEMA officials stated that many reports were not prepared because most monitors were detailed to assist with recovery efforts following Hurricane Katrina. However, our analysis shows the majority of the monthly monitoring reports that were required to be prepared throughout 2006 apparently were not. Further, more than 70 percent of the 145 monthly reports we reviewed did not specify the performance areas to which they related (see table 7). For example, some monitoring reports described the contractor’s activities, without specifying what performance area was being reviewed or an assessment of the performance. Because some monitors were responsible for reporting on multiple performance areas, and did not specify the areas on which they were reporting, we could not consistently determine the performance area(s) that the reports were intended to address. Many of the monthly reports were not clearly linked to contract-specified requirements because they used performance area names and numbers that were inconsistent with names and numbers in the BSA contract. When asked about the lack of a direct link to specific performance areas, as listed in the BSA contract, most of the BSA monitors we interviewed stated that they did not know the “number” of the performance area they were to monitor but knew the general areas. When we brought this issue to the attention of FEMA’s Program Management Office in August 2007, it determined that the numbering of performance areas was inconsistent in the BSA contract and the surveillance plan. As a result, the office revised the surveillance plan to make numbering of performance areas consistent with the contract. The surveillance plan also was modified to include the specific names of the monitors responsible for each performance area. FEMA’s inability to provide documentation that clearly indicated how contractor performance linked to contract standards indicates that records had not been properly managed and maintained in accordance with internal control standards for the federal government. FEMA management acknowledged the problem when we presented a preliminary analysis of performance reports and performance standards. While we did not become aware of any significant performance problems with the BSA contractor during the course of our review, our results are inconclusive because most of the monitoring reports were not documented. Given FEMA’s extensive use of contractor’s to implement the NFIP, it is vital that FEMA maintain internal controls, which are critical to ensuring that contractors are performing as required. The lack of documentation and linkages between performance reports and performance areas and the extent to which FEMA effectively monitored the BSA contract revealed weaknesses that could adversely impact the functioning of the NFIP. The majority of the 145 monthly monitoring reports that we reviewed were not date stamped or otherwise annotated to reflect the date they were submitted to either the COTR or the Program Management Office. Moreover, an official from the Program Management Office was unable to provide evidence that her office tracked the dates on which monitoring reports were received from each monitor. In response to our and other queries about the timeliness with which monitoring reports were submitted to the Program Management Office, in July 2007, the office directed monitors to submit their monthly monitoring reports to the COTR on the fifth of each month. The COTR was then directed to review these reports and provide the Program Management Office with a summary of the findings by the tenth of each month. While we did not evaluate monitoring reports submitted after May 2007, these contract-specific policies are a step in the right direction for ensuring that monitoring reports are collected and reviewed in a timely manner. In addition, the COTR and the Program Management Office appeared not to have consistently reviewed the monitoring reports. For example, according to the COTR, the Program Management Office directed monitors to send their monitoring reports directly to the Program Management Office. The COTR did not begin to receive them until July 2007, 21 months into the 27-month BSA contract. Therefore, it was not until July 2007 that the COTR began maintaining a quality assurance file for the BSA contract. While FEMA provided documentation of a portion of the required monitoring reports, FEMA could not provide evidence that they were reviewed systematically by the COTR or the Program Management Office. Internal control standards for the federal government provide that ongoing monitoring that occurs in the normal course of operations is performed continually and is ingrained in the agency’s operations. Moreover, these standards call for clear areas of authority and appropriate lines of reporting. While the surveillance plan established that the COTR had responsibility for collecting monitoring reports from each monitor and maintaining them in a quality assurance file, he was not a part of the process for reviewing monitoring reports until July 2007. As a result of these conditions, the extent to which monitoring reports were being reviewed appropriately and in a timely fashion was unclear. Such conditions could allow performance problems to go unnoticed and potentially worsen, thereby affecting the quality of NFIP. In addition, the failure of the COTR to begin maintaining a quality assurance file until July 2007 meant that a complete file of monitoring reports could not be provided to the Contracting Officer for consideration during contract renewal negotiations. Although the BSA contract was awarded to a different contractor in January 2008, the Contracting Officer would have been unable to determine whether the original contractor had a record of performance problems, potentially useful information to consider when deciding whether to renew a contract. In March 2008, FEMA provided GAO with monitoring procedures that established a clear process through which monitoring reports should be submitted to the COTR and the Program Management Office, and the review steps that should be taken by the COTR. However, these procedures do not specify the role of the Program Management Office in reviewing monitoring reports, or its broader responsibilities for the implementation of the contract monitoring procedures. Again, such conditions could allow performance problems to go unnoticed and potentially worsen, thereby affecting the quality of NFIP. Analysis of FEMA’s efforts to address performance deficiencies for two major NFIP contractors—the BSA and DSA—indicates a lack of coordination between key FEMA officials and a failure to properly document decisions and actions associated with performance problems. Of the 38 monitoring reports that FEMA provided in relation to the BSA contract, and that could be linked to specific performance areas, 2 indicated that performance standards were not met. While no discrepancy reports (which FEMA requires the Contracting Officer to issue when contractors fail to meet specified performance standards) were written as a result of the BSA deficiencies, 18 discrepancy reports were issued for the DSA contract. Two of the 38 BSA monthly monitoring reports that could be clearly linked to performance standards indicated that a performance standard was not met (see table 8). In both cases, one of which involved the failure of the BSA’s computer security system to meet performance standards, and the other related to the contractor’s failure to submit a deliverable to FEMA on time, the COTR determined that a discrepancy report was not necessary and did not inform the Contracting Officer of the contractor’s failure to meet its performance standards. According to the COTR, a discrepancy report was not necessary in the first case because the computer security standards were relatively new at the time and have been updated since. The COTR stated that, in the second case, he used his discretion to determine that a discrepancy report was not necessary and resolved the issue through discussions with the contractor. While only a few deficiencies were identified, the monthly monitoring reports that we reviewed most often found that the performance requirement was met. In two instances, they revealed a lack of coordination between the BSA COTR and the Contracting Officer. The BSA contract stated that if a performance standard was not met, the Contracting Officer was to issue a discrepancy report to which the contractor had to respond. Upon evaluation of the contractor’s response, the Contracting Officer would determine whether a deduction in payment to the contractor was appropriate. The failure of the COTR to share his assessment may be due to the lack of written policies and procedures specifying how such assessments should be shared with the Contracting Officer. While FEMA developed guidance in July 2007 specifying when and how the COTR should communicate discrepancies with the Contracting Officer, this guidance is specifically for the BSA contract. Federal standards for internal control call for appropriate documentation of significant events. Because the COTR did not document and inform the Contracting Officer of his assessment, FEMA management was unaware of the contractor’s failure to meet a performance requirement; the contractor was not penalized financially. Our analysis of the actions taken in connection with the 18 discrepancy reports written from September 2004 through May 2007 on the DSA contract also found that FEMA offices did not coordinate in preparing, documenting, and reviewing these determinations. Specifically, the COTR for the DSA contract, FEMA’s Program Management Office, and FEMA’s Contracting Officer did not coordinate to address the failure of the DSA to meet contract-specified performance standards. Generally, the DSA received discrepancy reports for not processing NFIP policy documents, such as renewals and applications, within required time frames. According to the COTR, these types of deficiencies had minimal negative effects because, in some cases, the universe of documents the contractor processed was so small that the failure to process 10-20 documents in a timely manner resulted in a discrepancy report. But, interviews with the FEMA offices responsible for processing discrepancy reports revealed that FEMA’s Contracting Officer was unaware that the COTR for that contract had sent 18 discrepancy reports to the DSA. According to the Contracting Officer, her office became aware that discrepancy reports had been sent to the DSA in June 2007 during the course of our review. In addition to a lack of communication about the discrepancy reports, some reports lacked required signatures, or evidence that different offices had reviewed the contractor’s responses and determined what, if any, actions would be taken. The discrepancy report is to contain a signature from FEMA’s Contracting Officer; a response from the contractor; FEMA’s subsequent evaluation of the contractor’s response; and the resulting action, such as a payment reduction. While discrepancy reports were to be signed by the Contracting Officer, none of the reports we reviewed had the signatures. The lack of signatures by the Contracting Officer suggests that this officer was unaware of the performance problems associated with the DSA and potentially could have renewed the contract without complete information about the contractor’s performance. Our review also showed a failure to consider the contractor’s written response to the report. According to the DSA contract, FEMA’s determination of payment changes is to be based on consideration of the contractor’s response to the discrepancy report. Neither the contract nor the discrepancy reports specify how the Contracting Officer was to be made aware of contractor performance problems; that is, whether and how either the COTR or the Program Management Office was responsible for informing the Contracting Officer of contractor performance problems. Six reports contained a written response from the contractor, yet none of the reports contained information on FEMA’s assessment of the contractor’s response or its subsequent actions (for example, payment reductions). According to the COTR for the DSA contract, if a contractor did not meet a performance standard, the COTR would arrange for deductions, regardless of the contractor’s stated or written response. Moreover, we found that the 18 discrepancy reports called for a total of more than $55,000 in financial disincentives for the DSA. However, FEMA had not debited nearly $19,000 in financial disincentives from the contractor’s invoices as of January 2008. According to the COTR, the disincentives that had not been debited had been assessed in 6 discrepancy reports prepared from 2005 through 2006. The COTR never gave 2 of these discrepancy reports to FEMA’s accounting department for processing, and the accounting department did not process the remaining 4. According to the COTR, all 6 discrepancy reports were not properly processed due to human error. The COTR said that FEMA had no process by which he could be informed that a financial penalty had been processed as a result of the discrepancy reports. In addition to the 6 unprocessed reports that assessed disincentives, FEMA did not process 2 other reports because they were drafted within the first 6 months of the contract. According to the COTR, the contractor had a 6-month “grace period” for meeting its performance standards; therefore, no financial disincentives were either calculated or applied for these discrepancy reports. However, such a grace period is not specified in the DSA contract. The lack of clear, written policies and procedures regarding the specific roles of various FEMA offices in processing discrepancy reports and ensuring the appropriate application of financial disincentives resulted in the failure of FEMA to process financial disincentives. In the monitoring procedures that FEMA provided to GAO in March 2008, the role of the COTR in identifying deficiencies and communicating them with a representative of the Contracting Officer is specified. However, the procedure does not explain how the Program Management Office will be involved, or how the agency will ensure that financial disincentives are appropriately applied. Various statistical trends reveal that while NFIP is growing and becoming more widely purchased enabling it to more widely diversify its risks, FEMA continues to face a number of challenges in managing this program including a growing number of claims on repetitive loss properties, insufficient information to readily track the property acquisitions of its mitigation programs, inconsistent application of contract monitoring procedures, and inconsistent documentation and coordination of contractor oversight. The ability of FEMA officials to effectively monitor the effectiveness of its flood mitigation programs, as well as its NFIP contractors, is essential to the effective implementation of NFIP. Floods impose an enormous financial burden on the nation’s flood insurer, the federal government. Consequently, FEMA management, Congress, and the public need accurate and timely information to assess the effectiveness of programs designed to mitigate flood-related damages, particularly for repetitive loss properties that account for a significant portion of claims paid under NFIP. We found that FEMA does not have specific written policies for the timely recording of property acquisition data in its mitigation programs. By developing such policies and guidance, FEMA could improve its ability to produce, analyze, and report on property acquisitions and thus improve its ability to assess the operations and effectiveness of these programs. In addition to not requiring the timely recording of acquisition data, since 2004 when FEMA began using eGrants as its grants management system, FEMA has been unable to use this grants management system to record such information. The eGrants system can process “front-end” processes (such as accepting applications) but not subsequent grants management processes (such as project closures). Not having an end-to-end grant management capability makes it particularly challenging for grant management staff to oversee the grant process across their organization. Grant management systems were intended to enhance the ability of federal managers and grant-making agencies to readily collect, analyze, and report information. With its current system limitations, FEMA cannot accurately assess or report the extent to which its mitigation programs are reducing the number of flood-damaged and repetitive loss properties. Deficiencies in FEMA processes relating to NFIP data and performance extend to oversight of contractors responsible for supporting NFIP. For instance, we were unable to link a substantial number of monitoring reports to contract-specified performance areas and were unable to determine, based upon available documentation, the extent to which monthly monitoring reports were submitted on time, systematically reviewed by appropriate officials and offices, and the associated documentation properly filed and maintained. The lack of a framework to ensure that essential oversight and control functions were completed could allow performance problems to go unnoticed or worsen. Furthermore, the lack of documentation to determine the extent to which specific performance standards were met makes it appear that FEMA was not effectively monitoring its contractors, diminishes its ability to determine if and when problems occurred, and may have led the agency to not apply specific financial incentives or disincentives per contract terms (such as when the BSA COTR independently determined that discrepancy reports were not necessary). Given the reliance of NFIP upon contractors, poor contractor performance could diminish the overall quality of program operations and management. In addition to enhancing its management and oversight of its contractors, FEMA also has an opportunity to improve internal operations and communication as they relate to contract oversight functions. Our review indicated a lack of overall contract-monitoring guidance and consequently conflicting understandings of procedures, responsibilities, and authority for addressing contractor deficiencies among FEMA officials and offices. While FEMA developed guidance during the course of our review for all Risk-Insurance NFIP-related contracts that have performance requirements, in part as a result of issues that we identified during our work, revised monitoring procedures were not scheduled to be implemented until May 2008, which was after the period of our analysis. To more accurately track the extent to which flood-prone properties are acquired, we recommend that the Secretary of Homeland Security take the following two actions: Establish written guidance for FEMA regional offices to better ensure consistent and timely recording of property acquisition data. Establish a means to track real-time property acquisitions for NFIP-funded mitigation programs. To ensure more effective oversight of contractors performing key NFIP data collection, reporting, and insurance functions, we also recommend that the Secretary of Homeland Security take the following three actions: Implement a process to ensure that monitoring reports are submitted on time and systematically reviewed by the COTR and the Program Management Office and copies of monitoring reports are retained in a quality assurance file, as directed by the contract. Ensure that FEMA staff clearly monitor each performance standard that the contractor is required to meet in the time frames required by contract and that FEMA staff clearly link monitoring reports and performance areas. Ensure implementation of written guidance for all NFIP-related contracts on how to consistently handle the failure of a contractor to meet standards in performance areas and establish written policies and procedures about the coordination between FEMA officials and offices (including the COTR, the Program Management Office, and the Contracting Officer) when addressing contractor deficiencies, including determining whether and under what circumstances to issue discrepancy reports, and ensuring that financial disincentives are appropriately and consistently applied. We requested comments on the draft of this report from the Secretary of Homeland Security. The Assistant Administrator, Mitigation Directorate, FEMA, provided written comments that are reprinted in appendix VIII. FEMA’s written response also included technical comments, which we incorporated as appropriate. In its written comments, FEMA generally concurred with our recommendations and noted that the agency has taken actions to address the recommendations related to oversight of contractors performing key data collection, reporting, and insurance functions. In particular, the agency stated that it has implemented a procedure whereby monitors will provide a monthly status report to the COTR using a specific format to ensure monitoring is performed in a consistent manner across all contracts; and developed written procedures on monitoring reporting requirements and conducted a training session with all monitors. In commenting on our presentation of information related to mitigation programs that can be used to acquire properties, FEMA headquarters agreed that the agency does not track property acquisition data in real time; that is, between review of project applications and closeout. FEMA stated that it would be inefficient for headquarters to collect real-time data from regional, state, and local partners, and asserted that the added value of such data was unclear. We agree that FEMA lacks an efficient process for collecting data on the extent to which properties have been acquired before a project is closed out and, therefore, recommend that FEMA establish written guidance for FEMA regional offices to better ensure consistent and timely recording of property acquisition data. We disagree that the value of collecting real- time property acquisition data at the headquarters level is unclear. Real- time data would improve FEMA headquarters’ ability to produce, analyze, and report information on ongoing operations and thus improve its ability to assess the effectiveness of its mitigation programs. For example, FEMA headquarters would be able to more accurately assess the rate at which properties are acquired and thus pinpoint within a shorter time frame the extent to which mitigation programs were reducing the number of flood- damaged and repetitive loss properties. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of this report until 30 days from the report date. At that time, we will provide copies to the Chairman, Senate Banking, Housing and Urban Affairs Committee; the Chairman and Ranking Member of the Senate Committee on Homeland Security and Governmental Affairs; the Chairman and Ranking Member of the House Committee on Financial Services; the Chairman and Ranking Member of the House Committee on Homeland Security; and other interested committees. We are also sending a copy of this report to the Secretary of Homeland Security and other interested parties. We also will make copies available to others upon request. In addition, the report will available at no charge on our Web site at http://www.gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. If you or your staff has any questions about this report, please contact me at (202) 512-8678 or williamso@gao.gov. GAO contact and staff acknowledgments are listed in appendix IX. Our objectives were to (1) describe trends for National Flood Insurance Program (NFIP) policies, insurance amounts, premiums, and losses from 1997 through 2006 and the extent to which NFIP losses were attributable to hurricanes and repetitive loss properties; (2) assess how the amounts available for the purchase of flood-damaged properties changed over time, and the extent to which the Federal Emergency Management Agency (FEMA) purchased flood-damaged properties; and (3) evaluate the extent to which FEMA followed its procedures for monitoring selected NFIP- related contracts. To describe overall NFIP statistics, we obtained data from FEMA on policies in force and claims made. We obtained data as of December 31 for each year of the period from calendar year 1997 through calendar year 2006 on policies in force, average insurance per policy in force, and average premium per policy in force. For the claims data, we obtained information (as of May 31, 2007) about the claim dates of losses incurred between January 1, 1997, and December 31, 2006. For all monetary data obtained, we adjusted dollar amounts to 2006 constant dollars using the Shelter Total formulas found in the Consumer Price Index. To describe statistics by flood zone, we first determined in which flood zones the majority of flood insurance policies were located by analyzing the data using SAS software version 9.1. FEMA has mapped flood risks in the United States and in most flood-prone areas has assigned a flood zone designation based on the level of flood risk. Although FEMA uses 12 types of flood zones (see appendix VII), we combined these into four flood zone designations based on risk levels—moderate- to low-risk (Zones B, C, and X); high-risk (Zone A); high-risk coastal (Zone V); and undetermined risk (Zone D). FEMA officials agreed with the way these were combined. In appendix III we also present data on Zone “O” (Other), which is not an official flood zone; rather, FEMA’s contractor uses the designation for coding purposes to indicate missing values or incorrect codes. Less than 1 percent of all policies and less than .5 percent of all losses fell under Zone “O.” In addition, in appendix III we present data on Zone “E” (Emergency Program), which indicates policies in the Emergency Program, which does not assign flood-risk zone designations. Communities participating in NFIP initially enter the Emergency Program. We determined that, for the 10-year period of our review, 99 percent of policies in force were located in the high-risk, high-risk coastal, and moderate- to low-risk zones. We, therefore, reported on these in the body of the report, and provided data on the remaining zones (undetermined risk and Emergency Program) in appendix III. For all flood zones, we obtained data on policies in force, annual average amount of flood insurance purchased, annual average premium, and losses. To describe statistics by occupancy type, we first determined which occupancy types represented the majority of policies in force. We determined that, for the period of our review, residential (single-family and two-four family) properties generally accounted for more than 70 percent of policies in force each year, and condominiums accounted for more than 20 percent of policies in force each year. We reported information on these occupancy types in the body of the report and provided data on the remaining occupancy types (other residential and nonresidential) in appendix IV. We conducted electronic testing of FEMA’s data to identify outliers and missing data elements. We also cross-checked various tables to assess the consistency of the data provided. For example, we compared data on overall losses with the losses reported by flood zone to ensure that the losses reported each year were consistent. According to our electronic testing and cross-checking, we determined that these data were sufficiently reliable for the purposes of this report. We obtained data on FEMA’s average historical loss estimate (the purpose of which is to estimate the amount of premium that would be sufficient to pay for the average level of losses that occurred in past years) for calendar years 1997 through 2006 from FEMA’s Chief Actuary. We interviewed FEMA officials about the basis for the average historical loss estimate, reviewed FEMA’s white paper on the estimate, and reviewed FEMA’s 2006 Actuarial Rate Review for additional information about this estimate. We also obtained data on FEMA’s estimates of catastrophic loss years from FEMA’s Chief Actuary. FEMA prepares the catastrophic loss year estimate, usually every other year, to indicate the maximum amount that NFIP would have to expend during a catastrophic loss year. That is, the estimate is designed to provide Congress with an informal guide on the losses that could occur in the event of a storm that has a 0.1 percent chance of occurring. We did not assess FEMA’s methodology for either of these estimates. To evaluate the extent to which flood-related damages exceeded flood insurance limits, we requested and obtained data from FEMA on flood- insurance policies that were purchased for coverage at the maximum limit for building-only coverage and contents-only coverage for calendar years 1997 through 2005. For policies that contained both building and contents coverage, we obtained data on policies where the maximum insurance limit was purchased for either the building or contents coverage (or both) for calendar years 1997 through 2005. We excluded group flood insurance policies because they have coverage limits that differ from other flood insurance policies. We obtained data on the number of claims that were paid for the resulting subset of flood-insurance policies and the number of claims for which damage data were available. We then identified the number of claims for which flood-related damages exceeded the maximum amount of insurance available and the losses associated with these claims. We presented the data for 1997–2004 and 2005 separately due to the high number of claims that occurred in 2005. For more information, see appendix VI. In conjunction with this work, we also reviewed parts of the 2006 study commissioned by FEMA. To evaluate the extent to which flood-related damages were greater than the amount of insurance purchased, we obtained data on flood insurance policies that were purchased for coverage below the maximum limit for contents coverage, and below the maximum limit for building coverage, for calendar years 1997 through 2005. For policies that contained both building and contents coverage, we obtained data on policies where less than the maximum insurance limit was purchased for either the building or contents coverage (or both) for calendar years 1997 through 2005. We excluded group flood insurance policies because they have coverage limits that differ from other flood insurance policies. We obtained data on the number of claims that were paid for the resulting subset of flood insurance policies and the number of claims for which damage data were available. We then identified the number of claims for which flood-related damages exceeded the amount of insurance purchased and the losses associated with these claims. We presented the data for 1997-2004 and 2005 separately due to the high number of claims that occurred in 2005. To describe the extent to which losses were attributable to repetitive loss properties, we obtained data from FEMA on the net cumulative number of claims filed for repetitive loss properties and the amount of losses FEMA paid out for these properties as of December 31 for each calendar year from 1997 through 2006. We obtained net cumulative data because this is the only way that FEMA collects data on repetitive loss properties. We also obtained data on the net cumulative number of repetitive loss properties for calendar years 1997–2006. According to FEMA officials, the number of repetitive loss properties represents a snapshot in time of the number of insured repetitive loss properties as of the end of each calendar year. The number of claims and amount of losses paid out on repetitive loss properties represents the net cumulative total of all dollars paid out. As a result, based upon the configuration of the available data, we were unable to calculate the average loss paid out to repetitive loss properties. To describe the extent to which losses were paid out for hurricane- damaged properties, we requested information on hurricane-related claims from FEMA for calendar years 1997 through 2006. According to FEMA officials, claims are not coded or notated as being hurricane-related. However, FEMA does maintain a list of “significant events.” To provide GAO data on hurricane-related claims, FEMA identified claims that were associated with significant events, then identified those events that were hurricanes. We did not verify FEMA’s categorizing of claims as being “hurricane-related.” To assess how the amounts available for the purchase of flood-damaged properties have changed over time, we obtained data from FEMA on funding appropriations, obligation authority brought forward, and funding available for the three NFIP-funded mitigation programs. For the Flood Mitigation Assistance (FMA) program, we obtained data for fiscal years 1997 through 2007. For the Repetitive Flood Claims (RFC) program and the Severe Repetitive Flood (SRL) pilot program, we obtained data for fiscal years 2006 and 2007, as both programs were unfunded until 2006. To assess the extent to which flood-damaged properties have been acquired, we also obtained data from FEMA on the number of projects and properties approved for acquisition and the number of properties actually acquired through the FMA and RFC programs, but not the SRL program because guidance for this program was not published until January 2008. FEMA officials informed us that the most reliable information that they could provide on property acquisitions was at the project level. FEMA officials also stated that because not all properties approved for acquisition are ultimately acquired, it may take several years for a project to close. Because FEMA’s grant management system does not track project closures or property acquisitions in real time, the data we report is likely an undercount of the actual number of properties that have been acquired through the FMA and RFC mitigation programs. For the FMA program, FEMA officials obtained data on property acquisitions (for closed projects) that occurred from 1997 through 2003 from FEMA’s Enterprise Data Warehouse. According to FEMA officials, the warehouse data are extracted from the National Emergency Management Information System (NEMIS), the information system FEMA used to manage the FMA program until 2003. In 2004, FEMA transitioned from NEMIS to the Electronic Grants Management System (eGrants) to manage the FMA program. eGrants does not have project closure capabilities; therefore, FEMA was unable to provide any data on property acquisitions for FMA projects that may have closed from 2004 through 2007. While we did not attempt to verify the reliability of this information, we did look for inconsistencies between the number of properties approved for acquisition and the number actually acquired and followed up with FEMA officials for an explanation of any differences. The property acquisition data FEMA provided for the FMA program differentiated acquisition-only projects, and mixed mitigation projects, or projects that mitigate flood-prone properties through acquisition and additional mitigation strategies, such as property elevation. We did not attempt to verify the categorization of acquisition-only or mixed mitigation projects but presented them as provided by FEMA. For the RFC program, which started in 2006, FEMA provided data on properties acquired (through closed projects) from regional FEMA offices, which keep such data in electronic spreadsheets or paper files. We did not attempt to verify the accuracy of this information. To obtain information on the procedures FEMA uses to monitor its NFIP- related contracts, we reviewed contracts awarded in support of NFIP, federal acquisition regulations, a surveillance plan, performance standards, and the template for discrepancy reports (which FEMA requires a Contracting Officer to issue when a contractor fails to meet its performance standards). For selected contracts, we interviewed FEMA officials and staff with responsibility for issuing and overseeing contracts—the Contracting Officer, the manager of FEMA’s Program Management Office, the Contracting Officer’s Technical Representatives (COTR) for each contract we reviewed, and monitors—as well as contractors. To determine how effectively FEMA followed its monthly monitoring procedures, we focused upon the contract for FEMA’s Bureau and Statistical Agent (BSA), which is responsible for collecting and reporting on financial and statistical data for the NFIP. First, we collected documentation of monthly monitoring reports for the period from October 2005 through May 2007 to determine if the reports were submitted by monitors to the appropriate office in a timely manner. We then compared these reports with the contract-specified performance standards to see if FEMA reported on each standard and to assess the extent to which FEMA determined whether the contractor met performance standards. We asked FEMA officials to provide an explanation of missing reports and explain why discrepancy reports were not required when performance standards were not met. In August 2007, we were provided with a Contract Administration Plan for the BSA contract, dated July 25, 2007 (nearly 22 months after the contract award date) that documented the contract administration process. During the course of our work, we learned the NFIP’s Direct Servicing Agent (DSA) contractor had received multiple discrepancy reports from FEMA. To determine if FEMA had followed its stated policies and procedures for addressing deficiencies identified through monitoring, we obtained copies of the discrepancy reports written for the DSA contractor, documentation of the contractor’s responses to the reports, and documentation of financial penalties made against the contractor. We also interviewed the Contracting Officer, the manager of FEMA’s Program Management Office, the COTRs for each contract we reviewed – as well as contractors. We conducted this performance audit in Atlanta, Georgia; Lanham, Maryland; and Washington, D.C., from March 2007 to June 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Under the NFIP, homeowners with mortgages from federally regulated lenders on property in communities identified to be in high-risk flood zones are required to purchase flood insurance for at least the outstanding mortgage amount, up to the maximum policy limit of $250,000. NFIP covers both residential and commercial properties. However, residential (defined as single- and two-four family dwellings) and condominium properties account for more than 90 percent of all policies in force. Optional, lower-cost coverage also is available under NFIP to protect homes in zones designated as moderate- to low-risk. In addition to building coverage, NFIP offers policies to protect personal property (“contents”) against flood damage, up to a maximum of $100,000. The tables and figures in this appendix provide selected information for the period we analyzed on policies in force, insurance coverage amounts, premiums, claims, and losses by calendar year. Tables and figures (see tables 9, 10, 11, 12, 13, 14, 15, and 16 and figures 7 and 8) in appendix II include all data unless specified otherwise. In addition, we provide data on estimates for historical loss years. The estimates are used as one indicator to help set annual premiums in NFIP that would be sufficient to pay for the average level of losses that occurred in past years. Both the average loss per policy and the average loss per claim fluctuated from 1997 through 2006 (See figure 8 and table 13). The average loss per flood insurance claim is the amount that NFIP pays to settle the average claim. The loss per claim (for all flood insurance policy types) averaged around $19,000 from 1998 through 2000, but fluctuated more widely since 2001, with peaks in 2001 as a result of Tropical Storm Allison and in 2005 (at more than $84,000) as a result of the Gulf Coast Hurricanes. According to FEMA, from 2000 through 2004 the average loss per flood insurance policy in force varied from about $82 to about $567. The average annual loss per policy increased significantly in 2005 as a result of the Gulf Coast Hurricanes to $4,189 (See table 14). As shown in table 16, the average historical loss year estimates has increased each year except 2001 and 2003. FEMA’s NFIP studies and maps flood risks, assigning 12 flood zone designations based on the risk level for flooding. We combined FEMA’s flood zone designations into four groups relating to risk levels (see table 17). FEMA agreed with the way we combined the designations. NFIP incorporates the flood zones into Flood Insurance Rate Maps— which also show land elevations and floodplain boundaries—and uses the maps to manage flood risks and help set insurance rates. More specifically, more than 20,300 communities participating in NFIP adopt and enforce the program’s minimum building standards for new construction within identified floodplains; NFIP also uses the maps to help set flood insurance policy rates for properties in a given area based on the designated flood risks. Further, federally regulated mortgage lenders use the maps to identify those property owners who are required to purchase federal flood insurance. To present additional detailed information on NFIP trends, we collated our analyses of policies in force, insurance amounts, premiums, losses, and other information by flood zone in this appendix. For the purposes of our analysis, the tables and figures in this appendix also include the Emergency Program as a zone. The Emergency Program is the initial phase of a community’s participation in the NFIP and was designed to provide a limited amount of insurance at less than actuarial rates. A community participating in the Emergency Program either does not have an identified and mapped flood hazard or has been provided with a Flood Hazard Boundary Map. According to FEMA officials, flood zone designations are not assigned to policyholders that are in the Emergency Program. As a result, FEMA captures data on these policies by referring to their Emergency Program status. Additionally, the FEMA contractor responsible for collection and analysis of NFIP data uses a coding designation of Zone “O” for policies for which flood zone information is missing or erroneous. That is, Zone “O” is not a FEMA flood zone but rather is used to help code data. The tables and figures in this appendix include Emergency Program and Zone O data unless otherwise indicated. The number of policies in force increased to the greatest extent (64 percent) in the moderate- to low-risk flood zone and to the least extent (24 percent) in the high-risk. More specifically, policies in force increased steeply in the moderate- to low-risk flood zone following the Gulf Coast hurricanes in 2005 (see fig. 9 and table 18) as more property owners purchased flood policies. However, as mentioned earlier, a FEMA commissioned study found the penetration rate outside of the high-risk areas to be about 1 percent. The average amount of flood insurance purchased gradually increased in the high risk and moderate- to low-risk zones from 1997 through 2006 (see fig. 10 and table 19). Flood-insurance policyholders in the moderate- to low-risk flood zones consistently purchased on average a higher amount of flood insurance than policyholders in the high-risk and high-risk coastal flood zones. As we mentioned previously, premiums in this zone tend to be more affordable and FEMA has been marketing in these areas through its FloodSmart program (see table 20). Approximately 73 percent of the $26 billion in losses paid from 1997 through 2006 were for properties in the high-risk flood zone, followed by 24 percent in moderate- to low-risk zones, and 3 percent for properties in the high-risk coastal zones. Over time, losses consistently were highest in the high-risk zone. As figure 11 illustrates, for all three of the flood zones analyzed, losses peaked in 2005 as a result of the Gulf Coast hurricanes. See table 21 for supporting data. For single- and two-four family homes, average losses per claim were generally highest in the high-risk zone from 1997 to 2006 (see fig. 12 and table 22). For all three of the flood zones analyzed average losses peaked in 2005. Policies under the NFIP insure buildings categorized into five different occupancy types: single-family, two-four family unit, condominium, other residential, and nonresidential. Other residential includes long-stay hotels or motels and rooming houses. Nonresidential includes small businesses, churches, schools, warehouses, short-stay hotels and motels, and nursing homes. We focused our analysis on the residential (single- and two-four family units) and condominium occupancy types because more than 90 percent of the policies in force each year (from 1997 through 2006) were for those occupancy types. Both the owners of units and condominium associations can take out policies. That is, while a condominium unit owner may purchase flood insurance for the unit, a condominium association could purchase coverage for all of the units in a condominium community. To present additional detailed information on NFIP policy trends, we collated our analysis of policies in force, insurance amounts, premiums, and losses by occupancy type. In this appendix, residential includes all single- and two-four family residences, excluding condominiums. Condominium includes policies that are purchased by condominium associations, which may cover all residential units within that association, as well as policies purchased by individual unit owners. The Emergency Program is separated out, or excluded, in some tables since it is through this program that properties enter NFIP, and participation in this program is temporary. Statistics by occupancy type are presented in tables 23, 24, 25, 26, and 27 and figures 13 and 14. This appendix presents statistics related to the percentage of losses under the program attributable to hurricanes (see table 28), as well as certain properties insured under NFIP of FEMA (see table 29). Repetitive loss properties are those with two or more flood insurance claims filed against them in a 10-year period. FEMA does not collect annual data on the number of repetitive loss properties, the number of losses paid out on repetitive loss properties, or the total amount paid out on repetitive loss properties. Rather, FEMA data on repetitive loss properties are cumulative. For every loss that NFIP pays out, information is collected on the reason for the flood loss, including whether the loss was related to a significant flooding event. To determine whether losses were related to a hurricane, FEMA’s BSA (the contractor responsible for collecting, analyzing, and reporting NFIP financial and statistical data) identified the significant flooding events that were hurricanes from 1997 through 2006. Under NFIP flood insurance can be purchased through policies with building-only coverage, contents-only coverage, or both building and contents coverage. For each coverage type, a policyholder can purchase up to the maximum amount of coverage, depending on the type of structure that they are insuring, and whether it is in the Emergency or Regular Program. NFIP also offers group flood insurance policies to recipients of disaster assistance (generally low-income persons), which provide coverage for 3 years following a flood loss. We excluded data on these policies from our analysis because they have coverage limits that differ from other flood insurance policies. According to FEMA information, data on the amount of flood-related damages that insured properties received are available for more than 99 percent of all claims filed from 1997 through 2004, and 97 percent of all claims filed in 2005 for policies that were purchased at the insurance limit. However, the reliability of available damage data is uncertain. According to FEMA guidance found in the NFIP Transaction Record Reporting and Processing (TRRP) Plan for the Write Your Own (WYO) Program, WYO insurers are required to report “Total Building Damages” and “Total Content Damages” to NFIP. Furthermore, FEMA guidance states that the amounts WYO insurers report to NFIP are not limited to the amount of insurance coverage on the property. However, a 2006 report that FEMA commissioned on NFIP states that in cases where the amount of flood insurance carried was less than the amount of damages, adjusters did not determine losses above the limit. Rather, the adjusters only recorded the losses needed to reach the limit. Therefore, the use of FEMA data to determine the number of claims and the dollars by which damages exceed the insurance limit (tables 30 to 37) is likely to result in an undercount. For single- and two-four family flood insurance policies with building-only, or both building and contents coverage that were purchased at the insurance limit, damage data were available (see table 30) for more than 99 percent of claims filed from 1997 through 2004 and damage data was available for about 98 percent of claims filed for policies with contents- only coverage. For policies with building-only, or both building and contents coverage, damage data were available (see table 31) for almost all claims filed in 2005, damage data was available for about 33 percent of the claims filed with contents-only coverage. For single- and two-four family flood insurance policies with building-only, or both building and contents coverage (see table 32) that were purchased at less than the insurance limit, damage data were available for more than 99 percent of claims filed from 1997 through 2004 and damage data was available for about 98 percent of claims filed for policies with contents- only coverage. For policies with building-only coverage, or both building and contents coverage (see table 33), damage data were available for almost all claims filed in 2005, damage data was available for 39 percent of the claims filed with contents-only coverage. According to NFIP data, properties insured for the maximum flood insurance available and with damage claims that exceeded the insurance maximum represented from 0 to 17 percent of claims filed from 1997 through 2004 (see table 34), and from 1 to 57 percent of claims filed in 2005 (see table 35), depending upon the type of flood insurance coverage and the type of structure insured. Similarly, properties insured for less than the maximum flood insurance available and with damage claims that exceeded the amount of insurance purchased represented from less than 1 to more than 27 percent of claims filed from 1997 through 2004 (see table 36), and from 5 to 71 percent of claims filed in 2005 (see table 37), depending upon the type of flood insurance coverage and the type of structure insured. Zone V: Areas along coasts subject to inundation by the 1-percent-annual- chance flood event with additional hazards associated with storm-induced waves. Because detailed hydraulic analyses have not been performed, no Base Flood Elevations (BFE) or flood depths are shown. Mandatory flood insurance purchase requirements apply. Zones VE and V1-V30: Areas along coasts subject to inundation by the 1- percent-annual-chance flood event with additional hazards due to storm- induced velocity wave action. BFEs derived from detailed hydraulic analyses are shown within these zones. Mandatory flood insurance purchase requirements apply. (Zone VE is used on new and revised maps in place of Zones V1-V30.) Zone A: Areas subject to inundation by the 1-percent-annual-chance flood event. Because detailed hydraulic analyses have not been performed, no BFEs or flood depths are shown. Mandatory flood insurance purchase requirements apply. Zones AE and A1-A30: Areas subject to inundation by the 1-percent- annual-chance flood event determined by detailed methods. BFEs are shown within these zones. Mandatory flood insurance purchase requirements apply. (Zone AE is used on new and revised maps in place of Zones A1-A30.) Zone AH: Areas subject to inundation by the 1-percent-annual-chance shallow flooding (usually areas of ponding) where average depths are between 1 and 3 feet. BFEs derived from detailed hydraulic analyses are shown in this zone. Mandatory flood insurance purchase requirements apply. Zone AO: Areas subject to inundation by the 1-percent-annual-chance shallow flooding (usually sheet flow on sloping terrain) where average depths are between 1 and 3 feet. Average flood depths derived from detailed hydraulic analyses are shown within this zone. Mandatory flood insurance purchase requirements apply. Zone A99: Areas subject to inundation by the 1-percent-annual-chance flood event, but which will ultimately be protected upon completion of an under-construction federal flood protection system. These are areas of special flood hazard where enough progress has been made on the construction of a protection system, such as a dikes, dams, or levees, to consider it complete for insurance rating purposes. Zone A99 may only be used when the flood protection system has reached specified statutory progress toward completion. No BFEs or flood depths are shown. Mandatory flood insurance purchase requirements apply. Zone AR: Areas that result from the decertification of a previously accredited flood protection system that is determined to be in the process of being restored to provide base flood protection. Mandatory flood insurance purchase requirements apply. Zones AR/AE, AR/AH, AR/AO, AR/A1-A30, AR/A: Dual flood zones that, because of the risk of flooding from other water sources that the flood protection system does not contain, will continue to be subject to flooding after the flood protection system is adequately restored. Mandatory flood insurance purchase requirements apply. Zones B, C, and X: Areas identified in the community Flood Insurance Study (FIS) as areas of moderate or minimal hazard from the principal source of flood in the area. However, buildings in these zones could be flooded by severe, concentrated rainfall coupled with inadequate local drainage systems. Local stormwater drainage systems are not normally considered in the community’s FIS. The failure of a local drainage system creates areas of high flood risk within these rate zones. Flood insurance is available in participating communities but is not required by regulation in these zones. (Zone X is used on new and revised maps in place of Zones B and C.) Zone D: Unstudied areas where flood hazards are undetermined, but flooding is possible. No mandatory flood insurance purchase requirements apply, but coverage is available in participating communities. In addition, the FEMA contractor responsible for collection and analysis of NFIP data uses two additional designations when collecting and reporting data by flood zone. Zone “O” (Other) is not a flood zone designation; rather it is used to indicate missing or erroneous data for policies. Policies under FEMA’s Emergency Program, which is the program through which communities enter NFIP, also do not have designated flood zones. Instead, the FEMA contractor captures data on the policies by using their Emergency Program status. In addition to the contact named above, Lawrence Cluff, Assistant Director; Verginie Amirkhanian; Crystal Swain-Bates; William (Rudy) Chatlos; May Lee; Lisa Moore; Barbara Roesmann; Christine San; Paul Thompson; Shamiah Woods; and William T. Woods made significant contributions to this report.

Summary: The Federal Emergency Management Agency (FEMA) and its contractors administer and implement the National Flood Insurance Program (NFIP). GAO designated NFIP as a high-risk area in March 2006, and as of December 2007, FEMA owed more than $17.3 billion to the Treasury for hurricane-related losses. Concerns have been raised about the financial condition of NFIP and FEMA's efforts to mitigate losses and monitor NFIP contractors. This report (1) describes statistical and financial trends for NFIP from 1997 through 2006, (2) assesses the extent to which flood-damaged properties were purchased to mitigate risk, and (3) evaluates procedures for monitoring NFIP-related contracts. For this study, GAO analyzed financial and statistical data on the NFIP and its mitigation programs, reviewed documentation of contract monitoring activities, and interviewed FEMA officials and contractors. The number of federal flood insurance policies in force nationwide increased 36 percent from 1997 through 2006, but most homeowners at risk of flooding still lacked such insurance. While average insurance amounts (per policy) increased 78 percent from 1997 through 2006--consistent with rising home values--the average premium decreased 3 percent from 1997 through 2006, likely driven in part by the increase in policies sold in moderate- to low-risk areas. Conversely, loss amounts fluctuated by year, peaking at more than $17.7 billion in 2005. Seventy-nine percent of the funds paid out through NFIP from 1997 through 2006 were for hurricane-related claims, but the percentages in individual years varied widely (correlating with hurricane activity). Finally, the extent of claim payments attributed to repetitive loss properties (those with two or more claims in a rolling 10-year period) increased from 1997 through 2006, from $3.7 billion to nearly $8 billion, with the most significant increases resulting from the 2005 Gulf Coast hurricanes. Because of data limitations, GAO was not able to determine the actual number of properties acquired through FEMA mitigation programs, which are intended to minimize the damage and financial impact of floods. Information on completed mitigation projects (which encompass multiple properties) indicates that about one-third of properties approved for acquisition from 1997 to 2006 were acquired. However, these data are limited because they do not include a count of properties acquired in ongoing projects. Projects may take several years to complete, and FEMA does not report properties acquired until a project is complete. Further, FEMA collected property acquisition data (for completed projects) in an ad hoc manner because FEMA's grants management system lacks the capability to record acquisition data. As a result, FEMA cannot readily determine the extent to which flood-damaged and repetitive loss properties have been acquired through its mitigation programs. Lack of monitoring records, inconsistent application of procedures, and lack of coordination have diminished the effectiveness of FEMA monitoring of NFIP-related contracts. While federal internal control standards state that records should be properly maintained, FEMA did not consistently follow its monitoring procedures for preparing or maintaining monitoring reports and was unable to provide copies of the majority of monitoring reports GAO requested. Further, FEMA offices did not coordinate information and actions relating to contractor deficiencies and payments. In some cases, key officials were unaware of decisions on contractor performance. As a result, FEMA cannot consistently ensure adherence to contract requirements and lacks information critical for effective oversight of key contractors. Given the reliance of NFIP upon contractors, it is important that FEMA have in place adequate controls that are consistently applied to all contracts.