Within FEMA, the Federal Insurance and Mitigation Administration (FIMA) manages NFIP and receives support from other divisions or offices (see fig. 1). In fiscal year 2013, about 390 FEMA employees, assisted by contractor employees, managed and oversaw NFIP from FEMA’s headquarters in Washington, D.C., and in field locations. FEMA management responsibilities included establishing and updating NFIP regulations, analyzing data to determine flood insurance rates, and training insurance agents and adjusters. As shown in figure 1 above, FIMA comprises three divisions: Risk Analysis, Risk Insurance, and Risk Reduction. Risk Analysis is responsible for flood mapping activities and develops flood mapping policy and guidance. FIMA established its 5-year Risk Mapping Assessment and Planning (Risk MAP) program in 2009 to, among other things, improve the quality of flood data used for mapping and enhance public acceptance of flood maps. FIMA maintains and updates data through Flood Insurance Rate Maps (FIRM) and risk assessments. FIRMs include statistical information such as data for river flow, storm tides, hydrologic/hydraulic analyses, and rainfall and topographic surveys. Risk Analysis staff in the 10 regional offices manage development of flood maps for their geographic areas. Headquarters and regional staff monitor and report flood hazard mapping progress based on program management data provided by FIMA’s three national Production and Technical Services (PTS) contractors and other flood mapping partners. The PTS contractors are private engineering firms working under contract to FIMA and are each responsible for a regional portfolio of flood study projects. The Risk MAP contract is a cost-plus-award-fee (CPAF) contract. Under the contract, FIMA has obligated approximately $410 million from fiscal year 2008 to the end of fiscal year 2013 to the two PTS contractors that we selected for review. Risk Insurance works with private insurers to provide flood insurance for property owners and also encourages communities to adopt and enforce floodplain management regulations. Private insurance companies largely are responsible for insurance sales and claims adjustment under FIMA’s Write Your Own (WYO) program. NFIP’s BSA contractor serves as the focal point of support operations for the WYO insurers. The BSA contractor liaises between the government and independent property and casualty insurance companies that issue federally guaranteed NFIP policies. Among the services the BSA contractor provides are financial and statistical reporting based upon data submissions from the WYO companies, development of forms and information related to NFIP, and various data analyses. The current BSA contract went into effect in January 2008 and expired in December 2013. The BSA contract is cost- plus-fixed-fee (CPFF). FIMA had obligated approximately $80 million to the BSA contractor as of the end of fiscal year 2013. Contract management responsibilities for NFIP are shared between OCPO and FIMA divisions. OCPO officials stated that they are primarily involved in the acquisition planning and contract formation phases of FIMA’s typical contracting process that is illustrated in figure 2. FIMA divisions (which for NFIP contracts we reviewed either would be FIMA’s Risk Analysis or Risk Insurance divisions) are responsible for defining the need for contracting support. Once the need is identified, OCPO works with FIMA divisions on developing statements of work and reporting requirements for contracts. OCPO is represented in the contracting process by a contracting officer, who has the delegated authority to negotiate, enter into, administer, modify, and terminate contracts on behalf of the government. Once the contract is awarded, the contracting officer receives support from the COR during the contract administration phase. The division acquiring the contracted goods and services selects a COR from its staff. The responsibilities of the COR include administering and directing daily operations within the scope of the contract, monitoring contractor performance, ensuring that requirements meet the terms of the contract, and partnering with the contracting officer. The COR is authorized to monitor the contract on behalf of the contracting officer. However, the COR is not authorized to make any contractual commitments or changes that may affect the contract price, terms, or conditions without the approval of the contracting officer. Generally, the COR role can be either part-time or full-time, and is often a collateral duty. FEMA has improved its contract management process since our prior reports. In particular, FEMA has developed policies and procedures that address our previous recommendation on implementing a DHS directive for contract management. Additionally, FEMA divisions have developed contract management guidance that follows best practices for contract administration (see app. I for the key best practices used in our review). Lastly, FEMA has developed guidance for performance reporting. FEMA has made progress in establishing or revising its guidance on contract management and oversight since we reported on these issues in 2008 and 2011. To address weaknesses in its oversight and management of acquisitions, we recommended in 2011 that FEMA complete the development and implementation of its revised acquisition process to be consistent with a DHS directive that sets overall policy and structure for acquisition management for DHS agencies. In May 2011, FEMA published its own directive on the review of contracts that was consistent with the departmental directive. FEMA also updated guidance in October 2011 that explains its acquisition process. The updated guidance was intended as a tool for program offices to use when initiating an acquisition. In particular, the guidance states that the program office is responsible for developing the acquisition plan that includes a description of requirements. If the program office decides not to define how the contractor is to accomplish the desired results of the contract, it can develop a performance work statement that defines the required results in measurable, mission-related terms absent details about how to do the work. The guidance requires that the performance work statement be accompanied by a performance requirements summary that documents the services and performance standards expected and a quality assurance surveillance plan that defines the agency’s plan for ensuring that the contractor has performed in accordance with the performance standards. The guidance includes a template for the performance work statement and an intranet link to a quality assurance surveillance plan template. In addition, FEMA published a revised version of its COR Handbook in March 2012 in response to a DHS directive. According to FEMA, the handbook is intended to provide practical guidance for CORs as they perform their daily contract administration duties. The handbook incorporates best practices in contract management as described in the OFPP guide. For example, the handbook incorporates language that encourages CORs to develop a contract administration plan along with a quality assurance surveillance plan—both OFPP best practices. Contract administration plans are intended to provide a broad overview of the contract, including areas of risk and concern. Quality assurance plans are meant to be used to evaluate the quality and timeliness of the products and services produced by the contractor, and include performance standards, the methods of assessment, and an assessment schedule. Along with policy development, FEMA has adopted an intranet-based system to centralize and electronically store NFIP contracting-related documents, including monitoring reports. In 2008, we recommended that FEMA implement a process to better ensure that CORs submit monitoring reports on time, systematically review these reports, and retain the reports in a quality assurance file. Several FEMA divisions use this intranet-based system. In part to address our 2008 report, FEMA staff in Risk Insurance involved in contract administration began using the system in November 2010. The Risk Insurance division intranet-based system is used by CORs to store and share COR-generated reports. The Risk Analysis division uses the intranet-based system for storing contract documents, particularly contract modifications and task orders submitted by the regional offices. The Risk Insurance and Risk Analysis divisions developed contract management guidance that follows best practices and implements the COR Handbook. More specifically, in December 2012 Risk Insurance finalized the Contracts Management Reference Guide. The guide closely follows the COR handbook and provides Risk Insurance CORs with a high-level overview of FEMA, DHS, and federal acquisition guidance and directs CORs to relevant reference materials. It also follows many of the practices recommended in the OFPP guide for contract administration. For instance, the Contracts Management Reference Guide lists implementation of a contract administration plan and a quality assurance surveillance plan as critical contract administration activities. Furthermore, FEMA’s Risk Insurance division developed additional guidance intended to help ensure consistency in handling the failure of a contractor to meet performance standards. Specifically, Discrepancy Report Procedures guide CORs in such instances. In 2008, we recommended that FEMA develop such guidance after finding that the agency did not coordinate information and actions related to deficiencies for certain contractors. The Discrepancy Report Procedures include guidance for the COR to coordinate with the contracting officer to ensure that the contractor is notified and corrective action is taken. FEMA’s Risk Analysis division has guidance for contract management, but took a different approach from the Risk Insurance division for its design and implementation because of the nature of the Risk MAP program. Risk Analysis established a Risk MAP Contracts Council to help ensure coordination, integration, and alignment of contracts across the Risk MAP program. The council comprises senior contracting officials and all CORs in the Risk MAP program. The Risk Analysis division follows FEMA’s COR Handbook, but has not developed further guidance for CORs like the Risk Insurance Contracts Management Reference Guide. Instead, Risk Analysis developed a number of plans that provide general guidance for contract management staff across the Risk MAP program. FEMA’s COR Handbook recommends such planning documents, which also are consistent with best practices as described in the OFPP guide. For instance, the Program Management Plan, which is a narrative summary of the program’s processes and plans, provides overall contract management guidance for Risk MAP. Several other planning documents provide guidance on specific issues including risk management, quality assurance management, product delivery, and changing task orders. Unlike the Risk Insurance division, Risk Analysis has not developed a distinct deficiency report policy. According to officials, the Risk Analysis division follows an award fee plan for all of the related task orders.