Skip to main content

Transit Security Grant Program: DHS Allocates Grants Based on Risk, but Its Risk Methodology, Management Controls, and Grant Oversight Can Be Strengthened

GAO-09-491 Published: Jun 08, 2009. Publicly Released: Jul 08, 2009.
Jump To:
Skip to Highlights

Highlights

From fiscal years 2006 through 2008, the Department of Homeland Security (DHS) has allocated about $755 million dollars to transit agencies through its Transit Security Grant Program (TSGP) to protect transit systems and the public from terrorist attacks. GAO was asked to evaluate the extent to which (1) TSGP funds are allocated and awarded based on risk; (2) DHS has allocated, awarded, and distributed TSGP grants in accordance with statutory deadlines and leading practices for collaborating agencies; and (3) DHS has evaluated the effectiveness of the TSGP and its investments. To address these objectives, GAO reviewed the TSGP risk model, fund allocation methodology and program documents, such as TSGP guidance, and interviewed DHS and transit officials, among other steps.

DHS has used a risk analysis model to allocate TSGP funding and award grants to higher-risk transit agencies, although transit agency officials have expressed concerns about changes that have occurred since the TSGP's inception, such as revised priorities. The TSGP risk model includes all three elements of risk--threat, vulnerability, and consequence--but can be strengthened by measuring variations in vulnerability. DHS has held vulnerability constant, which limits the model's overall ability to assess risk and more precisely allocate funds. Although the Transportation Security Administration (TSA) allocated about 90 percent of funding to the highest-risk agencies, lower-risk agency awards were based on other factors in addition to risk. In addition, TSA has revised the TSGP's approach, methodology and funding priorities each year since 2006. These changes have raised predictability and flexibility concerns among transit agencies because they make engaging in long-term planning difficult. DHS met the statutory timeline requirements for allocating and awarding grants, but the two agencies that manage the TSGP--TSA and Federal Emergency Management Agency (FEMA)--lack defined roles and responsibilities, and only 3 percent of the funds awarded for fiscal years 2006 through 2008 have been spent as of February 2009. There is no documentation articulating the roles and responsibilities of the agencies, and grant information has not been passed between the two agencies which affected TSA's ability to share grant status information with transit agencies. DHS met statutory deadlines for releasing grant guidance and acting upon applications, but management and resource issues have resulted in delays in approving projects and making funds available, including (1) lengthy project negotiations between transit agencies and TSA; (2) a backlog of required environmental reviews; and (3) a reported lack of personnel to conduct required reviews. As a result, according to FEMA records, as of February 2009, transit agencies have spent about $21 million of the $755 million that has been awarded for fiscal years 2006 through 2008. This spending rate is, in part, caused by agencies receiving authorization to spend grant dollars late in the grant period. Despite concerns over delays, FEMA has not communicated time frames for providing funding. In April 2004, GAO reported that timely grant awards are imperative to provide intended benefits. DHS has reported taking some actions to address delays, including shortening project approval times and hiring staff, but the effectiveness of these efforts is unknown. Although FEMA has taken initial efforts to develop measures to assess the effectiveness of its grant programs, TSA and FEMA lack a plan and related milestones for developing measures specifically for the TSGP, and thus DHS does not have the capability to measure the effectiveness of the program or its investments. Without such a plan, it will be difficult for TSA and FEMA to provide reasonable assurance that measures are being developed to assess the effectiveness of the program as intended. While FEMA is responsible for the financial controls and audits of the TSGP, it does not have a mechanism to systematically collect data and track grant projects throughout the grant process. As a result, FEMA cannot assess whether awards are timely or funds are being used effectively to reduce risk and increase transit system security

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, and to strengthen DHS's methodology for determining risk, the Secretary of Homeland Security should develop a cost-effective method for incorporating vulnerability information into future iterations of the TSGP risk model.
Closed – Implemented
In July 2012, FEMA officials provided an updated risk model for the Transit Security Grant Program (TSGP). FEMA officials noted that for FY 2012, the TSGP risk formula was updated to align with the Homeland Security Grant Program and Port Security Grant Program risk formulas. The TSGP risk formula now contains a distinct vulnerability component weighted at 20 percent of the risk formula. According to FEMA officials, the new vulnerability component was developed in coordination with TSA. The new vulnerability component, which was independently verified by GAO, consists of the following equally weighted metrics: (1) The BASE (Baseline Assessment and Security Enhancement) metric is based on TSA inspection of a transit system's security posture on the 17 Security and Emergency Preparedness Action Items. TSA has selected five of these areas that are most indicative of the operational capabilities of a transit system. The average of these five scores is used to form the BASE data element in the TSGP vulnerability component; and (2) the TTAL (Top Transit Asset List) is a list of assets that DHS considers nationally critical to surface transportation. These assets are also evaluated by TSA to determine the extent to which identified vulnerabilities are remediated, or funded to be remediated, by TSGP projects or other efforts. This is accounted for in the TSGP data element, and assets are weighted on a 1-3 scale (based on their level of completed remediation). Especially important to note is that the vulnerability component of the TSGP model reflects changing capabilities within a transit system, as security programs, whether grant funded or not, are implemented. In this regard, the TSGP model is a step forward because it provides a means for FEMA to justify lower funding as a result of actions taken to reduce vulnerability. This recommendation has been fully implemented.
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, and to strengthen the administration, oversight, and internal controls of the TSGP, the Secretary of Homeland Security should direct TSA and FEMA to define TSA's and FEMA's respective roles and responsibilities for managing the TSGP in a memorandum of understanding (MOU) or similar document.
Closed – Implemented
The Transportation Security Administration (TSA) and Federal Emergency Management Agency (FEMA) signed a Memorandum of Agreement (MOA) which defined the roles and responsibilities with regard to surface transportation security grant programs. In general, the MOA notes that FEMA is responsible for designing and operating the administrative mechanisms needed to implement and manage the Transportation Security Grant Program while TSA coordinates intelligence information and risk/vulnerability assessments, provides the ranking and rating of mass transit assets nationwide, and defines the parameters for identifying, protecting, deterring, responding, and recovering from such incidents. The MOA outlines that grantees should contact FEMA for questions related to the following: award acceptance, grant extensions, financial reporting questions, monitoring and documentation of grantee progress, release and distribution of funding to grantees, and environmental and historical preservation requirements and procedures. Additionally, the MOA notes that grantees should contact TSA for questions concerning the Top Transit Asset List and the priorities of the surface security grant program. This recommendation has been implemented.
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, and to strengthen the administration, oversight, and internal controls of the TSGP, the Secretary of Homeland Security should direct TSA and FEMA to develop a cost-effective plan for monitoring the use of grant funds once projects have been implemented, including a strategy for leveraging resources that could allow TSA surface transportation security inspectors to assist in monitoring the grant projects to ensure that the projects meet the security requirements set out in TSGP guidance.
Closed – Implemented
According to FEMA documentation, FEMA's Preparedness Grants Division underwent a business process improvement initiative in fiscal year 2013 to re-engineer how programmatic monitoring is approached and executed. According to FEMA information, FEMA has developed an approach to help ensure that awards are monitored on an annual basis. Their monitoring approach begins with an initial screening (first-line review) of all open awards within the GPD preparedness grants portfolio. The first-line review allows Program Analysts to collect information that will be used to determine award risk and provide a baseline assessment of open awards. Program Analysts screen each of their grants according to the Prioritization Criteria and results are recorded and calculated on the First-Line Review Survey/Score Sheet. The review encompasses a risk-based rating system to rate and select grantees for advanced monitoring which generates a weighted score that provides an indicator of the need for advanced monitoring. For those grant awards that present additional challenges or need more detailed analysis of apparent grant management or progress reviews, desk reviews and site visits provide an opportunity to more accurately troubleshoot grant issues and to offer technical assistance to grantees. Staff are then able to provide advanced monitoring to high-risk awards identified during the First-Line Review and Prioritization process. Post-Review Activities ensure proper assistance is provided to grantees and that this assistance and the reasons for it are justified to GPD leadership and external resources. According to FEMA, information about the Programmatic Monitoring Approach will be analyzed and refined throughout the process to streamline and optimize monitoring efforts. This recommendation has been implemented.
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, and to strengthen the administration, oversight, and internal controls of the TSGP, the Secretary of Homeland Security should direct TSA and FEMA to develop an interim solution to systematically collect data and track grant activities until FEMA's grants management system can perform these functions, and ensure that both agencies have access to these data.
Closed – Implemented
In July 2016, FEMA officials provided supporting documentation on information sharing activities between FEMA and TSA including spreadsheets tracking the status of grant project funding activities, descriptive lists of proposed projects, and email traffic documentation of the coordination efforts between the two agencies. Together these documents provide an interim solution to systematically collect data and track grant activities until FEMA's grants management system can perform these functions.
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, and to strengthen the administration, oversight, and internal controls of the TSGP, the Secretary of Homeland Security should direct TSA and FEMA to collaborate to develop a plan and milestones for measuring the effectiveness of the TSGP and its administration.
Closed – Implemented
According to FEMA documentation, FEMA and TSA have improved the administration and monitoring of TSGP awards by developing grant assessment methods that consider evolving transit system capabilities and risk characteristics, and developing measures that assess the effectiveness of grant programs. They have new performance metrics designed around the TSA Surface Transportation Security Inspection Program's Baseline Assessment for Security Enhancement (BASE). BASE assessments continue to be used to monitor operational training gaps. The reviews use a stoplight system to categorize agency training capabilities as green, yellow, or red. The colors represent different ranges of capabilities, where green ratings indicate a sound transportation security training program. FEMA and TSA will track progress made in closing training gaps through new measures which were provided. This recommendation has been implemented.
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, the Secretary of Homeland Security should direct FEMA to establish a time frame for revising environmental regulations to be more inclusive of nondisaster homeland security grant programs.
Closed – Implemented
In July 2010, the Federal Emergency Management Agency (FEMA) finalized a Programmatic Environmental Assessment (PEA) which provided an assessment of the expected environmental impacts associated with the implementation of the programs funded by FEMA's Grants Program Directorate (GPD). The implementation of GPD-funded grant programs involve a wide variety of projects designed to improve the preparedness and readiness of public safety and first response agencies, as well as improve homeland security through increased protection of the Nation's critical infrastructure. The PEA supports site-specific environmental evaluations that may be required to determine the nature and extent of impacts resulting from individual actions at specific locations while also allowing FEMA to identify those project types that will not have any impact to the environment and distinguish them from those that may require further analysis. The project types examined in the PEA have been organized into the following seven groups: planning, management and administration, training, exercises, mobile and portable equipment, modification of existing structures and facilities, and new construction. These categories allow FEMA to define those actions that have no environmental impacts, as well as those that require case-by-case consideration to accurately decide the appropriate level of analysis needed to determine environmental impacts. This recommendation has been implemented.
Department of Homeland Security To help strengthen the implementation and oversight of the TSGP, the Secretary of Homeland Security should direct FEMA to establish and communicate time frames for making funds available to transit agencies once FEMA receives project approvals from TSA.
Closed – Implemented
The Federal Emergency Management Agency (FEMA) has taken steps to provide more specific timeframes and information to grantees once project approvals have been received from the Transportation Security Administration. FEMA's Grants Program Directorate-Environmental and Historical Protection (GPD/EHP) has developed specific timeframes for the review of EHP submissions. For example, GPD/EHP has targeted completing its compliance reviews and making a determination on EHP submissions within 15-25 days of initial receipt. Additional timeframes have been built into the process depending on the level of review that needs to be conducted. The EHP review process was a major source of delays in distributing funds, so these timeframes should bring needed clarity to the process. Additionally, in fiscal year 2012, FEMA reformatted its guidance into two separate documents. There is now a separate "Award Administration Information" document specific to the Transportation Security Grant Program (TSGP). GPD pulled out the standard financial, administrative and legal information from the TSGP preparedness kit and created a stand-alone supplement which complements and is inherently related to the TSGP. This is intended to help grantees understand the rules and regulations associated with administering federally-funded grant awards. The new document also contains timeframes for certain aspects of the grant process, such as a requirement that all extension requests must be submitted to FEMA at least 60 days prior to the end of the performance period. This recommendation has been implemented.

Full Report

Office of Public Affairs

Topics

Data collectionEligibility determinationsEmergency preparednessFederal fundsFederal grantsFunds managementGovernment grantsGrant administrationGrant monitoringGrantsHomeland securityInternal controlsMass transitMass transit fundingProgram evaluationProgram managementRail securityRequirements definitionRisk factorsRisk managementSecurity threatsStrategic planningTerrorismTransportation securityPolicies and proceduresProgram implementationGovernment allocation