This is the accessible text file for GAO report number GAO-12-47 
entitled 'Port Security Grant Program: Risk Model, Grant Management, 
and Effectiveness Measures Could Be Strengthened' which was released 
on December 19, 2011. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Report to Congressional Requesters: 

November 2011: 

Port Security Grant Program: 

Risk Model, Grant Management, and Effectiveness Measures Could Be 
Strengthened: 

GAO-12-47: 

GAO Highlights: 

Highlights of GAO-12-47, a report to Congressional Requesters. 

Why GAO Did This Study: 

From fiscal years 2006 through 2010, the Department of Homeland 
Security (DHS) has awarded nearly $1.7 billion dollars to port areas 
through its Port Security Grant Program (PSGP) to protect critical 
maritime infrastructure and the public from terrorist attacks. The 
Federal Emergency Management Agency (FEMA)––a DHS component agency––is 
the agency responsible for distributing grant funds. GAO was asked to 
evaluate the extent to which DHS has (1) allocated PSGP funds in 
accordance with risk; (2) encountered challenges in administering the 
grant program and what actions, if any, DHS has taken to overcome 
these challenges; and (3) evaluated the effectiveness of the PSGP. To 
address these objectives, GAO reviewed the PSGP risk model, funding 
allocation methodology, grant distribution data, and program 
documents, such as PSGP guidance. Additionally, GAO interviewed DHS 
and port officials about grant processes, funding distribution, and 
program challenges, among other things. 

What GAO Found: 

In 2010 and 2011, PSGP allocations were based largely on port risk and 
determined through a combination of a risk analysis model and DHS 
implementation decisions. DHS uses a risk analysis model to allocate 
PSGP funding to port areas that includes all three elements of risk—-
threat, vulnerability, and consequence-—and DHS made modifications to 
enhance the model’s vulnerability element for fiscal year 2011. For 
example, DHS modified the vulnerability equation to recognize that 
different ports can have different vulnerability levels. However, the 
vulnerability equation is not responsive to changes in port security—
such as the implementation of PSGP-funded security projects. 
Additionally, the vulnerability equation does not utilize the most 
precise data available in all cases. DHS addressed prior GAO 
recommendations for strengthening the vulnerability element of grant 
risk models, but the PSGP model’s vulnerability measure could be 
further strengthened by incorporating the results of past security 
investments and by refining other data inputs. 

FEMA has faced several challenges in distributing PSGP grant funds, 
and FEMA has implemented specific steps to overcome these challenges. 
Only about one-quarter of awarded grant funding has been drawn down by 
grantees, and an additional one-quarter remains unavailable (see table 
below). Funding is unavailable-—meaning that grantees cannot begin 
using the funds to work on projects—-for two main reasons: federal 
requirements have not been met (such as environmental reviews), or the 
port area has not yet identified projects to fund with the grant 
monies. Several challenges contributed to funds being unavailable. For 
example, DHS was slow to review cost-share waiver requests—requests 
from grantees to forego the cost-share requirement. Without a more 
expedited waiver review process, grant applicants that cannot afford 
the cost-share may not apply for important security projects. Other 
challenges included managing multiple open grant rounds, complying 
with program requirements, and using an antiquated grants management 
system. FEMA has taken steps to address these challenges. For example 
FEMA and DHS have, among other things, increased staffing levels, 
introduced project submission time frames, implemented new procedures 
for environmental reviews, and implemented phase one of a new grants 
management system. However, it is too soon to determine how successful 
these efforts will be in improving the distribution of grant funds. 

FEMA is developing performance measures to assess its administration 
of the PSGP but it has not implemented measures to assess PSGP grant 
effectiveness. Although FEMA has taken initial steps to develop 
measures to assess the effectiveness of its grant programs, it does 
not have a plan and related milestones for implementing measures 
specifically for the PSGP. Without such a plan, it may be difficult 
for FEMA to effectively manage the process of implementing measures to 
assess whether the PSGP is achieving its stated purpose of 
strengthening critical maritime infrastructure against risks 
associated with potential terrorist attacks. 

Table: Financial Status of PSGP Awarded Funds, Fiscal Year 2006 
through 2010: 

Total funds awarded: $1,676,068,946; 
Funds drawn down by grantees: $394,880,416 (23.6%); 
Funds available to grantees to implement projects: $873,430,493 
(52.1%); 
Funds unavailable to grantees to implement projects: $407,758,036 
(24.3%). 

Source: GAO analysis of FEMA data as of September 2011. 

[End of table] 

What GAO Recommends: 

GAO recommends that DHS strengthen its methodology for measuring 
vulnerability in ports by accounting for how past security investments 
reduce vulnerability and by using the most precise data available. GAO 
also recommends that DHS evaluate the cost-share waiver review process 
and take steps to expedite the process where appropriate and develop a 
plan with milestones for implementing performance measures for the 
PSGP. DHS concurred with GAO’s recommendations. 

View [hyperlink, http://www.gao.gov/products/GAO-12-47]. For more 
information, contact David C. Maurer, (202) 512-9627, MaurerD@gao.gov 
or Stephen L. Caldwell, (202) 512-9610, CaldwellS@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

DHS Allocated PSGP Funds Based Largely on Risk, but the Risk Model Can 
Be Further Strengthened: 

Most Grant Funding Is Available, but $400 Million Is Unavailable Due 
to Various Challenges--Which FEMA Has Begun to Address: 

FEMA Is Developing Measures to Assess PSGP Administration but Does Not 
Have Measures to Assess Effectiveness: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Port Security Grant Program (PSGP) Allocations to Funding 
Groups, by Year: 

Appendix II: PSGP Risk Analysis Model, Fiscal Year 2011: 

Appendix III: Financial Status of PSGP Awarded Funds, Fiscal Years 
2006 through 2010: 

Appendix IV: Cost-Share Waiver Approval Process: 

Appendix V: FEMA's Internal Performance Measures: 

Appendix VI: Comments from the Department of Homeland Security: 

Appendix VII: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: Port Security Grant Program Funding: 

Table 2: Comparison of Allocation to Risk, by PSGP Funding Group, 
Fiscal Year 2011: 

Table 3: Effects of Funding Floor on Fiscal Year 2011 Allocations to 
Port Areas: 

Table 4: Data Components in Vulnerability Index of Fiscal Year 2011 
PSGP Risk Model: 

Table 5: Draw Down Rates by Group, Fiscal Years 2006 through 2010: 

Table 6: PSGP Funding Awarded and Unavailable, by Groups, Fiscal Years 
2006 through 2010: 

Table 7: Changing Cost-Share Requirements in the PSGP, Fiscal Years 
2006 through 2011: 

Table 8: Unused Group I Funding from Cost-Share Years, Fiscal Years 
2007 Supplemental through 2010: 

Table 9: Key DHS Actions Taken to Improve EHP Review Process Since 
Fiscal Year 2009: 

Table 10: Percent of Total PSGP Funding Directed at Each Funding 
Group, Fiscal Years 2007 through 2011: 

Table 11: Financial Status of PSGP Awarded Funds, by Funding Group, 
Fiscal Years 2006 through 2010: 

Table 12: Details on FEMA's Performance Measures to Assess Its 
Administrative Performance: 

Figures: 

Figure 1: Sample Port Area Showing Eligible PSGP Recipients and 
Projects, and Key Port Stakeholders Involved in the Grant Process: 

Figure 2: Location of Group I and Group II Port Areas: 

Figure 3: Overview of the PSGP Grant Process for Fiscal Years 2007 
Supplemental through 2011: 

Figure 4: Status of Awarded Grant Funding, Fiscal Years 2006 through 
2010: 

Figure 5: Comparison of PRMP Approval Dates for 11 Port Areas in Our 
Review to PSGP Grant Milestone Dates: 

Figure 6: Fiscal Year 2011 PSGP Risk Model: 

Figure 7: Review Process for Port Security Grant Program Cost-Share 
Waiver Requests: 

Abbreviations: 

AMSC: Area Maritime Security Committee: 

AMSP: Area Maritime Security Plan: 

ARRA: American Recovery and Reinvestment Act: 

COTP: Captain of the Port: 

DHS: Department of Homeland Security: 

DOT: Department of Transportation: 

EHP: Environmental and Historical Preservation: 

FEMA: Federal Emergency Management Agency: 

GPD: Grant Programs Directorate: 

HIV: High-Interest Vessel Program: 

HSGP: Homeland Security Grant Program: 

HSIN: Homeland Security Information Network: 

MSRAM: Maritime Security Risk Analysis Model: 

MTSA: Maritime Transportation Security Act: 

ND Grants: Non Disaster Grants System: 

NIPP: National Infrastructure Protection Plan: 

NPAD: National Preparedness Assessment Division: 

NRP: National Review Panel: 

OIG: Office of Inspector General: 

PEA: Programmatic Environmental Assessment: 

PRMP: Portwide Risk Mitigation Plan: 

PSGP: Port Security Grant Program 

TSA: Transportation Security Administration: 

TSGP: Transit Security Grant Program: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

November 17, 2011: 

Congressional Requesters: 

Since the terrorist attacks of September 11, 2001, the nation's ports 
have been viewed as potential targets of attack for many reasons. 
According to the Department of Homeland Security (DHS), ports, 
waterways, and vessels are part of an economic engine handling more 
than $700 billion in merchandise annually, and an attack on this 
system could have a widespread impact on global shipping, 
international trade, and the global economy.[Footnote 1] Additionally, 
ports often are not only gateways for the movement of goods, but also 
industrial hubs and close to population centers, presenting additional 
opportunities for terrorists intending to harm U.S. interests. They 
are also potential conduits for weapons prepared elsewhere and 
concealed in cargo designed to move quickly to many locations beyond 
the ports themselves. Further, cruise ships, tankers, and cargo ships 
present potentially desirable terrorist targets given the potential 
for loss of life, environmental damage, or disruption of commerce. 
Balancing security concerns with the need to facilitate the free flow 
of people and commerce remains an ongoing challenge for the public and 
private sectors alike. 

To strengthen the security of the nation's ports against risks 
associated with potential terrorist attacks, DHS administers the Port 
Security Grant Program (PSGP) through its component agency, the 
Federal Emergency Management Agency (FEMA). The Coast Guard provides 
subject matter expertise to FEMA on the maritime industry to inform 
grant award decisions. The PSGP is to provide funding to the nation's 
highest risk port areas[Footnote 2] to support increased portwide risk 
management; to enhance domain awareness; to train and exercise; to 
expand port recovery and resiliency capabilities; and to further 
capabilities to prevent, detect, respond to, and recover from attacks 
involving improvised explosive devices and other nonconventional 
weapons. Since the program's inception in fiscal year 2002, the 
federal government has provided almost $2.5 billion in PSGP funding to 
state, local, and private entities to increase portwide risk 
management, enhance domain awareness, and improve recovery and 
resiliency through the development of security plans, the purchase of 
security equipment, and the provision of security training to 
employees. 

You requested that we evaluate the PSGP, including DHS's methodology 
for determining risk, funding levels for U.S. ports, and the 
management of the program. Our report addresses the extent to which 
DHS: 

1. has allocated PSGP funds in accordance with risk; 

2. has encountered challenges in administering the PSGP and what 
actions, if any, it has taken to overcome these challenges; and: 

3. has evaluated the effectiveness of the PSGP. 

To assess the extent to which PSGP funds were allocated based on risk, 
we analyzed DHS documents, including those related to the grant model 
DHS uses to evaluate port risk and allocate grant money, PSGP 
guidance, and PSGP priorities. Our review of the PSGP risk analysis 
model focused on the fiscal year 2011 model, the most recent 
available. To provide a basis for examining DHS's efforts to carry out 
risk management principles, we compared the PSGP risk analysis model 
to DHS's overall risk management approach as identified in the 
National Infrastructure Protection Plan (NIPP), which it issued in 
June 2006 and updated in January 2009.[Footnote 3] We also reviewed 
the steps that FEMA took to ensure the reliability of the risk model 
by interviewing officials responsible for managing the model as well 
as reviewing DHS's documentation on the model. We determined that the 
model's inputs and results were sufficiently reliable for our purposes. 

To determine whether DHS has encountered challenges in administering 
the PSGP and what actions, if any, it has taken to overcome these 
challenges, we reviewed PSGP guidance, applicable laws, financial data 
for the program as a whole for fiscal years 2006 through 2010, and 
project data from FEMA for all seven Group I port areas--the highest 
risk port areas that receive the most grant funding.[Footnote 4] To 
verify the reliability of the project funding amounts for Group I port 
areas as provided by FEMA, we compared them to the total funding 
provided to each region and found that these amounts aligned. We did 
not include project-level data for Group II port areas due to data 
reliability concerns. Additionally, we did not include project-level 
data for Group III and the All Other Port Areas Group because these 
groups receive a small share of available grant funding and follow a 
different type of funding model. For the purposes of our report, we 
concluded that FEMA's financial data for the program as a whole and 
FEMA's project data for Group I port areas were sufficiently reliable. 
We also gathered information from FEMA on the environmental and 
historical preservation (EHP) review process--a key grant requirement--
to determine the length of time needed to complete this required 
review. However, FEMA was unable to provide complete data on the EHP 
process, so we were unable to comment on the length of time spent 
completing this requirement. Additionally, we conducted site visits 
at, or held teleconferences with, a total of 11 port areas, including 
all 7 Group I port areas and 4 selected Group II port areas. For these 
meetings, we interviewed and collected documents from PSGP fiduciary 
agents--entities that serve as the principal point of contact with 
FEMA for the application, management, and administration of Group I 
and II grant awards. In some cases, we also interviewed and collected 
documents from U.S. Coast Guard officials, who provide subject matter 
expertise for the maritime industry in their port areas. We used 
specific criteria to select these port areas, including levels of 
grant funding, stakeholder recommendations, and geographic diversity. 
While the information we obtained from these 11 port areas cannot be 
generalized to all port areas, it provides comprehensive coverage of 
Group I port areas. Additionally, it enhanced our understanding of the 
types of projects initiated using PSGP funds, the amount of funds 
allocated, awarded, and distributed for these port areas, and the 
challenges faced. Due to significant changes in PSGP management in the 
fiscal year 2007 supplemental funding round--including the 
introduction of the fiduciary agent model in Group I and II port 
areas--our review of program management issues focused on fiscal years 
2007 supplemental through 2011.[Footnote 5] However, to ensure a 
complete analysis of PSGP grant funds that are currently available for 
use, our discussion of the amount of PSGP funding distributed and on-
hold includes fiscal years 2006 through 2010.[Footnote 6] 

To determine the extent to which DHS has evaluated the effectiveness 
of the PSGP, we analyzed available or in-progress performance data and 
measures related to the grant program. To determine what performance 
measurement data had been collected or what measures FEMA might use to 
understand the progress of the PSGP, we interviewed grant officials 
from FEMA's Grant Programs Directorate (GPD) and FEMA's National 
Preparedness Directorate. 

We conducted this performance audit from October 2010 through November 
2011 in accordance with generally accepted government auditing 
standards.[Footnote 7] Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to 
provide a reasonable basis for our findings and conclusions based on 
our audit objectives. We believe the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. 

Background: 

Overview Of U.S. Port Security: 

The United States has approximately 360 commercial sea and river 
ports. While no two ports in the United States are exactly alike, many 
share certain characteristics that make them vulnerable to terrorist 
attacks: they are sprawling, easily accessible by water and land, 
close to crowded metropolitan areas, and interwoven with complex 
transportation networks designed to move cargo and commerce as quickly 
as possible (see fig 1). They contain not only terminals where goods 
bound for import or export are unloaded or loaded onto vessels, but 
also other facilities critical to the nation's economy, such as 
refineries, factories, and power plants. To reduce the opportunity for 
terrorists to exploit port vulnerabilities, port stakeholders are 
taking mitigation steps. For example, port stakeholders have installed 
fences, hired security guards, and purchased cameras to reduce the 
potential for unauthorized entry and help prevent vulnerabilities from 
being exploited. 

Figure 1: Sample Port Area Showing Eligible PSGP Recipients and 
Projects, and Key Port Stakeholders Involved in the Grant Process: 

[Refer to PDF for image: illustration] 

Sample of eligible PSGP recipients and projects: 

1) Facility operators: 
Recipients include oil, gas, and cargo companies. 

2) Local law and fire: Includes sheriff departments, firefighters, 
port police, and local police. 

3) Ferry systems: Includes public and private ferry systems. 

4) Surveillance cameras: CCTV cameras monitor terminal facilities. 

5) Fence/jersey barriers: Fencing and jersey barriers surround 
receiving terminal. 

6) Access control gate: Guarded gate controls access to terminal. 

Key stakeholders involved in PSGP process: 

7) Coast Guard: Review and approve PSGP applications. 

8) Fiduciary agent: Principal point of contact with FEMA for PSGP 
process. 

9) Area maritime security committee: Stakeholders from industry and 
all levels of government rank projects. 

Source: GAO. 

[End of figure] 

Grant Funding for Port Security: 

To help defray some of the costs of implementing security at ports 
around the United States, the PSGP was established in January 2002 
when the Transportation Security Administration (TSA) was appropriated 
$93.3 million to award grants to critical national seaports.[Footnote 
8] In November 2002, the Maritime Transportation Security Act (MTSA), 
which codified the program, was enacted.[Footnote 9] Since the 
supplemental appropriations act for fiscal year 2002, the 
appropriations acts have provided annual appropriations for the PSGP. 
FEMA is responsible for designing and operating the administrative 
mechanisms needed to implement and manage the grant program.[Footnote 
10] The Coast Guard--which is generally the lead federal agency for 
port security--provides subject matter expertise for the maritime 
industry and participates in project award decisions. From fiscal year 
2002 through fiscal year 2011, nearly $2.5 billion has been allocated 
to the PSGP, as shown in table 1. 

Table 1: Port Security Grant Program Funding[A]: 

Fiscal Year: 2002; 
Funding: $93 million; 

Fiscal Year: 2003; 
Funding: $244 million[B]; 

Fiscal Year: 2004; 
Funding: $179 million; 

Fiscal Year: 2005; 
Funding: $141 million; 

Fiscal Year: 2006; 
Funding: $168 million; 

Fiscal Year: 2007; 
Funding: $201 million; 

Fiscal Year: 2007S[C]; 
Funding: $110 million; 

Fiscal Year: 2008; 
Funding: $389 million; 

Fiscal Year: 2009; 
Funding: $389 million; 

Fiscal Year: ARRA[D]; 
Funding: $150 million; 

Fiscal Year: 2010; 
Funding: $288 million; 

Fiscal Year: 2011; 
Funding: $235 million; 

Total: 
Funding: $2.50 billion. 

Source: FEMA's annual PSGP grant guidance: 

[A] Target funding amounts as presented in FEMA's annual grant 
guidance. Total appropriation for the program is higher than funding 
in the table because FEMA receives a percentage of the allocation for 
management and administration of the program. This table has not been 
adjusted for inflation. 

[B] This figure includes $169 million in PSGP funding and $75 million 
in additional funding for port security under the Urban Area Security 
Initiative--another DHS grant program that provides funding for 
building and sustaining national preparedness capabilities. 

[C] Funding level pursuant to the fiscal year 2007 supplemental 
appropriation. 

[D] Funding level pursuant to appropriations in the American Recovery 
and Reinvestment Act (ARRA). Pub. L. No. 111-5, 123 Stat. 145, 164 
(2009). 

[End of table] 

Risk Management Practices Associated with the PSGP: 

In recent years, we, the Congress, the President, the Secretary of 
Homeland Security, and others have endorsed risk management as a way 
to direct finite resources to areas that are most at risk of terrorist 
attack. Risk management is a continuous process that includes the 
assessment of threats, vulnerabilities, and consequences to determine 
what actions should be taken to reduce one or more of these elements 
of risk. One way in which DHS has applied risk management principles 
to the PSGP is through the use of a risk model to assess the relative 
risk posed to ports throughout the nation and to help determine PSGP 
eligibility and funding levels. The PSGP risk methodology is similar 
to the methodology used to determine funding eligibility for other DHS 
state and local grant programs. The model consists of three variables: 
threat (the relative likelihood of an attack occurring), vulnerability 
(the relative exposure to an attack), and consequence (the relative 
expected impact of an attack). Data for each of these variables are 
collected from offices and components throughout DHS, as well as from 
other data sources, and then, using the model, each port is ranked 
against one another and assigned a relative risk score. At the 
recommendation of the Coast Guard, DHS considers some ports as a 
single cluster--known as a port area--due to geographic proximity, 
shared risk, and a common waterway. Based on risk, each port area is 
placed into one of three funding groups--Group I, Group II, or Group 
III.[Footnote 11]Ports not identified in Group I, II, or III are 
eligible to apply for funding as part of the "All Other Port Areas" 
Group.[Footnote 12] Figure 2 below shows the location of port areas 
for groups I and II--the two highest risk groups that receive the bulk 
of grant funding. 

Figure 2: Location of Group I and Group II Port Areas[A]: 

[Refer to PDF for image: illustrated U.S. map] 

Group I: 
California: 2; 
Delaware: 1; 
Louisiana: 1;
New Jersey: 1; 
New York: 1; 
Pennsylvania: 1; 
Texas: 1; 
Washington: 1. 
[Delaware-New Jersey-Pennsylvania: indicated as a single port area] 

Group II: 
Alabama: 1; 
Alaska: 1; 
California: 2; 
Connecticut: 1; 
Florida: 7; 
Georgia: 1; 
Guam: 1; 
Hawaii: 1; 
Idaho: 1; 
Illinois: 1; 
Indiana: 1; 
Kentucky: 1; 
Louisiana: 3; 
Maine: 1; 
Maryland: 1; 
Massachusetts: 1; 
Michigan: 1; 
Minnesota: 1; 
Mississippi: 1; 
New York: 1; 
North Carolina: 2; 
Ohio: 3; 
Oregon: 1; 
Pennsylvania: 1; 
Puerto Rico: 2; 
South Carolina: 1; 
Tennessee: 2; 
Texas: 3; 
Virginia: 1; 
Washington: 1; 
West Virginia: 1; 
Wisconsin: 1. 
[Idaho-Oregon-Washington: indicated as a single port area] 
[Illinois-Indiana: indicated as a single port area] 

Source: GAO analysis of PSGP grant guidance. 

[A] Icons connected by dotted lines indicate a single port area. 

[End of figure] 

To promote a regional approach to risk management in the highest risk 
port areas, FEMA required--beginning with the fiscal year 2007 
supplemental guidance--that all Group I and II port areas--the highest 
risk port areas--develop and implement a Portwide Risk Mitigation Plan 
(PRMP). The primary goal of a PRMP is to provide a port area with a 
mechanism for considering its entire port system strategically as a 
whole, and to identify and execute a series of actions designed to 
effectively mitigate risks to the system's maritime critical 
infrastructure. 

Overview of PSGP Grant Cycle: 

DHS creates PSGP grant guidance annually which provides the funding 
amounts for each group, eligible applicants, and the application 
materials for funding under the program. As shown in figure 3, there 
are three stages of the PSGP grant cycle: allocation, award, and 
distribution. 

Figure 3: Overview of the PSGP Grant Process for Fiscal Years 2007 
Supplemental through 2011[A]: 

[Refer to PDF for image: illustration] 

Stage 1, Allocation: 

Risk: 

Group I: 7 Highest Risk Port Areas; 
Group II: 48 Next Highest Risk Port Areas; 
Designated Allocation to Each Port Area. 

Group III: 35 Lowest Risk Port Areas; 
Allocation to Group as a Whole. 

Stage 2, Award: 

Group I and II Award Process:  

FEMA awards port area's allocation to fiduciary agent. Applicants 
submit project proposals to fiduciary agent.  

Each port area conducts a field review to evaluate project proposals 
and select projects to fund using its allocation.  

Selected projects are vetted by the National Review Panel. 

FEMA notifies fiduciary agent of approved projects. Fiduciary agent 
notifies applicant. 

Group III Award Process: 

Applicants submit project proposals to FEMA. 
      
FEMA screens projects for eligibility. Eligible projects are returned 
to the port area, where they are evaluated by the field review team. 

The National Review Panel evaluates all submitted projects and selects 
projects to fund. 
      
FEMA awards grant funding for selected projects directly to applicant. 

Stage 3, Distribution: 

Distribution of Grant Funds: When the applicant fulfills all post-
award grant requirements, FEMA distributes the funds and applicants 
can begin work on approved projects. 

Source: GAO analysis of FEMA documents related to the PSGP grant 
process. 

[A] Ports in the All Other Port Areas Group are not part of the risk 
model but follow the same process as Group III for award and 
distribution. 

[End of figure] 

Allocation Process: 

Each port area's allocation is driven by the results of the PSGP risk 
analysis model. However, the allocation process varies among groups as 
described below. 

* Groups I and II: The risk model determines the port areas at high 
risk of a terrorist attack and DHS places them in either Group I 
(highest risk group) or Group II (next highest risk group). In fiscal 
year 2011, there were 7 port areas in Group I and 48 port areas in 
Group II. Each port area in these groups is allocated a specific 
amount of funding based on its risk score. 

* Group III: Group III ports represent the next risk grouping of port 
areas based on the risk model scores. For fiscal year 2011, there were 
35 port areas in Group III. However, unlike Groups I and II, these 
port areas do not receive a specific allocation based on risk. 
Instead, DHS allocates a set amount of funding to Group III as a whole 
and port areas within Group III compete against each other for this 
funding based on risk and project effectiveness. 

* All Other Port Areas: Port areas not evaluated using the risk model, 
but which operate under an Area Maritime Security Plan (AMSP), 
[Footnote 13] are eligible to compete for funding with the All Other 
Port Areas Group--in a manner similar to Group III, but without using 
risk scores as a factor in project selection. 

Award Process: 

After DHS announces the allocation amounts for all of the groups 
through the release of the grant guidance, applicants must apply for 
funding--either through the fiduciary agent or directly to FEMA--
within 45 days of the release of the grant guidance. Applicants are 
entities within a port area--such as port authorities, facility 
operators, and state and local government agencies--that provide port 
security services. During the award process, DHS and the U.S. 
Department of Transportation (DOT) evaluate the port areas' projects 
and determine which projects to fund. Before the projects reach DHS 
and DOT for review they are vetted locally. The local evaluation 
process--known as field-level review--for Groups I and II differs from 
that of Group III and All Other Port Areas Group as described below. 

* Groups I and II: Beginning with the fiscal year 2007 supplemental 
guidance, port areas in Groups I and II received a single direct 
funding allocation based on risk.[Footnote 14] Once the allocation is 
made, stakeholders in the port area then undergo a collaborative 
process to determine the projects to fund with the grant allocation. 
To help manage the new direct allocation process, DHS introduced the 
use of fiduciary agents to help manage the PSGP at the local level and 
ensure that all port partners were incorporated into the planning and 
grant allocation processes. For Group I and II port areas, FEMA awards 
the port area allocation to each port area's selected fiduciary agent. 
According to the grant guidance, while the fiduciary agent acts as the 
principal point of contact with FEMA for application, management, and 
administration of the Group I and II grant awards, the fiduciary agent 
is not the sole decision maker regarding the use of the PSGP grants. 
Instead, a field-level review process is conducted by the applicable 
Coast Guard Captain of the Port (COTP) in coordination with DOT, the 
Maritime Administration, and appropriate personnel from the Area 
Maritime Security Committee (AMSC) including federal, state, and local 
agencies.[Footnote 15] At the completion of the field-level review 
process, the COTP--through the fiduciary agent--submits to FEMA a 
prioritized list of projects for funding ranked from highest to lowest 
in terms of their contributions to risk reduction and cost 
effectiveness. Once the COTP submits this information, DHS begins its 
national review process for Group I and II port areas. 

[Side bar: The Puget Sound Port Area: 
In fiscal year 2010, the Puget Sound Port Area-—a Group 1 that includes
port area Seattle-—received over $20 million in PSGP funding. This 
money was awarded to the Fiduciary Agent-—the Marine Exchange of Puget 
Sound. 

A subcommittee of a dozen federal, state, local, and private sector 
officials then reviewed and recommended funding for 27 projects to 15 
different port entities. Projects were then forwarded to FEMA for 
final review. 
Source: GAO. End of side bar] 

* Group III and All Other Port Areas: Unlike Groups I and II, grant 
projects in Group III and the All Other Port Areas Group are 
determined through a competitive process. Port entities in these two 
groups submit their project proposals directly to DHS for review. DHS 
reviews the projects for eligibility, and approved projects are 
grouped by port area and sent to the corresponding COTP for further 
review. At this point, the process mirrors the Group I and II process. 

Before grant awards are finalized, project proposals undergo a 
national review process conducted by the National Review Panel (NRP), 
a group of subject matter experts from DHS and DOT. During the 
national review process, the NRP reviews all submitted projects for 
eligibility, and makes a final funding recommendation to the Secretary 
of Homeland Security. 

Distribution Process: 

PSGP funds cannot be distributed to grantees to begin projects until 
DHS ensures the grantee's compliance with federal grant management 
requirements. FEMA's GPD is responsible for ensuring that all grant 
projects adhere to federal grant requirements, including all EHP 
requirements. For example, the National Environmental Policy Act 
requires DHS to analyze the possible environmental impacts of each 
project funded by a DHS grant.[Footnote 16] In addition to federal 
requirements, DHS also directs all applicants to provide detailed 
budgets for the requested funds at the time of application. Until FEMA 
is satisfied that all requirements have been met, no grant funding can 
be distributed to begin projects--rather the grant funding is 
considered "unavailable." Once FEMA makes funds available to grantees, 
port entities must complete the grant project within the designated 3- 
year performance period.[Footnote 17] For example, for fiscal year 
2009 projects, the performance period began on June 1, 2009. During 
this grant period, the City of Houston received approval for the 
second phase of a radio system project. By the time the project 
cleared local and federal review and funds were made available it was 
March 16, 2011--leaving the city about 14 months to implement the 
project before the performance period end date of May 31, 2012. 

DHS Allocated PSGP Funds Based Largely on Risk, but the Risk Model Can 
Be Further Strengthened: 

PSGP Allocations Were Largely Based on Port Risk and DHS 
Implementation Decisions: 

For fiscal years 2010 and 2011, DHS allocations of PSGP funds were 
based on DHS's risk model and implementation decisions, and were made 
largely in accordance with risk. For example, we found that 
allocations to port areas were highly positively correlated to port 
risk, as calculated by the risk model.[Footnote 18] In addition to the 
risk scores of the port areas, DHS made two implementation decisions 
when finalizing grant allocations for fiscal year 2011. First, DHS 
opted to direct the majority of available funding to the highest risk 
port areas. Second, DHS chose to limit fluctuations in grant funding 
from year to year to any given port area.[Footnote 19] Overall, as 
shown in table 2 below, DHS directed 60 percent of available grant 
funding to the 7 Group I port areas in fiscal year 2011, which 
represented about 54 percent of the total risk for port areas, 
according to the model's determination of risk.[Footnote 20] 

Table 2: Comparison of Allocation to Risk, by PSGP Funding Group, 
Fiscal Year 2011:[Footnote 21] 

Group I; 
Port areas in funding group: 7; 
Fiscal year 2011 group allocation: $141.0 million; 
Percent of total grant funding allocated to group: 60.0%; 
Percent of total risk represented by group as determined by the risk 
model: 54.4%. 

Group II; 
Port areas in funding group: 48; 
Fiscal year 2011 group allocation: $70.5 million; 
Percent of total grant funding allocated to group: 30.0%; 
Percent of total risk represented by group as determined by the risk 
model: 42.1%. 

Group III; 
Port areas in funding group: 35; 
Fiscal year 2011 group allocation: $11.8 million; 
Percent of total grant funding allocated to group: 5.0%; 
Percent of total risk represented by group as determined by the risk 
model: 3.5%. 

All other port areas[A]; 
Port areas in funding group: N/A; 
Fiscal year 2011 group allocation: $11.8 million; 
Percent of total grant funding allocated to group: 5.0%; 
Percent of total risk represented by group as determined by the risk 
model: N/A. 

Source: GAO analysis based on FEMA grant guidance and PSGP risk model. 

[A] These port areas are not included in the PSGP risk model. The All 
Other Port Areas Group is open to ports not included in a Group I, II, 
or III port area but which operate under an applicable AMSP. 

[End of table] 

After DHS determined the percentage of total funding it would direct 
to each group, it then provided each port area within Groups I and II 
with a designated allocation based on the results of the risk model. 
For example, in fiscal year 2011, the average allocation to a Group I 
port area was about $20 million, with allocations ranging from about 
$12 million for the Delaware Bay port area to about $30 million for 
the New York-New Jersey port area. The average allocation to a Group 
II port area was about $1.5 million, with allocations ranging from $1 
million, received by 21 Group II port areas, to $3.5 million for the 
Chicago/Lake Michigan port area. In contrast to Groups I and II, port 
areas in Group III or the All Other Port Areas Group do not receive a 
designated allocation. Instead, port areas in Group III and the All 
Other Port Areas Group compete within their group for a portion of the 
group's total funding--which was about $11.8 million for each group in 
fiscal year 2011. 

In addition to directing the majority of available grant money to the 
highest risk port areas, DHS also opted to provide stability in the 
funding levels of Group I and II port areas through another 
implementation decision. To achieve this stability, DHS utilized 
funding "floors" in the fiscal year 2011 risk model, which limited how 
much a port area allocation could decrease from year to year, despite 
changes in risk identified by the model.[Footnote 22] A senior FEMA 
official reported that floors were used in the fiscal year 2011 PSGP 
risk model to mitigate wide fluctuations in funding so that port areas 
could better plan for long-term security improvements. This official 
also noted that floors have been used in the PSGP risk model since 
fiscal year 2008 and were also used in the fiscal year 2011 Homeland 
Security Grant Program (HSGP) risk model. 

In the fiscal year 2011 model, DHS set the funding floor for Group I 
port areas at 25 percent--meaning that the port area's funding level 
could not decrease by more than 25 percent from its fiscal year 2010 
allocation regardless of how much its risk profile changed. Similarly, 
for fiscal year 2011, DHS set the funding floor for Group II port 
areas at 50 percent--meaning that the port area's allocation could not 
decrease by more than 50 percent from its fiscal year 2010 allocation 
regardless of changes in risk. According to FEMA data, if the floors 
had not been used in fiscal year 2011, the allocations to 3 Group I 
port areas would have fallen by more than 25 percent and the 
allocations to 8 Group II port areas would have fallen by more than 50 
percent. However, due to the use of funding floors, these 11 port 
areas collectively received fiscal year 2011 allocations that were 
about $11.6 million--or about 26 percent--higher than their risk 
profiles would have indicated. See table 3 below. 

Table 3: Effects of Funding Floor on Fiscal Year 2011 Allocations to 
Port Areas[A]: 

Group: I; 
Port area: Port A; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $361,997; 
Percent increase in allocation over what risk model would have 
indicated: 2.5%. 

Group: I; 
Port area: Port B; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $7,308,096; 
Percent increase in allocation over what risk model would have 
indicated: 74.5%. 

Group: I; 
Port area: Port C; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $2,325,071; 
Percent increase in allocation over what risk model would have 
indicated: 24.1%. 

Group: II; 
Port area: Port D; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $248,751; 
Percent increase in allocation over what risk model would have 
indicated: 13.4%. 

Group: II; 
Port area: Port E; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $198,318; 
Percent increase in allocation over what risk model would have 
indicated: 14.4. 

Group: II; 
Port area: Port F; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $271,472; 
Percent increase in allocation over what risk model would have 
indicated: 20.3%. 

Group: II; 
Port area: Port G; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $107,997; 
Percent increase in allocation over what risk model would have 
indicated: 8.2%. 

Group: II; 
Port area: Port H; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $124,059; 
Percent increase in allocation over what risk model would have 
indicated: 9.7%. 

Group: II; 
Port area: Port I; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $102,390; 
Percent increase in allocation over what risk model would have 
indicated: 10.2%. 

Group: II; 
Port area: Port J; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $128,750; 
Percent increase in allocation over what risk model would have 
indicated: 12.9%. 

Group: II; 
Port area: Port K; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $416,831; 
Percent increase in allocation over what risk model would have 
indicated: 41.7%. 

Group: Total; 
Port area: 11 port areas; 
Effect of funding floors on port area allocations: 
Additional allocation received beyond what risk model would have 
indicated: $11,593,732; 
Percent increase in allocation over what risk model would have 
indicated: 26.1%. 

Source: DHS. 

[A] Funding floors limit how much a port area's allocation can 
decrease from year to year, regardless of changes in risk identified 
by the model. This table shows the 11 port areas that received a 
higher PSGP allocation in fiscal year 2011 than their risk profiles 
would have indicated as a result of the inclusion of funding floors. 

[End of table] 

DHS Revised the Vulnerability Index of the PSGP Risk Model but 
Additional Changes Could Further Strengthen the Measure: 

In fiscal year 2011, DHS modified how port vulnerability--the relative 
exposure to an attack--is calculated in the PSGP risk model, but 
additional changes could improve how vulnerability is measured in the 
model. Prior to fiscal year 2011, the PSGP risk model held 
vulnerability constant, rather than accounting for differences across 
ports. We have reported on the value of measuring vulnerability in 
risk analysis models in two prior reports.[Footnote 23] In June 2008, 
we reported that DHS chose to hold vulnerability constant and consider 
all states and urban areas equally vulnerable in the HSGP risk 
analysis model, which reduced the value of the model in estimating 
risk.[Footnote 24]In June 2009, we reported that DHS also chose to 
consider all transit agencies equally vulnerable in its Transit 
Security Grant Program (TSGP) risk analysis model.[Footnote 25] 
Regarding both models--which are similar in structure to the PSGP risk 
model--we recommended that DHS formulate a method to measure 
vulnerability in a manner that captures variations across 
jurisdictions, and apply this vulnerability measure in future 
iterations of the grant allocation model. To respond to these 
recommendations and other external feedback regarding the grant 
programs, and to produce a more complete risk picture, DHS modified 
the vulnerability index in the fiscal year 2011 PSGP model such that 
vulnerability is no longer held constant.[Footnote 26] Instead, the 
new vulnerability index recognizes that different ports can have 
different vulnerability levels. In the fiscal year 2011 PSGP model, 
port vulnerability is assessed using four data components thought to 
influence a port's vulnerability to attack, as shown below in table 4. 
The fiscal year 2011 PSGP risk model is provided in full in appendix 
II. 

Table 4: Data Components in Vulnerability Index of Fiscal Year 2011 
PSGP Risk Model: 

Data Element: Ferry Passengers; 
Definition: The average daily ferry ridership for any ferry lines that 
began or ended in a port during the 2008 calendar year. 

Data Element: Cruise Ship Passengers; 
Definition: The annual number of cruise ship passengers that embarked 
on a cruise ship from that port during the 2009 calendar year. 

Data Element: Foreign Vessel Calls; 
Definition: The number of foreign-flagged vessels that arrived in a 
U.S. port during the 2010 calendar year with a foreign port as their 
last port of call. 

Data Element: HAZMAT Population; 
Definition: The volume of hazardous materials that transited through a 
port during the 2008 and 2009 calendar years multiplied by the 
population in a 5-mile radius around that port. 

Source: DHS. 

[End of table] 

Although FEMA has taken the first step towards improving how port 
vulnerability is measured in the PSGP risk model, further improvements 
are needed to ensure that the vulnerability score for a specific port 
is responsive to changes in security that may occur in that port--such 
as the implementation of new security measures. The fiscal year 2011 
vulnerability index does not provide a mechanism to account for how 
new security measures--such as the installation of cameras or the 
provision of additional training to security officials --affect a 
port's vulnerability, even if those security measures were funded 
using PSGP grant dollars. This limitation is due to the fact that the 
data elements within the vulnerability index are counts of activities, 
which recognize the number of activities that may occur--such as how 
many ferry passengers board a ferry--but do not account for the 
protective actions taken to secure them. For example, if a port 
installed security cameras throughout a ferry system to monitor vessel 
or ferry passenger activity, one would expect to reduce the ferry 
system's vulnerability to attack. However, because the "ferry 
passenger" data element within the model's vulnerability index is 
simply a count of passengers utilizing the ferry system and is not a 
reflection of the security measures in place to protect the ferry 
system, the new camera system would not reduce the port's 
vulnerability score as calculated by the risk model. Thus, with this 
type of measure, in this example, a port could only reduce its 
vulnerability score by reducing the number of passengers utilizing the 
ferry system. The model's robustness is thereby limited because 
activity counts do not reflect improvements made to port security. 

It is important to note that some security improvements may be 
captured by the inclusion of the Coast Guard's Maritime Security Risk 
Analysis Model (MSRAM) results in the PSGP risk model.[Footnote 27] 
The MSRAM data--which are updated annually--provide information to the 
model on the percentage of national high-risk assets that reside 
within each port. However, MSRAM does not account for all types of 
security improvements because it is an asset-based model that assesses 
improvements to individual port assets such as a ferry terminal or a 
chemical plant. As such, MSRAM is not designed, for example, to 
evaluate security projects that may affect multiple assets in a port. 

The National Infrastructure Protection Plan states that when measuring 
vulnerability, one should describe all protective measures in place 
and how they reduce vulnerability. FEMA officials reported that 
capturing data on all security improvements would be challenging due 
to the need to collect and validate data for all ports included in the 
PSGP risk model. However, FEMA officials acknowledged the importance 
of incorporating completed security projects as part of the 
vulnerability component of the risk model and stated that FEMA will 
continue to refine its vulnerability assessments. Without accounting 
for the reductions in vulnerability achieved through new security 
measures implemented in a port, including those funded through the 
PSGP, the robustness of the risk model may be limited and not 
accurately reflect the relative risk of port areas throughout the 
nation. Instead, the risk model would likely continue to recognize the 
same ports as the highest risk, regardless of the security 
improvements made in those ports. In addition, by not accounting for 
security improvements resulting from PSGP grants, the security 
benefits of the PSGP are also not recognized. Incorporating completed 
security projects into the vulnerability component of the risk model 
could help increase its robustness and more accurately direct 
allocations to the highest risk port areas. 

While FEMA officials reported that developing an improved 
vulnerability index that incorporates the effect of security 
improvements would be a challenging process, there are interim 
measures that FEMA could take to ensure that the most precise data 
available are being used to populate the existing vulnerability index. 
FEMA made some progress in this regard by modifying how the HAZMAT 
Population data component was calculated in the fiscal year 2011 
model.[Footnote 28] Rather than measuring only hazardous materials 
imports, as was done in the fiscal year 2010 and prior models, the 
modified measure also accounts for the transit of hazardous materials 
through a port where the port is not their final destination, 
providing added precision to the model. However, there are more 
precise data available that FEMA is not currently utilizing for at 
least one additional data component within the vulnerability index--
foreign vessel calls. 

In the fiscal year 2011 model, the foreign vessel calls component 
provides a count of foreign-flagged vessels arriving in U.S. ports 
that have a foreign port as their last port of call. However, this 
measure does not account for the variation in risk profiles of these 
vessels--as not all foreign vessels are considered to be of equal 
risk, according to the Coast Guard. Because the Coast Guard does not 
view all vessels to be of equal risk, it has developed a procedure to 
identify and target for boarding those vessels that it deems to pose a 
high relative security risk to a port. This program--called the High-
Interest Vessel (HIV) Program--collects data that classify arriving 
vessels according to risk, using multiple factors to establish the 
vessel's risk profile.[Footnote 29] According to a Coast Guard HIV 
program official, HIV data would provide a better indicator of the 
risk posed by vessels arriving from foreign ports than a vessel count 
would provide. He also reported that the Coast Guard already maintains 
these vessel data and they could be analyzed to determine areas with 
higher frequencies of high-risk vessel arrivals, although it would 
require the Coast Guard to extract data from multiple sources to 
conduct a port-by-port analysis. The National Infrastructure 
Protection Plan states that DHS is responsible for using the best 
available information to conduct risk analysis and risk management 
activities. FEMA officials reported that they considered using HIV 
data in fiscal year 2011 but determined that due to time constraints, 
it would be more straightforward to use a count of foreign-flagged 
vessels during the first iteration of the vulnerability index. 
However, FEMA officials reported that they will continue to research 
additional data elements for inclusion in future year risk models. 
Using data from the HIV Program--which the Coast Guard already 
collects--in future iterations of the risk model could position FEMA 
to better capture the vulnerability of port areas posed by vessels 
arriving from foreign ports and thereby improve the precision of 
allocations to high-risk port areas. 

Most Grant Funding Is Available, but $400 Million Is Unavailable Due 
to Various Challenges--Which FEMA Has Begun to Address: 

FEMA awarded nearly $1.7 billion in port security grants in fiscal 
years 2006 through 2010. As shown in figure 4 below, grantees have 
"drawn down" about one-quarter of funds--or about $395 
million.[Footnote 30] Further, about half of the funds are "available" 
to grantees to begin work on projects.[Footnote 31] However, about one-
quarter of funds are "unavailable" to grantees.[Footnote 32] 

Figure 4: Status of Awarded Grant Funding, Fiscal Years 2006 through 
2010: 

[Refer to PDF for image: illustration] 

Funds Drawn Down: $394.8 million (23.6%); 
Available Funds: $873.4 million (52.1%); 
Unavailable Funds: $407.8 million (24.3%). 

Source: GAO analysis of FEMA data as of September 2011. 

[End of figure] 

Grantees Have Drawn Down About One-Quarter of Awarded PSGP Grant Funds: 

As shown in table 5 below, FEMA awarded nearly $1.7 billion in port 
security grants in fiscal years 2006 through 2010; however, less than 
24 percent--or about $395,000 million--had been drawn down as of 
September 2011. 

Table 5: Draw Down Rates by Group, Fiscal Years 2006 through 2010[A]: 

Group I; 
Total PSGP funding awarded: $920,508,263; 
Amount of funding drawn: down by grantees: $160,476,245; 
Percent of awarded funds drawn down: 17.4%. 

Group II; 
Total PSGP funding awarded: $531,998,959; 
Amount of funding drawn: down by grantees: $109,788,562; 
Percent of awarded funds drawn down: 20.6%. 

Group III; 
Total PSGP funding awarded: $143,003,552; 
Amount of funding drawn: down by grantees: $80,702,875; 
Percent of awarded funds drawn down: 56.4%. 

All other port areas; 
Total PSGP funding awarded: $80,558,172; 
Amount of funding drawn: down by grantees: $43,912,734; 
Percent of awarded funds drawn down: 54.5%. 

Total; 
Total PSGP funding awarded: $1,676,068,946; 
Amount of funding drawn: down by grantees: $394,880,416; 
Percent of awarded funds drawn down: 23.6%. 

Source: GAO analysis of FEMA data as of September 2011. 

[A] For a complete summary of the financial status of PSGP funds, see 
appendix III. 

[End of table] 

Although draw down rates are often cited as a measure of progress in 
improving port security, FEMA officials stated that draw down rates 
are not an accurate reflection of progress made in improving port 
security because grantees do not always draw down their funds 
promptly. Thus, even though progress may be underway in improving port 
security, until the grantee draws down their funds, this progress is 
not evident. FEMA officials reported that grantees may not draw down 
their grant funds right away for two main reasons. First, as a 
reimbursement grant program, grantees are not eligible to draw down 
awarded PSGP funds until they have incurred a cost. FEMA officials 
reported that costs for PSGP grants are often not incurred until late 
in the grant performance period. For example, grantees may choose to 
wait until project completion before paying contractors to ensure that 
the project is completed according to the terms of the contract. Thus, 
the draw down of grant funds would occur late in the performance 
period, after project completion. Second, grantees may choose not to 
draw down funds immediately after incurring a cost. Instead, the 
grantee might choose to wait until the end of the performance period 
to draw down funds or choose to draw down funds at select points 
throughout the year. Often, according to FEMA officials, this delay is 
due to the parameters of local accounting systems or the need to seek 
approval from local government entities before requesting 
reimbursement. As a result of these two factors, grantees have likely 
made more progress towards implementing grant projects to improve port 
security than is reflected in the draw down numbers, according to FEMA 
officials. 

To encourage grantees to draw down funds more promptly, FEMA's GPD 
released an information bulletin in January 2011 requesting that 
whenever possible, grantees draw down funds no less than on a 
quarterly basis. According to the information bulletin, more frequent 
draw downs would provide a more accurate representation of FEMA grant 
fund usage.[Footnote 33] According to FEMA data on monthly draw down 
rates over time, there was an initial increase in draw down rates for 
some grant years after the information bulletin was released, but draw 
down rates have since leveled off. 

One-Quarter Of Awarded PSGP Grant Funding Is Unavailable To Grantees 
Due to Various Challenges: 

Of the nearly $1.7 billion in port security grants that FEMA awarded 
to port areas in fiscal years 2006 through 2010, more than $400 
million--or about 24 percent--remained unavailable to grantees as of 
September 2011, as shown in table 6 below. Grantees cannot use 
unavailable funds to begin work on security projects. 

Table 6: PSGP Funding Awarded and Unavailable, by Groups, Fiscal Years 
2006 through 2010[A]: 

Group I; 
Total PSGP funding awarded: $920,508,263; 
Unavailable funds: $242,252,671; 
Percent of awarded funding that is unavailable: 26.3%. 

Group II; 
Total PSGP funding awarded: $531,998,959; 
Unavailable funds: $144,090,543; 
Percent of awarded funding that is unavailable: 27.1%. 

Group III; 
Total PSGP funding awarded: $143,003,552; 
Unavailable funds: $13,943,075; 
Percent of awarded funding that is unavailable: 9.8%. 

All other port areas; 
Total PSGP funding awarded: $80,558,172; 
Unavailable funds: $7,471,747; 
Percent of awarded funding that is unavailable: 9.3%. 

Total; 
Total PSGP funding awarded: $1,676,068,946; 
Unavailable funds: $407,758,036; 
Percent of awarded funding that is unavailable: 24.3%. 

Source: GAO analysis of FEMA data as of September 2011. 

[A] For a complete summary of the financial status of PSGP funds, see 
appendix III. 

[End of table] 

There are two types of unavailable funds--funds that are "unused" and 
funds that are "on-hold." Unused funds--which exist only in Group I 
and II port areas--are funds which the port area has been awarded but 
has not yet used for specific projects.[Footnote 34] For example, as 
shown in table 6 above, approximately $242 million in grant funding 
awarded to Group 1 port areas was unavailable as of September 2011. Of 
this, about $116 million--or 48 percent--was unavailable because the 
funds have not been used for specific projects.[Footnote 35] The 
second type of unavailable funds--on-hold funds--exist in all four 
funding groups, and result when FEMA has approved the use of grant 
funding for a specific grant project, but compliance with postaward 
requirements--such as environmental and budgetary reviews--has not 
been completed. [Footnote 36] Until these postaward requirements are 
met, these grant funds remain "on-hold." Each type of unavailable 
funding--unused and on-hold--results from a different set of 
challenges, as discussed below. 

Three Challenges Contributed to Unused Grant Funds: 

Development and Approval of Risk Mitigation Plans Contributed to 
Delays in Using Funds: 

One challenge that PSGP program officials reported contributed to 
delays in using awarded grant funds was the implementation of the Port-
Wide Risk Mitigation Plan (PRMP) requirement. This PRMP requirement 
was announced in August 2007 for the fiscal year 2007 supplemental 
grant round and was part of a broader FEMA effort to shift the grant 
program from supporting asset-specific projects--such as fences around 
a facility--that benefited just one facility, to supporting more 
regional, portwide projects--such as interoperable communication 
systems--that would benefit an entire port area. This new requirement 
caused delays because port areas were not eligible to submit specific 
projects to FEMA for approval until their PRMP was approved, and many 
PRMP submissions and approvals were delayed. The fiscal year 2007 
supplemental grant guidance included a time line and specific 
deliverables to guide port areas in the plan development and approval 
process.[Footnote 37] Based on this time line, all port area PRMPs 
should have been finalized by May 2008. However, only 3 of the 11 port 
areas we interviewed had an approved plan in place by this time. Plans 
for the remaining 8 port areas were approved between July 2008 and 
September 2009. In June 2011, a senior FEMA official told us that FEMA 
did not hold stakeholders to the time lines for plan development 
because the time lines were unreasonably aggressive for some port 
areas. Another senior FEMA official stated that FEMA did not want to 
rush the plan development process because that could have been 
detrimental to the quality of the plans. Due to the delayed plan 
submissions, FEMA faced challenges in approving draft plans. For 
example, the senior FEMA official reported that it was difficult to 
convene the review panel to approve plans on a sporadic basis. Thus, 
rather than hold weekly or biweekly meetings to discuss one or two 
plans, which would pose a burden on their federal partners on the 
review panel, FEMA instead held review panel meetings every 2 months. 
As a result, the official reported that it took longer than expected 
to approve risk mitigation plans which then delayed the submission of 
grant projects from port areas. Until a port area's PRMP was approved, 
it was not eligible to submit projects to FEMA for approval. As a 
result, the delays associated with PRMP approval contributed to delays 
in the use of grant funds. For example, the PRMP for the Columbia-
Snake River System was not approved until September 2009, meaning that 
the port area could not submit projects to FEMA for approval for more 
than 2 years after the fiscal year 2007 supplemental grant guidance 
was released, creating delays in the use of grant funds in this port 
area. 

Managing Multiple Open Grant Rounds--with Varying Cost-Share 
Requirements--Posed a Challenge to Using Grant Funds: 

Fiduciary agents and FEMA officials reported that the initial delays 
resulting from delays in PRMP approval were exacerbated by the fact 
that multiple grant rounds--beginning with the fiscal year 2007 
supplemental grant round when the PRMP requirement was announced--were 
underway by the time port area PRMPs were approved and that these 
grant rounds had varying cost-share requirements. In the case of all 
11 port areas in our review, multiple grant rounds had been announced--
through the release of grant guidance--before the port area's PRMP was 
approved, as shown in figure 5. 

Figure 5: Comparison of PRMP Approval Dates for 11 Port Areas in Our 
Review to PSGP Grant Milestone Dates: 

[Refer to PDF for image: timeline] 

August 2007: 
FY 2007S Grant Guidance Released; 
PRMP Requirement Announced. 

February 2008: 
FY 2008  Grant Guidance Released. 

April 2008: 
New York/New Jersey  and New Orleans Plans Approved. 

May 2008: 
PRMP Approval Deadline; 
Sabine-Naches River Plan Approved. 

July 2008: 
Houston Galveston Plan Approved. 

August 2008: 
Delaware Bay Plan Approved. 

September 2008: 
Baltimore Plan Approved. 

November 2008: 
FY 2009 Grant Guidance Released; 
Los Angeles/Long Beach Plan Approved. 

January 2009: 
San Francisco Bay Plan Approved. 

February 2009: 
Jacksonville Plan Approved. 

April 2009: 
Puget Sound Plan Approved. 

May 2009: 
FY 2009 ARRA Grant Guidance Released. 

September 2009: 
Columbia-Snake River Plan Approved. 

December 2009: 
FY 2010 Grant Guidance Released. 

Source: GAO analysis. 

[End of figure] 

For example, both the fiscal year 2007 supplemental and the fiscal 
year 2008 grant rounds had been announced--in August 2007 and February 
2008 respectively--before the first PRMPs--for the New York-New Jersey 
port area and the New Orleans port areas--were approved in April 2008. 
In some cases, additional grant rounds were announced before port area 
PRMPs were approved. For example, as shown in figure 5, four grant 
rounds (fiscal year 2007 supplemental, fiscal year 2008, fiscal year 
2009, and ARRA) were announced before the Columbia-Snake River Port 
Area's PRMP was approved in September 2009. 

With multiple grant rounds open, applicants could choose under which 
grant year to apply for funding. Fiduciary agents and FEMA officials 
reported that the cost-share requirement was a significant factor in 
applicant decisions regarding under which grant year to apply for 
funding.[Footnote 38] 

As shown in table 7 below, the PSGP has traditionally required a cost-
match, but this requirement has been modified or waived in numerous 
grant rounds as a result of legislative action. 

Table 7: Changing Cost-Share Requirements in the PSGP, Fiscal Years 
2006 through 2011: 

Grant round: Fiscal year 2006; 
Cost-share requirements[A]: 
Public-sector applicants: 25 percent cash match; 
Private-sector applicants: 50 percent cash match. 

Grant round: Fiscal year 2007; 
Cost-share requirements[A]: 
Public-sector applicants: 25 percent cash match; 
Private-sector applicants: 50 percent cash match. 

Grant round: Fiscal year 2007S[B]; 
Cost-share requirements[A]: 
Public-sector applicants: 25 percent cash match; 
Private-sector applicants: 50 percent cash match. 

Grant round: Fiscal year 2008; 
Cost-share requirements[A]: 
Public-sector applicants: 25 percent cash match; 
Private-sector applicants: 50 percent cash match. 

Grant round: Fiscal year 2009; 
Cost-share requirements[A]: 
Public-sector applicants: 25 percent cash or in-kind match; 
Private-sector applicants: 50 percent cash or in-kind match. 

Grant round: Fiscal year 2009 ARRA; 
Cost-share requirements[A]: 
Public-sector applicants: Match waived; 
Private-sector applicants: Match waived. 

Grant round: Fiscal year 2010; 
Cost-share requirements[A]: 
Public-sector applicants: Match waived; 
Private-sector applicants: Match waived. 

Grant round: Fiscal year 2011; 
Cost-share requirements[A]: 
Public-sector applicants: Match waived; 
Private-sector applicants: Match waived. 

Source: PSGP grant guidance, fiscal years 2006 through 2011. 

[A] Values in this table represent the minimum contribution required. 
For fiscal years 2006 through 2009, the required match was waived for 
projects with a total cost less than $25,000. 

[B] The match requirement was waived for funds used to support the 
development of the Portwide Risk Mitigation Plan. 

[End of table] 

Fiduciary agents in 8 of 11 port areas in our review reported a 
lessened demand for grant funds in grant years where there was a cost-
share requirement, particularly for fiscal years 2008 and 2009. 
Fiduciary agents cited a variety of challenges with the cost-share 
requirement, including: (1) applicants were aware of long delays in 
the distribution of grant funds and faced difficulty preserving the 
cost-share obligation in their entity's budget while pending receipt 
of awarded grant funds, (2) facility owners who were compliant with 
security requirements under MTSA were hesitant to invest their own 
money for additional security projects beyond the requirements, and 
(3) applicants were unable to afford the cost-share requirement due to 
the economic downturn. For example, one fiduciary agent reported that 
while she generally supports a cost-share requirement because it 
ensures stakeholder buy-in, the cost-share requirement has been 
challenging due to the poor economic environment. As a result of the 
cost-share, this fiduciary agent reported conducting three distinct 
rounds of project solicitations in the fiscal year 2008 grant round in 
order to generate enough demand to spend the port area's entire 
allocation. We reported in October 2010 that a cost-share requirement 
is a key factor for effective federal grants because it ensures that 
federal grants supplement--rather than substitute for--stakeholder 
spending. We further reported that a cost-share requirement is 
reasonable given that grant benefits can be highly localized.[Footnote 
39] 

As a result of the inconsistent cost-share requirement, several 
fiduciary agents told us that applicants were more likely to request 
funding under the grant rounds with the most lenient cost-share 
requirement or delay project submission while waiting to learn whether 
or not the next round of grants would include the cost-share 
requirement. This uncertainty about the cost-share requirement created 
a disincentive for grant applicants to request funding during cost-
share years. For example, the fiduciary agent in one port area told us 
that the port area received project proposals totaling twice the port 
area's total allocation for fiscal year 2011. Thus, projects had to be 
denied for fiscal year 2011 funding during the field-level review, 
even though more than $9 million in fiscal year 2008 and 2009 grant 
money remained unused. As shown in table 8 below, a greater portion of 
money from cost-share years remains unused as compared to money from 
non-cost-share years, even though cost-share grant years preceded the 
non-cost-share grant year. For example, about 22 percent of grant 
funding awarded to Group 1 port areas during cost-share years remains 
unused, as compared to less than 4 percent during fiscal year 2010, 
when the cost-share requirement was waived.[Footnote 40] 

Table 8: Unused Group I Funding from Cost-Share Years, Fiscal Years 
2007 Supplemental through 2010A: 

Cost-share requirement in place: 

Fiscal year 2007 supplemental; 
Group I award: $66.0 million; 
Unused funds: $10.3 million; 
Percent of award unused: 15.6%. 

Fiscal year 2008; 
Group I award: $220.8 million; 
Unused funds: $47.2 million; 
Percent of award unused: 21.4%. 

Fiscal year 2009; 
Group I award: $217.8 million; 
Unused funds: $52.2 million; 
Percent of award unused: 24.0%. 

Total; 
Group I award: $504.6 million; 
Unused funds: $109.7 million; 
Percent of award unused: 21.8%. 

Cost-share requirement waived: 

Fiscal year 2010; 
Group I award: $173.1 million; 
Unused funds: $6.1 million; 
Percent of award unused: 3.5%. 

Total; 
Group I award: $173.1 million; 
Unused funds: $6.1 million; 
Percent of award unused: 3.5%. 

Source: GAO analysis of FEMA data as of September 2011. 

[A] While a cost-share requirement was in place prior to the fiscal 
year 2007 supplemental grant round, funding can only remain unused for 
specific projects under the fiduciary agent model, where port areas 
are given a designated allocation. As a result, we have excluded 
fiscal year 2006, fiscal year 2007, and the ARRA grant rounds from 
this analysis. This analysis also excludes fiscal year 2011--in which 
the cost-share requirement was waived--because it fell outside the 
scope of this report due to the timing of the grant cycle. 

[End of table] 

Waiver Process Exacerbated the Effects of the Cost Sharing; Further 
Efforts Could Improve the Process: 

Fiduciary agents reported that the lengthy cost-share waiver process--
used by applicants seeking an exemption from the required cost-share--
further exacerbated the impact of the cost-share requirement under the 
PSGP. Grant applicants unable to meet the cost-share requirement are 
eligible to apply for a waiver. The waiver approval process requires 
22 steps--which include approval by leadership within FEMA's GPD, 
approval by FEMA's Administrator, and finally, approval by the 
Secretary of Homeland Security.[Footnote 41] According to statute, the 
Secretary can grant a waiver of the cost-share requirement if she 
determines that a proposed project is meritorious but cannot be 
undertaken without additional federal support.[Footnote 42] However, 5 
of the 11 fiduciary agents we interviewed told us that they had 
concerns with the cost-waiver request process--including with the 
length of time required for a decision. For example, one fiduciary 
agent--who oversaw a cost-waiver application that took about 7 months 
to be approved--told us that the cost-waiver request process was time-
consuming and confusing. According to FEMA officials, an unknown 
portion of this 7-month approval process was spent ensuring that the 
fiduciary agent had submitted all of the required documentation and 
thus, the actual approval time once the request was finalized was less 
than 7 months. 

The cost-share requirement was waived for all applicants under the 
ARRA, fiscal year 2010, and fiscal year 2011 grant cycles. However, 
grant applicants may continue to submit cost-share waiver requests for 
new projects to be funded under the fiscal year 2007 supplemental, 
fiscal year 2008, and fiscal year 2009 grant cycles--which were cost-
share years--if money in their port area remains unused from those 
years. As shown earlier in table 8, about $110 million in PSGP funds 
awarded to Group I port areas from fiscal year 2007 through 2009--
years in which the cost-share was required--remains unused. As port 
areas solicit projects for these unused funds, some applicants may 
submit cost-share waiver requests as well. For example, one fiduciary 
agent from a Group 1 port area reported that her port area recently 
completed the field-review process to identify projects to fund using 
their unused fiscal year 2009 grant monies. As a result, the port area 
submitted 10 projects to FEMA for approval in October 2011, of which 8 
projects include a cost-share waiver request. 

Although FEMA has taken steps to improve the cost-waiver process, it 
continues to be lengthy and additional efforts may help expedite these 
reviews. In July 2009, FEMA issued an information bulletin to clarify 
the process that grantees should follow when submitting cost-share 
waiver requests.[Footnote 43] Since the issuance of this information 
bulletin, FEMA has received a total of 31 cost-share waiver requests--
of which, 22 were approved.[Footnote 44] In November 2009, following a 
Fiduciary Agent Workshop, FEMA released written responses to questions 
posed at the workshop. In this document, FEMA stated that a decision 
on a waiver request could be expected approximately 30 days after all 
documentation was provided to FEMA in accordance with the process 
outlined in the July 2009 information bulletin. However, according to 
FEMA records, for cost-share waivers reviewed since December 2009 DHS 
took--on average--126 days to approve a request once all of the 
required information had been received. Approval time lines ranged 
between 55 days and 268 days for these waiver requests. Of the 126 
days, on average, it took 74 days from the date requests were 
considered complete to achieve approval by GPD's leadership. It took 
an additional 52 days, on average, to complete the remaining 11 steps 
of the waiver process--including approval at the Administrator of FEMA 
level and the Secretary of Homeland Security level. According to DHS, 
due diligence requires both component and department level clearances, 
including secretarial clearance, in order to responsibly award 
funding. This process ensures that PSGP projects meet program goals 
and objectives. However, FEMA records show that no approval 
recommendations from GPD leadership were overturned as a result of the 
additional 52 days, on average, of required review. Further, only 1 of 
the 31 waiver requests submitted since the July 2009 information 
bulletin was issued has been denied--and it was denied at the GPD 
level. 

Standards for Internal Control in the Federal Government state that 
"pertinent information should be identified, captured, and distributed 
in a form and time frame that permits people to perform their duties 
efficiently."[Footnote 45] FEMA officials told us that FEMA has taken 
internal actions to improve the review process such as meeting with 
other key offices involved in the waiver process in the spring of 2011 
to discuss and standardize information requirements for the waiver 
package. FEMA officials reported that they believe that this effort 
has helped improve some aspects of the process, but further action may 
be required to streamline the process. Additionally, fiduciary agents 
remain wary of the cost-waiver request process. For example, one 
fiduciary agent told us that its field review team--including the 
COTP--would be unlikely to recommend a project for funding if that 
project relies on a cost-share waiver. Another fiduciary agent told us 
that there is little interest in the fiscal year 2009 funds due in 
part to the lengthy waiver review process. Without a more efficient 
review process, certain grant applicants that cannot fund the cost-
match requirement may not receive grant funds to implement their 
projects, or may not even apply for funds. Evaluating the waiver 
review process could help to ensure that the process is completed in a 
timely manner. 

Compliance with Postaward Requirements and an Antiquated Data 
Management System Contributed to On-Hold Grant Funds: 

In addition to funding that is unavailable because it is unused, some 
funding is also unavailable because it is on-hold due to delays in 
achieving compliance with postaward requirements and challenges with 
FEMA's grant management system. After FEMA approves the use of grant 
funds for a specific project, stakeholders reported that additional 
delays in making funds available resulted from compliance with 
postaward requirements. FEMA cannot make grant funds available to 
grantees to begin work on approved projects until all postaward 
requirements, including budgetary and environmental reviews, are met. 
One cause of delay was inefficiency in the reviews conducted pursuant 
to the National Environmental Policy Act, which requires a review of 
the impacts of proposed actions as well as reasonable alternatives to 
those actions.[Footnote 46] Grantees submit Environmental and 
Historical Preservation (EHP) information to the Grant Program 
Directorate--Environmental and Historical Preservation (GPD-EHP) 
office for review. If the project does not require a detailed EHP 
analysis, it can be reviewed and approved by a GPD analyst. However, 
projects that require a more detailed analysis are reviewed either by 
the GPD-EHP team or passed to a FEMA regional environmental officer 
depending on the scope of the review. 

Fiduciary agents we interviewed in 5 of 11 port areas reported that 
slow EHP reviews caused delays.[Footnote 47] During a July 2009 FEMA-
sponsored stakeholder conference, participating port areas stated that 
the EHP submission and review process associated with the PSGP was 
causing delays, which increased project costs and limited what 
grantees could accomplish with grant funds. The group requested the 
establishment of a more structured postaward time line, including 
deadlines for EHP reviews, so that grantees would be better able to 
plan their projects. A senior FEMA official reported that delays in 
EHP reviews were due to the fact that prior to 2008, GPD had not 
historically conducted EHP reviews on preparedness projects and thus, 
had no established program for doing so. This official further 
reported that creating an "EHP Team" within GPD with the assistance of 
subject matter specialists via technical support contract and 
standardizing the format for project submittals has helped expedite 
EHP reviews. 

According to FEMA officials, the delays caused by inefficient review 
processes have been amplified by FEMA's reliance on an antiquated data 
management system. As we reported in our June 2009 report on the 
Transit Security Grant Program, FEMA did not have a mechanism for 
systematically collecting data on the status of individual grant 
projects through the review process.[Footnote 48] For example, 
although FEMA has systems to track the financial information related 
to its grants programs, these systems did not allow FEMA to track the 
status of grant reviews, such as EHP reviews. According to FEMA, the 
data management system used to manage the Transit Security Grant 
Program is also used to manage the PSGP and no changes have been made 
to the system since our 2009 report. As such, GPD officials reported 
that each PSGP program analyst maintained separate spreadsheets that 
tracked the grants for which they were responsible. Using numerous 
data systems and spreadsheets resulted in inefficiencies and, in some 
cases, lost data, as program analysts had to search across systems for 
information or were reliant on systems--such as the Homeland Security 
Information Network--that lost application information.[Footnote 49] 
The overall result was a data system that did not provide information 
in a timely manner and that could not be used effectively to manage 
the grant lifecycle. 

DHS and FEMA Have Taken Steps to Address Unavailable Balances: 

DHS and FEMA have taken a number of steps to address unavailable 
balances. To ensure that grant awards were used for specific projects 
in a timely manner, FEMA implemented project submission deadlines 
beginning in fiscal year 2010. Prior to this, FEMA did not have 
deadlines for submitting projects which resulted in money being unused 
for projects and therefore unavailable until the port area could 
identify enough projects to fund--a process that, in some cases, took 
years to complete. Starting in fiscal year 2010, port areas had 45 
days from the initial fiduciary agent application deadline to submit 
specific project proposals. In fiscal year 2011, FEMA took an 
additional step to shorten application time frames by requiring all 
Group I and II port areas to submit specific project proposals at the 
time of the fiduciary agent's application. According to FEMA 
officials, this change will ensure that grant money allocated in the 
future will be immediately used, which will expedite the grant 
distribution process. 

DHS has also taken a number of steps to address the delays in the EHP 
review process that contributed to funds being on-hold. See table 9 
for a list of key DHS actions: 

Table 9: Key DHS Actions Taken to Improve EHP Review Process Since 
Fiscal Year 2009: 

Action Taken: Increased GPD staffing levels; 
Date: Fiscal years 2009 through 2011; 
Result: The number of staff working on the PSGP within FEMA GPD has 
increased every year since fiscal year 2008. For example, in fiscal 
year 2008, there was a total of 8 staff working on the PSGP. As of 
fiscal year 2011, there were 11 staff working on the PSGP, including 
two supervisors. According to FEMA officials, this additional staff 
better enables GPD to track the progress of grant applications through 
the EHP review process and follow-up on challenges more effectively. 

Action Taken: Developed Programmatic Environmental Assessment (PEA); 
Date: July 2010; 
Result: The PEA divides grant-funded projects into seven categories[A] 
and defines those actions that have no environmental impacts,b as well 
as those that require case-by-case consideration to determine the 
appropriate level of analysis needed to assess environmental impacts. 
The implementation of the PEA allowed FEMA to tailor the EHP review 
based on project category, thereby shortening or eliminating reviews 
of projects with no environmental impact. 

Action Taken: Revised EHP screening form; 
Date: February 2011; 
Result: The revised screening form is designed to streamline 
information and to be easy to understand. FEMA officials reported that 
this revised form should result in fewer mistakes in the grantee's 
original submissions, which will expedite review time frames. 

Action Taken: Changed time frames for submitting EHP information; 
Date: May 2011; 
Result: FEMA began requiring grant applicants to submit EHP paperwork 
when they submit their project's investment justification for 
approval. FEMA officials stated that they hope to begin the EHP review 
while the project is undergoing programmatic review in order to 
expedite the EHP process. 

Action Taken: Developed EHP review time frames; 
Date: June 2011; 
Result: GPD-EHP developed time frames under which projects going 
through the EHP process will be evaluated. According to FEMA 
officials, the initial review will take 15-25 days. If the project is 
excluded from further review, the process ends and EHP is complete. 
Projects that need additional review are sent to the regions. If the 
regional review finds no adverse impacts, the process will be 2-3 
months. If adverse impacts are determined the time frame will be 3-12 
months. 

Source: GAO. 

[A] The PEA divides grant-funded projects into seven categories: 
planning, management and administration, training, exercises, purchase 
of mobile and portable equipment, modification of existing structures 
and facilities, and new construction. 

[B] The following project types have been determined to have no 
environmental impacts: planning, management and administration, 
classroom-based training, table top and functional exercises, and 
mobile and portable equipment. 

[End of table] 

As a result of these changes, some fiduciary agents reported 
improvement in the EHP review process; however, these views could not 
be verified using FEMA data. Specifically, 5 of 11 fiduciary agents 
reported that the EHP review process has improved. For example, 1 
fiduciary agent believed that the EHP process has improved primarily 
because of FEMA's categorization of projects according to the amount 
of expected impact they would create. However, due to data reliability 
issues with FEMA's EHP data--there were too many missing EHP dates for 
an accurate analysis--we were not able to confirm whether the EHP 
process was improving. Because of limitations with FEMA's existing 
grant management system, all EHP data are managed on separate 
spreadsheets maintained by program analysts and these spreadsheets 
have varying levels of completeness. FEMA officials acknowledged the 
limitations with their data, including the omission of key dates in 
the EHP review process, such as the date when the EHP information was 
submitted for review or the date when the project's EHP review was 
approved. However, FEMA officials noted that the evolution of the Non 
Disaster Grants (ND Grants) system, which is discussed below, may 
allow for better tracking of EHP submissions and approvals in the 
future. 

To address challenges exacerbated by the antiquated data management 
system used to manage the PSGP, DHS took the first step towards 
consolidating its data management system in fiscal year 2011 by 
implementing the first of two planned phases of the ND Grants system. 
According to FEMA, the ND Grants system is intended to consolidate 
FEMA's disparate data systems and improve the ability of FEMA grant 
managers to track grants through the review and approval process. In 
February 2011, FEMA anticipated that the ND Grants system would be 
fully completed by the end of fiscal year 2014. Given the early stages 
of this process, it is too early to assess the extent to which the ND 
Grants system will alleviate data management challenges. 

FEMA Is Developing Measures to Assess PSGP Administration but Does Not 
Have Measures to Assess Effectiveness: 

In July 2011, during the course of our review, FEMA finalized eight 
performance measures designed to track how well FEMA GPD administers 
and manages the PSGP. According to FEMA documents, these measures 
include the percent of: (1) grant funds released to grantees within 
300 days, (2) grant awards programmatically monitored annually, (3) 
grant funds programmatically monitored annually, (4) grant awards 
financially monitored annually, (5) grant funds financially monitored 
annually, (6) corrective actions completed within the fiscal year 
issued, (7) preparedness grant awards processed within 150 days, and 
(8) grant closeouts completed within 120 days from the end of the 
period of performance. According to FEMA officials, data collection 
for these eight measures will begin in the fiscal year 2012 grant 
cycle and the 2012 baseline data will be used to develop targets for 
each measure beginning with the fiscal year 2013 grant cycle. For more 
information on these measures, see appendix V. In addition to these 
eight measures, FEMA officials reported that four additional measures 
are under development. By implementing these internal measures, FEMA 
officials should be better positioned to determine whether the changes 
they have made in recent months are sufficient to better ensure more 
efficient grant administration going forward or whether additional 
actions are required. However, since targets for the eight measures 
will not be established until at least fiscal year 2013, and the four 
additional measures remain under development, it is too early to know 
how effective they will be in helping FEMA to assess its performance 
and improve its grant management. 

FEMA has not evaluated the effectiveness of this program in 
strengthening critical maritime infrastructure against risks 
associated with potential terrorist attacks because it has not 
implemented measures to track progress toward achieving program goals. 
In 2006, the Department of Homeland Security's Office of Inspector 
General reported that as the PSGP continues to evolve, an important 
challenge DHS should undertake is the measurement of its impact. 
[Footnote 50] The Inspector General also reported that DHS has raised 
the overall bar of preparedness through the port security grants but 
it is not clear that DHS knows how much actual risk reduction has been 
achieved. Four years later, in January 2010, FEMA formed a task force 
to develop draft performance measures for the PSGP. This task force 
conceptualized 11 potential measures of effectiveness for the PSGP; 
however, baseline data needed to implement the measures did not exist 
for all 11 draft measures. According to FEMA documentation, baseline 
data existed for 2 of the 11 measures, additional data collection 
would be needed to populate 3 measures, and 6 measures would require 
further refinement or coordination with federal partners. 

In December 2010, FEMA transferred responsibility for developing 
performance measures from GPD to FEMA's National Preparedness 
Directorate, specifically the National Preparedness Assessment 
Division (NPAD).[Footnote 51] FEMA officials report that this change 
was made to consolidate the development of effectiveness measures 
within the directorate containing assessment experts. However, this 
may have contributed to delays in developing performance measures 
because the staff at NPAD, including the new Director, who began in 
March 2011, needed time to familiarize themselves with the grant 
program and draft measures. In July 2011, a senior NPAD official told 
us that the division was briefed on the draft measures developed by 
the GPD task force, but they were considering developing different 
measures as well. In October 2011, the same official told us that the 
division had developed a number of prospective performance measures 
for the PSGP, but that FEMA was still reviewing the draft measures. As 
a result, the official told us that it has not been determined whether 
the performance measures will be included in the fiscal year 2012 
guidance. Additionally, FEMA did not have a plan in place, with 
milestones, to ensure the implementation of such measures. According 
to best practices for project management, the development of a project 
management plan--which defines how the project is executed, monitored 
and controlled, and closed--is a key element of project management. 
[Footnote 52] Best practices for project management also call for 
milestone dates, among other factors, in carrying out a project 
successfully. As a result, FEMA's progress toward implementing 
measures to assess whether the program is achieving its stated purpose 
remains unclear. 

Conclusions: 

Port areas have unique characteristics--they are centers of commerce, 
hubs of transportation, and often close to major population centers. 
These characteristics result in specific vulnerabilities that must be 
addressed to avoid the human or economic losses that would result from 
a terrorist attack. The Port Security Grant Program (PSGP)--
administered by FEMA and supported with subject matter expertise from 
the Coast Guard--is one tool DHS uses to protect critical maritime 
infrastructure from these risks. Risk management has been endorsed by 
the federal government to help direct finite resources to areas of 
greatest risk and grant programs have provided substantial resources 
toward this effort. We found that PSGP allocations were highly 
correlated to risk for the grant years we examined and DHS has taken 
steps to strengthen the PSGP risk allocation model by improving the 
quality and precision of the data inputs. However, additional efforts-
-such as accounting for how new security measures affect port 
vulnerability and using the most precise data available in the risk 
model--could further strengthen the model and build upon the progress 
made. While the allocation process has been risk-based, FEMA has faced 
significant challenges administering the grant program. For example, 
FEMA awarded nearly $1.7 billion in port security grants for fiscal 
years 2006 through 2010; however, draw down levels for the PSGP are 
low--with about one-quarter of fiscal year 2006 through 2010 grant 
monies drawn down as of September 2011. While FEMA may not consider 
draw down levels to be an accurate measure of progress made in 
improving port security, this measure has become the de facto 
yardstick for assessing progress in securing our ports because no 
other measures exist. Additionally, about a quarter of the awarded 
funding remains unavailable due to delays in using grant funds, 
challenges with the cost-match and associated waiver process, and 
challenges that grantees have had complying with postaward 
requirements. As a result, about $400 million in awarded grant funding 
remains unavailable to grantees for port security projects. 

FEMA has taken steps to improve the availability of funds and has 
developed internal performance measures to begin evaluating its 
administration of the grant program. However, FEMA has not evaluated 
the effectiveness of the program because it does not have measures to 
track progress towards achieving program goals. To establish a more 
accurate measurement of grant effectiveness, FEMA should expedite its 
efforts to implement performance measures for the PSGP. Initial steps 
have been taken to develop performance measures for the PSGP, but the 
time frame for implementing them is unclear. Without a plan, there is 
little assurance that these measures will be implemented in a timely 
way to assess the program's effectiveness in ensuring that critical 
port infrastructure is protected. 

Recommendations for Executive Action: 

We are making four recommendations to help strengthen the 
implementation and oversight of the PSGP. To strengthen DHS's 
methodology for measuring vulnerability in ports, and to improve the 
precision of grant allocations to high-risk port areas, we recommend 
that the Secretary of Homeland Security direct the FEMA Administrator 
to: 

* Develop a vulnerability index that accounts for how security 
improvements affect port vulnerability, and incorporate these changes 
into future iterations of the PSGP risk model. 

* Coordinate with the Coast Guard to determine the most precise data 
available to populate the data elements within the vulnerability index 
and to utilize these data as an interim measure, until a revised 
vulnerability index is developed. 

To ensure that waiver requests--including those submitted under 
previous cost-share years in which money remains unassigned and those 
that may be submitted in future grant rounds if a cost-share 
requirement is applied--are evaluated promptly, we recommend that the 
FEMA Administrator--in conjunction with the Office of the Secretary of 
Homeland Security--evaluate the waiver review process to identify 
sources of delay and take measures to expedite the process. 

To strengthen the administration, oversight, and internal controls of 
the PSGP, and to streamline processes, we recommend that the Secretary 
of Homeland Security direct the FEMA Administrator to develop--in 
collaboration with the Coast Guard--time frames and related milestones 
for implementing performance measures to monitor the effectiveness of 
the PSGP. 

Agency Comments and Our Evaluation: 

We provided a draft of this report to DHS for review and comment. DHS 
provided written comments on November 14, 2011, which are reproduced 
in full in appendix VI. DHS concurred with the findings and 
recommendations in the report, and stated that FEMA is taking actions 
to implement our recommendations. 

DHS concurred with our first recommendation that it develop a 
vulnerability index that accounts for how security improvements affect 
port vulnerability, and incorporate these changes into future 
iterations of the PSGP risk model. DHS stated that although 
incorporating the effects of completed security projects on 
vulnerability is complex, the inclusion of this type of metric remains 
a key goal of the PSGP risk methodology and is revisited annually. 
However, DHS did not provide details regarding its plan to implement 
this recommendation. 

DHS concurred with our second recommendation that FEMA coordinate with 
the Coast Guard to determine the most precise data available to 
populate the data elements within the vulnerability index and to 
utilize this data as an interim measure until a revised vulnerability 
index is developed. Specifically, DHS stated that FEMA will continue 
to coordinate with subject matter experts, including the Coast Guard, 
to determine the best data available for use in the vulnerability 
index. Further, DHS stated that FEMA and the Coast Guard will continue 
discussions regarding data elements to be used in future grant years, 
and that these meetings will focus on what data elements are currently 
available for use as an interim measure while additional enhancements 
to the vulnerability component are developed. Such action should 
address the intent of this recommendation. 

DHS concurred with our third recommendation that FEMA evaluate the 
cost-share waiver request process in conjunction with the Office of 
the Secretary of Homeland Security to identify sources of delay and 
take measures to expedite the process. Specifically, it reported that 
FEMA and DHS are exploring the best solution to reduce delays and 
expedite the cost-share waiver request evaluation process and will 
work to implement appropriate process improvements as they are 
identified. Such action, when implemented, should address the intent 
of this recommendation. 

Finally, DHS concurred with the fourth recommendation that it develop 
time frames and related milestones for implementing performance 
measures to monitor the effectiveness of the PSGP. Specifically, DHS 
stated that FEMA's Grant Programs Directorate (GPD) is in the process 
of developing external measures to determine how effective grantees 
are in managing and administering the grants and that these external 
measures will be completed by January 1, 2012. DHS also stated that 
specific measures to monitor the performance of the PSGP are being 
developed within FEMA. Further, DHS stated that FEMA is also 
developing performance objectives for core capabilities, as required 
by Presidential Policy Directive 8 and the new National Preparedness 
Goal, and will be reviewing all prevention and protection measures, 
including those for PSGP. Finally, DHS stated that FEMA's National 
Preparedness Directorate will work with GPD and the Coast Guard in 
fiscal year 2012 to develop some specific measures towards building 
and sustaining capabilities. These efforts, as described above, are 
important steps towards implementing this recommendation. 

As agreed with your offices, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from the report date. At that time, we will send copies to the 
Secretary of Homeland Security, appropriate congressional committees 
and other interested parties. In addition, this report will be 
available at no charge on the GAO website at [hyperlink, 
http://www.gao.gov]. If you or your staff have any further questions 
about this report, please contact David C. Maurer at (202) 512-9627 or 
MaurerD@gao.gov or Stephen L. Caldwell at (202) 512-9610 or 
CaldwellS@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page. Key 
contributors are listed in appendix VII. 

Signed by: 

David C. Maurer: 
Director: 
Homeland Security and Justice Issues: 

Signed by: 

Stephen L. Caldwell:
Director:
Homeland Security and Justice Issues: 

List of Requesters: 

The Honorable Peter King: 
Chairman: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable John D Rockefeller IV: 
Chairman: 
Committee on Commerce, Science and Transportation: 
United States Senate: 

The Honorable Joseph Lieberman: 
Chairman: 
The Honorable Susan Collins Ranking Member: 
Homeland Security and Governmental Affairs Committee: 
United States Senate: 

The Honorable Candice Miller: 
Chairwoman: 
Subcommittee on Border and Maritime Security: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable Gus Bilirakis: 
Chairman:P 
Subcommittee on Emergency Preparedness, Response, and Communications: 
Committee on Homeland Security: 
House of Representatives: 

[End of section] 

Appendix I: Port Security Grant Program (PSGP) Allocations to Funding 
Groups, by Year: 

This appendix provides information on the percentage of total PSGP 
grant funding directed at each funding group since fiscal year 2007, 
the first year in which Department of Homeland Security (DHS) 
categorized port areas into funding groups. Table 10 shows that the 
percentage of funding directed at Group I port areas and all other 
port areas has been relatively stable over time, whereas this 
percentage has changed more drastically for Group II and Group III 
port areas. As discussed in the report, DHS allocations to individual 
port areas were made largely in accordance with risk, and were based 
on DHS's risk analysis and implementation decisions. DHS's decision to 
direct the majority of PSGP funding to the highest risk port areas--as 
shown in table 10--was one such implementation decision. The second 
decision involved the use of funding "floors" to limit fluctuations in 
individual port area funding from year to year. 

Table 10: Percent of Total PSGP Funding Directed at Each Funding 
Group, Fiscal Years 2007 through 2011[A]: 

Fiscal year 2007; 
Group I: 60.0%; 
Group II: 20.0%; 
Group III: 15.0%; 
All Other Port Areas: 5.0%; 
Ferry: N/A. 

Fiscal year 2007S; 
Group I: 60.0%; 
Group II: 20.0%; 
Group III: 15.0%; 
All Other Port Areas: 5.0%; 
Ferry: N/A. 

Fiscal year 2008; 
Group I: 54.2%; 
Group II: 34.5%; 
Group III: 4.9%; 
All Other Port Areas: 4.9%; 
Ferry: 1.4%. 

Fiscal year 2009; 
Group I: 54.2%; 
Group II: 36.0%; 
Group III: 4.5%; 
All Other Port Areas: 3.9%; 
Ferry: 1.3%. 

Fiscal year 2009 ARRA; 
Group I: 54.3%; 
Group II: 36.0%; 
Group III: 4.4%; 
All Other Port Areas: 4.0%; 
Ferry: 1.3%. 

Fiscal year 2010; 
Group I: 60.0%; 
Group II: 30.0%; 
Group III: 5.0%; 
All Other Port Areas: 5.0%; 
Ferry: N/A. 

Fiscal year 2011; 
Group I: 60.0%; 
Group II: 30.0%; 
Group III: 5.0%; 
All Other Port Areas: 5.0%; 
Ferry: N/A. 

Source: FEMA. 

[A] Total funding may not equate to 100 percent due to rounding. 

[End of table] 

[End of section] 

Appendix II: PSGP Risk Analysis Model, Fiscal Year 2011: 

This appendix provides information on the fiscal year 2011 PSGP risk 
model, which DHS uses to assess the relative risk posed to ports 
throughout the nation and to help determine PSGP eligibility and 
funding levels. As discussed in the report, DHS modified how port 
vulnerability--the relative exposure to an attack--was calculated in 
the PSGP risk model in fiscal year 2011. Rather than holding 
vulnerability constant, as was done in fiscal year 2010, DHS chose to 
modify the vulnerability index in fiscal year 2011 to recognize that 
different ports can have different vulnerability levels. The current 
vulnerability component--as shown in figure 6--considers how port 
vulnerability is affected by ferry and cruise ship ridership, foreign 
vessel calls, and hazardous material transits. However, as discussed 
in the report, further improvements are needed to ensure that the 
vulnerability score for a specific port is responsive to changes in 
security that may occur in that port--such as the implementation of 
new security measures--and that the vulnerability index is populated 
using the most precise data available. 

Figure 6: Fiscal Year 2011 PSGP Risk Model: 

[Refer to PDF for image: illustration] 

Port Risk: 
* Threat (30%); 
* Vulnerability (20%): 
- Ferry Passengers (5%) 
- Cruise Ship Passengers (5%) 
— Foreign Vessel Calls (5%) 
— HAZMAT Population (5%); 
* Consequence (50%): 
- Population Index (2%); 
- Economic Index (20%); 
- National Infrastructure Index (20%); 
- National Security Index (10%). 

Source: DHS.  

[End of figure] 

[End of section] 

Appendix III: Financial Status of PSGP Awarded Funds, Fiscal Years 
2006 through 2010: 

This appendix provides information on the financial status of PSGP 
funds awarded during fiscal years 2006 through 2010. As discussed in 
the report, DHS awarded nearly $1.7 billion in grant funds to port 
areas throughout the nation for fiscal years 2006 through 2010. As 
shown in table 11, grantees have drawn down about 24 percent--or about 
$395 million--of this funding, as of September 2011. An additional 52 
percent of the awarded funding--about $873 million--is available to 
grantees. About one-quarter of awarded grant funding--or about $408 
million--is unavailable, meaning that port areas have not identified 
specific projects to fund with these monies or compliance with 
postaward requirements is pending. 

Table 11: Financial Status of PSGP Awarded Funds, by Funding Group, 
Fiscal Years 2006 through 2010: 

Group I: 
Total PSGP funding awarded: $920,508,263; 
Funding drawn down: $160,476,245 (17.4%); 
Available funding: $517,779,347 (56.2%); 
Unavailable funding: $242,252,671 (26.3%). 

Group II: 
Total PSGP funding awarded: $531,998,959; 
Funding drawn down: $109,788,562 (20.6%); 
Available funding: $278,119,853 (52.3%); 
Unavailable funding: $144,090,543 (27.1%). 

Group III: 
Total PSGP funding awarded: $143,003,552; 
Funding drawn down: $80,702,875 (56.4%); 
Available funding: $48,357,602 (33.8%); 
Unavailable funding: $13,943,075 (9.8%). 

All Other Port Areas[A]: 
Total PSGP funding awarded: $80,558,172; 
Funding drawn down: $43,912,734 (54.5%); 
Available funding: $29,173,691 (36.2%); 
Unavailable funding: $7,471,747 (9.3%). 

Total: 
Total PSGP funding awarded: $1,676,068,946; 
Funding drawn down: $394,880,416 (23.6%); 
Available funding: $873,430,493 (52.1%); 
Unavailable funding: $407,758,036 (24.3%). 

Source: GAO analysis of FEMA data as of September 2011. 

[A] This row also includes the designated ferry allocations in 
applicable years. 

[End of table] 

[End of section] 

Appendix IV: PSGP Cost-Share Waiver Approval Process: 

This appendix contains information on the review and approval process 
for PSGP cost-share waivers, which grantees can request from DHS if 
they are unable to meet the cost-share requirement. As discussed in 
the report and shown in figure 7 below, the waiver approval process 
requires 22 steps--which include approval by leadership within FEMA's 
Grants Program Directorate (GPD), approval by FEMA's Administrator, 
and finally, approval by the Secretary of Homeland Security. In 
November 2009, FEMA told fiduciary agents that a decision on a waiver 
request could be expected within 30 days. However, under the review 
process outlined in figure 7, DHS took--on average--126 days to 
approve a cost-share waiver once all of the required information had 
been received. Evaluating the waiver review process could help ensure 
that the process is completed in a timely manner. 

Figure 7: Review Process for Port Security Grant Program Cost-Share 
Waiver Requests: 

[Refer to PDF for image: illustration] 

Review Process for Port Security Grant Program Cost-Share Waivers: 
Upon receipt and acceptance of an award, based on criteria published 
in Information Bulletin #322, a grantee may submit a cost-share waiver 
request. 

Program Office Review: 
PSGP PA; transfer to: 
PSGP Section Chief; transfer to: 
TISB Branch Chief; transfer to: 
GD&A Director; transfer to: GMD Director. 
                     
GPD Leadership Review: 
GMD Director; (revisions/comments to PSGP PA); transfer to: 
FEMA LAD Liaison to GPD; transfer to: 
Executive Officer; transfer to: 
Senior Policy Advisor; transfer to: 
FEMA OCC Liaison to GPD; transfer to: 
Deputy Assistant Administrator; transfer to: 
Assistant Administrator; transfer to: FEMA, OPPA. 
                             
PNP and FEMA Review  
FEMA, OPPA; (revisions/comments to GMD Director); transfer to: 
PNP Senior Counselor; transfer to: 
PNP Deputy Administrator; transfer to: 
FEMA Chief of Staff; transfer to: 
FEMA Administrator; transfer to: OGC. 

DHS Review: 
OGC; (revisions/comments to FEMA, OPPA); transfer to: 
Policy; transfer to: 
Management; transfer to: 
Others; transfer to: 
Counselors; transfer to: 
Front Office. 

Key: 
FEMA: Federal Emergency Management Agency; 
GD&A: Grant Development & Administration Division; 
GMD: Grants Management Division; 
GPD: Grant Programs Directorate; 
LAD: Legislative Affairs Division; 
OCC: Office of Chief Counsel    
OGC: Office of General Counselor; 
OPPA: Office of Policy & Program Analysis; 
PA: Program Analyst; 
PNP: Protection and National Preparedness; 
PSGP: Port Security Grant Program; 
TISB: Transportation Infrastructure Security Branch. 

Sources: DNS. 

[End of figure] 

[End of section] 

Appendix V: FEMA's Internal Performance Measures: 

This appendix provides descriptive information on the suite of 
internal performance measures that FEMA developed to track how well it 
administers and manages the PSGP. As discussed in the report, data 
collection for these measures--which were finalized in July 2011--will 
begin in the fiscal year 2012 grant cycle and the 2012 baseline data 
will be used to develop targets for each measure beginning in the 
fiscal year 2013 grant cycle. However, as discussed in the report, it 
is too early to know how effective these measures will be in helping 
FEMA to assess its performance and improve its grant management. 

Table 12: Details on FEMA's Performance Measures to Assess Its 
Administrative Performance: 

Internal measure: Percent of grant funds released to grantees within 
300 days; 
Description/Purpose: The timely release of preparedness grant funds 
impacts grantees' ability to fund, implement, and complete grant 
projects. This measure evaluates the percent of preparedness grant 
funds released to grantees within 300 days from the grant award date. 
Data for this measure will be used to assess GPD's efficiency in 
releasing preparedness grant funds and assisting grantees in meeting 
award conditions. These efforts also ensure that FEMA releases funds 
to the grantees in a timely manner to support project implementation 
within programs' specified period of performance. 

Internal measure: Percent of grant awards programmatically monitored 
annually; and: 
Internal measure: Percent of total grant funds programmatically 
monitored annually; 
Description/Purpose: GPD conducts programmatic monitoring each year to 
verify that preparedness grant programs and/or projects are executed 
in a manner consistent with grantees' stated implementation plans and 
according to applicable rules and regulations. Programmatic monitoring 
also highlights progress toward investments and the goals and 
objectives of State, Urban Area, Tribal, and other homeland security 
grantees. These measures evaluate the percentage of all open grant 
awards and the percentage of available grant funds programmatically 
monitored each year. Data from these measures are used to support 
GPD's efforts to ensure compliance with the regulations or guidance 
governing preparedness grant awards, as well as to proactively assess 
any impediments to project implementation and completion. This 
information also enables GPD to assess monitoring activities and 
implement an annual monitoring plan that balances the volume of grant 
awards with levels of grant funding. 

Internal measure: Percent of grant awards financially monitored 
annually; and: 
Internal measure: Percent of total grant funds financially monitored 
annually; 
Description/Purpose: GPD conducts financial monitoring each year to 
collect, analyze, and verify information on the business functions and 
grant administration practices of grantees. Financial monitoring also 
supports the identification of exceptions and potential issues related 
to grantees' management and administration of preparedness grant 
funding, which may require immediate investigation, resolution, 
further scrutiny, or the inclusion of FEMA's Office of the Inspector 
General (OIG). These measures evaluate the percentage of all open 
preparedness grant awards and the percentage of available grant funds 
financially monitored every 2 years, as required by statute. Data from 
this measure are used to support GPD's efforts to ensure compliance 
with the regulations or guidance governing preparedness grant awards, 
as well as to proactively assess any impediments to project 
implementation and completion. This information also enables GPD to 
assess the breadth of grant funding monitored every other year and to 
implement an annual monitoring plan that balances the volume of grants 
with the use of grant funding. 

Internal measure: Percent of corrective actions completed within the 
fiscal year issued; 
Description/Purpose: GPD currently tracks corrective actions issued by 
FEMA Regional staff as a result of financial monitoring visits during 
which problems of noncompliance are discovered and documented. While 
the 10 FEMA Regions are responsible for issuing, tracking, and 
resolving corrective actions, GPD monitors progress toward the 
resolution of corrective actions through regional financial monitoring 
activities. This measure evaluates the percent of corrective actions 
completed within the fiscal year issued. Data for this measure will be 
used to coordinate with FEMA Regions to track and monitor the timely 
resolution of corrective actions. These efforts also support the 
mitigation of noncompliant activities by grantees to reduce or 
eliminate impediments to project completion. 

Internal measure: Percent of preparedness grant awards processed 
within 150 days; 
Description/Purpose: Traditionally, GPD is appropriated annual 
preparedness grant funding that must be awarded prior to the end of 
the fiscal year (i.e., September 30 of each year). This measure 
evaluates GPD's effectiveness in the processing of grant awards for 
relevant preparedness programs. The data for this measure will be 
analyzed to assess the amount of time GPD expends to make and process 
preparedness grant awards. This analysis will enable GPD to monitor, 
identify, and mitigate any issues in the processing of preparedness 
grant awards to achieve and sustain internal grants management and 
administrative efficiencies. 

Internal measure: Percent of grant closeouts completed within 120 days 
from the end of the period of performance; 
Description/Purpose: FEMA regulations require GPD to close out grant 
awards after grantees have completed all administrative activities and 
related work. This measure evaluates the percent of preparedness grant 
close-outs processed within 120 days of receiving notice by grantees 
to assess GPD's efficiency in closing preparedness grant awards. Data 
for this measure will be used to monitor and, if possible, improve 
GPD's grant close-out process. These efforts also ensure that GPD 
complies with its mission to appropriately administer and manage all 
federal grant awards from appropriation to closeout. 

Source: GAO analysis of FEMA information. 

[End of table] 

[End of section] 

Appendix VI: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

November 14, 2011: 

David C. Maurer: 
Director, Homeland Security and Justice: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Re: Draft Report GAO-12-47, "Port Security Grant Program: Risk Model, 
Grant Management, and Effectiveness Measures Could Be Strengthened" 

Dear Mr. Maurer: 

Thank you for the opportunity to review and comment on this draft 
report. The U.S. Department of Homeland Security (DHS) appreciates the 
U.S. Government Accountability Office's (GAO's) work in planning and 
conducting its review and issuing this report. 

The Department is pleased to note the report's positive acknowledgment 
that the United States Coast Guard (USCG) has taken steps to maintain 
port security through their High-Interest Vessel Program along with 
the Federal Emergency Management Agency's (FEMA's) management of the 
grant program. Both agencies have a role in port security, with USCG 
being the subject matter experts dealing with the maritime industry 
and FEMA with the decisions on awarding grants. 

The draft report contained four recommendations with which DHS 
concurs. Specifically, to strengthen DHS's methodology for measuring 
vulnerability in ports and to improve the precision of grant 
allocations to high-risk port areas, GAO recommended that the 
Secretary of Homeland Security direct the FEMA Administrator to: 

Recommendation 1: Develop a vulnerability index that accounts for how 
security improvements affect port vulnerability, and incorporate these 
changes into future iterations of the Port Security Grant Program 
(PSGP) risk model. 

Response: Concur. FEMA remains committed to working with its partners, 
including USCG, to improve the measure of vulnerability within the 
PSGP risk methodology. As indicated in the report, FEMA has taken 
important first steps toward improving how vulnerability is measured 
in the Fiscal Year (FY) 2011 PSGP risk model and continues to 
recognize the importance of including a metric in future iterations of 
the risk methodology that captures the changes in port vulnerability 
due to the implementation of security enhancements. Although 
incorporating the effects of completed security projects on 
vulnerability is complex and requires more detailed data than are 
often available, the inclusion of this type of metric remains a key 
goal of the methodology and is revisited annually. 

Recommendation 2: Coordinate with the Coast Guard to determine the 
most precise data available to populate the data elements within the 
vulnerability index and to utilize this data as an interim measure, 
until a revised vulnerability index is developed. 

Response: Concur. FEMA will continue to coordinate with subject matter 
experts, including USCG, to determine the best data available for use 
in the vulnerability index. FEMA and USCG determined that foreign 
vessel call data were the most appropriate data for use in the 
vulnerability component of the PSGP risk methodology for FY 2011. FEMA 
and USCG will continue discussions regarding data elements to be used 
in future grant years. These meetings will focus on what data elements 
are currently available for use as an interim measure while additional 
enhancements to the vulnerability component are developed. 

Recommendation 3: Ensure that waiver requests—including those 
submitted under previous cost-share years in which money remains 
unassigned and those that may be submitted in future grant rounds if a 
cost-share requirement is applied—are evaluated promptly and, in 
conjunction with the Office of the Secretary of Homeland Security, 
evaluate the waiver review process to identify sources of delay and 
take measures to expedite the process. 

Response: Concur. FEMA and DHS are exploring the best solution to 
reduce delays and expedite the process in evaluating waiver requests. 
We will work to implement appropriate process improvements as they are 
identified. 

Recommendation 4: Strengthen the administration, oversight, and 
internal controls of the PSGP, and to streamline processes and, in 
collaboration with the Coast Guard, timeframes and related milestones 
for implementing performance measures to monitor the effectiveness of 
the PSGP. 

Response: Concur. FEMA's Grant Program Directorate (GPD) has developed 
internal performance measures that track FEMA's overall effectiveness 
in managing and administering their portfolio of preparedness grants, 
which includes PSGP. In addition, GPD is in the process of developing 
external measures to determine how effective grantees are in managing 
and administering the grants. The development of these external 
measures will be completed by January 1, 2012. Data for both sets of 
measures will be collected throughout FY 2012, allowing FEMA to create 
a baseline and targets for FY 2013 and beyond. 

Specific measures to monitor the performance of PSGP are being 
developed within FEMA. FEMA is developing overall performance 
objectives for core capabilities, as required in Presidential Policy 
Directive 8 and the new National Preparedness Goal, and will be 
reviewing all prevention and protection measures, including those for 
PSGP. In addition, FEMA's National Preparedness Directorate will work 
with GPD and USCG in FY 2012 to develop some specific PSGP measures 
toward building and sustaining capabilities. 

Again, thank you for the opportunity to review and comment on this 
draft report. Technical comments were previously provided under 
separate cover. We look forward to working with you on future Homeland 
Security issues. 

Sincerely, 

Signed by: 

Jim H. Crumpacker: 
Director: 
Departmental GAO-OIG Liaison Office: 

[End of section] 

Appendix VII: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

David C. Maurer, (202) 512-9627 or Maurerd@gao.gov: 

Stephen L. Caldwell, (202) 512-9610 or Caldwells@gao.gov: 

Staff Acknowledgments: 

In addition to the contacts above, Dawn Hoff, Assistant Director, and 
Dan Klabunde, Analyst-in-Charge, managed this assignment. Chuck 
Bausell, David Lutter, Sophia Payind, and Katy Trenholme made 
significant contributions to this report. Charlotte Gamble, Adam 
Hoffman, and Grant Sutton provided assistance with interviews. David 
Alexander assisted with design, methodology, and data analysis. Tracey 
King provided legal assistance. Jessica Orr provided assistance with 
report development and Robert Robinson provided graphic support. 

[End of section] 

Footnotes: 

[1] Department of Homeland Security, Small Vessel Security Strategy 
(Washington, D.C.: April 2008). 

[2] To promote a regional approach to port security, DHS aggregates 
individual ports into "port areas" for grant funding purposes. 
Decisions about how to group individual ports into port areas are made 
based on the recommendations of the Coast Guard and consider such 
factors as geographic proximity, shared risk, and common waterways. 
For fiscal year 2011, there were a total of 145 specifically 
identified critical ports that were aggregated into 90 discrete port 
funding areas. 

[3] DHS, National Infrastructure Protection Plan, Partnering to 
Enhance Protection and Resiliency (Washington, D.C.: January 2009). In 
accordance with the Homeland Security Act and in response to HSPD-7, 
DHS issued the first National Infrastructure Protection Plan (NIPP) in 
June 2006, and later updated the plan in 2009. The NIPP provides the 
overarching approach for integrating the nation's critical 
infrastructure and key resource protection initiatives in a single 
effort. For more information on the NIPP, see GAO, Critical 
Infrastructure Protection: Update to National Infrastructure 
Protection Plan Includes Increased Emphasis on Risk Management and 
Resilience, [hyperlink, http://www.gao.gov/products/GAO-10-296] 
(Washington, D.C.: Mar. 5, 2010). 

[4] In the fiscal year 2007 supplemental grant round, there were eight 
port areas within Group I. 

[5] FEMA implemented key changes to the grant program in the fiscal 
year 2007 and 2007 supplemental grant rounds to promote enhanced 
regional collaboration. For instance, in fiscal year 2007, FEMA 
introduced a tiered structure to the grant program whereby each port 
area was placed into a funding group based on risk. FEMA allocated 
port areas in the highest risk funding group a specific amount of 
grant funding and grant projects were determined using a regional 
decision-making process. In the supplemental 2007 grant round, FEMA 
also transitioned the second highest risk funding group to this 
collaborative process. The remaining funding groups retained the 
competitive structure and competed for funding within their funding 
Group. FEMA made two additional changes in the 2007 supplemental 
funding round to promote regional collaboration. First, FEMA required 
all Group I and II port areas to select a fiduciary agent to 
coordinate the grant process in the port area. Second, FEMA required 
all Group I and II port areas to develop a Portwide Risk Mitigation 
Plan. 

[6] Grant funds may be expended for up to 5 years after the end of the 
fiscal year in which they are awarded. As a result, all fiscal year 
2005 grants were closed as of September 30, 2010; however, some fiscal 
year 2006 grant awards were still available for use by grant 
applicants during the period of our review. We do not have data on the 
amount of PSGP funding distributed and on-hold for fiscal year 2011, 
as this grant round was in its initial stages during the period of our 
review. 

[7] This work was done in conjunction with a broader review of other 
homeland security grant programs. We plan to issue that broader report 
early next year. 

[8] Department of Defense and Emergency Supplemental Appropriations 
for Recovery from and Response to Terrorist Attacks on the United 
States, 2002, Pub. L. No. 107-117, 115 Stat. 2230, 2327 (2002). 

[9] Pub. L. No. 107-295, § 102(a), 116 Stat. 2064, 2068-84 (2002) 
(codified as amended at 46 U.S.C. § 70107). 

[10] Responsibility for administering the PSGP has changed numerous 
times since its inception in 2002. When first established, TSA managed 
the PSGP in partnership with the Maritime Administration and the Coast 
Guard. In March 2003, TSA was transferred from the Department of 
Transportation to the Department of Homeland Security under the 
Homeland Security Act; however, TSA continued to operate the program. 
In March 2004, the Secretary of Homeland Security established the 
Office of State and Local Government Coordination and Preparedness 
(OSLGCP), and for fiscal year 2005, OSLGCP was appropriated funding 
for the PSGP. In October 2005, the Secretary of Homeland Security 
created the Preparedness Directorate, and within that directorate, the 
Office of Grants and Training (OGT). Thus, for fiscal years 2006 and 
2007, OGT administered the program. In April 2007, under the Post-
Katrina Emergency Management Reform Act, many of the functions and 
authorities of the Preparedness Directorate were transferred to FEMA, 
and since that time, FEMA has administered the PSGP. 

[11] More information about the PSGP groups will be discussed later in 
the report. 

[12] There are not a set number of port areas within the All Other 
Port Areas Group and it can vary from year to year. 

[13] Area Maritime Security Plans (AMSP) are a Maritime Transportation 
Security Act (MTSA) requirement and include among other things, 
operational and physical security measures in place at the port under 
different security levels, details of the security incident command 
and response structure, procedures for responding to security threats 
including provisions for maintaining operations in the port, and 
procedures to facilitate the recovery of the marine transportation 
system after a security incident. See 46 U.S.C. § 70103(b). A Coast 
Guard Navigation and Vessel Inspection Circular--the Coast Guard's 
detailed guidance about the enforcement or compliance with federal 
marine safety regulations and Coast Guard marine safety programs--
provided a common template for AMSPs and specified the 
responsibilities of port stakeholders under them. As of October 2011, 
43 AMSPs were in place. Plans were first required in 2004 and, as 
required, were updated by 2009. 

[14] Prior to fiscal year 2007, the PSGP did not include funding 
groups. Rather, all port areas competed for one pool of grant funding. 
In fiscal year 2007, DHS introduced the group concept, and provided 
port areas in Group I with a single direct allocation based on risk. 
In the fiscal year 2007 supplemental grant round, DHS chose to also 
provide port areas in Group II with a single direct allocation based 
on risk. Since fiscal year 2007 supplemental, each port area in Groups 
I and II has received a single direct allocation. 

[15] Port security and commerce functions within ports reside with the 
Coast Guard Captain of the Port (COTP), whose responsibilities are 
summarized at 33 C.F.R. § 1.01-30. An AMSC serves as a forum for port 
stakeholders, facilitating the dissemination of information through 
regularly scheduled meetings, issuance of electronic bulletins, and 
sharing key documents. MTSA provided the Coast Guard with the 
authority to create AMSCs--composed of federal, state, local, and 
industry members--that help to develop the AMSP for the port. As of 
October 2011, the Coast Guard had organized 43 AMSCs. Each has 
flexibility to assemble and operate in a way that reflects the needs 
of its port area, resulting in variations in the number of 
participants, the types of state and local organizations involved, and 
the way in which information is shared. 

[16] Pub. L. No. 91-190, 83 Stat. 852 (1970). 

[17] PSGP funds are appropriated on an annual basis and must be 
awarded by the end of the fiscal year in which they are appropriated. 
FEMA has set a 3-year performance period for PSGP grants, meaning that 
all grant projects must be completed within 3 years. However, FEMA has 
the authority to extend the 3-year performance period by up to 2 
years, giving grantees up to 5 years in total to complete the grant 
project. After 5 years, the money must be returned to the Treasury 
under federal appropriations law. 

[18] When considering individual port areas, the correlation 
coefficients between a port area's calculated risk and allocation were 
0.97 in fiscal year 2011 and 0.93 in fiscal year 2010. We did not 
complete these calculations for years prior to fiscal year 2010. The 
correlation coefficient measures the direction of and strength of 
association between two variables, where the strength of association 
refers to how the scores on one variable are distributed with respect 
to the scores on the other variable. The statistic ranges between -1 
and 1, with the strength of association between two variables 
increasing the further the statistic is from zero. A positive 
correlation coefficient indicates that the two correlated variables 
move in the same direction. In contrast, a negative correlation 
coefficient indicates that as one variable increases, the second 
variable decreases. A correlation coefficient of 0 indicates that 
there is no relationship between the two variables. 

[19] DHS also made these two implementation decisions when finalizing 
grant allocations for fiscal year 2010. 

[20] For each grant cycle since fiscal year 2007 when the group 
funding structure was introduced, DHS determined what portion of the 
overall PSGP funding to direct towards each funding group. The 
allocation to Group I has ranged from 54 to 60 percent, the allocation 
to Group II from 20 to 36 percent, the allocation to Group III from 4 
to 15 percent, and the allocation to the All Other Port Areas Group 
from 4 to 5 percent. In fiscal year 2008 and 2009, as well as for the 
American Recovery and Reinvestment Act, eligible ferry systems also 
received a designated portion of the overall grant allocation. For 
additional information, see app I. 

[21] In fiscal year 2010, Group I was allocated 60 percent of grant 
funding and accounted for 43.5 percent of the risk. Group II was 
allocated 30 percent of grant funding and accounted for 53 percent of 
the risk. Group III was allocated 5 percent of grant funding and 
accounted for the remaining 3.5 percent of the risk. 

[22] DHS has also used "ceilings" in past years to limit how much a 
port area's allocation could increase from year to year, despite 
changes in risk. However, DHS did not utilize ceilings in the fiscal 
year 2011 PSGP risk model. 

[23] GAO, Homeland Security: DHS Risk-Based Grant Methodology Is 
Reasonable, But Current Version's Measure of Vulnerability is Limited, 
[hyperlink, http://www.gao.gov/products/GAO-08-852] (Washington, D.C.: 
June 27, 2008). GAO, Transit Security Grant Program: DHS Allocates 
Grants Based on Risk, but Its Risk Methodology, Management Controls, 
and Grant Oversight Can Be Strengthened, [hyperlink, 
http://www.gao.gov/products/GAO-09-491] (Washington, D.C.: June 8, 
2009). 

[24] The Homeland Security Grant Program (HSGP)--which is comprised of 
five interconnected grant programs including the State Homeland 
Security Program and the Urban Area Security Initiative--provides a 
primary funding mechanism for building and sustaining national 
preparedness capabilities. These grant programs fund a range of 
preparedness activities, including planning, organization, equipment 
purchase, training, exercises, and management and administration. For 
more information on the Homeland Security Grant Program, see GAO-08-
852. 

[25] The Transit Security Grant Program (TSGP) is one of five grant 
programs that constitute the DHS focus on transportation 
infrastructure security activities. The TSGP provides funds to owners 
and operators of transit systems to protect critical surface 
transportation infrastructure and the traveling public from acts of 
terrorism and to increase the resilience of transit infrastructure. 

[26] DHS officials reported that the decision to incorporate a 
vulnerability component in the fiscal year 2011 risk model was 
primarily based on feedback in the following three reports: (1) GAO-08-
852; (2) National Academies "Review of the Department of Homeland 
Security's Approach to Risk Analysis" (Washington, D.C.: 2010); and 
(3) Homeland Security Studies and Analysis Institute's "FEMA GPD Risk 
Integration and Cost to Capability Analysis Final Report" (Arlington, 
Va: November 2010). Additionally, DHS officials reported that FEMA 
made this modification as part of a process of continual improvements 
to the formula. 

[27] MSRAM data are captured in the Consequence index of the PSGP risk 
model. The Coast Guard uses MSRAM to assess maritime security risk, 
which it defines as the product of threat, vulnerability, and 
consequence. The MSRAM risk formula produces a risk index number (RIN) 
for each maritime target, such as a shipping terminal or passenger 
ferry, that allows Coast Guard officials at the local, regional, and 
national levels to compare and rank critical infrastructure for the 
purpose of informing security decisions. To calculate a RIN for each 
maritime target, the Coast Guard depends upon local port security 
partners to provide information on a target's vulnerability and the 
estimated consequences of a successful attack. Threat information in 
MSRAM is provided by the Coast Guard Intelligence Coordination Center 
and represents intelligence community assessments of the intent, 
capability, and geographic preference of terrorist organizations to 
attack maritime targets. For more information on MSRAM, see GAO, Coast 
Guard: Security Risk Model Meets DHS Criteria, but More Training Could 
Enhance Its Use for Managing Programs and Operations, GAO-12-14 
(Washington, D.C.: Nov. 17, 2011). 

[28] The HAZMAT Population data component was part of the consequence 
index in the fiscal year 2010 model. It was moved to the vulnerability 
index in the fiscal year 2011 model. 

[29] The Coast Guard established its High-Interest Vessel (HIV) 
Program to address increased U.S. maritime security requirements in 
the aftermath of the terrorist events of September 11, 2001. The 
program targets HIVs, or those that might pose high relative security 
risks to U.S. ports. 

[30] The term "draw down" indicates that the grant recipient has 
incurred an expense related to their approved grant project and has 
sought reimbursement for this expense. Once the grantee has been 
reimbursed, the grant funds are considered drawn down. Before draw 
down can occur, FEMA has to approve the use of grant funds for a 
specific project, the grantee has to comply with all postaward 
requirements for that grant project, and FEMA has to distribute the 
funds to the grantee. 

[31] The term "available funds" indicates that FEMA has given the 
grantee approval to spend money on an approved grant project. In order 
for funds to be available, FEMA has to approve the use of grant funds 
for a specific project and the grantee has to comply with all 
postaward requirements for that grant project. 

[32] The term "unavailable funds" indicates that FEMA has not given 
the grantee approval to spend money on a grant project. 

[33] FEMA Grants Program Directorate Information Bulletin No. 352 -
Timeliness of Grantee Draw Downs (Jan. 18, 2011). 

[34] Port areas in Groups I and II receive a designated allocation 
from which approved projects are funded. In contrast, grant awards for 
port areas in Group III or the "All Other Port Areas" group are made 
on a competitive basis and as such, specific projects are identified 
at the time of award. As a result, all funding awarded to Group III 
and "All Other Port Areas" Group is immediately linked to specific 
projects as a result of the competitive award process and thus, cannot 
remain unused. 

[35] We are unable to report on the portion of Group II grant funds 
that are unavailable because they remain unused, due to concerns about 
data reliability. 

[36] Each project must fulfill certain postaward requirements--such as 
environmental and budgetary reviews--before FEMA can release the hold 
and distribute the grant funds to the grantee. We will discuss these 
requirements later in this report. 

[37] Among the requirements stipulated in the grant guidance, port 
areas were required to submit to FEMA a concept of operations for 
their plan within 30 days of their award date. Following approval of 
the concept of operations, port areas had an additional 90 days to 
submit a draft plan for review. 

[38] According to the statute, federal funds for any eligible project 
under the PSGP shall not exceed 75 percent of the total cost of such 
project. See 46 U.S.C. § 70107(c)(1). The cost-share is required by 
federal law and ports can only be exempted through waiver requests to 
the Secretary of Homeland Security, as discussed on page 33. 

[39] GAO, Maritime Security: Responses to Questions for the Record, 
[hyperlink, http://www.gao.gov/products/GAO-11-140R] (Washington, 
D.C.: Oct. 22, 2010). 

[40] Grant years requiring a cost-share--fiscal years 2007 
supplemental, 2008, and 2009--are older than is the fiscal year 2010 
grant round. For example, the fiscal year 2010 PSGP was announced in 
December 2009 whereas the fiscal year 2009 grant round was announced 
in November 2008. Despite the fiscal year 2010 round being announced 
more than 1 year later than the fiscal year 2009 grant round, more 
funding has been used in the more recent grant round. Additionally, 
the cost-share is required by federal law and applicants can only be 
exempted from it through a waiver. 

[41] The 22-step waiver process is outlined in appendix IV. 

[42] The Secretary may approve PSGP grants with a matching requirement 
other than the 25 percent outlined in the statute if the Secretary 
determines that a proposed project merits support and cannot be 
undertaken without a higher rate of federal support. See 46 USC § 
70107(c)(2)(B). 

[43] FEMA Information Bulletin 322, Port Security Grant Program Cost-
Share Requirement Clarification and Waiver Process for FY 2007 
Supplemental through FY 2009 Grant Awards (July 15, 2009). 

[44] Of the 31 waiver requests submitted in accordance with the July 
2009 information bulletin, 22 were approved, 1 was denied, and 2 were 
withdrawn by the grantee. An additional 6 waiver requests were pending 
a decision at the time of this report. 

[45] Standards for Internal Control in the Federal Government, 
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
(Washington, D.C.: November 1999). 

[46] Pub. L. No. 91-190, 83 Stat. 852 (1970). 

[47] Due to concerns about data reliability, we are unable to provide 
information on the average length of time required to achieve 
compliance with EHP requirements. 

[48] [hyperlink, http://www.gao.gov/products/GAO-09-491]. 

[49] In November 2009, FEMA moved to the Homeland Security Information 
Network (HSIN)--an information-sharing and collaboration system 
operated by DHS--to receive investment justifications, detailed 
budgets, and field review forms. In May 2011, FEMA ceased using HSIN 
for the submission of grant documents. 

[50] Department of Homeland Security Office of Inspector General, 
Follow Up Review of the Port Security Grant Program, OIG-06-24 
(Washington, D.C.: February 2006). 

[51] According to FEMA, the National Preparedness Directorate (NPD) 
strives to achieve a nation prepared through a comprehensive cycle of 
planning, organizing and equipping, training, exercising, evaluating, 
and improvement planning. The National Preparedness Assessment 
Division (NPAD) is a component within NPD, which is responsible for 
leading the nation's efforts to enhance preparedness to prevent, 
protect from, respond to, and recover from disasters, natural and man-
made. 

[52] Project Management Institute, The Standard for Program Management 
© (2006). 

[End of section] 

GAO’s Mission: 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the 
performance and accountability of the federal government for the 
American people. GAO examines the use of public funds; evaluates 
federal programs and policies; and provides analyses, recommendations, 
and other assistance to help Congress make informed oversight, policy, 
and funding decisions. GAO’s commitment to good government is 
reflected in its core values of accountability, integrity, and 
reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each 
weekday afternoon, GAO posts on its website newly released reports, 
testimony, and correspondence. To have GAO e mail you a list of newly 
posted products, go to [hyperlink, http://www.gao.gov] and select “E-
mail Updates.” 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of 
production and distribution and depends on the number of pages in the 
publication and whether the publication is printed in color or black 
and white. Pricing and ordering information is posted on GAO’s 
website, [hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional 
information. 

Connect with GAO: 

Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov]. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; 
E-mail: fraudnet@gao.gov; 
Automated answering system: (800) 424-5454 or (202) 512-7470. 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400
U.S. Government Accountability Office, 441 G Street NW, Room 7125
Washington, DC 20548. 

Public Affairs: 
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, DC 20548.