This is the accessible text file for GAO report number GAO-12-47 entitled 'Port Security Grant Program: Risk Model, Grant Management, and Effectiveness Measures Could Be Strengthened' which was released on December 19, 2011. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to Congressional Requesters: November 2011: Port Security Grant Program: Risk Model, Grant Management, and Effectiveness Measures Could Be Strengthened: GAO-12-47: GAO Highlights: Highlights of GAO-12-47, a report to Congressional Requesters. Why GAO Did This Study: From fiscal years 2006 through 2010, the Department of Homeland Security (DHS) has awarded nearly $1.7 billion dollars to port areas through its Port Security Grant Program (PSGP) to protect critical maritime infrastructure and the public from terrorist attacks. The Federal Emergency Management Agency (FEMA)ñña DHS component agencyññis the agency responsible for distributing grant funds. GAO was asked to evaluate the extent to which DHS has (1) allocated PSGP funds in accordance with risk; (2) encountered challenges in administering the grant program and what actions, if any, DHS has taken to overcome these challenges; and (3) evaluated the effectiveness of the PSGP. To address these objectives, GAO reviewed the PSGP risk model, funding allocation methodology, grant distribution data, and program documents, such as PSGP guidance. Additionally, GAO interviewed DHS and port officials about grant processes, funding distribution, and program challenges, among other things. What GAO Found: In 2010 and 2011, PSGP allocations were based largely on port risk and determined through a combination of a risk analysis model and DHS implementation decisions. DHS uses a risk analysis model to allocate PSGP funding to port areas that includes all three elements of riskó- threat, vulnerability, and consequence-óand DHS made modifications to enhance the modelís vulnerability element for fiscal year 2011. For example, DHS modified the vulnerability equation to recognize that different ports can have different vulnerability levels. However, the vulnerability equation is not responsive to changes in port securityó such as the implementation of PSGP-funded security projects. Additionally, the vulnerability equation does not utilize the most precise data available in all cases. DHS addressed prior GAO recommendations for strengthening the vulnerability element of grant risk models, but the PSGP modelís vulnerability measure could be further strengthened by incorporating the results of past security investments and by refining other data inputs. FEMA has faced several challenges in distributing PSGP grant funds, and FEMA has implemented specific steps to overcome these challenges. Only about one-quarter of awarded grant funding has been drawn down by grantees, and an additional one-quarter remains unavailable (see table below). Funding is unavailable-ómeaning that grantees cannot begin using the funds to work on projectsó-for two main reasons: federal requirements have not been met (such as environmental reviews), or the port area has not yet identified projects to fund with the grant monies. Several challenges contributed to funds being unavailable. For example, DHS was slow to review cost-share waiver requestsórequests from grantees to forego the cost-share requirement. Without a more expedited waiver review process, grant applicants that cannot afford the cost-share may not apply for important security projects. Other challenges included managing multiple open grant rounds, complying with program requirements, and using an antiquated grants management system. FEMA has taken steps to address these challenges. For example FEMA and DHS have, among other things, increased staffing levels, introduced project submission time frames, implemented new procedures for environmental reviews, and implemented phase one of a new grants management system. However, it is too soon to determine how successful these efforts will be in improving the distribution of grant funds. FEMA is developing performance measures to assess its administration of the PSGP but it has not implemented measures to assess PSGP grant effectiveness. Although FEMA has taken initial steps to develop measures to assess the effectiveness of its grant programs, it does not have a plan and related milestones for implementing measures specifically for the PSGP. Without such a plan, it may be difficult for FEMA to effectively manage the process of implementing measures to assess whether the PSGP is achieving its stated purpose of strengthening critical maritime infrastructure against risks associated with potential terrorist attacks. Table: Financial Status of PSGP Awarded Funds, Fiscal Year 2006 through 2010: Total funds awarded: $1,676,068,946; Funds drawn down by grantees: $394,880,416 (23.6%); Funds available to grantees to implement projects: $873,430,493 (52.1%); Funds unavailable to grantees to implement projects: $407,758,036 (24.3%). Source: GAO analysis of FEMA data as of September 2011. [End of table] What GAO Recommends: GAO recommends that DHS strengthen its methodology for measuring vulnerability in ports by accounting for how past security investments reduce vulnerability and by using the most precise data available. GAO also recommends that DHS evaluate the cost-share waiver review process and take steps to expedite the process where appropriate and develop a plan with milestones for implementing performance measures for the PSGP. DHS concurred with GAOís recommendations. View [hyperlink, http://www.gao.gov/products/GAO-12-47]. For more information, contact David C. Maurer, (202) 512-9627, MaurerD@gao.gov or Stephen L. Caldwell, (202) 512-9610, CaldwellS@gao.gov. [End of section] Contents: Letter: Background: DHS Allocated PSGP Funds Based Largely on Risk, but the Risk Model Can Be Further Strengthened: Most Grant Funding Is Available, but $400 Million Is Unavailable Due to Various Challenges--Which FEMA Has Begun to Address: FEMA Is Developing Measures to Assess PSGP Administration but Does Not Have Measures to Assess Effectiveness: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Port Security Grant Program (PSGP) Allocations to Funding Groups, by Year: Appendix II: PSGP Risk Analysis Model, Fiscal Year 2011: Appendix III: Financial Status of PSGP Awarded Funds, Fiscal Years 2006 through 2010: Appendix IV: Cost-Share Waiver Approval Process: Appendix V: FEMA's Internal Performance Measures: Appendix VI: Comments from the Department of Homeland Security: Appendix VII: GAO Contact and Staff Acknowledgments: Tables: Table 1: Port Security Grant Program Funding: Table 2: Comparison of Allocation to Risk, by PSGP Funding Group, Fiscal Year 2011: Table 3: Effects of Funding Floor on Fiscal Year 2011 Allocations to Port Areas: Table 4: Data Components in Vulnerability Index of Fiscal Year 2011 PSGP Risk Model: Table 5: Draw Down Rates by Group, Fiscal Years 2006 through 2010: Table 6: PSGP Funding Awarded and Unavailable, by Groups, Fiscal Years 2006 through 2010: Table 7: Changing Cost-Share Requirements in the PSGP, Fiscal Years 2006 through 2011: Table 8: Unused Group I Funding from Cost-Share Years, Fiscal Years 2007 Supplemental through 2010: Table 9: Key DHS Actions Taken to Improve EHP Review Process Since Fiscal Year 2009: Table 10: Percent of Total PSGP Funding Directed at Each Funding Group, Fiscal Years 2007 through 2011: Table 11: Financial Status of PSGP Awarded Funds, by Funding Group, Fiscal Years 2006 through 2010: Table 12: Details on FEMA's Performance Measures to Assess Its Administrative Performance: Figures: Figure 1: Sample Port Area Showing Eligible PSGP Recipients and Projects, and Key Port Stakeholders Involved in the Grant Process: Figure 2: Location of Group I and Group II Port Areas: Figure 3: Overview of the PSGP Grant Process for Fiscal Years 2007 Supplemental through 2011: Figure 4: Status of Awarded Grant Funding, Fiscal Years 2006 through 2010: Figure 5: Comparison of PRMP Approval Dates for 11 Port Areas in Our Review to PSGP Grant Milestone Dates: Figure 6: Fiscal Year 2011 PSGP Risk Model: Figure 7: Review Process for Port Security Grant Program Cost-Share Waiver Requests: Abbreviations: AMSC: Area Maritime Security Committee: AMSP: Area Maritime Security Plan: ARRA: American Recovery and Reinvestment Act: COTP: Captain of the Port: DHS: Department of Homeland Security: DOT: Department of Transportation: EHP: Environmental and Historical Preservation: FEMA: Federal Emergency Management Agency: GPD: Grant Programs Directorate: HIV: High-Interest Vessel Program: HSGP: Homeland Security Grant Program: HSIN: Homeland Security Information Network: MSRAM: Maritime Security Risk Analysis Model: MTSA: Maritime Transportation Security Act: ND Grants: Non Disaster Grants System: NIPP: National Infrastructure Protection Plan: NPAD: National Preparedness Assessment Division: NRP: National Review Panel: OIG: Office of Inspector General: PEA: Programmatic Environmental Assessment: PRMP: Portwide Risk Mitigation Plan: PSGP: Port Security Grant Program TSA: Transportation Security Administration: TSGP: Transit Security Grant Program: [End of section] United States Government Accountability Office: Washington, DC 20548: November 17, 2011: Congressional Requesters: Since the terrorist attacks of September 11, 2001, the nation's ports have been viewed as potential targets of attack for many reasons. According to the Department of Homeland Security (DHS), ports, waterways, and vessels are part of an economic engine handling more than $700 billion in merchandise annually, and an attack on this system could have a widespread impact on global shipping, international trade, and the global economy.[Footnote 1] Additionally, ports often are not only gateways for the movement of goods, but also industrial hubs and close to population centers, presenting additional opportunities for terrorists intending to harm U.S. interests. They are also potential conduits for weapons prepared elsewhere and concealed in cargo designed to move quickly to many locations beyond the ports themselves. Further, cruise ships, tankers, and cargo ships present potentially desirable terrorist targets given the potential for loss of life, environmental damage, or disruption of commerce. Balancing security concerns with the need to facilitate the free flow of people and commerce remains an ongoing challenge for the public and private sectors alike. To strengthen the security of the nation's ports against risks associated with potential terrorist attacks, DHS administers the Port Security Grant Program (PSGP) through its component agency, the Federal Emergency Management Agency (FEMA). The Coast Guard provides subject matter expertise to FEMA on the maritime industry to inform grant award decisions. The PSGP is to provide funding to the nation's highest risk port areas[Footnote 2] to support increased portwide risk management; to enhance domain awareness; to train and exercise; to expand port recovery and resiliency capabilities; and to further capabilities to prevent, detect, respond to, and recover from attacks involving improvised explosive devices and other nonconventional weapons. Since the program's inception in fiscal year 2002, the federal government has provided almost $2.5 billion in PSGP funding to state, local, and private entities to increase portwide risk management, enhance domain awareness, and improve recovery and resiliency through the development of security plans, the purchase of security equipment, and the provision of security training to employees. You requested that we evaluate the PSGP, including DHS's methodology for determining risk, funding levels for U.S. ports, and the management of the program. Our report addresses the extent to which DHS: 1. has allocated PSGP funds in accordance with risk; 2. has encountered challenges in administering the PSGP and what actions, if any, it has taken to overcome these challenges; and: 3. has evaluated the effectiveness of the PSGP. To assess the extent to which PSGP funds were allocated based on risk, we analyzed DHS documents, including those related to the grant model DHS uses to evaluate port risk and allocate grant money, PSGP guidance, and PSGP priorities. Our review of the PSGP risk analysis model focused on the fiscal year 2011 model, the most recent available. To provide a basis for examining DHS's efforts to carry out risk management principles, we compared the PSGP risk analysis model to DHS's overall risk management approach as identified in the National Infrastructure Protection Plan (NIPP), which it issued in June 2006 and updated in January 2009.[Footnote 3] We also reviewed the steps that FEMA took to ensure the reliability of the risk model by interviewing officials responsible for managing the model as well as reviewing DHS's documentation on the model. We determined that the model's inputs and results were sufficiently reliable for our purposes. To determine whether DHS has encountered challenges in administering the PSGP and what actions, if any, it has taken to overcome these challenges, we reviewed PSGP guidance, applicable laws, financial data for the program as a whole for fiscal years 2006 through 2010, and project data from FEMA for all seven Group I port areas--the highest risk port areas that receive the most grant funding.[Footnote 4] To verify the reliability of the project funding amounts for Group I port areas as provided by FEMA, we compared them to the total funding provided to each region and found that these amounts aligned. We did not include project-level data for Group II port areas due to data reliability concerns. Additionally, we did not include project-level data for Group III and the All Other Port Areas Group because these groups receive a small share of available grant funding and follow a different type of funding model. For the purposes of our report, we concluded that FEMA's financial data for the program as a whole and FEMA's project data for Group I port areas were sufficiently reliable. We also gathered information from FEMA on the environmental and historical preservation (EHP) review process--a key grant requirement-- to determine the length of time needed to complete this required review. However, FEMA was unable to provide complete data on the EHP process, so we were unable to comment on the length of time spent completing this requirement. Additionally, we conducted site visits at, or held teleconferences with, a total of 11 port areas, including all 7 Group I port areas and 4 selected Group II port areas. For these meetings, we interviewed and collected documents from PSGP fiduciary agents--entities that serve as the principal point of contact with FEMA for the application, management, and administration of Group I and II grant awards. In some cases, we also interviewed and collected documents from U.S. Coast Guard officials, who provide subject matter expertise for the maritime industry in their port areas. We used specific criteria to select these port areas, including levels of grant funding, stakeholder recommendations, and geographic diversity. While the information we obtained from these 11 port areas cannot be generalized to all port areas, it provides comprehensive coverage of Group I port areas. Additionally, it enhanced our understanding of the types of projects initiated using PSGP funds, the amount of funds allocated, awarded, and distributed for these port areas, and the challenges faced. Due to significant changes in PSGP management in the fiscal year 2007 supplemental funding round--including the introduction of the fiduciary agent model in Group I and II port areas--our review of program management issues focused on fiscal years 2007 supplemental through 2011.[Footnote 5] However, to ensure a complete analysis of PSGP grant funds that are currently available for use, our discussion of the amount of PSGP funding distributed and on- hold includes fiscal years 2006 through 2010.[Footnote 6] To determine the extent to which DHS has evaluated the effectiveness of the PSGP, we analyzed available or in-progress performance data and measures related to the grant program. To determine what performance measurement data had been collected or what measures FEMA might use to understand the progress of the PSGP, we interviewed grant officials from FEMA's Grant Programs Directorate (GPD) and FEMA's National Preparedness Directorate. We conducted this performance audit from October 2010 through November 2011 in accordance with generally accepted government auditing standards.[Footnote 7] Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: Overview Of U.S. Port Security: The United States has approximately 360 commercial sea and river ports. While no two ports in the United States are exactly alike, many share certain characteristics that make them vulnerable to terrorist attacks: they are sprawling, easily accessible by water and land, close to crowded metropolitan areas, and interwoven with complex transportation networks designed to move cargo and commerce as quickly as possible (see fig 1). They contain not only terminals where goods bound for import or export are unloaded or loaded onto vessels, but also other facilities critical to the nation's economy, such as refineries, factories, and power plants. To reduce the opportunity for terrorists to exploit port vulnerabilities, port stakeholders are taking mitigation steps. For example, port stakeholders have installed fences, hired security guards, and purchased cameras to reduce the potential for unauthorized entry and help prevent vulnerabilities from being exploited. Figure 1: Sample Port Area Showing Eligible PSGP Recipients and Projects, and Key Port Stakeholders Involved in the Grant Process: [Refer to PDF for image: illustration] Sample of eligible PSGP recipients and projects: 1) Facility operators: Recipients include oil, gas, and cargo companies. 2) Local law and fire: Includes sheriff departments, firefighters, port police, and local police. 3) Ferry systems: Includes public and private ferry systems. 4) Surveillance cameras: CCTV cameras monitor terminal facilities. 5) Fence/jersey barriers: Fencing and jersey barriers surround receiving terminal. 6) Access control gate: Guarded gate controls access to terminal. Key stakeholders involved in PSGP process: 7) Coast Guard: Review and approve PSGP applications. 8) Fiduciary agent: Principal point of contact with FEMA for PSGP process. 9) Area maritime security committee: Stakeholders from industry and all levels of government rank projects. Source: GAO. [End of figure] Grant Funding for Port Security: To help defray some of the costs of implementing security at ports around the United States, the PSGP was established in January 2002 when the Transportation Security Administration (TSA) was appropriated $93.3 million to award grants to critical national seaports.[Footnote 8] In November 2002, the Maritime Transportation Security Act (MTSA), which codified the program, was enacted.[Footnote 9] Since the supplemental appropriations act for fiscal year 2002, the appropriations acts have provided annual appropriations for the PSGP. FEMA is responsible for designing and operating the administrative mechanisms needed to implement and manage the grant program.[Footnote 10] The Coast Guard--which is generally the lead federal agency for port security--provides subject matter expertise for the maritime industry and participates in project award decisions. From fiscal year 2002 through fiscal year 2011, nearly $2.5 billion has been allocated to the PSGP, as shown in table 1. Table 1: Port Security Grant Program Funding[A]: Fiscal Year: 2002; Funding: $93 million; Fiscal Year: 2003; Funding: $244 million[B]; Fiscal Year: 2004; Funding: $179 million; Fiscal Year: 2005; Funding: $141 million; Fiscal Year: 2006; Funding: $168 million; Fiscal Year: 2007; Funding: $201 million; Fiscal Year: 2007S[C]; Funding: $110 million; Fiscal Year: 2008; Funding: $389 million; Fiscal Year: 2009; Funding: $389 million; Fiscal Year: ARRA[D]; Funding: $150 million; Fiscal Year: 2010; Funding: $288 million; Fiscal Year: 2011; Funding: $235 million; Total: Funding: $2.50 billion. Source: FEMA's annual PSGP grant guidance: [A] Target funding amounts as presented in FEMA's annual grant guidance. Total appropriation for the program is higher than funding in the table because FEMA receives a percentage of the allocation for management and administration of the program. This table has not been adjusted for inflation. [B] This figure includes $169 million in PSGP funding and $75 million in additional funding for port security under the Urban Area Security Initiative--another DHS grant program that provides funding for building and sustaining national preparedness capabilities. [C] Funding level pursuant to the fiscal year 2007 supplemental appropriation. [D] Funding level pursuant to appropriations in the American Recovery and Reinvestment Act (ARRA). Pub. L. No. 111-5, 123 Stat. 145, 164 (2009). [End of table] Risk Management Practices Associated with the PSGP: In recent years, we, the Congress, the President, the Secretary of Homeland Security, and others have endorsed risk management as a way to direct finite resources to areas that are most at risk of terrorist attack. Risk management is a continuous process that includes the assessment of threats, vulnerabilities, and consequences to determine what actions should be taken to reduce one or more of these elements of risk. One way in which DHS has applied risk management principles to the PSGP is through the use of a risk model to assess the relative risk posed to ports throughout the nation and to help determine PSGP eligibility and funding levels. The PSGP risk methodology is similar to the methodology used to determine funding eligibility for other DHS state and local grant programs. The model consists of three variables: threat (the relative likelihood of an attack occurring), vulnerability (the relative exposure to an attack), and consequence (the relative expected impact of an attack). Data for each of these variables are collected from offices and components throughout DHS, as well as from other data sources, and then, using the model, each port is ranked against one another and assigned a relative risk score. At the recommendation of the Coast Guard, DHS considers some ports as a single cluster--known as a port area--due to geographic proximity, shared risk, and a common waterway. Based on risk, each port area is placed into one of three funding groups--Group I, Group II, or Group III.[Footnote 11]Ports not identified in Group I, II, or III are eligible to apply for funding as part of the "All Other Port Areas" Group.[Footnote 12] Figure 2 below shows the location of port areas for groups I and II--the two highest risk groups that receive the bulk of grant funding. Figure 2: Location of Group I and Group II Port Areas[A]: [Refer to PDF for image: illustrated U.S. map] Group I: California: 2; Delaware: 1; Louisiana: 1; New Jersey: 1; New York: 1; Pennsylvania: 1; Texas: 1; Washington: 1. [Delaware-New Jersey-Pennsylvania: indicated as a single port area] Group II: Alabama: 1; Alaska: 1; California: 2; Connecticut: 1; Florida: 7; Georgia: 1; Guam: 1; Hawaii: 1; Idaho: 1; Illinois: 1; Indiana: 1; Kentucky: 1; Louisiana: 3; Maine: 1; Maryland: 1; Massachusetts: 1; Michigan: 1; Minnesota: 1; Mississippi: 1; New York: 1; North Carolina: 2; Ohio: 3; Oregon: 1; Pennsylvania: 1; Puerto Rico: 2; South Carolina: 1; Tennessee: 2; Texas: 3; Virginia: 1; Washington: 1; West Virginia: 1; Wisconsin: 1. [Idaho-Oregon-Washington: indicated as a single port area] [Illinois-Indiana: indicated as a single port area] Source: GAO analysis of PSGP grant guidance. [A] Icons connected by dotted lines indicate a single port area. [End of figure] To promote a regional approach to risk management in the highest risk port areas, FEMA required--beginning with the fiscal year 2007 supplemental guidance--that all Group I and II port areas--the highest risk port areas--develop and implement a Portwide Risk Mitigation Plan (PRMP). The primary goal of a PRMP is to provide a port area with a mechanism for considering its entire port system strategically as a whole, and to identify and execute a series of actions designed to effectively mitigate risks to the system's maritime critical infrastructure. Overview of PSGP Grant Cycle: DHS creates PSGP grant guidance annually which provides the funding amounts for each group, eligible applicants, and the application materials for funding under the program. As shown in figure 3, there are three stages of the PSGP grant cycle: allocation, award, and distribution. Figure 3: Overview of the PSGP Grant Process for Fiscal Years 2007 Supplemental through 2011[A]: [Refer to PDF for image: illustration] Stage 1, Allocation: Risk: Group I: 7 Highest Risk Port Areas; Group II: 48 Next Highest Risk Port Areas; Designated Allocation to Each Port Area. Group III: 35 Lowest Risk Port Areas; Allocation to Group as a Whole. Stage 2, Award: Group I and II Award Process: FEMA awards port area's allocation to fiduciary agent. Applicants submit project proposals to fiduciary agent. Each port area conducts a field review to evaluate project proposals and select projects to fund using its allocation. Selected projects are vetted by the National Review Panel. FEMA notifies fiduciary agent of approved projects. Fiduciary agent notifies applicant. Group III Award Process: Applicants submit project proposals to FEMA. FEMA screens projects for eligibility. Eligible projects are returned to the port area, where they are evaluated by the field review team. The National Review Panel evaluates all submitted projects and selects projects to fund. FEMA awards grant funding for selected projects directly to applicant. Stage 3, Distribution: Distribution of Grant Funds: When the applicant fulfills all post- award grant requirements, FEMA distributes the funds and applicants can begin work on approved projects. Source: GAO analysis of FEMA documents related to the PSGP grant process. [A] Ports in the All Other Port Areas Group are not part of the risk model but follow the same process as Group III for award and distribution. [End of figure] Allocation Process: Each port area's allocation is driven by the results of the PSGP risk analysis model. However, the allocation process varies among groups as described below. * Groups I and II: The risk model determines the port areas at high risk of a terrorist attack and DHS places them in either Group I (highest risk group) or Group II (next highest risk group). In fiscal year 2011, there were 7 port areas in Group I and 48 port areas in Group II. Each port area in these groups is allocated a specific amount of funding based on its risk score. * Group III: Group III ports represent the next risk grouping of port areas based on the risk model scores. For fiscal year 2011, there were 35 port areas in Group III. However, unlike Groups I and II, these port areas do not receive a specific allocation based on risk. Instead, DHS allocates a set amount of funding to Group III as a whole and port areas within Group III compete against each other for this funding based on risk and project effectiveness. * All Other Port Areas: Port areas not evaluated using the risk model, but which operate under an Area Maritime Security Plan (AMSP), [Footnote 13] are eligible to compete for funding with the All Other Port Areas Group--in a manner similar to Group III, but without using risk scores as a factor in project selection. Award Process: After DHS announces the allocation amounts for all of the groups through the release of the grant guidance, applicants must apply for funding--either through the fiduciary agent or directly to FEMA-- within 45 days of the release of the grant guidance. Applicants are entities within a port area--such as port authorities, facility operators, and state and local government agencies--that provide port security services. During the award process, DHS and the U.S. Department of Transportation (DOT) evaluate the port areas' projects and determine which projects to fund. Before the projects reach DHS and DOT for review they are vetted locally. The local evaluation process--known as field-level review--for Groups I and II differs from that of Group III and All Other Port Areas Group as described below. * Groups I and II: Beginning with the fiscal year 2007 supplemental guidance, port areas in Groups I and II received a single direct funding allocation based on risk.[Footnote 14] Once the allocation is made, stakeholders in the port area then undergo a collaborative process to determine the projects to fund with the grant allocation. To help manage the new direct allocation process, DHS introduced the use of fiduciary agents to help manage the PSGP at the local level and ensure that all port partners were incorporated into the planning and grant allocation processes. For Group I and II port areas, FEMA awards the port area allocation to each port area's selected fiduciary agent. According to the grant guidance, while the fiduciary agent acts as the principal point of contact with FEMA for application, management, and administration of the Group I and II grant awards, the fiduciary agent is not the sole decision maker regarding the use of the PSGP grants. Instead, a field-level review process is conducted by the applicable Coast Guard Captain of the Port (COTP) in coordination with DOT, the Maritime Administration, and appropriate personnel from the Area Maritime Security Committee (AMSC) including federal, state, and local agencies.[Footnote 15] At the completion of the field-level review process, the COTP--through the fiduciary agent--submits to FEMA a prioritized list of projects for funding ranked from highest to lowest in terms of their contributions to risk reduction and cost effectiveness. Once the COTP submits this information, DHS begins its national review process for Group I and II port areas. [Side bar: The Puget Sound Port Area: In fiscal year 2010, the Puget Sound Port Area-óa Group 1 that includes port area Seattle-óreceived over $20 million in PSGP funding. This money was awarded to the Fiduciary Agent-óthe Marine Exchange of Puget Sound. A subcommittee of a dozen federal, state, local, and private sector officials then reviewed and recommended funding for 27 projects to 15 different port entities. Projects were then forwarded to FEMA for final review. Source: GAO. End of side bar] * Group III and All Other Port Areas: Unlike Groups I and II, grant projects in Group III and the All Other Port Areas Group are determined through a competitive process. Port entities in these two groups submit their project proposals directly to DHS for review. DHS reviews the projects for eligibility, and approved projects are grouped by port area and sent to the corresponding COTP for further review. At this point, the process mirrors the Group I and II process. Before grant awards are finalized, project proposals undergo a national review process conducted by the National Review Panel (NRP), a group of subject matter experts from DHS and DOT. During the national review process, the NRP reviews all submitted projects for eligibility, and makes a final funding recommendation to the Secretary of Homeland Security. Distribution Process: PSGP funds cannot be distributed to grantees to begin projects until DHS ensures the grantee's compliance with federal grant management requirements. FEMA's GPD is responsible for ensuring that all grant projects adhere to federal grant requirements, including all EHP requirements. For example, the National Environmental Policy Act requires DHS to analyze the possible environmental impacts of each project funded by a DHS grant.[Footnote 16] In addition to federal requirements, DHS also directs all applicants to provide detailed budgets for the requested funds at the time of application. Until FEMA is satisfied that all requirements have been met, no grant funding can be distributed to begin projects--rather the grant funding is considered "unavailable." Once FEMA makes funds available to grantees, port entities must complete the grant project within the designated 3- year performance period.[Footnote 17] For example, for fiscal year 2009 projects, the performance period began on June 1, 2009. During this grant period, the City of Houston received approval for the second phase of a radio system project. By the time the project cleared local and federal review and funds were made available it was March 16, 2011--leaving the city about 14 months to implement the project before the performance period end date of May 31, 2012. DHS Allocated PSGP Funds Based Largely on Risk, but the Risk Model Can Be Further Strengthened: PSGP Allocations Were Largely Based on Port Risk and DHS Implementation Decisions: For fiscal years 2010 and 2011, DHS allocations of PSGP funds were based on DHS's risk model and implementation decisions, and were made largely in accordance with risk. For example, we found that allocations to port areas were highly positively correlated to port risk, as calculated by the risk model.[Footnote 18] In addition to the risk scores of the port areas, DHS made two implementation decisions when finalizing grant allocations for fiscal year 2011. First, DHS opted to direct the majority of available funding to the highest risk port areas. Second, DHS chose to limit fluctuations in grant funding from year to year to any given port area.[Footnote 19] Overall, as shown in table 2 below, DHS directed 60 percent of available grant funding to the 7 Group I port areas in fiscal year 2011, which represented about 54 percent of the total risk for port areas, according to the model's determination of risk.[Footnote 20] Table 2: Comparison of Allocation to Risk, by PSGP Funding Group, Fiscal Year 2011:[Footnote 21] Group I; Port areas in funding group: 7; Fiscal year 2011 group allocation: $141.0 million; Percent of total grant funding allocated to group: 60.0%; Percent of total risk represented by group as determined by the risk model: 54.4%. Group II; Port areas in funding group: 48; Fiscal year 2011 group allocation: $70.5 million; Percent of total grant funding allocated to group: 30.0%; Percent of total risk represented by group as determined by the risk model: 42.1%. Group III; Port areas in funding group: 35; Fiscal year 2011 group allocation: $11.8 million; Percent of total grant funding allocated to group: 5.0%; Percent of total risk represented by group as determined by the risk model: 3.5%. All other port areas[A]; Port areas in funding group: N/A; Fiscal year 2011 group allocation: $11.8 million; Percent of total grant funding allocated to group: 5.0%; Percent of total risk represented by group as determined by the risk model: N/A. Source: GAO analysis based on FEMA grant guidance and PSGP risk model. [A] These port areas are not included in the PSGP risk model. The All Other Port Areas Group is open to ports not included in a Group I, II, or III port area but which operate under an applicable AMSP. [End of table] After DHS determined the percentage of total funding it would direct to each group, it then provided each port area within Groups I and II with a designated allocation based on the results of the risk model. For example, in fiscal year 2011, the average allocation to a Group I port area was about $20 million, with allocations ranging from about $12 million for the Delaware Bay port area to about $30 million for the New York-New Jersey port area. The average allocation to a Group II port area was about $1.5 million, with allocations ranging from $1 million, received by 21 Group II port areas, to $3.5 million for the Chicago/Lake Michigan port area. In contrast to Groups I and II, port areas in Group III or the All Other Port Areas Group do not receive a designated allocation. Instead, port areas in Group III and the All Other Port Areas Group compete within their group for a portion of the group's total funding--which was about $11.8 million for each group in fiscal year 2011. In addition to directing the majority of available grant money to the highest risk port areas, DHS also opted to provide stability in the funding levels of Group I and II port areas through another implementation decision. To achieve this stability, DHS utilized funding "floors" in the fiscal year 2011 risk model, which limited how much a port area allocation could decrease from year to year, despite changes in risk identified by the model.[Footnote 22] A senior FEMA official reported that floors were used in the fiscal year 2011 PSGP risk model to mitigate wide fluctuations in funding so that port areas could better plan for long-term security improvements. This official also noted that floors have been used in the PSGP risk model since fiscal year 2008 and were also used in the fiscal year 2011 Homeland Security Grant Program (HSGP) risk model. In the fiscal year 2011 model, DHS set the funding floor for Group I port areas at 25 percent--meaning that the port area's funding level could not decrease by more than 25 percent from its fiscal year 2010 allocation regardless of how much its risk profile changed. Similarly, for fiscal year 2011, DHS set the funding floor for Group II port areas at 50 percent--meaning that the port area's allocation could not decrease by more than 50 percent from its fiscal year 2010 allocation regardless of changes in risk. According to FEMA data, if the floors had not been used in fiscal year 2011, the allocations to 3 Group I port areas would have fallen by more than 25 percent and the allocations to 8 Group II port areas would have fallen by more than 50 percent. However, due to the use of funding floors, these 11 port areas collectively received fiscal year 2011 allocations that were about $11.6 million--or about 26 percent--higher than their risk profiles would have indicated. See table 3 below. Table 3: Effects of Funding Floor on Fiscal Year 2011 Allocations to Port Areas[A]: Group: I; Port area: Port A; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $361,997; Percent increase in allocation over what risk model would have indicated: 2.5%. Group: I; Port area: Port B; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $7,308,096; Percent increase in allocation over what risk model would have indicated: 74.5%. Group: I; Port area: Port C; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $2,325,071; Percent increase in allocation over what risk model would have indicated: 24.1%. Group: II; Port area: Port D; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $248,751; Percent increase in allocation over what risk model would have indicated: 13.4%. Group: II; Port area: Port E; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $198,318; Percent increase in allocation over what risk model would have indicated: 14.4. Group: II; Port area: Port F; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $271,472; Percent increase in allocation over what risk model would have indicated: 20.3%. Group: II; Port area: Port G; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $107,997; Percent increase in allocation over what risk model would have indicated: 8.2%. Group: II; Port area: Port H; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $124,059; Percent increase in allocation over what risk model would have indicated: 9.7%. Group: II; Port area: Port I; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $102,390; Percent increase in allocation over what risk model would have indicated: 10.2%. Group: II; Port area: Port J; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $128,750; Percent increase in allocation over what risk model would have indicated: 12.9%. Group: II; Port area: Port K; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $416,831; Percent increase in allocation over what risk model would have indicated: 41.7%. Group: Total; Port area: 11 port areas; Effect of funding floors on port area allocations: Additional allocation received beyond what risk model would have indicated: $11,593,732; Percent increase in allocation over what risk model would have indicated: 26.1%. Source: DHS. [A] Funding floors limit how much a port area's allocation can decrease from year to year, regardless of changes in risk identified by the model. This table shows the 11 port areas that received a higher PSGP allocation in fiscal year 2011 than their risk profiles would have indicated as a result of the inclusion of funding floors. [End of table] DHS Revised the Vulnerability Index of the PSGP Risk Model but Additional Changes Could Further Strengthen the Measure: In fiscal year 2011, DHS modified how port vulnerability--the relative exposure to an attack--is calculated in the PSGP risk model, but additional changes could improve how vulnerability is measured in the model. Prior to fiscal year 2011, the PSGP risk model held vulnerability constant, rather than accounting for differences across ports. We have reported on the value of measuring vulnerability in risk analysis models in two prior reports.[Footnote 23] In June 2008, we reported that DHS chose to hold vulnerability constant and consider all states and urban areas equally vulnerable in the HSGP risk analysis model, which reduced the value of the model in estimating risk.[Footnote 24]In June 2009, we reported that DHS also chose to consider all transit agencies equally vulnerable in its Transit Security Grant Program (TSGP) risk analysis model.[Footnote 25] Regarding both models--which are similar in structure to the PSGP risk model--we recommended that DHS formulate a method to measure vulnerability in a manner that captures variations across jurisdictions, and apply this vulnerability measure in future iterations of the grant allocation model. To respond to these recommendations and other external feedback regarding the grant programs, and to produce a more complete risk picture, DHS modified the vulnerability index in the fiscal year 2011 PSGP model such that vulnerability is no longer held constant.[Footnote 26] Instead, the new vulnerability index recognizes that different ports can have different vulnerability levels. In the fiscal year 2011 PSGP model, port vulnerability is assessed using four data components thought to influence a port's vulnerability to attack, as shown below in table 4. The fiscal year 2011 PSGP risk model is provided in full in appendix II. Table 4: Data Components in Vulnerability Index of Fiscal Year 2011 PSGP Risk Model: Data Element: Ferry Passengers; Definition: The average daily ferry ridership for any ferry lines that began or ended in a port during the 2008 calendar year. Data Element: Cruise Ship Passengers; Definition: The annual number of cruise ship passengers that embarked on a cruise ship from that port during the 2009 calendar year. Data Element: Foreign Vessel Calls; Definition: The number of foreign-flagged vessels that arrived in a U.S. port during the 2010 calendar year with a foreign port as their last port of call. Data Element: HAZMAT Population; Definition: The volume of hazardous materials that transited through a port during the 2008 and 2009 calendar years multiplied by the population in a 5-mile radius around that port. Source: DHS. [End of table] Although FEMA has taken the first step towards improving how port vulnerability is measured in the PSGP risk model, further improvements are needed to ensure that the vulnerability score for a specific port is responsive to changes in security that may occur in that port--such as the implementation of new security measures. The fiscal year 2011 vulnerability index does not provide a mechanism to account for how new security measures--such as the installation of cameras or the provision of additional training to security officials --affect a port's vulnerability, even if those security measures were funded using PSGP grant dollars. This limitation is due to the fact that the data elements within the vulnerability index are counts of activities, which recognize the number of activities that may occur--such as how many ferry passengers board a ferry--but do not account for the protective actions taken to secure them. For example, if a port installed security cameras throughout a ferry system to monitor vessel or ferry passenger activity, one would expect to reduce the ferry system's vulnerability to attack. However, because the "ferry passenger" data element within the model's vulnerability index is simply a count of passengers utilizing the ferry system and is not a reflection of the security measures in place to protect the ferry system, the new camera system would not reduce the port's vulnerability score as calculated by the risk model. Thus, with this type of measure, in this example, a port could only reduce its vulnerability score by reducing the number of passengers utilizing the ferry system. The model's robustness is thereby limited because activity counts do not reflect improvements made to port security. It is important to note that some security improvements may be captured by the inclusion of the Coast Guard's Maritime Security Risk Analysis Model (MSRAM) results in the PSGP risk model.[Footnote 27] The MSRAM data--which are updated annually--provide information to the model on the percentage of national high-risk assets that reside within each port. However, MSRAM does not account for all types of security improvements because it is an asset-based model that assesses improvements to individual port assets such as a ferry terminal or a chemical plant. As such, MSRAM is not designed, for example, to evaluate security projects that may affect multiple assets in a port. The National Infrastructure Protection Plan states that when measuring vulnerability, one should describe all protective measures in place and how they reduce vulnerability. FEMA officials reported that capturing data on all security improvements would be challenging due to the need to collect and validate data for all ports included in the PSGP risk model. However, FEMA officials acknowledged the importance of incorporating completed security projects as part of the vulnerability component of the risk model and stated that FEMA will continue to refine its vulnerability assessments. Without accounting for the reductions in vulnerability achieved through new security measures implemented in a port, including those funded through the PSGP, the robustness of the risk model may be limited and not accurately reflect the relative risk of port areas throughout the nation. Instead, the risk model would likely continue to recognize the same ports as the highest risk, regardless of the security improvements made in those ports. In addition, by not accounting for security improvements resulting from PSGP grants, the security benefits of the PSGP are also not recognized. Incorporating completed security projects into the vulnerability component of the risk model could help increase its robustness and more accurately direct allocations to the highest risk port areas. While FEMA officials reported that developing an improved vulnerability index that incorporates the effect of security improvements would be a challenging process, there are interim measures that FEMA could take to ensure that the most precise data available are being used to populate the existing vulnerability index. FEMA made some progress in this regard by modifying how the HAZMAT Population data component was calculated in the fiscal year 2011 model.[Footnote 28] Rather than measuring only hazardous materials imports, as was done in the fiscal year 2010 and prior models, the modified measure also accounts for the transit of hazardous materials through a port where the port is not their final destination, providing added precision to the model. However, there are more precise data available that FEMA is not currently utilizing for at least one additional data component within the vulnerability index-- foreign vessel calls. In the fiscal year 2011 model, the foreign vessel calls component provides a count of foreign-flagged vessels arriving in U.S. ports that have a foreign port as their last port of call. However, this measure does not account for the variation in risk profiles of these vessels--as not all foreign vessels are considered to be of equal risk, according to the Coast Guard. Because the Coast Guard does not view all vessels to be of equal risk, it has developed a procedure to identify and target for boarding those vessels that it deems to pose a high relative security risk to a port. This program--called the High- Interest Vessel (HIV) Program--collects data that classify arriving vessels according to risk, using multiple factors to establish the vessel's risk profile.[Footnote 29] According to a Coast Guard HIV program official, HIV data would provide a better indicator of the risk posed by vessels arriving from foreign ports than a vessel count would provide. He also reported that the Coast Guard already maintains these vessel data and they could be analyzed to determine areas with higher frequencies of high-risk vessel arrivals, although it would require the Coast Guard to extract data from multiple sources to conduct a port-by-port analysis. The National Infrastructure Protection Plan states that DHS is responsible for using the best available information to conduct risk analysis and risk management activities. FEMA officials reported that they considered using HIV data in fiscal year 2011 but determined that due to time constraints, it would be more straightforward to use a count of foreign-flagged vessels during the first iteration of the vulnerability index. However, FEMA officials reported that they will continue to research additional data elements for inclusion in future year risk models. Using data from the HIV Program--which the Coast Guard already collects--in future iterations of the risk model could position FEMA to better capture the vulnerability of port areas posed by vessels arriving from foreign ports and thereby improve the precision of allocations to high-risk port areas. Most Grant Funding Is Available, but $400 Million Is Unavailable Due to Various Challenges--Which FEMA Has Begun to Address: FEMA awarded nearly $1.7 billion in port security grants in fiscal years 2006 through 2010. As shown in figure 4 below, grantees have "drawn down" about one-quarter of funds--or about $395 million.[Footnote 30] Further, about half of the funds are "available" to grantees to begin work on projects.[Footnote 31] However, about one- quarter of funds are "unavailable" to grantees.[Footnote 32] Figure 4: Status of Awarded Grant Funding, Fiscal Years 2006 through 2010: [Refer to PDF for image: illustration] Funds Drawn Down: $394.8 million (23.6%); Available Funds: $873.4 million (52.1%); Unavailable Funds: $407.8 million (24.3%). Source: GAO analysis of FEMA data as of September 2011. [End of figure] Grantees Have Drawn Down About One-Quarter of Awarded PSGP Grant Funds: As shown in table 5 below, FEMA awarded nearly $1.7 billion in port security grants in fiscal years 2006 through 2010; however, less than 24 percent--or about $395,000 million--had been drawn down as of September 2011. Table 5: Draw Down Rates by Group, Fiscal Years 2006 through 2010[A]: Group I; Total PSGP funding awarded: $920,508,263; Amount of funding drawn: down by grantees: $160,476,245; Percent of awarded funds drawn down: 17.4%. Group II; Total PSGP funding awarded: $531,998,959; Amount of funding drawn: down by grantees: $109,788,562; Percent of awarded funds drawn down: 20.6%. Group III; Total PSGP funding awarded: $143,003,552; Amount of funding drawn: down by grantees: $80,702,875; Percent of awarded funds drawn down: 56.4%. All other port areas; Total PSGP funding awarded: $80,558,172; Amount of funding drawn: down by grantees: $43,912,734; Percent of awarded funds drawn down: 54.5%. Total; Total PSGP funding awarded: $1,676,068,946; Amount of funding drawn: down by grantees: $394,880,416; Percent of awarded funds drawn down: 23.6%. Source: GAO analysis of FEMA data as of September 2011. [A] For a complete summary of the financial status of PSGP funds, see appendix III. [End of table] Although draw down rates are often cited as a measure of progress in improving port security, FEMA officials stated that draw down rates are not an accurate reflection of progress made in improving port security because grantees do not always draw down their funds promptly. Thus, even though progress may be underway in improving port security, until the grantee draws down their funds, this progress is not evident. FEMA officials reported that grantees may not draw down their grant funds right away for two main reasons. First, as a reimbursement grant program, grantees are not eligible to draw down awarded PSGP funds until they have incurred a cost. FEMA officials reported that costs for PSGP grants are often not incurred until late in the grant performance period. For example, grantees may choose to wait until project completion before paying contractors to ensure that the project is completed according to the terms of the contract. Thus, the draw down of grant funds would occur late in the performance period, after project completion. Second, grantees may choose not to draw down funds immediately after incurring a cost. Instead, the grantee might choose to wait until the end of the performance period to draw down funds or choose to draw down funds at select points throughout the year. Often, according to FEMA officials, this delay is due to the parameters of local accounting systems or the need to seek approval from local government entities before requesting reimbursement. As a result of these two factors, grantees have likely made more progress towards implementing grant projects to improve port security than is reflected in the draw down numbers, according to FEMA officials. To encourage grantees to draw down funds more promptly, FEMA's GPD released an information bulletin in January 2011 requesting that whenever possible, grantees draw down funds no less than on a quarterly basis. According to the information bulletin, more frequent draw downs would provide a more accurate representation of FEMA grant fund usage.[Footnote 33] According to FEMA data on monthly draw down rates over time, there was an initial increase in draw down rates for some grant years after the information bulletin was released, but draw down rates have since leveled off. One-Quarter Of Awarded PSGP Grant Funding Is Unavailable To Grantees Due to Various Challenges: Of the nearly $1.7 billion in port security grants that FEMA awarded to port areas in fiscal years 2006 through 2010, more than $400 million--or about 24 percent--remained unavailable to grantees as of September 2011, as shown in table 6 below. Grantees cannot use unavailable funds to begin work on security projects. Table 6: PSGP Funding Awarded and Unavailable, by Groups, Fiscal Years 2006 through 2010[A]: Group I; Total PSGP funding awarded: $920,508,263; Unavailable funds: $242,252,671; Percent of awarded funding that is unavailable: 26.3%. Group II; Total PSGP funding awarded: $531,998,959; Unavailable funds: $144,090,543; Percent of awarded funding that is unavailable: 27.1%. Group III; Total PSGP funding awarded: $143,003,552; Unavailable funds: $13,943,075; Percent of awarded funding that is unavailable: 9.8%. All other port areas; Total PSGP funding awarded: $80,558,172; Unavailable funds: $7,471,747; Percent of awarded funding that is unavailable: 9.3%. Total; Total PSGP funding awarded: $1,676,068,946; Unavailable funds: $407,758,036; Percent of awarded funding that is unavailable: 24.3%. Source: GAO analysis of FEMA data as of September 2011. [A] For a complete summary of the financial status of PSGP funds, see appendix III. [End of table] There are two types of unavailable funds--funds that are "unused" and funds that are "on-hold." Unused funds--which exist only in Group I and II port areas--are funds which the port area has been awarded but has not yet used for specific projects.[Footnote 34] For example, as shown in table 6 above, approximately $242 million in grant funding awarded to Group 1 port areas was unavailable as of September 2011. Of this, about $116 million--or 48 percent--was unavailable because the funds have not been used for specific projects.[Footnote 35] The second type of unavailable funds--on-hold funds--exist in all four funding groups, and result when FEMA has approved the use of grant funding for a specific grant project, but compliance with postaward requirements--such as environmental and budgetary reviews--has not been completed. [Footnote 36] Until these postaward requirements are met, these grant funds remain "on-hold." Each type of unavailable funding--unused and on-hold--results from a different set of challenges, as discussed below. Three Challenges Contributed to Unused Grant Funds: Development and Approval of Risk Mitigation Plans Contributed to Delays in Using Funds: One challenge that PSGP program officials reported contributed to delays in using awarded grant funds was the implementation of the Port- Wide Risk Mitigation Plan (PRMP) requirement. This PRMP requirement was announced in August 2007 for the fiscal year 2007 supplemental grant round and was part of a broader FEMA effort to shift the grant program from supporting asset-specific projects--such as fences around a facility--that benefited just one facility, to supporting more regional, portwide projects--such as interoperable communication systems--that would benefit an entire port area. This new requirement caused delays because port areas were not eligible to submit specific projects to FEMA for approval until their PRMP was approved, and many PRMP submissions and approvals were delayed. The fiscal year 2007 supplemental grant guidance included a time line and specific deliverables to guide port areas in the plan development and approval process.[Footnote 37] Based on this time line, all port area PRMPs should have been finalized by May 2008. However, only 3 of the 11 port areas we interviewed had an approved plan in place by this time. Plans for the remaining 8 port areas were approved between July 2008 and September 2009. In June 2011, a senior FEMA official told us that FEMA did not hold stakeholders to the time lines for plan development because the time lines were unreasonably aggressive for some port areas. Another senior FEMA official stated that FEMA did not want to rush the plan development process because that could have been detrimental to the quality of the plans. Due to the delayed plan submissions, FEMA faced challenges in approving draft plans. For example, the senior FEMA official reported that it was difficult to convene the review panel to approve plans on a sporadic basis. Thus, rather than hold weekly or biweekly meetings to discuss one or two plans, which would pose a burden on their federal partners on the review panel, FEMA instead held review panel meetings every 2 months. As a result, the official reported that it took longer than expected to approve risk mitigation plans which then delayed the submission of grant projects from port areas. Until a port area's PRMP was approved, it was not eligible to submit projects to FEMA for approval. As a result, the delays associated with PRMP approval contributed to delays in the use of grant funds. For example, the PRMP for the Columbia- Snake River System was not approved until September 2009, meaning that the port area could not submit projects to FEMA for approval for more than 2 years after the fiscal year 2007 supplemental grant guidance was released, creating delays in the use of grant funds in this port area. Managing Multiple Open Grant Rounds--with Varying Cost-Share Requirements--Posed a Challenge to Using Grant Funds: Fiduciary agents and FEMA officials reported that the initial delays resulting from delays in PRMP approval were exacerbated by the fact that multiple grant rounds--beginning with the fiscal year 2007 supplemental grant round when the PRMP requirement was announced--were underway by the time port area PRMPs were approved and that these grant rounds had varying cost-share requirements. In the case of all 11 port areas in our review, multiple grant rounds had been announced-- through the release of grant guidance--before the port area's PRMP was approved, as shown in figure 5. Figure 5: Comparison of PRMP Approval Dates for 11 Port Areas in Our Review to PSGP Grant Milestone Dates: [Refer to PDF for image: timeline] August 2007: FY 2007S Grant Guidance Released; PRMP Requirement Announced. February 2008: FY 2008 Grant Guidance Released. April 2008: New York/New Jersey and New Orleans Plans Approved. May 2008: PRMP Approval Deadline; Sabine-Naches River Plan Approved. July 2008: Houston Galveston Plan Approved. August 2008: Delaware Bay Plan Approved. September 2008: Baltimore Plan Approved. November 2008: FY 2009 Grant Guidance Released; Los Angeles/Long Beach Plan Approved. January 2009: San Francisco Bay Plan Approved. February 2009: Jacksonville Plan Approved. April 2009: Puget Sound Plan Approved. May 2009: FY 2009 ARRA Grant Guidance Released. September 2009: Columbia-Snake River Plan Approved. December 2009: FY 2010 Grant Guidance Released. Source: GAO analysis. [End of figure] For example, both the fiscal year 2007 supplemental and the fiscal year 2008 grant rounds had been announced--in August 2007 and February 2008 respectively--before the first PRMPs--for the New York-New Jersey port area and the New Orleans port areas--were approved in April 2008. In some cases, additional grant rounds were announced before port area PRMPs were approved. For example, as shown in figure 5, four grant rounds (fiscal year 2007 supplemental, fiscal year 2008, fiscal year 2009, and ARRA) were announced before the Columbia-Snake River Port Area's PRMP was approved in September 2009. With multiple grant rounds open, applicants could choose under which grant year to apply for funding. Fiduciary agents and FEMA officials reported that the cost-share requirement was a significant factor in applicant decisions regarding under which grant year to apply for funding.[Footnote 38] As shown in table 7 below, the PSGP has traditionally required a cost- match, but this requirement has been modified or waived in numerous grant rounds as a result of legislative action. Table 7: Changing Cost-Share Requirements in the PSGP, Fiscal Years 2006 through 2011: Grant round: Fiscal year 2006; Cost-share requirements[A]: Public-sector applicants: 25 percent cash match; Private-sector applicants: 50 percent cash match. Grant round: Fiscal year 2007; Cost-share requirements[A]: Public-sector applicants: 25 percent cash match; Private-sector applicants: 50 percent cash match. Grant round: Fiscal year 2007S[B]; Cost-share requirements[A]: Public-sector applicants: 25 percent cash match; Private-sector applicants: 50 percent cash match. Grant round: Fiscal year 2008; Cost-share requirements[A]: Public-sector applicants: 25 percent cash match; Private-sector applicants: 50 percent cash match. Grant round: Fiscal year 2009; Cost-share requirements[A]: Public-sector applicants: 25 percent cash or in-kind match; Private-sector applicants: 50 percent cash or in-kind match. Grant round: Fiscal year 2009 ARRA; Cost-share requirements[A]: Public-sector applicants: Match waived; Private-sector applicants: Match waived. Grant round: Fiscal year 2010; Cost-share requirements[A]: Public-sector applicants: Match waived; Private-sector applicants: Match waived. Grant round: Fiscal year 2011; Cost-share requirements[A]: Public-sector applicants: Match waived; Private-sector applicants: Match waived. Source: PSGP grant guidance, fiscal years 2006 through 2011. [A] Values in this table represent the minimum contribution required. For fiscal years 2006 through 2009, the required match was waived for projects with a total cost less than $25,000. [B] The match requirement was waived for funds used to support the development of the Portwide Risk Mitigation Plan. [End of table] Fiduciary agents in 8 of 11 port areas in our review reported a lessened demand for grant funds in grant years where there was a cost- share requirement, particularly for fiscal years 2008 and 2009. Fiduciary agents cited a variety of challenges with the cost-share requirement, including: (1) applicants were aware of long delays in the distribution of grant funds and faced difficulty preserving the cost-share obligation in their entity's budget while pending receipt of awarded grant funds, (2) facility owners who were compliant with security requirements under MTSA were hesitant to invest their own money for additional security projects beyond the requirements, and (3) applicants were unable to afford the cost-share requirement due to the economic downturn. For example, one fiduciary agent reported that while she generally supports a cost-share requirement because it ensures stakeholder buy-in, the cost-share requirement has been challenging due to the poor economic environment. As a result of the cost-share, this fiduciary agent reported conducting three distinct rounds of project solicitations in the fiscal year 2008 grant round in order to generate enough demand to spend the port area's entire allocation. We reported in October 2010 that a cost-share requirement is a key factor for effective federal grants because it ensures that federal grants supplement--rather than substitute for--stakeholder spending. We further reported that a cost-share requirement is reasonable given that grant benefits can be highly localized.[Footnote 39] As a result of the inconsistent cost-share requirement, several fiduciary agents told us that applicants were more likely to request funding under the grant rounds with the most lenient cost-share requirement or delay project submission while waiting to learn whether or not the next round of grants would include the cost-share requirement. This uncertainty about the cost-share requirement created a disincentive for grant applicants to request funding during cost- share years. For example, the fiduciary agent in one port area told us that the port area received project proposals totaling twice the port area's total allocation for fiscal year 2011. Thus, projects had to be denied for fiscal year 2011 funding during the field-level review, even though more than $9 million in fiscal year 2008 and 2009 grant money remained unused. As shown in table 8 below, a greater portion of money from cost-share years remains unused as compared to money from non-cost-share years, even though cost-share grant years preceded the non-cost-share grant year. For example, about 22 percent of grant funding awarded to Group 1 port areas during cost-share years remains unused, as compared to less than 4 percent during fiscal year 2010, when the cost-share requirement was waived.[Footnote 40] Table 8: Unused Group I Funding from Cost-Share Years, Fiscal Years 2007 Supplemental through 2010A: Cost-share requirement in place: Fiscal year 2007 supplemental; Group I award: $66.0 million; Unused funds: $10.3 million; Percent of award unused: 15.6%. Fiscal year 2008; Group I award: $220.8 million; Unused funds: $47.2 million; Percent of award unused: 21.4%. Fiscal year 2009; Group I award: $217.8 million; Unused funds: $52.2 million; Percent of award unused: 24.0%. Total; Group I award: $504.6 million; Unused funds: $109.7 million; Percent of award unused: 21.8%. Cost-share requirement waived: Fiscal year 2010; Group I award: $173.1 million; Unused funds: $6.1 million; Percent of award unused: 3.5%. Total; Group I award: $173.1 million; Unused funds: $6.1 million; Percent of award unused: 3.5%. Source: GAO analysis of FEMA data as of September 2011. [A] While a cost-share requirement was in place prior to the fiscal year 2007 supplemental grant round, funding can only remain unused for specific projects under the fiduciary agent model, where port areas are given a designated allocation. As a result, we have excluded fiscal year 2006, fiscal year 2007, and the ARRA grant rounds from this analysis. This analysis also excludes fiscal year 2011--in which the cost-share requirement was waived--because it fell outside the scope of this report due to the timing of the grant cycle. [End of table] Waiver Process Exacerbated the Effects of the Cost Sharing; Further Efforts Could Improve the Process: Fiduciary agents reported that the lengthy cost-share waiver process-- used by applicants seeking an exemption from the required cost-share-- further exacerbated the impact of the cost-share requirement under the PSGP. Grant applicants unable to meet the cost-share requirement are eligible to apply for a waiver. The waiver approval process requires 22 steps--which include approval by leadership within FEMA's GPD, approval by FEMA's Administrator, and finally, approval by the Secretary of Homeland Security.[Footnote 41] According to statute, the Secretary can grant a waiver of the cost-share requirement if she determines that a proposed project is meritorious but cannot be undertaken without additional federal support.[Footnote 42] However, 5 of the 11 fiduciary agents we interviewed told us that they had concerns with the cost-waiver request process--including with the length of time required for a decision. For example, one fiduciary agent--who oversaw a cost-waiver application that took about 7 months to be approved--told us that the cost-waiver request process was time- consuming and confusing. According to FEMA officials, an unknown portion of this 7-month approval process was spent ensuring that the fiduciary agent had submitted all of the required documentation and thus, the actual approval time once the request was finalized was less than 7 months. The cost-share requirement was waived for all applicants under the ARRA, fiscal year 2010, and fiscal year 2011 grant cycles. However, grant applicants may continue to submit cost-share waiver requests for new projects to be funded under the fiscal year 2007 supplemental, fiscal year 2008, and fiscal year 2009 grant cycles--which were cost- share years--if money in their port area remains unused from those years. As shown earlier in table 8, about $110 million in PSGP funds awarded to Group I port areas from fiscal year 2007 through 2009-- years in which the cost-share was required--remains unused. As port areas solicit projects for these unused funds, some applicants may submit cost-share waiver requests as well. For example, one fiduciary agent from a Group 1 port area reported that her port area recently completed the field-review process to identify projects to fund using their unused fiscal year 2009 grant monies. As a result, the port area submitted 10 projects to FEMA for approval in October 2011, of which 8 projects include a cost-share waiver request. Although FEMA has taken steps to improve the cost-waiver process, it continues to be lengthy and additional efforts may help expedite these reviews. In July 2009, FEMA issued an information bulletin to clarify the process that grantees should follow when submitting cost-share waiver requests.[Footnote 43] Since the issuance of this information bulletin, FEMA has received a total of 31 cost-share waiver requests-- of which, 22 were approved.[Footnote 44] In November 2009, following a Fiduciary Agent Workshop, FEMA released written responses to questions posed at the workshop. In this document, FEMA stated that a decision on a waiver request could be expected approximately 30 days after all documentation was provided to FEMA in accordance with the process outlined in the July 2009 information bulletin. However, according to FEMA records, for cost-share waivers reviewed since December 2009 DHS took--on average--126 days to approve a request once all of the required information had been received. Approval time lines ranged between 55 days and 268 days for these waiver requests. Of the 126 days, on average, it took 74 days from the date requests were considered complete to achieve approval by GPD's leadership. It took an additional 52 days, on average, to complete the remaining 11 steps of the waiver process--including approval at the Administrator of FEMA level and the Secretary of Homeland Security level. According to DHS, due diligence requires both component and department level clearances, including secretarial clearance, in order to responsibly award funding. This process ensures that PSGP projects meet program goals and objectives. However, FEMA records show that no approval recommendations from GPD leadership were overturned as a result of the additional 52 days, on average, of required review. Further, only 1 of the 31 waiver requests submitted since the July 2009 information bulletin was issued has been denied--and it was denied at the GPD level. Standards for Internal Control in the Federal Government state that "pertinent information should be identified, captured, and distributed in a form and time frame that permits people to perform their duties efficiently."[Footnote 45] FEMA officials told us that FEMA has taken internal actions to improve the review process such as meeting with other key offices involved in the waiver process in the spring of 2011 to discuss and standardize information requirements for the waiver package. FEMA officials reported that they believe that this effort has helped improve some aspects of the process, but further action may be required to streamline the process. Additionally, fiduciary agents remain wary of the cost-waiver request process. For example, one fiduciary agent told us that its field review team--including the COTP--would be unlikely to recommend a project for funding if that project relies on a cost-share waiver. Another fiduciary agent told us that there is little interest in the fiscal year 2009 funds due in part to the lengthy waiver review process. Without a more efficient review process, certain grant applicants that cannot fund the cost- match requirement may not receive grant funds to implement their projects, or may not even apply for funds. Evaluating the waiver review process could help to ensure that the process is completed in a timely manner. Compliance with Postaward Requirements and an Antiquated Data Management System Contributed to On-Hold Grant Funds: In addition to funding that is unavailable because it is unused, some funding is also unavailable because it is on-hold due to delays in achieving compliance with postaward requirements and challenges with FEMA's grant management system. After FEMA approves the use of grant funds for a specific project, stakeholders reported that additional delays in making funds available resulted from compliance with postaward requirements. FEMA cannot make grant funds available to grantees to begin work on approved projects until all postaward requirements, including budgetary and environmental reviews, are met. One cause of delay was inefficiency in the reviews conducted pursuant to the National Environmental Policy Act, which requires a review of the impacts of proposed actions as well as reasonable alternatives to those actions.[Footnote 46] Grantees submit Environmental and Historical Preservation (EHP) information to the Grant Program Directorate--Environmental and Historical Preservation (GPD-EHP) office for review. If the project does not require a detailed EHP analysis, it can be reviewed and approved by a GPD analyst. However, projects that require a more detailed analysis are reviewed either by the GPD-EHP team or passed to a FEMA regional environmental officer depending on the scope of the review. Fiduciary agents we interviewed in 5 of 11 port areas reported that slow EHP reviews caused delays.[Footnote 47] During a July 2009 FEMA- sponsored stakeholder conference, participating port areas stated that the EHP submission and review process associated with the PSGP was causing delays, which increased project costs and limited what grantees could accomplish with grant funds. The group requested the establishment of a more structured postaward time line, including deadlines for EHP reviews, so that grantees would be better able to plan their projects. A senior FEMA official reported that delays in EHP reviews were due to the fact that prior to 2008, GPD had not historically conducted EHP reviews on preparedness projects and thus, had no established program for doing so. This official further reported that creating an "EHP Team" within GPD with the assistance of subject matter specialists via technical support contract and standardizing the format for project submittals has helped expedite EHP reviews. According to FEMA officials, the delays caused by inefficient review processes have been amplified by FEMA's reliance on an antiquated data management system. As we reported in our June 2009 report on the Transit Security Grant Program, FEMA did not have a mechanism for systematically collecting data on the status of individual grant projects through the review process.[Footnote 48] For example, although FEMA has systems to track the financial information related to its grants programs, these systems did not allow FEMA to track the status of grant reviews, such as EHP reviews. According to FEMA, the data management system used to manage the Transit Security Grant Program is also used to manage the PSGP and no changes have been made to the system since our 2009 report. As such, GPD officials reported that each PSGP program analyst maintained separate spreadsheets that tracked the grants for which they were responsible. Using numerous data systems and spreadsheets resulted in inefficiencies and, in some cases, lost data, as program analysts had to search across systems for information or were reliant on systems--such as the Homeland Security Information Network--that lost application information.[Footnote 49] The overall result was a data system that did not provide information in a timely manner and that could not be used effectively to manage the grant lifecycle. DHS and FEMA Have Taken Steps to Address Unavailable Balances: DHS and FEMA have taken a number of steps to address unavailable balances. To ensure that grant awards were used for specific projects in a timely manner, FEMA implemented project submission deadlines beginning in fiscal year 2010. Prior to this, FEMA did not have deadlines for submitting projects which resulted in money being unused for projects and therefore unavailable until the port area could identify enough projects to fund--a process that, in some cases, took years to complete. Starting in fiscal year 2010, port areas had 45 days from the initial fiduciary agent application deadline to submit specific project proposals. In fiscal year 2011, FEMA took an additional step to shorten application time frames by requiring all Group I and II port areas to submit specific project proposals at the time of the fiduciary agent's application. According to FEMA officials, this change will ensure that grant money allocated in the future will be immediately used, which will expedite the grant distribution process. DHS has also taken a number of steps to address the delays in the EHP review process that contributed to funds being on-hold. See table 9 for a list of key DHS actions: Table 9: Key DHS Actions Taken to Improve EHP Review Process Since Fiscal Year 2009: Action Taken: Increased GPD staffing levels; Date: Fiscal years 2009 through 2011; Result: The number of staff working on the PSGP within FEMA GPD has increased every year since fiscal year 2008. For example, in fiscal year 2008, there was a total of 8 staff working on the PSGP. As of fiscal year 2011, there were 11 staff working on the PSGP, including two supervisors. According to FEMA officials, this additional staff better enables GPD to track the progress of grant applications through the EHP review process and follow-up on challenges more effectively. Action Taken: Developed Programmatic Environmental Assessment (PEA); Date: July 2010; Result: The PEA divides grant-funded projects into seven categories[A] and defines those actions that have no environmental impacts,b as well as those that require case-by-case consideration to determine the appropriate level of analysis needed to assess environmental impacts. The implementation of the PEA allowed FEMA to tailor the EHP review based on project category, thereby shortening or eliminating reviews of projects with no environmental impact. Action Taken: Revised EHP screening form; Date: February 2011; Result: The revised screening form is designed to streamline information and to be easy to understand. FEMA officials reported that this revised form should result in fewer mistakes in the grantee's original submissions, which will expedite review time frames. Action Taken: Changed time frames for submitting EHP information; Date: May 2011; Result: FEMA began requiring grant applicants to submit EHP paperwork when they submit their project's investment justification for approval. FEMA officials stated that they hope to begin the EHP review while the project is undergoing programmatic review in order to expedite the EHP process. Action Taken: Developed EHP review time frames; Date: June 2011; Result: GPD-EHP developed time frames under which projects going through the EHP process will be evaluated. According to FEMA officials, the initial review will take 15-25 days. If the project is excluded from further review, the process ends and EHP is complete. Projects that need additional review are sent to the regions. If the regional review finds no adverse impacts, the process will be 2-3 months. If adverse impacts are determined the time frame will be 3-12 months. Source: GAO. [A] The PEA divides grant-funded projects into seven categories: planning, management and administration, training, exercises, purchase of mobile and portable equipment, modification of existing structures and facilities, and new construction. [B] The following project types have been determined to have no environmental impacts: planning, management and administration, classroom-based training, table top and functional exercises, and mobile and portable equipment. [End of table] As a result of these changes, some fiduciary agents reported improvement in the EHP review process; however, these views could not be verified using FEMA data. Specifically, 5 of 11 fiduciary agents reported that the EHP review process has improved. For example, 1 fiduciary agent believed that the EHP process has improved primarily because of FEMA's categorization of projects according to the amount of expected impact they would create. However, due to data reliability issues with FEMA's EHP data--there were too many missing EHP dates for an accurate analysis--we were not able to confirm whether the EHP process was improving. Because of limitations with FEMA's existing grant management system, all EHP data are managed on separate spreadsheets maintained by program analysts and these spreadsheets have varying levels of completeness. FEMA officials acknowledged the limitations with their data, including the omission of key dates in the EHP review process, such as the date when the EHP information was submitted for review or the date when the project's EHP review was approved. However, FEMA officials noted that the evolution of the Non Disaster Grants (ND Grants) system, which is discussed below, may allow for better tracking of EHP submissions and approvals in the future. To address challenges exacerbated by the antiquated data management system used to manage the PSGP, DHS took the first step towards consolidating its data management system in fiscal year 2011 by implementing the first of two planned phases of the ND Grants system. According to FEMA, the ND Grants system is intended to consolidate FEMA's disparate data systems and improve the ability of FEMA grant managers to track grants through the review and approval process. In February 2011, FEMA anticipated that the ND Grants system would be fully completed by the end of fiscal year 2014. Given the early stages of this process, it is too early to assess the extent to which the ND Grants system will alleviate data management challenges. FEMA Is Developing Measures to Assess PSGP Administration but Does Not Have Measures to Assess Effectiveness: In July 2011, during the course of our review, FEMA finalized eight performance measures designed to track how well FEMA GPD administers and manages the PSGP. According to FEMA documents, these measures include the percent of: (1) grant funds released to grantees within 300 days, (2) grant awards programmatically monitored annually, (3) grant funds programmatically monitored annually, (4) grant awards financially monitored annually, (5) grant funds financially monitored annually, (6) corrective actions completed within the fiscal year issued, (7) preparedness grant awards processed within 150 days, and (8) grant closeouts completed within 120 days from the end of the period of performance. According to FEMA officials, data collection for these eight measures will begin in the fiscal year 2012 grant cycle and the 2012 baseline data will be used to develop targets for each measure beginning with the fiscal year 2013 grant cycle. For more information on these measures, see appendix V. In addition to these eight measures, FEMA officials reported that four additional measures are under development. By implementing these internal measures, FEMA officials should be better positioned to determine whether the changes they have made in recent months are sufficient to better ensure more efficient grant administration going forward or whether additional actions are required. However, since targets for the eight measures will not be established until at least fiscal year 2013, and the four additional measures remain under development, it is too early to know how effective they will be in helping FEMA to assess its performance and improve its grant management. FEMA has not evaluated the effectiveness of this program in strengthening critical maritime infrastructure against risks associated with potential terrorist attacks because it has not implemented measures to track progress toward achieving program goals. In 2006, the Department of Homeland Security's Office of Inspector General reported that as the PSGP continues to evolve, an important challenge DHS should undertake is the measurement of its impact. [Footnote 50] The Inspector General also reported that DHS has raised the overall bar of preparedness through the port security grants but it is not clear that DHS knows how much actual risk reduction has been achieved. Four years later, in January 2010, FEMA formed a task force to develop draft performance measures for the PSGP. This task force conceptualized 11 potential measures of effectiveness for the PSGP; however, baseline data needed to implement the measures did not exist for all 11 draft measures. According to FEMA documentation, baseline data existed for 2 of the 11 measures, additional data collection would be needed to populate 3 measures, and 6 measures would require further refinement or coordination with federal partners. In December 2010, FEMA transferred responsibility for developing performance measures from GPD to FEMA's National Preparedness Directorate, specifically the National Preparedness Assessment Division (NPAD).[Footnote 51] FEMA officials report that this change was made to consolidate the development of effectiveness measures within the directorate containing assessment experts. However, this may have contributed to delays in developing performance measures because the staff at NPAD, including the new Director, who began in March 2011, needed time to familiarize themselves with the grant program and draft measures. In July 2011, a senior NPAD official told us that the division was briefed on the draft measures developed by the GPD task force, but they were considering developing different measures as well. In October 2011, the same official told us that the division had developed a number of prospective performance measures for the PSGP, but that FEMA was still reviewing the draft measures. As a result, the official told us that it has not been determined whether the performance measures will be included in the fiscal year 2012 guidance. Additionally, FEMA did not have a plan in place, with milestones, to ensure the implementation of such measures. According to best practices for project management, the development of a project management plan--which defines how the project is executed, monitored and controlled, and closed--is a key element of project management. [Footnote 52] Best practices for project management also call for milestone dates, among other factors, in carrying out a project successfully. As a result, FEMA's progress toward implementing measures to assess whether the program is achieving its stated purpose remains unclear. Conclusions: Port areas have unique characteristics--they are centers of commerce, hubs of transportation, and often close to major population centers. These characteristics result in specific vulnerabilities that must be addressed to avoid the human or economic losses that would result from a terrorist attack. The Port Security Grant Program (PSGP)-- administered by FEMA and supported with subject matter expertise from the Coast Guard--is one tool DHS uses to protect critical maritime infrastructure from these risks. Risk management has been endorsed by the federal government to help direct finite resources to areas of greatest risk and grant programs have provided substantial resources toward this effort. We found that PSGP allocations were highly correlated to risk for the grant years we examined and DHS has taken steps to strengthen the PSGP risk allocation model by improving the quality and precision of the data inputs. However, additional efforts- -such as accounting for how new security measures affect port vulnerability and using the most precise data available in the risk model--could further strengthen the model and build upon the progress made. While the allocation process has been risk-based, FEMA has faced significant challenges administering the grant program. For example, FEMA awarded nearly $1.7 billion in port security grants for fiscal years 2006 through 2010; however, draw down levels for the PSGP are low--with about one-quarter of fiscal year 2006 through 2010 grant monies drawn down as of September 2011. While FEMA may not consider draw down levels to be an accurate measure of progress made in improving port security, this measure has become the de facto yardstick for assessing progress in securing our ports because no other measures exist. Additionally, about a quarter of the awarded funding remains unavailable due to delays in using grant funds, challenges with the cost-match and associated waiver process, and challenges that grantees have had complying with postaward requirements. As a result, about $400 million in awarded grant funding remains unavailable to grantees for port security projects. FEMA has taken steps to improve the availability of funds and has developed internal performance measures to begin evaluating its administration of the grant program. However, FEMA has not evaluated the effectiveness of the program because it does not have measures to track progress towards achieving program goals. To establish a more accurate measurement of grant effectiveness, FEMA should expedite its efforts to implement performance measures for the PSGP. Initial steps have been taken to develop performance measures for the PSGP, but the time frame for implementing them is unclear. Without a plan, there is little assurance that these measures will be implemented in a timely way to assess the program's effectiveness in ensuring that critical port infrastructure is protected. Recommendations for Executive Action: We are making four recommendations to help strengthen the implementation and oversight of the PSGP. To strengthen DHS's methodology for measuring vulnerability in ports, and to improve the precision of grant allocations to high-risk port areas, we recommend that the Secretary of Homeland Security direct the FEMA Administrator to: * Develop a vulnerability index that accounts for how security improvements affect port vulnerability, and incorporate these changes into future iterations of the PSGP risk model. * Coordinate with the Coast Guard to determine the most precise data available to populate the data elements within the vulnerability index and to utilize these data as an interim measure, until a revised vulnerability index is developed. To ensure that waiver requests--including those submitted under previous cost-share years in which money remains unassigned and those that may be submitted in future grant rounds if a cost-share requirement is applied--are evaluated promptly, we recommend that the FEMA Administrator--in conjunction with the Office of the Secretary of Homeland Security--evaluate the waiver review process to identify sources of delay and take measures to expedite the process. To strengthen the administration, oversight, and internal controls of the PSGP, and to streamline processes, we recommend that the Secretary of Homeland Security direct the FEMA Administrator to develop--in collaboration with the Coast Guard--time frames and related milestones for implementing performance measures to monitor the effectiveness of the PSGP. Agency Comments and Our Evaluation: We provided a draft of this report to DHS for review and comment. DHS provided written comments on November 14, 2011, which are reproduced in full in appendix VI. DHS concurred with the findings and recommendations in the report, and stated that FEMA is taking actions to implement our recommendations. DHS concurred with our first recommendation that it develop a vulnerability index that accounts for how security improvements affect port vulnerability, and incorporate these changes into future iterations of the PSGP risk model. DHS stated that although incorporating the effects of completed security projects on vulnerability is complex, the inclusion of this type of metric remains a key goal of the PSGP risk methodology and is revisited annually. However, DHS did not provide details regarding its plan to implement this recommendation. DHS concurred with our second recommendation that FEMA coordinate with the Coast Guard to determine the most precise data available to populate the data elements within the vulnerability index and to utilize this data as an interim measure until a revised vulnerability index is developed. Specifically, DHS stated that FEMA will continue to coordinate with subject matter experts, including the Coast Guard, to determine the best data available for use in the vulnerability index. Further, DHS stated that FEMA and the Coast Guard will continue discussions regarding data elements to be used in future grant years, and that these meetings will focus on what data elements are currently available for use as an interim measure while additional enhancements to the vulnerability component are developed. Such action should address the intent of this recommendation. DHS concurred with our third recommendation that FEMA evaluate the cost-share waiver request process in conjunction with the Office of the Secretary of Homeland Security to identify sources of delay and take measures to expedite the process. Specifically, it reported that FEMA and DHS are exploring the best solution to reduce delays and expedite the cost-share waiver request evaluation process and will work to implement appropriate process improvements as they are identified. Such action, when implemented, should address the intent of this recommendation. Finally, DHS concurred with the fourth recommendation that it develop time frames and related milestones for implementing performance measures to monitor the effectiveness of the PSGP. Specifically, DHS stated that FEMA's Grant Programs Directorate (GPD) is in the process of developing external measures to determine how effective grantees are in managing and administering the grants and that these external measures will be completed by January 1, 2012. DHS also stated that specific measures to monitor the performance of the PSGP are being developed within FEMA. Further, DHS stated that FEMA is also developing performance objectives for core capabilities, as required by Presidential Policy Directive 8 and the new National Preparedness Goal, and will be reviewing all prevention and protection measures, including those for PSGP. Finally, DHS stated that FEMA's National Preparedness Directorate will work with GPD and the Coast Guard in fiscal year 2012 to develop some specific measures towards building and sustaining capabilities. These efforts, as described above, are important steps towards implementing this recommendation. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Homeland Security, appropriate congressional committees and other interested parties. In addition, this report will be available at no charge on the GAO website at [hyperlink, http://www.gao.gov]. If you or your staff have any further questions about this report, please contact David C. Maurer at (202) 512-9627 or MaurerD@gao.gov or Stephen L. Caldwell at (202) 512-9610 or CaldwellS@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page. Key contributors are listed in appendix VII. Signed by: David C. Maurer: Director: Homeland Security and Justice Issues: Signed by: Stephen L. Caldwell: Director: Homeland Security and Justice Issues: List of Requesters: The Honorable Peter King: Chairman: Committee on Homeland Security: House of Representatives: The Honorable John D Rockefeller IV: Chairman: Committee on Commerce, Science and Transportation: United States Senate: The Honorable Joseph Lieberman: Chairman: The Honorable Susan Collins Ranking Member: Homeland Security and Governmental Affairs Committee: United States Senate: The Honorable Candice Miller: Chairwoman: Subcommittee on Border and Maritime Security: Committee on Homeland Security: House of Representatives: The Honorable Gus Bilirakis: Chairman:P Subcommittee on Emergency Preparedness, Response, and Communications: Committee on Homeland Security: House of Representatives: [End of section] Appendix I: Port Security Grant Program (PSGP) Allocations to Funding Groups, by Year: This appendix provides information on the percentage of total PSGP grant funding directed at each funding group since fiscal year 2007, the first year in which Department of Homeland Security (DHS) categorized port areas into funding groups. Table 10 shows that the percentage of funding directed at Group I port areas and all other port areas has been relatively stable over time, whereas this percentage has changed more drastically for Group II and Group III port areas. As discussed in the report, DHS allocations to individual port areas were made largely in accordance with risk, and were based on DHS's risk analysis and implementation decisions. DHS's decision to direct the majority of PSGP funding to the highest risk port areas--as shown in table 10--was one such implementation decision. The second decision involved the use of funding "floors" to limit fluctuations in individual port area funding from year to year. Table 10: Percent of Total PSGP Funding Directed at Each Funding Group, Fiscal Years 2007 through 2011[A]: Fiscal year 2007; Group I: 60.0%; Group II: 20.0%; Group III: 15.0%; All Other Port Areas: 5.0%; Ferry: N/A. Fiscal year 2007S; Group I: 60.0%; Group II: 20.0%; Group III: 15.0%; All Other Port Areas: 5.0%; Ferry: N/A. Fiscal year 2008; Group I: 54.2%; Group II: 34.5%; Group III: 4.9%; All Other Port Areas: 4.9%; Ferry: 1.4%. Fiscal year 2009; Group I: 54.2%; Group II: 36.0%; Group III: 4.5%; All Other Port Areas: 3.9%; Ferry: 1.3%. Fiscal year 2009 ARRA; Group I: 54.3%; Group II: 36.0%; Group III: 4.4%; All Other Port Areas: 4.0%; Ferry: 1.3%. Fiscal year 2010; Group I: 60.0%; Group II: 30.0%; Group III: 5.0%; All Other Port Areas: 5.0%; Ferry: N/A. Fiscal year 2011; Group I: 60.0%; Group II: 30.0%; Group III: 5.0%; All Other Port Areas: 5.0%; Ferry: N/A. Source: FEMA. [A] Total funding may not equate to 100 percent due to rounding. [End of table] [End of section] Appendix II: PSGP Risk Analysis Model, Fiscal Year 2011: This appendix provides information on the fiscal year 2011 PSGP risk model, which DHS uses to assess the relative risk posed to ports throughout the nation and to help determine PSGP eligibility and funding levels. As discussed in the report, DHS modified how port vulnerability--the relative exposure to an attack--was calculated in the PSGP risk model in fiscal year 2011. Rather than holding vulnerability constant, as was done in fiscal year 2010, DHS chose to modify the vulnerability index in fiscal year 2011 to recognize that different ports can have different vulnerability levels. The current vulnerability component--as shown in figure 6--considers how port vulnerability is affected by ferry and cruise ship ridership, foreign vessel calls, and hazardous material transits. However, as discussed in the report, further improvements are needed to ensure that the vulnerability score for a specific port is responsive to changes in security that may occur in that port--such as the implementation of new security measures--and that the vulnerability index is populated using the most precise data available. Figure 6: Fiscal Year 2011 PSGP Risk Model: [Refer to PDF for image: illustration] Port Risk: * Threat (30%); * Vulnerability (20%): - Ferry Passengers (5%) - Cruise Ship Passengers (5%) ó Foreign Vessel Calls (5%) ó HAZMAT Population (5%); * Consequence (50%): - Population Index (2%); - Economic Index (20%); - National Infrastructure Index (20%); - National Security Index (10%). Source: DHS. [End of figure] [End of section] Appendix III: Financial Status of PSGP Awarded Funds, Fiscal Years 2006 through 2010: This appendix provides information on the financial status of PSGP funds awarded during fiscal years 2006 through 2010. As discussed in the report, DHS awarded nearly $1.7 billion in grant funds to port areas throughout the nation for fiscal years 2006 through 2010. As shown in table 11, grantees have drawn down about 24 percent--or about $395 million--of this funding, as of September 2011. An additional 52 percent of the awarded funding--about $873 million--is available to grantees. About one-quarter of awarded grant funding--or about $408 million--is unavailable, meaning that port areas have not identified specific projects to fund with these monies or compliance with postaward requirements is pending. Table 11: Financial Status of PSGP Awarded Funds, by Funding Group, Fiscal Years 2006 through 2010: Group I: Total PSGP funding awarded: $920,508,263; Funding drawn down: $160,476,245 (17.4%); Available funding: $517,779,347 (56.2%); Unavailable funding: $242,252,671 (26.3%). Group II: Total PSGP funding awarded: $531,998,959; Funding drawn down: $109,788,562 (20.6%); Available funding: $278,119,853 (52.3%); Unavailable funding: $144,090,543 (27.1%). Group III: Total PSGP funding awarded: $143,003,552; Funding drawn down: $80,702,875 (56.4%); Available funding: $48,357,602 (33.8%); Unavailable funding: $13,943,075 (9.8%). All Other Port Areas[A]: Total PSGP funding awarded: $80,558,172; Funding drawn down: $43,912,734 (54.5%); Available funding: $29,173,691 (36.2%); Unavailable funding: $7,471,747 (9.3%). Total: Total PSGP funding awarded: $1,676,068,946; Funding drawn down: $394,880,416 (23.6%); Available funding: $873,430,493 (52.1%); Unavailable funding: $407,758,036 (24.3%). Source: GAO analysis of FEMA data as of September 2011. [A] This row also includes the designated ferry allocations in applicable years. [End of table] [End of section] Appendix IV: PSGP Cost-Share Waiver Approval Process: This appendix contains information on the review and approval process for PSGP cost-share waivers, which grantees can request from DHS if they are unable to meet the cost-share requirement. As discussed in the report and shown in figure 7 below, the waiver approval process requires 22 steps--which include approval by leadership within FEMA's Grants Program Directorate (GPD), approval by FEMA's Administrator, and finally, approval by the Secretary of Homeland Security. In November 2009, FEMA told fiduciary agents that a decision on a waiver request could be expected within 30 days. However, under the review process outlined in figure 7, DHS took--on average--126 days to approve a cost-share waiver once all of the required information had been received. Evaluating the waiver review process could help ensure that the process is completed in a timely manner. Figure 7: Review Process for Port Security Grant Program Cost-Share Waiver Requests: [Refer to PDF for image: illustration] Review Process for Port Security Grant Program Cost-Share Waivers: Upon receipt and acceptance of an award, based on criteria published in Information Bulletin #322, a grantee may submit a cost-share waiver request. Program Office Review: PSGP PA; transfer to: PSGP Section Chief; transfer to: TISB Branch Chief; transfer to: GD&A Director; transfer to: GMD Director. GPD Leadership Review: GMD Director; (revisions/comments to PSGP PA); transfer to: FEMA LAD Liaison to GPD; transfer to: Executive Officer; transfer to: Senior Policy Advisor; transfer to: FEMA OCC Liaison to GPD; transfer to: Deputy Assistant Administrator; transfer to: Assistant Administrator; transfer to: FEMA, OPPA. PNP and FEMA Review FEMA, OPPA; (revisions/comments to GMD Director); transfer to: PNP Senior Counselor; transfer to: PNP Deputy Administrator; transfer to: FEMA Chief of Staff; transfer to: FEMA Administrator; transfer to: OGC. DHS Review: OGC; (revisions/comments to FEMA, OPPA); transfer to: Policy; transfer to: Management; transfer to: Others; transfer to: Counselors; transfer to: Front Office. Key: FEMA: Federal Emergency Management Agency; GD&A: Grant Development & Administration Division; GMD: Grants Management Division; GPD: Grant Programs Directorate; LAD: Legislative Affairs Division; OCC: Office of Chief Counsel OGC: Office of General Counselor; OPPA: Office of Policy & Program Analysis; PA: Program Analyst; PNP: Protection and National Preparedness; PSGP: Port Security Grant Program; TISB: Transportation Infrastructure Security Branch. Sources: DNS. [End of figure] [End of section] Appendix V: FEMA's Internal Performance Measures: This appendix provides descriptive information on the suite of internal performance measures that FEMA developed to track how well it administers and manages the PSGP. As discussed in the report, data collection for these measures--which were finalized in July 2011--will begin in the fiscal year 2012 grant cycle and the 2012 baseline data will be used to develop targets for each measure beginning in the fiscal year 2013 grant cycle. However, as discussed in the report, it is too early to know how effective these measures will be in helping FEMA to assess its performance and improve its grant management. Table 12: Details on FEMA's Performance Measures to Assess Its Administrative Performance: Internal measure: Percent of grant funds released to grantees within 300 days; Description/Purpose: The timely release of preparedness grant funds impacts grantees' ability to fund, implement, and complete grant projects. This measure evaluates the percent of preparedness grant funds released to grantees within 300 days from the grant award date. Data for this measure will be used to assess GPD's efficiency in releasing preparedness grant funds and assisting grantees in meeting award conditions. These efforts also ensure that FEMA releases funds to the grantees in a timely manner to support project implementation within programs' specified period of performance. Internal measure: Percent of grant awards programmatically monitored annually; and: Internal measure: Percent of total grant funds programmatically monitored annually; Description/Purpose: GPD conducts programmatic monitoring each year to verify that preparedness grant programs and/or projects are executed in a manner consistent with grantees' stated implementation plans and according to applicable rules and regulations. Programmatic monitoring also highlights progress toward investments and the goals and objectives of State, Urban Area, Tribal, and other homeland security grantees. These measures evaluate the percentage of all open grant awards and the percentage of available grant funds programmatically monitored each year. Data from these measures are used to support GPD's efforts to ensure compliance with the regulations or guidance governing preparedness grant awards, as well as to proactively assess any impediments to project implementation and completion. This information also enables GPD to assess monitoring activities and implement an annual monitoring plan that balances the volume of grant awards with levels of grant funding. Internal measure: Percent of grant awards financially monitored annually; and: Internal measure: Percent of total grant funds financially monitored annually; Description/Purpose: GPD conducts financial monitoring each year to collect, analyze, and verify information on the business functions and grant administration practices of grantees. Financial monitoring also supports the identification of exceptions and potential issues related to grantees' management and administration of preparedness grant funding, which may require immediate investigation, resolution, further scrutiny, or the inclusion of FEMA's Office of the Inspector General (OIG). These measures evaluate the percentage of all open preparedness grant awards and the percentage of available grant funds financially monitored every 2 years, as required by statute. Data from this measure are used to support GPD's efforts to ensure compliance with the regulations or guidance governing preparedness grant awards, as well as to proactively assess any impediments to project implementation and completion. This information also enables GPD to assess the breadth of grant funding monitored every other year and to implement an annual monitoring plan that balances the volume of grants with the use of grant funding. Internal measure: Percent of corrective actions completed within the fiscal year issued; Description/Purpose: GPD currently tracks corrective actions issued by FEMA Regional staff as a result of financial monitoring visits during which problems of noncompliance are discovered and documented. While the 10 FEMA Regions are responsible for issuing, tracking, and resolving corrective actions, GPD monitors progress toward the resolution of corrective actions through regional financial monitoring activities. This measure evaluates the percent of corrective actions completed within the fiscal year issued. Data for this measure will be used to coordinate with FEMA Regions to track and monitor the timely resolution of corrective actions. These efforts also support the mitigation of noncompliant activities by grantees to reduce or eliminate impediments to project completion. Internal measure: Percent of preparedness grant awards processed within 150 days; Description/Purpose: Traditionally, GPD is appropriated annual preparedness grant funding that must be awarded prior to the end of the fiscal year (i.e., September 30 of each year). This measure evaluates GPD's effectiveness in the processing of grant awards for relevant preparedness programs. The data for this measure will be analyzed to assess the amount of time GPD expends to make and process preparedness grant awards. This analysis will enable GPD to monitor, identify, and mitigate any issues in the processing of preparedness grant awards to achieve and sustain internal grants management and administrative efficiencies. Internal measure: Percent of grant closeouts completed within 120 days from the end of the period of performance; Description/Purpose: FEMA regulations require GPD to close out grant awards after grantees have completed all administrative activities and related work. This measure evaluates the percent of preparedness grant close-outs processed within 120 days of receiving notice by grantees to assess GPD's efficiency in closing preparedness grant awards. Data for this measure will be used to monitor and, if possible, improve GPD's grant close-out process. These efforts also ensure that GPD complies with its mission to appropriately administer and manage all federal grant awards from appropriation to closeout. Source: GAO analysis of FEMA information. [End of table] [End of section] Appendix VI: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: November 14, 2011: David C. Maurer: Director, Homeland Security and Justice: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Re: Draft Report GAO-12-47, "Port Security Grant Program: Risk Model, Grant Management, and Effectiveness Measures Could Be Strengthened" Dear Mr. Maurer: Thank you for the opportunity to review and comment on this draft report. The U.S. Department of Homeland Security (DHS) appreciates the U.S. Government Accountability Office's (GAO's) work in planning and conducting its review and issuing this report. The Department is pleased to note the report's positive acknowledgment that the United States Coast Guard (USCG) has taken steps to maintain port security through their High-Interest Vessel Program along with the Federal Emergency Management Agency's (FEMA's) management of the grant program. Both agencies have a role in port security, with USCG being the subject matter experts dealing with the maritime industry and FEMA with the decisions on awarding grants. The draft report contained four recommendations with which DHS concurs. Specifically, to strengthen DHS's methodology for measuring vulnerability in ports and to improve the precision of grant allocations to high-risk port areas, GAO recommended that the Secretary of Homeland Security direct the FEMA Administrator to: Recommendation 1: Develop a vulnerability index that accounts for how security improvements affect port vulnerability, and incorporate these changes into future iterations of the Port Security Grant Program (PSGP) risk model. Response: Concur. FEMA remains committed to working with its partners, including USCG, to improve the measure of vulnerability within the PSGP risk methodology. As indicated in the report, FEMA has taken important first steps toward improving how vulnerability is measured in the Fiscal Year (FY) 2011 PSGP risk model and continues to recognize the importance of including a metric in future iterations of the risk methodology that captures the changes in port vulnerability due to the implementation of security enhancements. Although incorporating the effects of completed security projects on vulnerability is complex and requires more detailed data than are often available, the inclusion of this type of metric remains a key goal of the methodology and is revisited annually. Recommendation 2: Coordinate with the Coast Guard to determine the most precise data available to populate the data elements within the vulnerability index and to utilize this data as an interim measure, until a revised vulnerability index is developed. Response: Concur. FEMA will continue to coordinate with subject matter experts, including USCG, to determine the best data available for use in the vulnerability index. FEMA and USCG determined that foreign vessel call data were the most appropriate data for use in the vulnerability component of the PSGP risk methodology for FY 2011. FEMA and USCG will continue discussions regarding data elements to be used in future grant years. These meetings will focus on what data elements are currently available for use as an interim measure while additional enhancements to the vulnerability component are developed. Recommendation 3: Ensure that waiver requestsóincluding those submitted under previous cost-share years in which money remains unassigned and those that may be submitted in future grant rounds if a cost-share requirement is appliedóare evaluated promptly and, in conjunction with the Office of the Secretary of Homeland Security, evaluate the waiver review process to identify sources of delay and take measures to expedite the process. Response: Concur. FEMA and DHS are exploring the best solution to reduce delays and expedite the process in evaluating waiver requests. We will work to implement appropriate process improvements as they are identified. Recommendation 4: Strengthen the administration, oversight, and internal controls of the PSGP, and to streamline processes and, in collaboration with the Coast Guard, timeframes and related milestones for implementing performance measures to monitor the effectiveness of the PSGP. Response: Concur. FEMA's Grant Program Directorate (GPD) has developed internal performance measures that track FEMA's overall effectiveness in managing and administering their portfolio of preparedness grants, which includes PSGP. In addition, GPD is in the process of developing external measures to determine how effective grantees are in managing and administering the grants. The development of these external measures will be completed by January 1, 2012. Data for both sets of measures will be collected throughout FY 2012, allowing FEMA to create a baseline and targets for FY 2013 and beyond. Specific measures to monitor the performance of PSGP are being developed within FEMA. FEMA is developing overall performance objectives for core capabilities, as required in Presidential Policy Directive 8 and the new National Preparedness Goal, and will be reviewing all prevention and protection measures, including those for PSGP. In addition, FEMA's National Preparedness Directorate will work with GPD and USCG in FY 2012 to develop some specific PSGP measures toward building and sustaining capabilities. Again, thank you for the opportunity to review and comment on this draft report. Technical comments were previously provided under separate cover. We look forward to working with you on future Homeland Security issues. Sincerely, Signed by: Jim H. Crumpacker: Director: Departmental GAO-OIG Liaison Office: [End of section] Appendix VII: GAO Contact and Staff Acknowledgments: GAO Contact: David C. Maurer, (202) 512-9627 or Maurerd@gao.gov: Stephen L. Caldwell, (202) 512-9610 or Caldwells@gao.gov: Staff Acknowledgments: In addition to the contacts above, Dawn Hoff, Assistant Director, and Dan Klabunde, Analyst-in-Charge, managed this assignment. Chuck Bausell, David Lutter, Sophia Payind, and Katy Trenholme made significant contributions to this report. Charlotte Gamble, Adam Hoffman, and Grant Sutton provided assistance with interviews. David Alexander assisted with design, methodology, and data analysis. Tracey King provided legal assistance. Jessica Orr provided assistance with report development and Robert Robinson provided graphic support. [End of section] Footnotes: [1] Department of Homeland Security, Small Vessel Security Strategy (Washington, D.C.: April 2008). [2] To promote a regional approach to port security, DHS aggregates individual ports into "port areas" for grant funding purposes. Decisions about how to group individual ports into port areas are made based on the recommendations of the Coast Guard and consider such factors as geographic proximity, shared risk, and common waterways. For fiscal year 2011, there were a total of 145 specifically identified critical ports that were aggregated into 90 discrete port funding areas. [3] DHS, National Infrastructure Protection Plan, Partnering to Enhance Protection and Resiliency (Washington, D.C.: January 2009). In accordance with the Homeland Security Act and in response to HSPD-7, DHS issued the first National Infrastructure Protection Plan (NIPP) in June 2006, and later updated the plan in 2009. The NIPP provides the overarching approach for integrating the nation's critical infrastructure and key resource protection initiatives in a single effort. For more information on the NIPP, see GAO, Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience, [hyperlink, http://www.gao.gov/products/GAO-10-296] (Washington, D.C.: Mar. 5, 2010). [4] In the fiscal year 2007 supplemental grant round, there were eight port areas within Group I. [5] FEMA implemented key changes to the grant program in the fiscal year 2007 and 2007 supplemental grant rounds to promote enhanced regional collaboration. For instance, in fiscal year 2007, FEMA introduced a tiered structure to the grant program whereby each port area was placed into a funding group based on risk. FEMA allocated port areas in the highest risk funding group a specific amount of grant funding and grant projects were determined using a regional decision-making process. In the supplemental 2007 grant round, FEMA also transitioned the second highest risk funding group to this collaborative process. The remaining funding groups retained the competitive structure and competed for funding within their funding Group. FEMA made two additional changes in the 2007 supplemental funding round to promote regional collaboration. First, FEMA required all Group I and II port areas to select a fiduciary agent to coordinate the grant process in the port area. Second, FEMA required all Group I and II port areas to develop a Portwide Risk Mitigation Plan. [6] Grant funds may be expended for up to 5 years after the end of the fiscal year in which they are awarded. As a result, all fiscal year 2005 grants were closed as of September 30, 2010; however, some fiscal year 2006 grant awards were still available for use by grant applicants during the period of our review. We do not have data on the amount of PSGP funding distributed and on-hold for fiscal year 2011, as this grant round was in its initial stages during the period of our review. [7] This work was done in conjunction with a broader review of other homeland security grant programs. We plan to issue that broader report early next year. [8] Department of Defense and Emergency Supplemental Appropriations for Recovery from and Response to Terrorist Attacks on the United States, 2002, Pub. L. No. 107-117, 115 Stat. 2230, 2327 (2002). [9] Pub. L. No. 107-295, ß 102(a), 116 Stat. 2064, 2068-84 (2002) (codified as amended at 46 U.S.C. ß 70107). [10] Responsibility for administering the PSGP has changed numerous times since its inception in 2002. When first established, TSA managed the PSGP in partnership with the Maritime Administration and the Coast Guard. In March 2003, TSA was transferred from the Department of Transportation to the Department of Homeland Security under the Homeland Security Act; however, TSA continued to operate the program. In March 2004, the Secretary of Homeland Security established the Office of State and Local Government Coordination and Preparedness (OSLGCP), and for fiscal year 2005, OSLGCP was appropriated funding for the PSGP. In October 2005, the Secretary of Homeland Security created the Preparedness Directorate, and within that directorate, the Office of Grants and Training (OGT). Thus, for fiscal years 2006 and 2007, OGT administered the program. In April 2007, under the Post- Katrina Emergency Management Reform Act, many of the functions and authorities of the Preparedness Directorate were transferred to FEMA, and since that time, FEMA has administered the PSGP. [11] More information about the PSGP groups will be discussed later in the report. [12] There are not a set number of port areas within the All Other Port Areas Group and it can vary from year to year. [13] Area Maritime Security Plans (AMSP) are a Maritime Transportation Security Act (MTSA) requirement and include among other things, operational and physical security measures in place at the port under different security levels, details of the security incident command and response structure, procedures for responding to security threats including provisions for maintaining operations in the port, and procedures to facilitate the recovery of the marine transportation system after a security incident. See 46 U.S.C. ß 70103(b). A Coast Guard Navigation and Vessel Inspection Circular--the Coast Guard's detailed guidance about the enforcement or compliance with federal marine safety regulations and Coast Guard marine safety programs-- provided a common template for AMSPs and specified the responsibilities of port stakeholders under them. As of October 2011, 43 AMSPs were in place. Plans were first required in 2004 and, as required, were updated by 2009. [14] Prior to fiscal year 2007, the PSGP did not include funding groups. Rather, all port areas competed for one pool of grant funding. In fiscal year 2007, DHS introduced the group concept, and provided port areas in Group I with a single direct allocation based on risk. In the fiscal year 2007 supplemental grant round, DHS chose to also provide port areas in Group II with a single direct allocation based on risk. Since fiscal year 2007 supplemental, each port area in Groups I and II has received a single direct allocation. [15] Port security and commerce functions within ports reside with the Coast Guard Captain of the Port (COTP), whose responsibilities are summarized at 33 C.F.R. ß 1.01-30. An AMSC serves as a forum for port stakeholders, facilitating the dissemination of information through regularly scheduled meetings, issuance of electronic bulletins, and sharing key documents. MTSA provided the Coast Guard with the authority to create AMSCs--composed of federal, state, local, and industry members--that help to develop the AMSP for the port. As of October 2011, the Coast Guard had organized 43 AMSCs. Each has flexibility to assemble and operate in a way that reflects the needs of its port area, resulting in variations in the number of participants, the types of state and local organizations involved, and the way in which information is shared. [16] Pub. L. No. 91-190, 83 Stat. 852 (1970). [17] PSGP funds are appropriated on an annual basis and must be awarded by the end of the fiscal year in which they are appropriated. FEMA has set a 3-year performance period for PSGP grants, meaning that all grant projects must be completed within 3 years. However, FEMA has the authority to extend the 3-year performance period by up to 2 years, giving grantees up to 5 years in total to complete the grant project. After 5 years, the money must be returned to the Treasury under federal appropriations law. [18] When considering individual port areas, the correlation coefficients between a port area's calculated risk and allocation were 0.97 in fiscal year 2011 and 0.93 in fiscal year 2010. We did not complete these calculations for years prior to fiscal year 2010. The correlation coefficient measures the direction of and strength of association between two variables, where the strength of association refers to how the scores on one variable are distributed with respect to the scores on the other variable. The statistic ranges between -1 and 1, with the strength of association between two variables increasing the further the statistic is from zero. A positive correlation coefficient indicates that the two correlated variables move in the same direction. In contrast, a negative correlation coefficient indicates that as one variable increases, the second variable decreases. A correlation coefficient of 0 indicates that there is no relationship between the two variables. [19] DHS also made these two implementation decisions when finalizing grant allocations for fiscal year 2010. [20] For each grant cycle since fiscal year 2007 when the group funding structure was introduced, DHS determined what portion of the overall PSGP funding to direct towards each funding group. The allocation to Group I has ranged from 54 to 60 percent, the allocation to Group II from 20 to 36 percent, the allocation to Group III from 4 to 15 percent, and the allocation to the All Other Port Areas Group from 4 to 5 percent. In fiscal year 2008 and 2009, as well as for the American Recovery and Reinvestment Act, eligible ferry systems also received a designated portion of the overall grant allocation. For additional information, see app I. [21] In fiscal year 2010, Group I was allocated 60 percent of grant funding and accounted for 43.5 percent of the risk. Group II was allocated 30 percent of grant funding and accounted for 53 percent of the risk. Group III was allocated 5 percent of grant funding and accounted for the remaining 3.5 percent of the risk. [22] DHS has also used "ceilings" in past years to limit how much a port area's allocation could increase from year to year, despite changes in risk. However, DHS did not utilize ceilings in the fiscal year 2011 PSGP risk model. [23] GAO, Homeland Security: DHS Risk-Based Grant Methodology Is Reasonable, But Current Version's Measure of Vulnerability is Limited, [hyperlink, http://www.gao.gov/products/GAO-08-852] (Washington, D.C.: June 27, 2008). GAO, Transit Security Grant Program: DHS Allocates Grants Based on Risk, but Its Risk Methodology, Management Controls, and Grant Oversight Can Be Strengthened, [hyperlink, http://www.gao.gov/products/GAO-09-491] (Washington, D.C.: June 8, 2009). [24] The Homeland Security Grant Program (HSGP)--which is comprised of five interconnected grant programs including the State Homeland Security Program and the Urban Area Security Initiative--provides a primary funding mechanism for building and sustaining national preparedness capabilities. These grant programs fund a range of preparedness activities, including planning, organization, equipment purchase, training, exercises, and management and administration. For more information on the Homeland Security Grant Program, see GAO-08- 852. [25] The Transit Security Grant Program (TSGP) is one of five grant programs that constitute the DHS focus on transportation infrastructure security activities. The TSGP provides funds to owners and operators of transit systems to protect critical surface transportation infrastructure and the traveling public from acts of terrorism and to increase the resilience of transit infrastructure. [26] DHS officials reported that the decision to incorporate a vulnerability component in the fiscal year 2011 risk model was primarily based on feedback in the following three reports: (1) GAO-08- 852; (2) National Academies "Review of the Department of Homeland Security's Approach to Risk Analysis" (Washington, D.C.: 2010); and (3) Homeland Security Studies and Analysis Institute's "FEMA GPD Risk Integration and Cost to Capability Analysis Final Report" (Arlington, Va: November 2010). Additionally, DHS officials reported that FEMA made this modification as part of a process of continual improvements to the formula. [27] MSRAM data are captured in the Consequence index of the PSGP risk model. The Coast Guard uses MSRAM to assess maritime security risk, which it defines as the product of threat, vulnerability, and consequence. The MSRAM risk formula produces a risk index number (RIN) for each maritime target, such as a shipping terminal or passenger ferry, that allows Coast Guard officials at the local, regional, and national levels to compare and rank critical infrastructure for the purpose of informing security decisions. To calculate a RIN for each maritime target, the Coast Guard depends upon local port security partners to provide information on a target's vulnerability and the estimated consequences of a successful attack. Threat information in MSRAM is provided by the Coast Guard Intelligence Coordination Center and represents intelligence community assessments of the intent, capability, and geographic preference of terrorist organizations to attack maritime targets. For more information on MSRAM, see GAO, Coast Guard: Security Risk Model Meets DHS Criteria, but More Training Could Enhance Its Use for Managing Programs and Operations, GAO-12-14 (Washington, D.C.: Nov. 17, 2011). [28] The HAZMAT Population data component was part of the consequence index in the fiscal year 2010 model. It was moved to the vulnerability index in the fiscal year 2011 model. [29] The Coast Guard established its High-Interest Vessel (HIV) Program to address increased U.S. maritime security requirements in the aftermath of the terrorist events of September 11, 2001. The program targets HIVs, or those that might pose high relative security risks to U.S. ports. [30] The term "draw down" indicates that the grant recipient has incurred an expense related to their approved grant project and has sought reimbursement for this expense. Once the grantee has been reimbursed, the grant funds are considered drawn down. Before draw down can occur, FEMA has to approve the use of grant funds for a specific project, the grantee has to comply with all postaward requirements for that grant project, and FEMA has to distribute the funds to the grantee. [31] The term "available funds" indicates that FEMA has given the grantee approval to spend money on an approved grant project. In order for funds to be available, FEMA has to approve the use of grant funds for a specific project and the grantee has to comply with all postaward requirements for that grant project. [32] The term "unavailable funds" indicates that FEMA has not given the grantee approval to spend money on a grant project. [33] FEMA Grants Program Directorate Information Bulletin No. 352 - Timeliness of Grantee Draw Downs (Jan. 18, 2011). [34] Port areas in Groups I and II receive a designated allocation from which approved projects are funded. In contrast, grant awards for port areas in Group III or the "All Other Port Areas" group are made on a competitive basis and as such, specific projects are identified at the time of award. As a result, all funding awarded to Group III and "All Other Port Areas" Group is immediately linked to specific projects as a result of the competitive award process and thus, cannot remain unused. [35] We are unable to report on the portion of Group II grant funds that are unavailable because they remain unused, due to concerns about data reliability. [36] Each project must fulfill certain postaward requirements--such as environmental and budgetary reviews--before FEMA can release the hold and distribute the grant funds to the grantee. We will discuss these requirements later in this report. [37] Among the requirements stipulated in the grant guidance, port areas were required to submit to FEMA a concept of operations for their plan within 30 days of their award date. Following approval of the concept of operations, port areas had an additional 90 days to submit a draft plan for review. [38] According to the statute, federal funds for any eligible project under the PSGP shall not exceed 75 percent of the total cost of such project. See 46 U.S.C. ß 70107(c)(1). The cost-share is required by federal law and ports can only be exempted through waiver requests to the Secretary of Homeland Security, as discussed on page 33. [39] GAO, Maritime Security: Responses to Questions for the Record, [hyperlink, http://www.gao.gov/products/GAO-11-140R] (Washington, D.C.: Oct. 22, 2010). [40] Grant years requiring a cost-share--fiscal years 2007 supplemental, 2008, and 2009--are older than is the fiscal year 2010 grant round. For example, the fiscal year 2010 PSGP was announced in December 2009 whereas the fiscal year 2009 grant round was announced in November 2008. Despite the fiscal year 2010 round being announced more than 1 year later than the fiscal year 2009 grant round, more funding has been used in the more recent grant round. Additionally, the cost-share is required by federal law and applicants can only be exempted from it through a waiver. [41] The 22-step waiver process is outlined in appendix IV. [42] The Secretary may approve PSGP grants with a matching requirement other than the 25 percent outlined in the statute if the Secretary determines that a proposed project merits support and cannot be undertaken without a higher rate of federal support. See 46 USC ß 70107(c)(2)(B). [43] FEMA Information Bulletin 322, Port Security Grant Program Cost- Share Requirement Clarification and Waiver Process for FY 2007 Supplemental through FY 2009 Grant Awards (July 15, 2009). [44] Of the 31 waiver requests submitted in accordance with the July 2009 information bulletin, 22 were approved, 1 was denied, and 2 were withdrawn by the grantee. An additional 6 waiver requests were pending a decision at the time of this report. [45] Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999). [46] Pub. L. No. 91-190, 83 Stat. 852 (1970). [47] Due to concerns about data reliability, we are unable to provide information on the average length of time required to achieve compliance with EHP requirements. [48] [hyperlink, http://www.gao.gov/products/GAO-09-491]. [49] In November 2009, FEMA moved to the Homeland Security Information Network (HSIN)--an information-sharing and collaboration system operated by DHS--to receive investment justifications, detailed budgets, and field review forms. In May 2011, FEMA ceased using HSIN for the submission of grant documents. [50] Department of Homeland Security Office of Inspector General, Follow Up Review of the Port Security Grant Program, OIG-06-24 (Washington, D.C.: February 2006). [51] According to FEMA, the National Preparedness Directorate (NPD) strives to achieve a nation prepared through a comprehensive cycle of planning, organizing and equipping, training, exercising, evaluating, and improvement planning. The National Preparedness Assessment Division (NPAD) is a component within NPD, which is responsible for leading the nation's efforts to enhance preparedness to prevent, protect from, respond to, and recover from disasters, natural and man- made. [52] Project Management Institute, The Standard for Program Management © (2006). [End of section] GAOís Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAOís commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAOís website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select ìE- mail Updates.î Order by Phone: The price of each GAO publication reflects GAOís actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAOís website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125 Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548.