As a result, it  is inevitable that assumptions and policy judgments must be used in risk  analysis and management. DHS has used an evolving risk-based methodology to identify the urban  areas eligible for HSGP grants and the amount of funds states and urban  areas receive (see Fig 2). DHS made this change in response to the 9/11Act  requirement to perform a risk assessment for the 100 largest MSAs by  population. The change to the use of MSA data in fiscal year 2008 also resulted in  changes in the relative risk rankings of some urban areas. As a result, DHS  officials expanded the eligible urban areas in fiscal year 2008 to a total of  60 UASI grantees, in part, to address the effects of this change to MSA  data, as well as to ensure that all urban areas that received fiscal year 2007  funding also received funding for fiscal year 2008, according to DHS  officials. One benefit of the  change to MSAs was that the UASI boundaries align more closely with the  boundaries used to collect some of the economic and population data used  in the model. Consequently, the fiscal year 2008 model may have resulted  in more accurate data. Vulnerability Element of the Risk Analysis Model Has Limitations that Reduce Its Value

Although the methodology DHS uses is reasonable, the vulnerability  element of the risk analysis model—as currently calculated by DHS—has  limitations that reduce its value for providing an accurate assessment of  risk. DHS considered most areas of the country equally vulnerable to a  terrorist attack in the risk analysis model used for fiscal years 2007 and  2008 and assigned a constant value to vulnerability, which ignores  geographic differences in the social, built, and natural environments  across states and urban areas. As a  result, DHS did not measure vulnerability, but assigned it a constant value  of 1.0 across all states and urban areas. DHS’s risk-based allocation methodology and risk analysis model are  generally reasonable tools for measuring relative risk within a given fiscal  year, considering its use of a generally-accepted risk calculation formula;  key model results’ decreased sensitivity to incremental changes in the  assumptions related to Tier 1 UASI grantees or the eligibility for Tier 2  UASI funding, the reliability of the consequence variable component  indices, and its adoption of MSAs to calculate urban area footprints. Homeland Security Grant Program

	Introduction

		According to the Department of Homeland Security (DHS), in fiscal

DHS provided approximately $1.7 billion to states and urban areas  through its Homeland Security Grant Program (HSGP) to prevent,  protect against, respond to, and recover from acts of terrorism or  other catastrophic events. DHS plans to distribute about $1.6 billion  for these grants in fiscal year 2008. What methodology did DHS use to allocate HSGP funds for  fiscal years 2007 and 2008, including any changes DHS  made to the eligibility and allocation processes for fiscal  year 2008 and the placement of states and urban areas  within threat tiers, and why? Scope and Methodology

		We analyzed DHS documents including the FY2007 and FY2008 risk analysis models,

grant guidance, presentations, and interviewed DHS officials about:  The HSGP grant determination process in FY07—and any changes to the   The process by which DHS’s risk analysis model is used to estimate  relative risk: Risk = Threat*(Vulnerability & Consequences);  How the effectiveness assessment process is conducted;  How final allocation decisions are made. Effectiveness Assessment

For fiscal year 2007 DHS assessed the applications submitted by  states and eligible urban areas. FY 2007 Effectiveness Assessment

		Final Allocation Process – FY 2007 Grants Based on Both Risk and Effectiveness Scores

DHS allocated funds based on the risk scores of states and urban areas, as  adjusted by their effectiveness scores. minimum = 0.375% of all funds appropriated for SHSP and UASI. In fiscal year 2005, the footprint was  limited to city boundaries (and did not include the 10-mile buffer zone). In fiscal year 2008, DHS used  Metropolitan Statistical Areas (MSAs) from the Census Bureau, as required  under the Implementing Recommendations of the 9/11 Commission Act of  2007.
Why GAO Did This Study

Since 2002, the Department of Homeland Security (DHS) has distributed almost $20 billion in funding to enhance the nation's capabilities to respond to acts of terrorism or other catastrophic events. In fiscal year 2007, DHS provided approximately $1.7 billion to states and urban areas through its Homeland Security Grant Program (HSGP) to prevent, protect against, respond to, and recover from acts of terrorism or other catastrophic events. As part of the Omnibus Appropriations Act of 2007, GAO was mandated to review the methodology used by DHS to allocate HSGP grants. This report addresses (1) the changes DHS has made to its risk-based methodology used to allocate grant funding from fiscal year 2007 to fiscal year 2008 and (2) whether the fiscal year 2008 methodology is reasonable. To answer these questions, GAO analyzed DHS documents related to its methodology and grant guidance, interviewed DHS officials about the grant process used in fiscal year 2007 and changes made to the process for fiscal year 2008, and used GAO's risk management framework based on best practices.

What GAO Found

For fiscal year 2008 HSGP grants, DHS is primarily following the same methodology it used in fiscal year 2007, but incorporated metropolitan statistical areas (MSAs) within the model used to calculate risk. The methodology consists of a three-step process--a risk analysis of urban areas and states based on measures of threat, vulnerability and consequences, an effectiveness assessment of applicants' investment justifications, and a final allocation decision. The principal change in the risk analysis model for 2008 is in the definition of the geographic boundaries of eligible urban areas. In 2007, the footprint was defined using several criteria, which included a 10-mile buffer zone around the center city. Reflecting the requirements of the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS assessed risk for the Census Bureau's 100 largest MSAs by population in determining its 2008 Urban Areas Security Initiative (UASI) grant allocations. This change altered the geographic footprint of the urban areas assessed, aligning them more closely with the boundaries used by government agencies to collect some of the economic and population data used in the model. This may have resulted in DHS using data in its model that more accurately estimated the population and economy of those areas. The change to the use of MSA data in fiscal year 2008 also resulted in changes in the relative risk rankings of some urban areas. As a result, DHS officials expanded the eligible urban areas in fiscal year 2008 to a total of 60 UASI grantees, in part, to address the effects of this change to MSA data, as well as to ensure that all urban areas receiving fiscal year 2007 funding continued to receive funding in fiscal year 2008, according to DHS officials. Generally, DHS has constructed a reasonable methodology to assess risk and allocate funds within a given fiscal year. The risk analysis model DHS uses as part of its methodology includes empirical risk analysis and policy judgments to select the urban areas eligible for grants (all states are guaranteed a specified minimum percentage of grant funds available) and to allocate State Homeland Security Program (SHSP) and UASI funds. However, our review found that the vulnerability element of the risk analysis model has limitations that reduce its value. Measuring vulnerability is considered a generally-accepted practice in assessing risk; however, DHS's current risk analysis model does not measure vulnerability for each state and urban area. Rather, DHS considered all states and urban areas equally vulnerable to a successful attack and assigned every state and urban area a vulnerability score of 1.0 in the risk analysis model, which does not take into account any geographic differences. Thus, as a practical matter, the final risk scores are determined by the threat and consequences scores.