Risk management is a continuous process that includes the  assessment of threats, vulnerabilities, and consequences to determine  what actions should be taken to reduce one or more of these elements of  risk. One way in which DHS has applied risk management principles to  the PSGP is through the use of a risk model to assess the relative risk  posed to ports throughout the nation and to help determine PSGP  eligibility and funding levels. Each port area’s allocation is driven by the results of the PSGP risk  analysis model. DHS Allocated PSGP Funds Based Largely on Risk, but the Risk Model Can Be Further Strengthened

		PSGP Allocations Were Largely Based on Port Risk and DHS Implementation Decisions

For fiscal years 2010 and 2011, DHS allocations of PSGP funds were  based on DHS’s risk model and implementation decisions, and were  made largely in accordance with risk. See table 3 below. Instead, the  new vulnerability index recognizes that different ports can have different  vulnerability levels. FEMA  officials reported that grantees may not draw down their grant funds right  away for two main reasons. One-Quarter of Awarded PSGP Grant Funding Is Unavailable to Grantees Due to Various Challenges

Of the nearly $1.7 billion in port security grants that FEMA awarded to  port areas in fiscal years 2006 through 2010, more than $400 million—or  about 24 percent—remained unavailable to grantees as of September  2011, as shown in table 6 below. Grantees cannot use unavailable funds  to begin work on security projects. Of this, about $116  million—or 48 percent—was unavailable because the funds have not  been used for specific projects.on-hold funds—exist in all four funding groups, and result when FEMA  has approved the use of grant funding for a specific grant project, but  compliance with postaward requirements—such as environmental and   The second type of unavailable funds— budgetary reviews—has not been completed.requirements are met, these grant funds remain “on-hold.” Each type of  unavailable funding—unused and on-hold—results from a different set of  challenges, as discussed below. Without a more efficient review process, certain grant applicants that  cannot fund the cost-match requirement may not receive grant funds to  implement their projects, or may not even apply for funds. For example, although FEMA has systems  to track the financial information related to its grants programs, these  systems did not allow FEMA to track the status of grant reviews, such as  EHP reviews. DHS and FEMA Have Taken Steps to Address Unavailable Balances

DHS and FEMA have taken a number of steps to address unavailable  balances. FEMA Is Developing Measures to Assess PSGP Administration but Does Not Have Measures to Assess Effectiveness

In July 2011, during the course of our review, FEMA finalized eight  performance measures designed to track how well FEMA GPD  administers and manages the PSGP. FEMA has not evaluated the effectiveness of this program in  strengthening critical maritime infrastructure against risks associated with  potential terrorist attacks because it has not implemented measures to  track progress toward achieving program goals. Best practices for project management also call for  milestone dates, among other factors, in carrying out a project  successfully. As a result, FEMA’s progress toward implementing  measures to assess whether the program is achieving its stated purpose  remains unclear. The Port Security Grant Program (PSGP)—administered by FEMA  and supported with subject matter expertise from the Coast Guard—is  one tool DHS uses to protect critical maritime infrastructure from these  risks. While the allocation process has been risk- based, FEMA has faced significant challenges administering the grant  program. FEMA has taken steps to improve the availability of funds and has  developed internal performance measures to begin evaluating its  administration of the grant program. Initial steps  have been taken to develop performance measures for the PSGP, but the  time frame for implementing them is unclear. To strengthen DHS’s  methodology for measuring vulnerability in ports, and to improve the  precision of grant allocations to high-risk port areas, we recommend that  the Secretary of Homeland Security direct the FEMA Administrator to:
Develop a vulnerability index that accounts for how security  improvements affect port vulnerability, and incorporate these changes  into future iterations of the PSGP risk model. To ensure that waiver requests—including those submitted under  previous cost-share years in which money remains unassigned and those  that may be submitted in future grant rounds if a cost-share requirement  is applied—are evaluated promptly, we recommend that the FEMA  Administrator—in conjunction with the Office of the Secretary of  Homeland Security—evaluate the waiver review process to identify  sources of delay and take measures to expedite the process. To strengthen the administration, oversight, and internal controls of the  PSGP, and to streamline processes, we recommend that the Secretary of  Homeland Security direct the FEMA Administrator to develop—in  collaboration with the Coast Guard—time frames and related milestones  for implementing performance measures to monitor the effectiveness of  the PSGP. However, as discussed in the report, further improvements are needed to  ensure that the vulnerability score for a specific port is responsive to  changes in security that may occur in that port—such as the  implementation of new security measures—and that the vulnerability  index is populated using the most precise data available. However, as discussed in the report, it is too early to  know how effective these measures will be in helping FEMA to assess its  performance and improve its grant management.
Why GAO Did This Study

From fiscal years 2006 through 2010, the Department of Homeland Security (DHS) has awarded nearly $1.7 billion dollars to port areas through its Port Security Grant Program (PSGP) to protect critical maritime infrastructure and the public from terrorist attacks. The Federal Emergency Management Agency (FEMA)--a DHS component agency--is the agency responsible for distributing grant funds. GAO was asked to evaluate the extent to which DHS has (1) allocated PSGP funds in accordance with risk; (2) encountered challenges in administering the grant program and what actions, if any, DHS has taken to overcome these challenges; and (3) evaluated the effectiveness of the PSGP. To address these objectives, GAO reviewed the PSGP risk model, funding allocation methodology, grant distribution data, and program documents, such as PSGP guidance. Additionally, GAO interviewed DHS and port officials about grant processes, funding distribution, and program challenges, among other things.

What GAO Found

In 2010 and 2011, PSGP allocations were based largely on port risk and determined through a combination of a risk analysis model and DHS implementation decisions. DHS uses a risk analysis model to allocate PSGP funding to port areas that includes all three elements of risk--threat, vulnerability, and consequence--and DHS made modifications to enhance the model's vulnerability element for fiscal year 2011. For example, DHS modified the vulnerability equation to recognize that different ports can have different vulnerability levels. However, the vulnerability equation is not responsive to changes in port security--such as the implementation of PSGP-funded security projects. Additionally, the vulnerability equation does not utilize the most precise data available in all cases. DHS addressed prior GAO recommendations for strengthening the vulnerability element of grant risk models, but the PSGP model's vulnerability measure could be further strengthened by incorporating the results of past security investments and by refining other data inputs. FEMA has faced several challenges in distributing PSGP grant funds, and FEMA has implemented specific steps to overcome these challenges. Only about one-quarter of awarded grant funding has been drawn down by grantees, and an additional one-quarter remains unavailable (see table below). Funding is unavailable--meaning that grantees cannot begin using the funds to work on projects--for two main reasons: federal requirements have not been met (such as environmental reviews), or the port area has not yet identified projects to fund with the grant monies. Several challenges contributed to funds being unavailable. For example, DHS was slow to review cost-share waiver requests--requests from grantees to forego the cost-share requirement. Without a more expedited waiver review process, grant applicants that cannot afford the cost-share may not apply for important security projects. Other challenges included managing multiple open grant rounds, complying with program requirements, and using an antiquated grants management system. FEMA has taken steps to address these challenges. For example FEMA and DHS have, among other things, increased staffing levels, introduced project submission time frames, implemented new procedures for environmental reviews, and implemented phase one of a new grants management system. However, it is too soon to determine how successful these efforts will be in improving the distribution of grant funds. FEMA is developing performance measures to assess its administration of the PSGP but it has not implemented measures to assess PSGP grant effectiveness. Although FEMA has taken initial steps to develop measures to assess the effectiveness of its grant programs, it does not have a plan and related milestones for implementing measures specifically for the PSGP. Without such a plan, it may be difficult for FEMA to effectively manage the process of implementing measures to assess whether the PSGP is achieving its stated purpose of strengthening critical maritime infrastructure against risks associated with potential terrorist attacks.

What GAO Recommends

GAO recommends that DHS strengthen its methodology for measuring vulnerability in ports by accounting for how past security investments reduce vulnerability and by using the most precise data available. GAO also recommends that DHS evaluate the cost-share waiver review process and take steps to expedite the process where appropriate and develop a plan with milestones for implementing performance measures for the PSGP. DHS concurred with GAO's recommendations.