GMM Is to Address FEMA’s Shortcomings with Grants Management

FEMA initiated GMM in 2015, in part, due to EMMIE’s failed attempt to  modernize the agency’s grants management environment. These leading practices state that effective business process  reengineering and IT requirements management involve, among other  things, (1) ensuring strong executive leadership support for process  reengineering; (2) assessing the current and target business environment  and business performance goals; (3) establishing plans for implementing  new business processes; (4) establishing clear, prioritized, and traceable  IT requirements; (5) tracking progress in delivering IT requirements; and  (6) incorporating input from end user stakeholders. Among these six selected leading practices for reengineering business  processes and managing IT requirements, FEMA fully implemented four  and partially implemented two of them for its GMM program. Specifically,
The agency took steps to develop a common understanding of its  grants management processes by documenting each of the 12 grant  categories. GAO’s Cost Estimating and Assessment  Guide defines leading practices related to the following four  characteristics of a high-quality, reliable estimate. In May 2017, DHS approved GMM’s lifecycle cost estimate of about $251  million for fiscal years 2015 through 2030. In  December 2018, program officials stated that they had completed the  revised cost estimate but it was still undergoing departmental approval. One of the most significant issues was that the program’s fast  approaching, final delivery date of September 2020 was not informed by a  realistic assessment of GMM development activities, and rather was  determined by imposing an unsubstantiated delivery date. For the GMM program’s engineering and test environment, which went  live in February 2018, FEMA fully addressed three of the five key  cybersecurity practices in NIST’s risk management framework and  partially addressed two of the practices. Specifically, FEMA categorized  GMM’s environment based on security risk, implemented select security  controls, and monitored security controls on an ongoing basis. In addition, as of September 2018, the program had not established  corrective action plans for the 13 medium- and low-impact vulnerabilities. Program officials stated that they do not typically address low-impact  vulnerabilities; however, this is in conflict with DHS guidance that  specifies that corrective action plans must be developed for every  weakness identified during a security control assessment and within a  security assessment report. While the program eventually took corrective actions in response to our  audit by developing the missing plans, the GMM program initially failed to  follow DHS’s guidance on preparing corrective actions plans for all  security vulnerabilities. While GMM’s initial cost estimate was reliable, key assumptions about the  program since the initial estimate had changed and, therefore, it no longer  reflected the current approach for the program. As a result, the  GMM engineering and test environment remains at an increased risk of  exploitations. In its comments, the department concurred with  all eight of our recommendations and provided estimated completion  dates for implementing each of them. GAO staff who made key contributions to this report  are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine the extent to which the Federal  Emergency Management Agency (FEMA) is implementing leading  practices for reengineering its grants management business processes  and incorporating business needs into Grants Management  Modernization (GMM) information technology (IT) requirements; (2)  assess the reliability of the program’s estimated costs and schedule; and  (3) determine the extent to which FEMA is addressing key cybersecurity  practices for GMM. These grants are to help communities prevent,  prepare for, protect against, mitigate the effects of, respond to, and  recover from disasters and terrorist attacks.
Why GAO Did This Study

FEMA, a component of DHS, annually awards billions of dollars in grants to help communities prepare for, mitigate the effects of, and recover from major disasters. However, FEMA's complex IT environment supporting grants management consists of many disparate systems. In 2008, the agency attempted to modernize these systems but experienced significant challenges. In 2015, FEMA initiated a new endeavor (the GMM program) aimed at streamlining and modernizing the grants management IT environment.
GAO was asked to review the GMM program. GAO's objectives were to (1) determine the extent to which FEMA is implementing leading practices for reengineering its grants management processes and incorporating needs into IT requirements; (2) assess the reliability of the program's estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices. GAO compared program documentation to leading practices for process reengineering and requirements management, cost and schedule estimation, and cybersecurity risk management, as established by the Software Engineering Institute, National Institute of Standards and Technology, and GAO.

What GAO Found

Of six important leading practices for effective business process reengineering and information technology (IT) requirements management, the Federal Emergency Management Agency (FEMA) fully implemented four and partially implemented two for the Grants Management Modernization (GMM) program (see table). Specifically, FEMA ensured senior leadership commitment, took steps to assess its business environment and performance goals, took recent actions to track progress in delivering IT requirements, and incorporated input from end user stakeholders. However, FEMA has not yet fully established plans for implementing new business processes or established complete traceability of IT requirements.
Until FEMA fully implements the remaining two practices, it risks delivering an IT solution that does not fully modernize FEMA's grants management systems.
While GMM's initial May 2017 cost estimate of about $251 million was generally consistent with leading practices for a reliable, high-quality estimate, it no longer reflects current assumptions about the program. FEMA officials stated in December 2018 that they had completed a revised cost estimate, but it was undergoing departmental approval. GMM's program schedule was inconsistent with leading practices; of particular concern was that the program's final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date. Developing sound cost and schedule estimates is necessary to ensure that FEMA has a clear understanding of program risks.
Of five key cybersecurity practices, FEMA fully addressed three and partially addressed two for GMM. Specifically, it categorized GMM's system based on security risk, selected and implemented security controls, and monitored security controls on an ongoing basis. However, the program had not initially established corrective action plans for 13 medium- and low-risk vulnerabilities. This conflicts with the Department of Homeland Security's (DHS) guidance that specifies that corrective action plans must be developed for every weakness identified. Until FEMA, among other things, ensures that the program consistently follows the department's guidance on preparing corrective action plans for all security vulnerabilities, GMM's system will remain at increased risk of exploits.

What GAO Recommends

GAO is making eight recommendations to FEMA to implement leading practices related to reengineering processes, managing requirements, scheduling, and implementing cybersecurity. DHS concurred with all recommendations and provided estimated dates for implementing each of them.