Through these grant programs, DHS has sought to enhance the capacity  of states, localities, and other entities, such as ports or transit agencies,  to prevent, prepare for, protect against, respond to, and recover from, and  mitigate a natural or manmade disaster, including terrorist incidents. SHSP grant  awards are calculated in two parts. Specifically, the risk model did not measure vulnerability for each  state and urban area; rather it assigned a vulnerability score of 1.0 to  every state and urban area. DHS components concurred with our  recommendation to measure vulnerability in a way that captures  variations across states and urban areas and apply this measure in future  iterations of FEMA’s model. Other Reviews of FEMA’s Risk Methodology

DHS and the National Research Council (NRC) have also performed  reviews of FEMA’s risk assessment methodologies, providing their own  conclusions and recommendations, since our 2008 review. For example,  in 2010, the NRC reported that FEMA should strengthen its scientific  practices, such as documentation, analyses to determine how changes to  a model could affect its results, and peer review by technical experts  external to DHS, in order to further develop an understanding of the  uncertainties in its terrorism-related risk analyses. Various Factors Affected SHSP and UASI Grant Allocations to States and Urban Areas From Fiscal Years 2008 Through 2018

		SHSP Allocations Reflect Both a State’s Relative Risk Score and the Minimum Allocation by Law

While all states and territories receive minimum SHSP program grant  allocations by law, the risk-based grant assessment model also informs  the grant allocation of the remaining funds to each state. Over the period from fiscal years 2008 through 2018, the number of low- risk states whose SHSP grant awards were primarily based on the legal  minimum amount had varied from year to year, from 19 states in fiscal  year 2008, to 37 states in fiscal year 2018, as shown in table 1. In addition, from fiscal year 2008 through fiscal year 2018, there was a  decrease in the percent of total SHSP funds awarded to states and  territories based on FEMA’s risk model. Then, FEMA’s risk model also  helps inform DHS leadership’s decisions on the final funding amounts for  each grantee, according to FEMA officials. Those urban areas below this 85 percent  threshold are ineligible for UASI grant awards in that fiscal year,  according to FEMA officials. For additional details on UASI grant awards for fiscal years 2008 through  2018 by urban areas, see appendix I, table 5. FEMA Has Improved Its Risk-based Grant Assessment Model, but Additional Steps Could Further Strengthen Its Model

		FEMA Has Taken a Number of Steps to Improve the Risk-based Grant Assessment Model for Allocating SHSP and UASI Grants

Since 2008, FEMA has taken a number of steps to assess and improve  its risk-based grant assessment model for allocating grants based on past  reviews, our prior recommendations, and various changes related to  evolving terrorist threats and real-world scenarios. For example, FEMA  added a Vulnerability Index to its risk model in 2011 in response to our  2008 recommendation. However, FEMA has not fully adopted these scientific  practices for its risk-based grant assessment model. Documentation: FEMA documentation on the sources of data used for  the model’s calculations does not include information that would enable a  reviewer to understand the underlying assumptions that form the basis for  its risk-based grant assessment model—such as the size of the weights  assigned to Threat, Vulnerability, and Consequence, or the justification  for changes to these weights from one year to the next. : the Soft Target Index in 2018). We have identified  opportunities where FEMA could strengthen its scientific practices. Applying  such scientific practices could assist FEMA in further strengthening its  risk-based grant assessment model. The FEMA Administrator should take steps to coordinate an  independent, external peer review of its risk-based grant assessment  model.
Why GAO Did This Study

FEMA, a component of DHS, provides preparedness grants to state, local, tribal, and territorial governments to help prepare for, prevent, protect against, respond to, recover from and mitigate terrorist attacks or other disasters. SHSP grants fund the nation's 56 states and territories, while UASI grants fund eligible urban areas. Grant allocations have been based, in part, on FEMA's risk-based grant assessment model, with states and urban areas deemed to be at higher risk receiving more grant dollars than those deemed at lower risk. Since 2008, GAO and others have assessed the model and made recommendations to strengthen it.
This report 1) describes SHSP and UASI grant awards during fiscal years 2008 through 2018, and factors affecting grant distributions; and 2) examines the steps that FEMA has taken to strengthen its risk assessment model for allocating preparedness grants, and any additional opportunities to improve the model. GAO analyzed the information in FEMA's model, and data on SHSP and UASI grant awards for fiscal years 2008 through 2018. GAO also interviewed FEMA and DHS officials and collected documents.

What GAO Found

GAO found that various factors affected Federal Emergency Management Agency (FEMA) State Homeland Security Program (SHSP) and Urban Area Security Initiative (UASI) grant awards from fiscal year 2008 through 2018. SHSP grant awards to states were based on two factors—(1) minimum amounts set in law each year, and (2) FEMA's risk model. For example, in fiscal year 2012, each state was to receive a minimum of approximately $2.74 million, with each state receiving additional funds based on its relative risk score. Conversely, UASI grant awards are made based on its FEMA's risk-based grant assessment model, which ranks each urban area relative to others in that year, and Department of Homeland Security (DHS) leadership decisions on how funding should be allocated. From fiscal year 2008 through 2018, the number of USAI grantees varied from year to year (see figure below).
Since 2008, FEMA has taken steps to strengthen its risk-based grant assessment model, but has not incorporated additional scientific practices into its model. For example, in 2011 FEMA included more information in its model on potential targets and their vulnerability in each state and urban area, addressing a prior GAO recommendation. More recently in 2018, FEMA added additional factors to better assess vulnerability in each state and urban area, such as the number of special events where large crowds gather and soft targets susceptible to lone wolf attacks, among other things. However, GAO found that FEMA does not fully utilize scientific practices recognized by the National Research Council and the Office of Management and Budget as best practices. Specifically, FEMA did not fully document its model's underlying assumptions, such as the weights in its model or the justification for changes to these weights. FEMA also did not perform the level of analysis needed to determine how changes to its model could affect the resulting risk scores. Finally, FEMA has not coordinated an independent external peer review of its model. Applying such scientific practices could assist FEMA in further strengthening its model.

What GAO Recommends

GAO is making three recommendations to FEMA to further strengthen its risk-based grant assessment model by (1) fully documenting the model's assumptions and justifications, (2) performing additional in-depth analyses, and (3) coordinating an external peer review. FEMA concurred with our recommendations.