National Preparedness: Additional Actions Needed to Address Gaps in the Nation's Emergency Management Capabilities

FEMA uses the National Preparedness System to help assess the nation's emergency management capabilities in preparing for disasters and, in part, to help prioritize federal preparedness grants it provides to state and local jurisdictions. Since 2002, FEMA has provided over $52 billion in such grants intended to enhance preparedness capabilities.

GAO was asked to examine national preparedness. This report examines the extent to which: (1) FEMA's National Preparedness System and associated preparedness grants have assisted jurisdictions in preparing for disasters; (2) FEMA has strengthened the National Preparedness System and what steps remain; and (3) FEMA is using after-action reports to identify lessons learned and strengthen future preparedness. GAO evaluated agency guidance, analyzed 2013 to 2017 capability data—the most current available; conducted site visits to five states; and interviewed FEMA, state, and local emergency management officials.

The Federal Emergency Management Agency's (FEMA) National Preparedness System and associated grants have helped build some emergency management capabilities, but gaps remain. Capabilities fall in five mission areas: (1) prevention—preventing imminent acts of terrorism, (2) protection—protecting citizens and assets, (3) mitigation—mitigating the loss of life and property, (4) response—responding quickly to save lives, and (5) recovery—timely restoration of infrastructure and housing, among other things. From fiscal years 2013 through 2018, jurisdictions directed almost 90 percent of FEMA preparedness grants ($7.3 of $8.3 billion) to capabilities in the crosscutting (i.e., benefit all five mission areas), response, and prevention areas (figure below). Jurisdictions reported a higher level of preparedness in these areas compared to capabilities in the other mission areas—recovery, mitigation, and protection. Jurisdictions have consistently rated select capabilities in these three mission areas—such as disaster housing and cybersecurity—in the lowest category since 2013. FEMA does not limit jurisdictions' use of preparedness grants for select capabilities, but it has encouraged jurisdictions to address the known gaps.

FEMA is taking steps to strengthen the national preparedness system, but has yet to determine what steps are needed to address the nation's capability gaps across all levels of government. Specifically, FEMA is implementing a new methodology to collect more quantitative data on capabilities at the state, territory, and local levels—as GAO recommended in 2011—and also plans to begin assessing the federal government's capabilities. Including the federal government in such an assessment would enable FEMA and jurisdictions to assess national preparedness capabilities collectively. While these are positive steps that could meet the intent of the 2011 recommendation, FEMA has yet to determine what steps are needed to address the capability gaps once they are identified, including jurisdictions' capability gaps that have been known since 2012. By determining these steps and informing key stakeholders, such as Congress, about what resources will be needed across all levels of government, FEMA will be better positioned to address the nation's capability gaps.

FEMA after-action reports have identified areas for improvement and lessons learned following disasters, but has completed after-action reviews for only 29 percent of disasters from 2017 through 2019. FEMA lacks a formal mechanism to track corrective actions and does not have guidance on sharing after-action reports with key external stakeholders, as appropriate.

GAO is making four recommendations that FEMA (1) determine what steps are needed to address emergency management capability gaps, and communicate it to key stakeholders (2) prioritize completion of after-action reviews, 3) track corrective actions, and (4) develop guidance on sharing findings externally. The Department of Homeland Security concurred and FEMA is taking actions in response.

The 2017 and 2018 hurricanes, wildfires, and other recent disasters  highlight the challenges that all levels of government face in preparing for  and responding effectively to disasters—in terms of both immediate  response and long-term recovery efforts. According to the Federal  Emergency Management Agency’s (FEMA) 2017 Hurricane Season  After-Action Report, the 2017 hurricanes collectively affected 47 million  people, and Hurricanes Harvey, Irma, and Maria all rank among the top  five costliest hurricanes ever recorded. The 2018 hurricane season  followed with Hurricanes Florence and Michael causing nearly $50 billon  of damage, according to the National Oceanic and Atmospheric  Administration. In addition, in 2018, the Camp Fire in northern California  destroyed more than 18,500 buildings and was the costliest and deadliest  wildfire in California’s history.

The rising number of natural disasters and increasing state, local, and  tribal reliance on federal disaster assistance is a key source of federal  fiscal exposure. Since 2005, federal funding for disaster assistance has  totaled at least $460 billion, which consists of obligations for disaster  assistance from 2005 through 2014 totaling at least $278 billion and  select appropriations for disaster assistance from 2015 through 2019  totaling $183 billion. Most of this funding was appropriated for  catastrophic hurricanes, flooding, wildfires, and other losses in 2017 and  2018. Disaster costs are projected to increase as extreme weather  events become more frequent and intense due to climate change—as  observed and projected by the U.S. Global Change Research Program  and the National Academies of Sciences, Engineering, and Medicine.

FEMA—a component of the Department of Homeland Security (DHS)—is  the lead federal agency responsible for disaster preparedness, response,  and recovery. We previously reported that FEMA faced challenges in  preparing for, responding to, and recovering from Hurricane Maria, which  largely affected Puerto Rico in 2017. After major disasters, FEMA’s  standard practice is to prepare an after-action report that identifies  strengths, areas for improvement, and potential best practices identified  during response and recovery efforts. FEMA’s 2017 Hurricane Season  After-Action Report recognized the challenges of Hurricane Maria, among  other disasters, and found that the agency must better prepare for  sequential, complex disasters and address logistical challenges that may  complicate efforts to deploy resources to remote areas. We have also  reported on the challenges in assessing state and local jurisdiction  preparedness for emergencies and disasters. In March 2011, we  reported that FEMA needed to improve its oversight of preparedness  grants by establishing a framework with measurable performance  objectives for assessing urban area, state, territory, and tribal capabilities  to identify gaps and prioritize investments. Specifically, we  recommended that FEMA complete a national preparedness assessment  of capability gaps at each level based on tiered, capability-specific  performance objectives to enable prioritization of grant funding. As of  March 2020, this recommendation has not been implemented.

FEMA uses the National Preparedness System to help assess the  nation’s emergency management capabilities and, in part, to help  prioritize federal preparedness grants it provides to state and local  communities to fill gaps in their emergency management capabilities.  Specifically, the National Preparedness System is designed to help  communities measure and assess their 32 distinct emergency  management capabilities (“core capabilities”) and, in part, to prioritize  preparedness grants. According to DHS, from fiscal years 2002 through  2019, DHS awarded over $52 billion in preparedness grants to enhance  and strengthen the capabilities of state, local, tribal, and territorial grant  recipients to prevent, protect, mitigate against, respond to, and recover  from terrorist attacks and other disasters.

You asked us to review a broad range of issues related to disaster  preparedness. This report examines:  1.  the extent to which the National Preparedness System and associated  preparedness grants assisted jurisdictions in preparing for disasters;  2.  the extent to which FEMA has strengthened the National  Preparedness System and what steps remain to prepare for future  disasters; and,  3.  the extent to which FEMA uses after-action reports following major  disasters to identify lessons learned and strengthen future  preparedness activities.

To determine the extent to which the National Preparedness System and  associated preparedness grants assisted jurisdictions in preparing for  disasters, we reviewed FEMA’s 2012 guidance, which jurisdictions used  to prepare assessments of their emergency management capabilities  from 2012 through 2017—the most current data available at the time of  our review. After reviewing the guidance, we reviewed 10 jurisdictions’  assessments of their emergency management capabilities for 2013  through 2018 to examine the extent to which their capability ratings were  being enhanced or sustained over that period. We selected these  jurisdictions because they had prepared assessments prior to 2018 and  were also impacted by the 2017 and 2018 hurricanes and wildfires. We  also reviewed DHS notices announcing the availability of preparedness  grants and FEMA case studies examining jurisdictions’ use of grant  funds, to determine the extent to which FEMA requires or encourages  grant recipients to use the funds to improve the capabilities. Further, we  analyzed data submitted by jurisdictions from their emergency  management capability assessments on the 32 core capabilities, broken  down annually by state, territory, and, to the extent possible, by Urban  Area Security Initiative regions, which encompass major metropolitan  areas throughout the United States. To validate FEMA’s assessment of  the submitted jurisdictions’ data, we conducted the same analysis that  FEMA conducted on the emergency management capability assessments  submitted by the 50 states, District of Columbia, and 5 territories from  2013 through 2017. The results of both analyses proved to be  consistent with one another. We also compared our data analysis to  FEMA’s data analysis to help ensure the reliability of the data. In addition,  we interviewed FEMA officials to determine how, and to what extent, the  data can be used to report on national preparedness. We determined that  these data were reliable for the purpose of our reporting objectives.

We also reviewed FEMA’s current guidance, which was updated in 2018  and included instructions to the jurisdictions on how to measure and  assess their capabilities in a manner that would allow them to define their  capability gaps quantitatively moving forward. In addition, we reviewed  FEMA’s strategic planning documents and the Comprehensive  Preparedness Guide 101, which provides additional guidance jurisdictions  use to develop preparedness plans and report on their capabilities. We  also conducted interviews and site visits with state emergency  management officials in California, Florida, New York, North Carolina,  and Texas to discuss their process for identifying and preparing for  specific threats, hazards, and risks. Four of the five states we visited  experienced major disasters during 2017 and 2018. In addition to the four  states that incurred damages during 2017 and 2018, we visited New  York, which was not impacted by the 2017 and 2018 hurricanes or  wildfires. However, New York has multiple threats, risks, and hazards-and  receives preparedness grants annually. We interviewed officials from the  state and city of New York to, in part, discuss their use of preparedness  grant funds. Additionally, within the five states we visited, we interviewed  emergency management officials in four cities and 11 counties to obtain  their views on the response and recovery to the 2017 and 2018  hurricanes and wildfires, as well as their perspectives on various  preparedness activities they participate in as part of the National  Preparedness System. We selected the counties and cities based on  the high level of damages they incurred during the 2017 and 2018  disasters and by whether they receive preparedness grant funding. The information obtained during these site visits are specific to the state and  local officials we interviewed and are not generalizable to all state and  local emergency management officials or recipients of preparedness  grants, but their perspectives provide insights into how the National  Preparedness System and associated preparedness grants are helping  jurisdictions prepare for disasters.

To determine the extent to which FEMA has strengthened the National  Preparedness System and what, if any, steps remain to prepare for future  disasters, we conducted interviews with officials in FEMA’s National  Preparedness Directorate and the National Preparedness Assessment  Division to gain their perspectives on FEMA’s implementation and use of  the National Preparedness System. We reviewed relevant information  from our prior testimony to Congress on national capabilities and  analyzed FEMA documents—such as the 2019 National Threat and  Hazard Identification and Risk Assessment (National THIRA) Overview  and Methodology. In addition, we interviewed state and local officials  from the five states we visited to discuss the implementation of the 2018  methodology that recipients of preparedness grants use to conduct state,  local, and territorial threat assessments.

To determine the extent to which FEMA is using after-action reports  following major disasters to strengthen future preparedness activities, we  interviewed officials from FEMA’s headquarters and its regional staff  (Regions II, IV, VI, and IX) who are responsible for conducting, collecting,  and analyzing FEMA’s after-action reports; and collected and analyzed  available after-action reports. We selected these FEMA regions because  of their proximity to the five states we visited and their experiences  assisting in the response and recovery efforts during the 2017 and 2018  disasters. The FEMA regional officials we interviewed are responsible for  coordinating disaster assistance and preparedness activities in California,  Florida, New York, North Carolina, Puerto Rico, Texas, and U.S. Virgin  Islands. While the regional officials’ views add important context to our  findings, their statements cannot be generalized and are not  representative of all FEMA Regional officials. In addition, we reviewed  prior GAO reports, in which we reviewed coordination among FEMA’s  regional offices and headquarters, in part, to assess their process for  conducting and using after-action reports. We also reviewed FEMA  program guidance related to FEMA’s after-action reporting protocols.  We then compared FEMA’s efforts to identify and address lessons  learned with the provisions in the Post-Katrina Emergency Management  Reform Act of 2006 (Post-Katrina Act) as well as the standards for  conducting lessons learned efforts outlined in The Standards for Program  Management. We also assessed FEMA’s efforts against DHS’s National  Response Framework, which specifies that evaluation and continual  process improvement are cornerstones of effective preparedness.

We conducted this performance audit from July 2018 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Following Hurricane Katrina in 2005, the Post-Katrina Act required FEMA  to develop a national preparedness system and assess preparedness  capabilities to determine the nation’s disaster preparedness. In  September 2011, DHS issued the National Preparedness Goal: a secure  and resilient nation with the capabilities required across the whole  community to prevent, protect against, mitigate, respond to, and recover  from the threats and hazards that pose the greatest risk. The National  Preparedness Goal also defined the “whole community” as individuals  and communities, the private and nonprofit sectors, faith-based  organizations, and all governments (local, regional/metropolitan, state,  tribal, territorial, insular area, and federal). The National Preparedness  Goal identifies and defines 32 core capabilities across five broad mission  areas. These capabilities form the foundation for measuring overall  national preparedness and assisting the nation in allocating resources to  fill identified preparedness gaps. Three of the 32 core capabilities affect  all mission areas and are considered to be “crosscutting” (see fig. 1). The  five broad mission areas are:

Prevention. Preventing an imminent threat, or actual act of terrorism.

Protection. Protecting citizens, residents, visitors, and assets in a  manner that allows interests, aspirations, and way of life to thrive.

Mitigation. Mitigating the loss of life and property by lessening the  impact of future disasters.

Response. Responding quickly to save lives, protect property and the  environment, and meet basic human needs in the immediate  aftermath of an incident.

Recovery. Recovering through a focus on the timely restoration,  strengthening, and revitalization of infrastructure, housing, and a  sustainable economy, as well as the health, social, cultural, historic,  and environment fabric of communities affected by an incident.

Since 2012, DHS has produced a National Preparedness Report  annually, which assesses progress toward the National Preparedness  Goal of achieving a secure and resilient nation. A key element of the  National Preparedness Report is that it evaluates and measures the  extent to which jurisdictions have strengthened their 32 core capabilities.  From 2012 to 2017, all 50 states, District of Columbia, and 5 territories  were required to assess the preparedness levels of their 32 capabilities  by providing a rating of 1 to 5, with 5 being the highest preparedness  rating. Emergency management capabilities with a rating of 1 or 2 are  considered to have the largest capability gaps. FEMA used this  assessment process to inform the National Preparedness Report by  illustrating which threats and hazards occurred in the past and which  capabilities have the largest gaps.

FEMA’s National Preparedness Directorate, which includes the National  Preparedness Assessment Division, is responsible for assisting  communities in becoming more resilient by developing the capabilities  needed to prevent, protect against, respond to, recover from, and mitigate  against all threats and hazards. The Directorate provides guidance,  programs, and processes to assist communities in completing the  requirements associated with the National Preparedness System.

Jurisdictions’ Emergency Management Capability Assessments

To help jurisdictions more comprehensively assess their gaps, FEMA  required they complete the Threat and Hazard Identification and Risk  Assessment (THIRA) and Stakeholders Preparedness Review (SPR).  The THIRA is conducted by jurisdictions every 3 years to, in part, identify  threats and hazards that are both reasonably likely to affect the  community and would most challenge the community’s ability to deliver  one or more of its capabilities; and estimate and describe the potential  impacts of those threats and hazards. The types of threats and hazards  are defined as (1) natural hazards or acts of nature; (2) technological  hazards that are accidents or failures of systems and structures; and (3)  human-caused incidents resulting from intentional actions. Jurisdictions  are to conduct the SPR annually to, among other things, identify  capability gaps by assessing the capabilities against the types of threats  and hazards identified in the THIRA.

In 2012-2013, FEMA issued its initial guidance to jurisdictions to help  them understand how to identify the threats and hazards through the  THIRA, and assess their core capabilities. In 2018, FEMA issued new  guidance for the THIRA and SPR requiring jurisdictions to change the  methodology, moving away from proficiency-based ratings to a process  that relies more on quantitative data to measure gaps across the core  capabilities. In 2018, FEMA required jurisdictions to begin using the new  methodology to assess the core capabilities within the response and  recovery mission areas. Beginning in 2019, FEMA required jurisdictions  to begin using the new methodology to assess the core capabilities  across all mission areas. FEMA’s 10 regions provide technical assistance  and training to help jurisdictions become more proficient in completing  these capability assessments. FEMA also sponsors exercises with states,  territories, tribes, and localities to help them assess their emergency  management capabilities.

In addition to the jurisdictions’ THIRAs and SPRs, in 2019, FEMA initiated  an effort to assess the federal government’s emergency management  capacity. According to FEMA, the effort is intended to provide a national  THIRA and SPR that assesses the federal government’s capabilities  against the nation’s threats and hazards. The Disaster Recovery Reform  Act of 2018 (DRRA) requires FEMA, among other things, to provide  congressional committees updates every 6 months on its progress in  completing a national preparedness assessment until the assessment is  complete. In July 2019, FEMA issued its 2019 National Threat and  Hazard Identification and Risk Assessment (National THIRA): Overview  and Methodology, describing its approach to completing a national-level  risk assessment (i.e., a National THIRA). According to FEMA, the  National THIRA was completed in 2020, and will be included in the 2020  National Preparedness Report.

DHS, through FEMA, provides jurisdictions preparedness grants, which  are used, in part, to strengthen the 32 core capabilities across the five  mission areas. FEMA has traditionally provided three primary  preparedness grants that jurisdictions can use to strengthen their  emergency management core capabilities. Two of the three grants, the  State Homeland Security Grant Program and the Urban Area Security  Initiative, were established after the terrorist attacks of September 11,  2001. As established by federal law, these grants are intended to help  states and localities prevent, prepare for, protect against, and respond to  acts of terrorism.

State Homeland Security Grant Program. Provides funding to assist  state, local, and tribal governments in preventing, preparing for,  protecting against, and responding to acts of terrorism. Helps  support states’ implementation of homeland security strategies to  address the identified planning, organization, equipment, training, and  exercise needs at the state and local levels. In fiscal year 2019, the  total funding available to all 50 states, District of Columbia and 5  territories was $415 million.

Urban Area Security Initiative. Provides federal assistance to  address the unique needs of high-threat, high-density urban areas,  and assists the areas in building a capacity to prevent, prepare for,  protect against, and respond to acts of terrorism. In fiscal year 2019,  the total funding available to the 31 urban areas was $590 million.

Emergency Management Performance Grant. Provides federal  assistance to states to assist state, local, and tribal governments in   preparing for all hazards. The program plays a valuable role in  strengthening and sustaining the 32 core capabilities across the five  mission areas. In fiscal year 2019, the total funding available to states,  local governments, and tribes was $315 million.

The National Preparedness System and Grants Have Helped Build Some Emergency Management Capabilities, but Gaps Remain

The National Preparedness System and associated preparedness grants  have helped jurisdictions strengthen and sustain their emergency  management capabilities. More specifically, according to National  Preparedness Reports since calendar year 2012, states and territories  generally have rated their capabilities within the prevention and response  mission areas, as well as their crosscutting capabilities—which involve all  five mission areas, as having the highest preparedness levels. By  contrast, states and territories generally have rated their capabilities in the  recovery and protection mission areas as having lower preparedness  levels, and these ratings showed little to no improvement from 2013 to  2017. Additionally, since 2013, jurisdictions have directed nearly 87  percent of their FEMA preparedness grants toward sustaining or  strengthening capabilities in the crosscutting, prevention, and response  mission areas, and around 13 percent on enhancing or sustaining  capabilities in the protection, mitigation, and recovery mission areas.  FEMA has encouraged jurisdictions to invest future preparedness grants  to strengthen their capabilities that have lower preparedness ratings and  to address emerging threats, such as cybersecurity. However, FEMA officials told us their efforts to help jurisdictions enhance their capabilities,  including the distribution of existing preparedness grants, will likely not be  sufficient to address the capability gaps that have been identified by  jurisdictions.

Preparedness Data Show Capabilities Are Strongest in the Crosscutting, Prevention, and Response Areas; Lowest in the Protection and Recovery Areas

States and territories’ 2017 preparedness data showed that eight core  capabilities in the response and crosscutting mission areas had the  highest level of preparedness (a rating of 4 or 5 on a 5-point scale). For  example, as shown in figure 2 below, over 50 percent of the assessment  ratings by the states and territories identified crosscutting capabilities,  such as public information and warning and operational coordination, in  the highest category of preparedness. Similarly, 57 percent of the  assessment ratings by states and territories identified on-scene security,  protection, and law enforcement capabilities within the response mission  area in the highest preparedness categories.

In our discussions with local officials who were impacted by the 2017 and  2018 hurricanes, they told us that the operational coordination and public  information and warning capabilities were effective during their response  efforts. For example, Craven County, NC, officials told us that in response  to the flooding from Hurricane Florence, their emergency operations  center was instrumental in communicating with first responders. In doing  so, they were able to keep county wells running while working with utility  companies to prioritize areas that needed electrical power, such as  hospitals and grocery stores. Additionally, Onslow County, NC officials  said their emergency operations center was instrumental in  communicating and coordinating the rescue operations of around 700  residents through the use of the county’s swift water rescue teams, with  assistance from the U.S. Marine Corps, North Carolina’s National Guard,  and the local fire and police departments. In addition, Brazoria County,  TX, officials told us that in response to Hurricane Harvey they used  videos and social media to get warning messages out to the residents  and businesses about evacuation assistance as well as information on  hurricane preparedness.

Supply chain integrity and security  Hurricane Florence caused significant  flooding in and around New Hanover County,  North Carolina. County officials told us the  state’s National Guard high wheel clearance  trucks had to be used to transport food,  water, fuel, and generators throughout the  flooded areas to isolated communities  because the county did not have the  capability to deliver these commodities.  According to the North Carolina National  Guard, the high-water vehicles were also  used to evacuate citizens to shelters and  transport essential civilian personnel such as  nurses, doctors, and first responders.

Preparedness data from 2017 show that almost 40 percent of  jurisdictions’ ratings identified five capabilities in the recovery and  protection mission areas in the lowest category of preparedness (a rating  of a 1-2 on a 5-point scale). For example, within the recovery mission  area, 51 percent of the ratings identified disaster housing in the lowest  category of preparedness. Similarly, within the protection mission area,  46 percent of the assessment ratings identified cybersecurity in the lowest  category. Additionally, these capabilities have been consistently rated in  the lowest preparedness categories from 2013 through 2017 and have  shown little-to-no change. For example, under the recovery mission area,  56 percent of the assessment ratings by states and territories identified  disaster housing in the lowest category in 2013, with minimal changes  through 2017. Some of the capabilities that had the lowest  preparedness ratings in 2013 were:

Economic recovery. The ability to return economic and business  activities (including agricultural) to a state of health and develop new  economic opportunities that result in a sustainable and economically  viable community.

Natural and cultural resources. The ability to preserve, conserve,  rehabilitate, and restore historic property consistent with post-disaster  community priorities and best practices and in compliance with  environmental and historic preservation laws and executive orders.

Disaster housing. The ability to address pre- and post-disaster  housing issues and coordinate the delivery of federal resources and  activities to assist local, state, tribal, territorial, and insular area  governments as they rehabilitate and reconstruct destroyed and  damaged housing.

Supply chain integrity and security. The ability to secure and make  resilient key nodes, methods of transport between nodes, and  materials in transit between a supplier and consumer.

Table 1 shows the percentages of the lowest-rated capabilities from 2013  through 2017.

While the National Preparedness System may help jurisdictions assess  their preparedness using emergency preparedness capability  assessments, jurisdictional officials we spoke with told us that real-life  disasters sometimes show jurisdictions to be less prepared than their  capability assessments previously indicated. As a result, some states  have lowered their preparedness ratings in subsequent capability  assessments following a disaster. For example, after the 2017 and 2018  hurricanes, some states told us they lowered their preparedness rating in  their 2019 assessments for disaster housing because they realized the  capability gap was larger than they previously believed. Officials from the  North Carolina Division of Emergency Management said that in 2018,  they lowered their preparedness rating for housing because their housing  capacity was not able to meet the needs of disaster victims who needed  immediate housing assistance.

From Fiscal Years 2013 through 2018, Jurisdictions Directed Almost 90 Percent of FEMA Preparedness Grant Funding to the Crosscutting, Prevention, and Response Mission Areas

From fiscal years 2013 through 2018, jurisdictions received approximately  $8.3 billion in preparedness grants funds primarily from the State  Homeland Security Program, Urban Area Security Initiative, and the  Emergency Management Performance Grant. Of this amount,  jurisdictions directed about $7.3 billion—or about 87 percent of the  funds—to capabilities in the crosscutting, prevention, and response  mission areas, which constitute the highest-rated mission areas. For  example, in California, $1.9 million in Urban Area Security Initiative grants  were used to strengthen crosscutting and prevention capabilities by  providing situational awareness to first responders and emergency  managers working on active threats to infrastructure. Additionally, in  Florida, up to $2.8 million of the State Homeland Security grant was used  to create a system intended to strengthen crosscutting and prevention  capabilities by enabling the state’s law enforcement agencies to more  easily share information.

Of the $8.3 billion in preparedness grant funding from fiscal years 2013  through 2018, about $1.1 billion—or about 13 percent—was directed  to  capabilities in the mitigation, protection, and recovery mission areas,  which constitute the lowest-rated mission areas. During this time,  jurisdictions directed the least amount of preparedness grant funds on the  recovery mission area—$78 million, or about 1 percent (see fig. 3).  Jurisdictions also directed about 5 percent of the $1.1 billion to  capabilities within the mitigation mission area, though preparedness  ratings in the mitigation mission area generally showed improvements  each year. In 2017, 43 percent of the assessment ratings by states and  territories rated three of the four mitigation-related capabilities in the  highest category. Improvements in the mitigation mission area could be,  in part, attributable to FEMA providing jurisdictions with grant funds other  than preparedness grants, such as post-disaster grants, which include  Hazard Mitigation Grant Program funds.

Further, state and local decisions on how to prioritize preparedness grant  awards resulted in about 1 percent—$78 million—being directed to  capabilities within the recovery mission area between 2013 and 2018. As  shown in figure 4, jurisdictions directed approximately 79 percent of the  $78 million (about $62 million) in the recovery mission area to the  infrastructure systems capability, which is intended to, in part, allow  jurisdictions to re-establish critical infrastructure in disaster-impacted  areas to support life sustainment activities, ongoing emergency response  operations, and to help facilitate recovery efforts. Additionally, about 3  percent of the $78 million—about $2.4 million—was directed to disaster  housing capabilities, such as implementing housing solutions that  effectively support the temporary housing needs of an impacted  jurisdiction.

State officials from New York and North Carolina, as well as officials from  five localities, said they often prioritize and use preparedness grants to  maintain existing capabilities within the crosscutting, prevention, and  response capabilities, rather than enhancing capabilities where gaps are  known to exist, such as those in the recovery and protection areas. In  addition, state officials from Texas, as well as officials from two localities  told us that they need to use portions of their limited grant funds— especially from Emergency Management Performance Grant funds—to  hire and retain local emergency management personnel, which leaves  fewer funds for them to devote to enhancing lower-rated emergency  management capabilities. For example, some county governments may  not have the resources necessary to fund a single emergency manager,  which requires them to use Emergency Management Performance Grant  funds to hire and retain necessary staff.

Another reason why jurisdictions do not use more of the grants toward  lower-rated mission areas is because some view certain capabilities in  the recovery and mitigation mission areas to be the responsibility of the  federal government. Both FEMA and state officials told us that sometimes  jurisdictions do not use these grants to strengthen capabilities such as  housing because they consider the federal government responsible for  filling the gaps. For example, preparedness data from 2013 to 2017  showed the percent of jurisdictions identifying the federal government as  responsible for providing housing solutions to disaster survivors increased  from 46 to 53 percent. According to state officials from North Carolina, it  would not be a prudent use of grant funds for the state to purchase and  store temporary housing units that may not be needed inside the borders  of the state for several years. Following a major disaster declaration,  FEMA coordinates with jurisdictions to provide disaster housing  assistance to people displaced from their homes. For example, following  Hurricane Florence, FEMA provided financial rental assistance and grants  under its Individuals and Households program to help make repairs to  damaged homes. In addition, FEMA, in coordination with the state of  North Carolina, delivered travel trailers and manufactured housing units  (i.e., mobile homes) to displaced disaster victims through FEMA’s Direct  Temporary Housing Assistance program.

FEMA Has Encouraged Jurisdictions to Invest More Grant Funds on the Largest Capability Gaps, and Has Proposed New Grants to Address Such Gaps

FEMA has encouraged jurisdictions to make investments in core  capabilities that have the largest preparedness gaps (i.e., the lowest  preparedness scores). From 2013 to 2018, DHS identified investment  priorities in its annual announcements of preparedness grant funding  opportunities. The priorities focused on select capabilities where  jurisdictions had reported lower preparedness scores, such as  cybersecurity, disaster housing, economic recovery, natural and cultural  resources, and supply chain integrity and security. Specifically, FEMA  officials told us cybersecurity remains a high priority for all jurisdictions for  2020 and has identified areas from lessons learned where cybersecurity  could be strengthened. Jurisdictions are considering investments in  cybersecurity such as adding more information technology equipment and  hiring personnel with cybersecurity expertise. However, according to state  officials from New York and Texas, jurisdictions often lack the resources  necessary to hire and retain personnel skilled enough to prepare for,  respond to, and recover from cyberattacks.

Preparedness grants, in general, are designed to allow jurisdictions  discretion to spend the funds as they see fit on projects that meet  eligibility requirements. While FEMA encourages jurisdictions to invest  grant funds to address their capability gaps, it does not require or direct  jurisdictions to spend grant funding in a certain area. In light of these  challenges, FEMA has taken a number of other steps to try to address  these capability gaps.

FEMA proposed creating a new National Priorities Security Grant in  the President’s 2019 and 2020 budget proposals, which could be  used to address new and emerging threats and gaps, such as those  in cybersecurity. FEMA proposed that the program’s priorities be  assessed frequently and shift as needed to address emerging threats  and capability gaps. In fiscal years 2019 and 2020, the President’s  budget proposed $522 and $430 million respectively. The proposed  grant program was not approved by Congress.

In 2019, FEMA established the Regional Catastrophic Preparedness  Grant Program to help jurisdictions address known capability gaps in  disaster housing as well as logistics and supply chain management. In  fiscal year 2019, FEMA awarded $10 million in these grants to eight  local governments.

In 2019, FEMA began implementing the Building Resilient  Infrastructure and Communities (BRIC) program to provide  jurisdictions with funding to make their infrastructure more resilient in  future disasters. According to FEMA, grant recipients could use  future funding to strengthen capability gaps in the recovery and  mitigation mission areas. FEMA plans to issue a Notice of Funding  Opportunity in the summer of 2020, followed by an application period.  Based on historical disaster expenditures, FEMA anticipates BRIC will  be funded between $300 million and $500 million per year on  average. It is too early to assess the extent to which this program will  help address capability gaps.

While FEMA is taking steps to encourage jurisdictions to enhance their  lower-rated capabilities, FEMA officials told us their efforts combined with  existing preparedness grants, will likely not be sufficient to fully address  jurisdictions’ capability gaps. Specifically, FEMA officials told us that the  current suite of preparedness grants lacks the flexibility needed to  address some of the long-standing capability gaps, in part, because the  grants are required to be spent on capabilities that have a nexus to  terrorism. In addition, as described earlier, one state official, and two local  officials, suggested that the level of funding for the Emergency  Management Performance Grant will likely not allow states and localities  to hire and retain local emergency management personnel while also  making the investments needed to address the capability gaps identified  through the National Preparedness System. For example, one emergency  management official from a county explained that without using the  Emergency Management Performance Grant to offset his own salary, the  county would not have an emergency management department with the  capability to complete many of the FEMA requirements associated with  receiving disaster assistance.

In addition to the steps FEMA has already taken to attempt to address the  capability gaps, FEMA has developed a new methodology for assessing  national preparedness capabilities that uses more quantitative methods.  According to FEMA, such methods could enable jurisdictions to more  tangibly define what resources are needed to fill identified gaps. We  describe this methodology in more detail below.

FEMA Is Taking Steps to Strengthen Assessments of Federal and Jurisdiction Capabilities, but Opportunities Exist to Further Enhance National Preparedness FEMA Is Implementing a New Methodology to Strengthen How Jurisdictions Assess Preparedness

FEMA has taken steps to enhance its methodology for assessing  jurisdictions’ emergency management capabilities by requiring  jurisdictions to collect more quantitative preparedness data to support  their capability ratings. We reported in March 2011 that FEMA needed to  improve its oversight of preparedness grants by establishing a framework  with measurable performance objectives for assessing urban area, state,  territory, and tribal capabilities to identify gaps and prioritize  investments. Specifically, we recommended that FEMA complete a  national preparedness assessment of capability gaps at each level of  government based on tiered, capability-specific performance objectives to  enable prioritization of grant funding.

We also reported in March 2013 that FEMA has made some progress in  assessing its preparedness capabilities, but continued to face challenges  developing a national preparedness system that could assist FEMA in  prioritizing preparedness grant funding. FEMA’s issuance of the 2020  National Preparedness Report could provide an assessment of capability  gaps at each level of government—including an assessment of the  federal government’s capabilities for the first time—and help FEMA  address the intent of the 2011 recommendation. However, as discussed  before, prioritizing jurisdictions’ preparedness grant funding alone may  not effectively address the nation’s emergency management capability  gaps. An assessment that also considers the federal government’s  emergency management capabilities could help determine what  capabilities federal agencies could provide to assist in the wake of  disasters when jurisdictions’ capabilities become overwhelmed or are not  otherwise available. Once the assessment is completed, FEMA and its  federal budgeting stakeholders (i.e., Congress and the Office of  Management and Budget) could use such an assessment to identify the  potential costs of establishing and maintaining capabilities, not only at the  jurisdictional level, but also at the federal level.

FEMA has continued to take steps to implement the 2011  recommendation, but has not yet fully addressed it as of January 2020.  For example, FEMA published new guidance in May 2018 to update the  methodology for how jurisdictions are to evaluate their preparedness  levels when completing THIRAs and SPRs. The intent was to allow  communities to collect more specific, quantitative data to compare their  capability targets to current capabilities, thereby more accurately defining  their capability gaps. Beginning in 2018, jurisdictions used the new  methodology to assess their capabilities in the crosscutting, response,  and recovery mission areas. Beginning in 2019, jurisdictions were  required to use the new methodology to assess the capabilities across all  five mission areas: prevention, protection, mitigation, response, and  recovery.

According to FEMA, this new methodology improves on the prior one  because the new methodology will allow jurisdictions to more accurately  determine what amount of resources are needed to address specific  threats and hazards. Specifically, as a result of using more quantitative  data, such as the specific number of disaster victims able to be sheltered  following a disaster, jurisdictions may be able to better define their  capability gaps when compiling their SPRs. For example, if jurisdictions  are able to understand that their current capability is less than their  needed capability target, they will be able to define their capability gaps in  quantitative terms. According to FEMA officials, the new methodology, if  implemented successfully, will allow jurisdictions to know what additional  resources and capabilities—beyond their own current capabilities—may  be needed during future disasters. Table 2 shows an example of how  FEMA’s updated methodology provides a more quantitative assessment  to more accurately define their capabilities.

FEMA Is Using Its New Methodology to Assess the Federal Government’s Emergency Management Capacity and Better Define the Nation’s Capability Gaps

In 2019, FEMA began working on its first National Threat and Hazard  Identification and Risk Assessment (National THIRA) to identify what  federal government capabilities will be needed to address the greatest  threats to the nation. According to FEMA, the results of this effort are  expected to be included in FEMA’s annual National Preparedness Report  in 2020, which is expected to be published late in calendar year 2020.  FEMA’s effort is intended to provide a quantitative assessment of federal  capabilities, which when combined with state, territory, urban area, and  tribal THIRAs and SPRs, could provide a more meaningful assessment of  the nation’s overall preparedness. Figure 5 below shows how national  and jurisdiction risk assessments are intended to work together to provide  a collective picture of overall capability gaps. As subsequent iterations of  the National THIRA and National SPR are produced, FEMA intends to  consolidate them with the THIRA and SPR assessments submitted by  jurisdictions to provide a comprehensive overview of national  preparedness.

FEMA officials told us that they have begun to assess and measure the  federal government’s capabilities in the crosscutting, response, and  recovery mission areas. In conducting the 2019 National THIRA—that  FEMA officials told us will be included in the 2020 National Preparedness  Report—FEMA coordinated with over a dozen federal departments and  agencies, as well as selected national laboratories and the White House  to solicit feedback on the most challenging threats and hazards facing the  nation. The 2019 National THIRA consists of nine catastrophic incident  scenarios and 22 capability targets across the crosscutting, response,  and recovery mission areas. For example, FEMA used catastrophic  scenarios, such as a pandemic (see sidebar) or New Madrid Earthquake,  to assess the nation’s emergency management capacity.

Pandemic Scenario  In early October, the Centers for Disease  Control and Prevention (CDC) reports a new  strain of influenza virus in the National Capital  Region. Less than 2 weeks after the first  confirmed case is identified at a local  hospital, the illness causes hundreds of  fatalities and thousands of people seeking  medical attention. As the virus spreads,  approximately 30 percent of the population  across the United States and other countries  becomes severely ill. Conventional flu  vaccines are ineffective against the current  strain, and the CDC estimates that a new  vaccine could be months away from mass  production. Because of the pandemic, social  distancing is in widespread effect. Utilities,  police, fire, government, and other essential  services are disrupted due to social  distancing and employee absenteeism.  Businesses close, resulting in a large-scale  loss of services across the region (e.g.  banking, food stores, gas stations). There is a  shortage of medical supplies, equipment,  beds, and healthcare workers as hospitals  are quickly overwhelmed, with up to millions  of individuals seeking outpatient medical care  and millions more requiring hospitalization.  Civil disorder contributes to the high rate of  absenteeism and the overcrowding of  hospitals and medical centers. how quickly power service can be restored to customers; how quickly life-sustaining commodities can be delivered to people; how quickly emergency sheltering, food, and water can be provided to how quickly affected healthcare facilities can restore function.

In the aftermath of the sequential 2017 disasters, FEMA’s 2017 Hurricane  Season FEMA After-Action Report recognized the need to more  effectively scale response efforts for concurrent, complex incidents. As  a result, in addition to the nine catastrophic scenarios, the National  THIRA considered the challenges associated with managing concurrent  incidents. To examine the potential impacts of managing concurrent  incidents, FEMA developed a set of “plausible concurrent operations.”  FEMA acknowledged that the agency and its federal partners “will almost  certainly be engaged in ongoing disaster operations at the time of any  catastrophic-level incident” and gathered data from historical incidents  from recent years, including the sequential disasters that took place in  2017; three large hurricanes and wildfires in California, among others.  FEMA found that combining the impacts of a National THIRA scenario  with the set of plausible concurrent operations more accurately reflects  the challenges the nation would need to address should one of the threat  scenarios identified in the National THIRA occur. However, given that  FEMA has yet to finalize inclusion of the National THIRA into the 2020  National Preparedness Report, it is too early to determine the extent to  which it helps FEMA more accurately define the nation’s emergency  management capability gaps and results in the nation being better  prepared for future catastrophic disasters.

FEMA Has Yet to Determine What Steps Need to be Taken to Address Capability Gaps at the Federal and Jurisdictional Levels

As discussed above, the National Preparedness System has identified  gaps in jurisdictions’ emergency management capabilities since 2012.  While jurisdictions have used preparedness grants to strengthen select  capabilities, preparedness data shows that they have not used the grants  to address capability gaps across all the mission areas. Furthermore,  while FEMA has encouraged jurisdictions to use grant funding to address  capabilities that have the largest capability gaps, such as those in the  recovery and cybersecurity areas, they do not require that jurisdictions do  this. However, if FEMA were to require jurisdictions to use their grant  funds to address lower-rated capabilities, it could affect jurisdictions’  ability to sustain other core capabilities—or to fund emergency  management personnel in select jurisdictions, some of which only have  one full-time employee. As FEMA implements its new methodology and  begins to more fully assess both federal and jurisdictional capabilities, the  agency is expected to have better and more quantitative information on  capability gaps in order to better prioritize grant funds and resources.  According to FEMA, the agency and its partners will better understand the  extent of the nation’s emergency management capability gaps when they  issue the National Preparedness Report by December 2020.

While these actions may allow FEMA to address our 2011  recommendation and better measure the nation’s overall preparedness,  the agency has yet to determine what additional actions may be needed  to close the remaining gaps once the 2020 National Preparedness Report  is issued. Further, while FEMA has taken some steps to close the gaps  jurisdictions have identified since 2012, such as proposing the National  Priorities Security Grant, this program has not been approved by  Congress, and thus, will not help to address the gaps. According to FEMA  officials, preparedness grants alone are unlikely to address the gaps in an  effective manner. In addition, the National Preparedness Goal states that  analyzing current performance against intended capabilities allows the  emergency management community the opportunity to determine  necessary resource levels, inform resource allocation, and help guide  federal investments in preparedness. Such information could help  inform budget decisions across the preparedness enterprise and help  prioritize limited resources. For example, determining what steps need to  be taken, following the issuance of the 2020 National Preparedness  Report, could help FEMA inform key decision makers, such as Congress  and the Office of Management and Budget, about the necessary level of  resources—including the allocation of resources—that are needed to  address the nation’s capability gaps. Such an effort could be a significant  step toward enhancing the capability gaps that have been identified since  2012 and help determine the nation’s overall preparedness levels, as  called for in the Post-Katrina Act.

FEMA Has Identified Some Areas for Improvement Following Disasters, but Could Strengthen After-Action Reviews and Follow-Up FEMA Has Policies and Processes for Using After- Action Reviews to Identify Areas for Improvement following a Major Disaster

The Post-Katrina Act requires FEMA to analyze real-world events to  identify and disseminate lessons learned and best practices, and to  generate and disseminate, as appropriate, after-action reports to  participants after real-world events. After major disasters occur, FEMA’s  policy is to conduct an after-action review that identifies strengths, areas  for improvement, and potential best practices identified during response  and recovery efforts. Lessons learned from past disasters are to provide  collective knowledge and diverse experiences for improving disaster  response and recovery. Further, FEMA’s 2018-2022 Strategic Plan calls  for sharing lessons learned from disasters and exercises with the whole  community to help prioritize investments and anticipate known challenges  during future disasters.

In July 2018, FEMA published its 2017 Hurricane Season After-Action  Report, which discussed findings and recommendations based on a  review of the agency’s preparation for, immediate response to, and initial  recovery operations for Hurricanes Harvey, Irma, and Maria. According  to FEMA, the agency is implementing recommendations to address the  challenges outlined in the after-action report, which include the following  focus areas:  scaling and staffing for concurrent complex incidents;  improving logistics capabilities during response;  improving response to long-term infrastructure outages; and,  improving mass care to initial disaster housing operations based on  innovations developed during the 2017 hurricane season.

According to FEMA, the agency has taken a number of actions in  response to this after-action report. For example, it increased its incident  management workforce strength by 19 percent since Hurricane Harvey  and updated hurricane plans, annexes, and procedures for the  continental United States and for states and territories outside the  continental United States, among other things.

FEMA’s Continuous Improvement Program is responsible for collecting  observations and conducting after-action reviews after disasters. The  program is intended to consolidate feedback and information from  regional, headquarters, and field operations staff and provide information  to FEMA leadership and program offices to improve the efficiency and  effectiveness of the agency’s disaster operations. The regional role in the  Continuous Improvement Program is to identify lessons learned and best  practices from disaster events in their regions, conduct after-action  reviews, and track corrective actions and improvement plans applicable to  the region through Continuous Improvement Working Groups. FEMA  officials told us that after-action report findings that cannot be resolved at  the regional level are elevated to headquarters for resolution. According  to FEMA officials, FEMA headquarters reviews completed after-action  reports to identify any areas for improvement that may need to be  addressed through changes in policies and procedures.

FEMA Conducts After- Action Reviews for Select Disasters, but Has Not Developed Guidance to Assist Regional Officials in Prioritizing Which Disasters Should Result in an After-Action Review

Although FEMA’s policy requires after-action reviews be conducted after  every presidentially-declared major disaster, we found that the agency  does not consistently conduct after-action reviews after all major disasters  and has not instituted time frames for following up on incomplete after- action reviews. As of January 2020 FEMA had completed after-action  reviews for 29 percent of disasters since January 2017, with 43 percent  pending or in the process of being completed, and 27 percent having  been deferred (i.e., not completed or status unknown), as shown in figure  6. Our review of relevant policy indicates that FEMA does not specify time  frames for when after-action reviews are to be completed. This is  consistent with what we heard from FEMA officials who explained they do  not have any time frames for when a certain region is to complete after- action reviews.

FEMA has recently updated its Continuous Improvement Program. For  example, in 2019, FEMA updated the Continuous Improvement Directive  to formalize an annual Summary of Findings that consolidates the field,  regional, and headquarters’ observations from the year’s incidents in  order to identify the strengths, best practices, and lessons learned that  should be addressed the following year. However, FEMA officials noted  that this had only been done once in 2019, and would be completed in  future years.

Officials from FEMA’s Continuous Improvement Program in one region  cited challenges with capacity, staffing, and the number of on-going after-  action reviews as reasons for not being able to complete all of their after- action reports. According to FEMA officials, in 2017 each region was  assigned one to two continuous improvement advisors who are  responsible for developing the region’s after-action reviews. However,  FEMA officials in one region said that in 2019, they faced challenges in  having the staff resources necessary to operate the Continuous  Improvement Program due to competing priorities, such as responding to  active disasters. In addition, FEMA officials stated that due to limited staff,  the regions have to prioritize which after-action reviews they can  complete based on the severity and impact of the disaster. For example,  in 2017, FEMA focused resources on reviewing the agency’s response  and recovery for Hurricanes Harvey, Irma, and Maria. According to FEMA  regional and headquarters officials, competing priorities, such as  responding to active disasters, often result in staff being unavailable to  conduct after-action reviews.

While we acknowledge staffing is limited and that FEMA may need to  prioritize completing some after-action reviews over others, FEMA  officials have not established a process or framework by which regional  offices are to prioritize after-action reviews. Based on our analysis of the  after-action reviews since 2017 and discussions with FEMA headquarters  and regional staff, we found that FEMA does not have a formal process to  prioritize after-action reviews and has not established general time frames  for how long following a disaster an after-action review should be  completed, or followed-up on. FEMA officials agreed that having a formal  process to prioritize after-action reviews, including establishing time  frames for following up on incomplete after-action reviews, could provide  the agency additional opportunities to improve response and recovery  operations for future disasters. According to FEMA Regional officials,  timely after-action reviews are useful. For example, as a result of the  2017 Hurricanes Season After-Action Report, Region II was able to  update response plans for Puerto Rico, which could prove to be beneficial  for future disasters.

According to The Standards for Program Management, agencies should  collect, measure, and disseminate performance information, analyze  program trends, and point to areas in need of adjustment. In addition,  leading practices for program management indicate that project  schedules should be developed to define project milestones and identify  and sequence activities in order to determine start and end dates for each  activity. Additionally, in other branches of FEMA, the agency provides  time frames for completing after-action reports. For example, states and  territories are expected to submit after-action reports within 90 days of  exercises that are funded by the Homeland Security Grant Program. .  Similarly, FEMA policy requires Urban Search and Rescue teams to  submit after-action reports 30 days after returning from deployment.  Developing a process by which regional offices are to prioritize after- action reviews could help FEMA ensure that regions have a common  framework to work from when determining what disasters should be  prioritized for review and could help FEMA prioritize staff resources more  effectively across the Continuous Improvement Program. Furthermore,  establishing time frames for following up on incomplete after-action  reviews could provide FEMA with greater assurance that the reviews will  be conducted in a timely fashion, so that other FEMA Regions and key  stakeholders can benefit from the lessons learned.

FEMA Headquarters Lacks a Formal Mechanism to Document and Track Best Practices, Lessons Learned, and Corrective Actions Identified through After- Action Reviews

As described earlier, FEMA regional offices Continuous Improvement  Working Groups are responsible for developing and tracking, to the extent  possible, corrective actions and best practices identified through after- action reviews. These working groups are to elevate to FEMA  headquarters any issues that cannot be resolved at the regional-level.  However, FEMA does not have a formal mechanism at the headquarters  level for documenting and tracking best practices, lessons learned, and  corrective actions that have been elevated from the regional working  groups. According to FEMA, it has taken steps to track best practices and  lessons learned through a serious of Microsoft Excel files, but it is not a  long term or ideal operating solution due to its lack of accessibility, ease  of use, and ability to be queried.

In February 2016, we recommended that FEMA implement a process to  document, track, and analyze recommendations and implement lessons  learned after disaster deployments. FEMA concurred with this  recommendation and implemented the recommendation by using the  Department of Defense’s Joint Lessons Learned Information System as  its primary system to capture and manage lessons learned data.  However, according to FEMA officials, as of July 2019, it no longer uses  the system to capture lessons learned data. FEMA officials also said the  Joint Lessons Learned Information System was not user-friendly.

FEMA officials stated that they hold a quarterly meeting, as required by  FEMA Directive 107-1, with FEMA’s Associate Administrators to review  national priorities and issues that have been elevated to headquarters for  resolution. According to FEMA officials, this group performs the function  that a Continuous Improvement Working Group does at the regional level  by monitoring issues that need adjudication by senior management  officials. While the quarterly meeting may be helpful, it does not serve as  a mechanism, such as a data system, for documenting and tracking best  practices, lessons learned, and corrective actions identified after a major  disaster.

Additionally, continuous improvement coordinators from the regions we  interviewed stated that once a finding is elevated to FEMA’s  headquarters, in general the region does not have visibility into what  steps, if any, FEMA headquarters is taking or plans to take to address the  issue. Having a mechanism, such as a database, to record after-action  report findings, such as corrective actions or best practices, could help  FEMA facilitate awareness across the agency about the status of FEMA’s  efforts to address them.

According to the Post-Katrina Act, FEMA should conduct remedial action  tracking and long-term trend analysis. Furthermore, the National  Response Framework specifies that evaluation and continual process  improvement are cornerstones of effective preparedness. The  framework notes that effective practices with continuity planning ensures  the capabilities contained in the framework can continue to be executed  regardless of the threat or hazard. Without a mechanism to document and  track best practices, lessons learned, and corrective actions identified  through after-action reviews across the regions and headquarters, FEMA  may not be able to provide assurance that it is effectively leveraging best  practices and lessons learned or taking corrective actions to improve its  response and recovery programs.

FEMA Lacks Guidance on Sharing After-Action Report Findings with External Stakeholders Following a Disaster

As described earlier, the Post-Katrina Act requires FEMA to generate and  disseminate, as appropriate, after-action reports to participants in  exercises and real-world events. In addition, FEMA’s stated policy on  knowledge sharing after disasters is to collaborate with public and private  sector partners to share insights on critical issues facing emergency  management, promote best practices, and discuss ways in which FEMA  itself can improve. However, based on a query of FEMA’s website for  after-action reports on disasters, since January 1, 2017, FEMA has  placed on-line one after-action report on the 2017 hurricane season. In  addition, state officials from Florida, as well as officials from ten localities  told us that there has been no communication from FEMA specifically in  regards to its 2017 Hurricane Season After-Action Report to ask  jurisdictions to provide feedback on the final product or its findings.

In addition to FEMA not communicating with jurisdictions about its final  product or its findings, state and local officials we spoke with said that  FEMA does not consistently share after-action reports with affected  jurisdictions. For example, officials from the state of Florida and four  localities told us that FEMA does not consistently share its reports after  each disaster, while officials from the state of California stated that FEMA  has regularly shared after-action reports from disasters. One FEMA  regional official noted that it would be helpful to know who, when, and to  what extent lessons learned should be shared with external partners.  Further, according to FEMA, knowledge sharing allows communities  impacted by disasters to prioritize investments and anticipate known  challenges during disasters. According to The Standards for Program  Management, agencies should collect, measure, and disseminate  performance information and analyze program trends, and point to areas  in need of adjustment.

FEMA has guidance for sharing after-action reports internally within the  agency, but according to FEMA officials has not developed guidance for  when after-action reports, or findings from after-action reports, should be  shared with external stakeholders. According to some state and local  officials we spoke with, having access to disaster after-action reports  could be useful to FEMA’s external stakeholders. For example, because  FEMA’s 2017 Hurricanes Season After-Action Report was accessible,  New York City officials said they were able to be proactive in areas that  needed to be strengthened in the event of delayed federal assistance,  such as providing disaster housing services.

Lessons learned can be produced through after-action reports and are  relevant to key stakeholders, such as state and local governments, which  are instrumental in disaster preparedness, response, and recovery, and  would play a key role in any future disasters. However, without guidance  to help officials determine when it is appropriate to share after-action  reports, FEMA may miss opportunities to share lessons learned. Further,  FEMA’s Strategic Plan states that building a culture of preparedness  requires continued learning, improvement, innovative ideas, and  engagement of the whole community. As such, all sectors of society,  including governments, nonprofit organizations, and the private sector,  will need to be involved in preparedness for future disasters. The plan  further states that insights can be gained through observations from after- action reports and through feedback from stakeholders. A FEMA official  from one of the region’s Continuous Improvement Program agreed that  developing guidance to determine when it is appropriate to share after- action reports, could help stakeholders better prepare for future disasters.  By developing guidance for sharing after-action reports or their relevant  findings—when appropriate—with key external stakeholders, FEMA could  help communities better prepare for future disasters through knowledge  sharing.

FEMA has taken numerous steps to continue to strengthen national  preparedness, such as distributing grant funds. However, FEMA has not  fully defined the capability gaps and determined what steps are needed to  enhance capabilities across all levels of government. Informing key  stakeholders, such as the Office of Management and Budget and   Congress, about what resources will be necessary to address the gaps— across all levels of government—will be critical in addressing the nation’s  emergency management capability gaps.

In addition, opportunities exist to enhance FEMA’s after-action review  process. More specifically, until FEMA prioritizes when—and for what  disasters—after-action reviews should be completed and establishes time  frames for following up on incomplete after-action reports, the agency will  not be able to guarantee that FEMA and its stakeholders can leverage  lessons learned from recent disasters and apply corrective actions before  future disasters occur. Further, without a mechanism to document and  track best practices, lessons learned, and corrective actions throughout  the agency, FEMA may not be able to effectively leverage best practices  and lessons learned or implement corrective actions to improve its  response and recovery operations. By addressing areas needing  improvement (i.e., corrective actions) once after-action reviews are  completed, FEMA could improve response and recovery operations in the  wake of future disasters. In addition, FEMA could help communities better  prepare for future disasters by developing guidance to share its after- action reports or findings from its after-action reports—when  appropriate—with key stakeholders, allowing them to provide feedback on  the findings or adjust their own operational plans to be better prepared to  work with FEMA during future disasters.

We are making the following four recommendations to the FEMA  Administrator:  Following the completion of the 2021 National Preparedness Report,  determine what steps are needed to address the nation’s emergency  management capability gaps across all levels of government and inform  key stakeholders, such as the Office of Management and Budget and  Congress, about what level of resources will be necessary to address the  known gaps. (Recommendation 1)

Develop guidance to help determine which after-action reviews should be  prioritized based on factors, such as the severity of disasters and  availability of staff and resources to conduct the review, and implement  time frames for following up on incomplete after-action reports.  (Recommendation 2)

Develop a mechanism to consistently track best practices, lessons  learned, and corrective actions that have been elevated to headquarters  for resolution. (Recommendation 3)

Develop guidance on sharing after-action reports and their relevant  findings with external stakeholders, when appropriate. (Recommendation  4)

We provided a draft of this report to the Department of Homeland Security  (DHS) for their review and comment. DHS provided written comments,  which are reproduced in appendix I. In its comments, DHS concurred with  the four recommendations and described actions under way or planned to  address them by March 31, 2022. DHS provided technical comments,  which we incorporated as appropriate.

DHS concurred with our first recommendation to determine what steps  are needed to address the nation's emergency management capability gaps across all levels of government and inform key stakeholders about  what level of resources will be necessary to address the known gaps.  According to DHS, this recommendation is consistent with the  requirements outlined in the Disaster Recovery Reform Act of 2018  (DRRA) noting that FEMA complete a national preparedness assessment  of capability gaps at each level based on tiered, capability-specific  performance objectives to enable prioritization of grant funding; and  identify the potential costs for establishing and maintaining those  capabilities at each level and determine what capabilities federal  agencies should provide.

DHS also stated that while the 2020 National Preparedness Report will  include a nation-wide assessment of community capability against  national capability targets to help understand gaps and inform grant  investments, it will not include data on federal capabilities. The collection  of that information, through the National Stakeholder Preparedness  Report, was scheduled to begin in 2020 but was delayed due to response  operations for the COVID-19 pandemic. According to DHS, this  information will be incorporated into the 2021 National Preparedness  Report, helping to form a more complete picture of national capabilities.  FEMA stated that the costs to address the nation’s resource gaps cannot  be estimated without first accounting for existing federal capabilities.  According to DHS, the anticipated date for the 2020 National  Preparedness Report, pending response operations to the COVID-19  pandemic, is October 30, 2020, and the 2021 National Preparedness  Report is planned to be released in October 2021. DHS stated that once  the 2021 National Preparedness Report is released, FEMA will develop  and socialize a plan to work with the federal interagency to identify  resources needed to address the national gaps identified in the 2021  National Preparedness Report.

If implemented effectively, these actions combined with the steps taken to  inform key stakeholders could meet the intent of our recommendation.  Due to the impacts of the COVID-19 pandemic and the need to finalize  the 2021 National Preparedness Report prior to being able to account for  the federal government’s existing capabilities, we are adjusting the  wording of this recommendation to follow the issuance of the 2021  National Preparedness Report. DHS estimates the expected completion  date to be March 2022.

DHS concurred with our second recommendation to develop guidance to  help determine which after-action reviews should be prioritized and  implement timeframes for following up on incomplete after-action reports.

According to DHS, FEMA will address the prioritization of disaster after- action reports as the Continuous Improvement Program’s first priority for  2020. Additionally, FEMA plans to identify and develop timeframes for  following up on after-action reports as part of a broader program  evaluation effort in 2020. These actions, if implemented effectively, could  meet the intent of our recommendation. While FEMA originally anticipated  completing this guidance during 2020, the COVID-19 response extended  this timeline. DHS estimates the expected completion date to be March  31, 2021.

DHS concurred with our third recommendation to develop a formal  mechanism to consistently track best practices, lessons learned, and  corrective actions. DHS stated that FEMA, in December 2019,  implemented an issue elevation and resolution system for tracking best  practices, lessons learned, and corrective actions that are elevated to  FEMA headquarters level for resolution, as appropriate. However,  according to FEMA in April 2020, the agency has taken steps to track  best practices and lessons learned through a serious of Microsoft Excel  files, but this is not considered to be a long term or ideal operating  solution due to its lack of accessibility, ease of use, and ability to be  queried. Further, in April 2020, FEMA stated that it is working to identify  resources to build an actual application that will be used for this purpose.  These actions, if implemented effectively, could meet the intent of our  recommendation.

DHS concurred with our fourth recommendation that FEMA develop  guidance on sharing after-action reports and their relevant findings with  external stakeholders, when appropriate. According to DHS, FEMA is  drafting program guidance for the Continuous Improvement Program to  address the sharing of after action reports and their relevant findings with  external stakeholders. These actions, if implemented effectively, could  meet the intent of the recommendation. Due to the ongoing COIVD-19  pandemic, FEMA estimates its completion date to be March 31, 2021.

We are sending copies of this report to the Secretary of Homeland  Security, the FEMA Administrator, and the appropriate congressional  committees. If you or your staff have any questions about this report,  please contact me at (404) 679-1875 or curriec@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. Key contributors to this report are  listed in appendix II. In addition, the report will be available at no charge  on the GAO website at http://www.gao.gov.

Appendix I: Comments from the Department of Homeland Security

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Aditi Archer (Assistant Director),  Robert Denton Herring (Analyst-in-Charge), Erin Guinn-Villareal, James  Lawson, Ben Ayres, Eric Hauswirth, Tracey King, Amanda Miller, Kevin  Reeves, and Minette Richardson made significant contributions to this  report.

FEMA uses several scenarios—including a pandemic influenza similar to COVID-19—to allow states and territories to assess their own emergency response and recovery capabilities (e.g., how quickly they can restore electricity, or how much emergency housing they can provide).

States and territories have a good handle on their strengths and weaknesses, but FEMA hasn’t used the information to determine the full scope of national needs. FEMA also hasn’t determined what resources the federal government would need to close the gaps—many of which are longstanding.

We recommended taking these steps and more to strengthen national preparedness.