FEMA Spent Port Security Money Well. It Never Checked the Results.

A Department of Homeland Security Inspector General audit⧉ of FEMA's Port Security Grant Program (PSGP) set out to answer two separate questions: was the money spent according to the rules, and has the program actually made ports more secure.▸ The audit answers the first question in FEMA's favor. It cannot answer the second at all -- because in the program's 23 years and more than $3.6 billion in appropriations, FEMA has never measured it.

PSGP was created by the Maritime Transportation Security Act of 2002 in the aftermath of the September 11 attacks, and FEMA has run it ever since -- funding port authorities, terminal operators, and state and local agencies to buy security equipment, surveillance systems, and training.▸ OIG reviewed FEMA's records of $281.8 million reimbursed across 5,112 transactions for fiscal years 2018-2021, isolated the 2,496 transactions of $10,000 or more (98.3% of the total, worth $276.9 million), and tested a random statistical sample of 333 of those transactions -- $35.5 million across 173 recipients. Its finding: an estimated 98.86% of that population, more than $273.7 million, was allowable and properly documented.

The exceptions were narrow.▸ Two recipients, across four awards, either lacked documentation for their required non-Federal cost share or spent it on items PSGP doesn't allow -- one recipient bought general-use trucks and SUVs to satisfy its cost-share obligation, which the program doesn't permit. OIG questioned $281,045 in those cost-share expenditures and is recommending FEMA recover $199,083 of it. FEMA's own risk-screening process also missed something: one of the four flagged recipients had already failed multiple compliance audits between FY2018 and FY2021, yet FEMA's Fiscal Integrity Review never designated it at-risk or attached special award conditions.

The audit's larger finding is what it found nothing on.▸ "At the time of our audit, FEMA had not yet evaluated PSGP's performance in strengthening maritime port security and resiliency," OIG wrote. "FEMA cannot demonstrate whether PSGP is effective in reducing risks or strengthening the security of the Nation's maritime ports." That is not a new gap FEMA just discovered. FEMA announced an initiative in 2018 -- 16 years into the program -- to build a risk baseline and performance metrics. It issued a formal methodology guide in August 2022, piloted it that October at five ports (Virginia; Los Angeles/Long Beach; Tampa; Boston; and Port Hueneme), and expanded to a second phase in June 2023 at the ports of New York/New Jersey and New Orleans. FEMA officials told OIG they don't expect the tool -- called Port-RAM -- to be fully implemented nationwide until 2027, and that once it is, they'll need another three to four years of data before they can actually measure whether the grants are working.

Meanwhile the money keeps moving: the Congressional Research Service⧉ puts PSGP's FY2025 appropriation at $90 million, part of the same $3.6 billion-plus Congress has authorized since 2002 -- all of it, so far, spent on a hypothesis FEMA has never gone back to test.

FEMA agreed with all four of OIG's recommendations -- reconciling the cost-share documentation, fixing the risk-review process, and building a formal plan to eventually measure PSGP's performance -- with target completion dates of August 31, 2026.▸ But as of the report's issuance, OIG considered the most basic of the four, simply communicating cost-share requirements clearly to grant recipients, still open and unresolved. The two agencies also disagreed on something more basic than any finding: OIG's report says FEMA denied it direct, read-only access to FEMA's own financial system during the audit, providing data extracts instead. FEMA's written response disputes the word "denied," saying it judged direct access inappropriate given the system's unrelated sensitive data and that the extracts it provided met the audit's actual scope.