Background In 2017, three major hurricanes made landfall in the United States and historic wildfires struck California. According to FEMA, the 2017 hurricanes and wildfires collectively affected 47 million people—nearly 15 percent of the nation’s population. See figure 1 for a timeline of these major disasters. Overview of Federal Disaster Response and Recovery When disasters hit, state and local entities are typically responsible for disaster response efforts. The Stafford Act establishes a process by which the Governor of the affected state or the Chief Executive of an affected Indian tribal government may request a presidential major disaster declaration to obtain federal assistance. According to the DHS National Response Framework—a guide to how the federal government, states and localities, and other public and private sector institutions should respond to disasters and emergencies—the Secretary of Homeland Security is responsible for ensuring that federal preparedness actions are coordinated to prevent gaps in the federal government’s efforts to respond to all major disasters, among other emergencies. The framework also designates FEMA as the lead agency to coordinate the federal disaster response efforts across 30 federal agencies. The National Response Framework identifies 14 emergency support functions that serve as the federal government’s primary coordinating structure for building, sustaining, and delivering disaster response efforts across more than 30 federal agencies. Each function defines specific mission areas—such as communication, transportation, and energy—and designates a federal department or agency as the coordinating agency. For example, provision of assets and services related to public works and engineering, such as temporary roofing or power, are coordinated by USACE within DOD. See Appendix II for more information about emergency support function responsibilities across the federal government. FEMA’s Response Directorate coordinates disaster response efforts through mission assignments—work orders that it issues to other federal agencies to direct them to utilize their authorities and the resources granted to them under federal law in support of direct assistance to state, local, tribal, and territorial governments. Mission assignments are authorized by the Stafford Act, and agencies may fulfill these assignments through federal contracts. FEMA made 1,515 mission assignments for the 2017 hurricanes and California wildfires, and total obligations for these mission assignments were more than $7.8 billion as of January 2018, according to FEMA. See figure 2 for a depiction of the mission assignment process under a notional scenario of removing derelict marine vessels—boats and ships damaged during a hurricane and that are determined to be inoperable. The National Response Framework states that when an Emergency Support Function is activated in response to an incident, the primary agency for that emergency support function is responsible for executing contracts and procuring goods and services as needed, among other things. For example, DOD and USACE are the coordinators for Emergency Support Function 3—public works and engineering—and as part of this role, these agencies are responsible for emergency contracting support for lifesaving and life-sustaining services. As such, during the 2017 disasters, USACE obligated funds on contracts in support of its assigned mission of public works and engineering by restoring the electrical grid in Puerto Rico following Hurricane Maria and removing debris following the California wildfires. FEMA’s Contracting Workforce In its role as the lead coordinator of federal disaster response efforts across federal agencies, FEMA’s contracting workforce plays a key role in post-disaster contracts. FEMA’s contracting efforts are supported by its contracting workforce within FEMA’s Office of the Chief Procurement Officer (OCPO). In our prior work, we found that FEMA’s contracting workforce had grown significantly since Hurricane Katrina, but the agency struggled with attrition at times. While the majority of FEMA’s contracting workforce is located in headquarters, contracting officers are also located in each of FEMA’s 10 regional offices. See figure 3 for the location of FEMA’s 10 regional offices as well as the states and territories for which each one is responsible in terms of fulfilling National Response Framework duties. In addition, FEMA can deploy members of its Disaster Acquisition Response Team (DART), a group whose primary purpose is to support contract administration for disasters. There are two DART teams under FEMA’s Expeditionary branch, each comprised of contracting officers, contracting specialists, and quality assurance specialists. Figure 4 shows how FEMA’s contracting workforce is organized. In headquarters, FEMA’s contracting officers support a variety of functions, such as contracting for information technology needs, activities to prepare for and mitigate disasters, and disaster response. In the field, the disaster and field operations division manages contracting for disaster response efforts including: Logistics: delivering goods and services to support disaster survivors and communities, including life-sustaining commodities such as meals, blankets, and electricity generators, Response: coordinating capabilities needed immediately following a disaster, such as air and ground evacuation services and emergency sheltering, and Recovery: primarily supporting rebuilding efforts, including technical assistance programs. Regional Contracting Officers Regional contracting officers serve as the first response for contracting if a disaster occurs in their region. During a disaster, the regional offices can request additional contracting support from headquarters if needed. Contracting officers are typically located in each regional office’s mission support division, which provide essential administrative, financial, information technology, and acquisition support for the region. Each region is headed by a Regional Administrator who reports directly to the head of FEMA, the FEMA Administrator. In response to a 2009 DHS Inspector General Report, FEMA created a formal agreement to establish a new role for FEMA’s OCPO to oversee regional contracting staff. The Inspector General report found that regional contracting officers only reported to their respective supervisor in the region—who usually are not contracting officers—with no formal link to FEMA’s OCPO. The Inspector General recommended that only contracting officials should manage the technical performance of contracting officers. The report stated that having the contracting officer’s performance and career advancement controlled by someone who is not a contracting professional was an internal control risk and created a potential conflict-of-interest situation for the contracting officer. A subsequent 2011 agreement between the regions and headquarters states that a FEMA OCPO official will be the contracting officers’ performance reviewer and that the regional supervisors will continue to manage regional contracting officials’ day-to-day activities. As a result, regional contracting officers have a dual reporting chain to both FEMA OCPO in headquarters and to their supervisor within the region. In September 2015, we identified challenges with how the agreement was being implemented, particularly in that it heightened the potential for an environment of competing interests for the regional contracting officers. Specifically, we found that being physically located in a regional office where their regional supervisor is not a contracting professional gave contracting officers less standing to resist requests to perform duties outside of a contracting officer’s responsibilities or to resist pressure from program officials to make certain decisions. Further, we found that FEMA had not updated its 2011 agreement, even though the agreement states that FEMA OCPO and the regions will revisit it each year. We recommended that the FEMA Administrator direct FEMA OCPO and the regional administrators to revisit the 2011 agreement to, among other things, add details about the extent of operational control headquarters and regional supervisors should exercise to minimize potential competing interests experienced by regional contracting officers, and further detail headquarters and regional supervisors’ roles and responsibilities for managing regional contracting officers to improve coordination and communication. We also recommended, and FEMA agreed, that it establish a plan to review this agreement on an annual basis. As of January 2019, FEMA had not implemented these recommendations. Joint Field Offices After a major disaster is declared, FEMA establishes a joint field office, a temporary office through which it coordinates disaster response and recovery efforts with state and local governments and organizations. Once the need for disaster response and recovery ends and a joint field office is closed, the contracts supporting the disaster are returned to the cognizant regional contracting office. Post-Katrina Emergency Management Reform Act Contracting Requirements Congress enacted the Post-Katrina Emergency Management Reform Act of 2006 (PKEMRA) after shortcomings were identified in preparation for and response to Hurricane Katrina—one of the largest and most destructive natural disasters in U.S. history, which hit the Gulf Coast in 2005. PKEMRA included several provisions related to contracting, including: Contracting preference for local vendors. PKEMRA amended the Stafford Act to provide a contracting preference for local vendors. Specifically, for contracts or agreements with private entities, the provisions of the act state, in part: in general, for major disaster assistance activities, agencies shall provide a preference, to the extent feasible and practicable, to organizations, firms, and individuals residing or doing business primarily in the area affected by the major disaster or emergency; they may be set aside for local vendors, which means that only vendors residing or primarily doing business in the declared disaster area are allowed to compete for an award; those not awarded to local vendors shall be justified in writing in the contract file. After the enactment of PKEMRA, changes were made to the FAR to implement provisions regarding the award of set-aside contracts to local vendors. Figure 5 displays the steps a contracting officer must take to implement the preference for awarding post-disaster contracts to a local vendor based on related laws and regulation. Use of noncompetitive contracts using the urgency exception. Agencies are generally required to use full and open competition— achieved when all responsible sources are permitted to compete— when awarding contracts. The Competition in Contracting Act of 1984 recognizes that full and open competition is not feasible in all circumstances and authorizes contracting without full and open competition under certain conditions, such as in cases with an unusual and compelling urgency and the government would be seriously injured unless the agency is permitted to limit the number of sources from which it solicits offers (“urgency exception”). When DHS awards disaster contracts non-competitively based on the urgency exception, PKEMRA, as implemented in the Homeland Security Acquisition Regulation, restricts the period of performance to 150 days, unless the Head of Contracting Activity determines that exceptional circumstances apply. For other uses of the urgency exception, the FAR’s period of performance limit is generally no more than one year. Generally, exceptions to full and open competition must be supported by written justifications that contain sufficient facts and rationale to justify use of the specific exception. Depending on the proposed value of the contract, the justifications require review and approval at successively higher approval levels within the agency. Use of advance contracts. PKEMRA requires FEMA to establish advance contracts, which are typically needed to quickly provide life- sustaining goods and services, such as tarps and meals, in the immediate aftermath of disasters. While not required under PKEMRA, USACE also establishes advance contracts for supplies and services (e.g., generators for its temporary power mission) using its independent statutory authorities for emergency management, such as Section 5 of the Flood Control Act of 1941. In addition, DLA has an interagency agreement with FEMA to provide disaster commodities and services, including fuel. As such, DLA also has some advance contracts in place. In December 2018, we found that FEMA and USACE were the primary users of advance contracts. Federal Agencies Obligated at Least $5 Billion through Post- Disaster Contracts as of June 2018, but More Comprehensive Data on Disaster Contracting Obligations Would Enhance Transparency As of June 30, 2018, federal agencies obligated at least $5 billion through post-disaster contracts to support disaster response and recovery efforts after hurricanes Harvey, Irma, and Maria and the 2017 California wildfires. USACE and FEMA awarded over three quarters of the reported obligations on post-disaster contracts. However, data on post-disaster contracting are not comprehensive due to changes in the criteria for establishing and closing a NIA code and DHS’s inconsistent implementation of the criteria for closing codes. Specifically, we found DHS closed the codes for Hurricanes Harvey and Irma less than a year after the storms hit, compared to prior hurricanes when the NIA codes remained open for at least 5 years. Federal Agencies Obligated at Least $5 Billion through Post- Disaster Contracts for the 2017 Disasters As of June 30, 2018, federal agencies obligated at least $5 billion through post-disaster contracts in response to the three 2017 hurricanes and the California wildfires. Data on obligations for the California wildfires are limited to those contracts identified by two selected agencies in our review—FEMA and USACE—because no NIA code was established in FPDS-NG to track contracts specifically for the wildfire events at a government-wide level. The obligations on post-disaster contracts accounted for more than half of the $9.5 billion in contract obligations on contracts related to the three hurricanes and the 2017 California wildfires, with the remainder of the dollars obligated on advance contracts. See figure 6 for details on post-disaster and advance contract obligations by event. FEMA and USACE accounted for more than three quarters of the total obligations on post-disaster contracts for the three hurricanes. Because there was no NIA code for the 2017 California wildfires, we cannot identify government-wide obligations in FPDS-NG and, therefore, do not know which agencies had the highest contract obligations for the two wildfire events. Figure 7 provides details on known obligations on post-disaster contracts, by agency. About 63 percent of the obligations on post-disaster contracts, or $3.1 billion, was for services. See figure 8 for a breakdown of services and products by 2017 disaster. Five services across the 2017 disasters comprised nearly 80 percent of total obligations for services on post-disaster contracts. Contracts for repair and maintenance services comprised 38 percent of total obligations on post-disaster contracts for services, largely driven by the $1 billion obligated to support the power restoration effort in Puerto Rico following Hurricane Maria. Following Hurricanes Harvey and Irma, agencies primarily awarded post-disaster contracts for management support functions, such as call center services. See figure 9 for the top post- disaster contract services across the three hurricanes and the California wildfires. Of the $1.8 billion agencies obligated on goods through post-disaster contracts, 28 percent was on contracts for subsistence, such as food and water. Nearly 30 percent, or more than $530 million, of all obligations on post-disaster contracts for goods was on contracts for electric wire and power distribution equipment, almost all of which was for the power mission in Puerto Rico following Hurricane Maria. See Figure 10. Across all three hurricanes and the California wildfires, we found that the competition rate—the percentage of total obligations reported under competitive contracts—was about 75 percent for post-disaster contracts. This is an increase from the past since we previously found that the competition rate in the immediate aftermath of Hurricane Katrina was about 53 percent. Contracting for disaster relief and recovery efforts presents unique circumstances in which to solicit, award, and administer contracts. Under the FAR, agencies are generally required to use full and open competition when soliciting offers, with some exceptions. As discussed earlier, an agency may award a contract without full and open competition, for example when the need for goods and services is of such an unusual and compelling urgency that the federal government faces the risk of serious financial or other type of loss, unless the agency is permitted to limit the number of sources from which it solicits offers (“urgency exception”). When using the urgency exception, the FAR requires agencies to request offers from as many potential sources as practicable. Based on FPDS-NG data, we found that about 47 percent of obligations on post-disaster contracts were on contracts citing the urgency exception, with 63 percent of those obligations on contracts coded in FPDS-NG as using “limited competition.” Among our selected contracts, we also found that contracting officers implemented the urgency exception to seek offers from as many sources as possible in different ways. Of the 11 contracts in our sample that cited the urgency exception, five included abbreviated award time frames in the justification documentation. More Comprehensive Data Could Provide Increased Transparency on Disaster Contracting The full extent of disaster contracting—for both advance and post- disaster contracts—related to the 2017 disasters is unknown due to changes in the criteria for establishing and closing a NIA code in FPDS- NG and DHS’s inconsistent implementation of the updated criteria for closing codes. The NIA code data element in FPDS-NG was established following landfall of several major hurricanes in 2005 to enable consistent tracking of emergency or contingency-related contracting. Contracting officers select the applicable NIA code in FPDS-NG when entering related contract information into the system. Officials at GSA—the agency responsible for operating and maintaining FPDS-NG—stated there is little to no cost or administrative burden associated with establishing or maintaining a NIA code. Based on a memorandum of agreement (the agreement), GSA, DHS, and DOD are jointly responsible for determining when a NIA code should be established and closed. DHS delegated its role, on behalf of civilian agencies for disaster or emergency events, to its Office of the Chief Procurement Officer (DHS OCPO), and DOD, on behalf of military departments and defense agencies for contingency operations, delegated its role to the Defense Contract and Pricing office. The agreement outlines criteria DHS and DOD should consider in making determinations to establish and close a NIA code. We identified changes in the criteria for establishing and closing a NIA code between a June 2012 agreement and a June 2018 update that superseded and replaced it. According to DHS OCPO officials, the agencies updated the agreement to incorporate lessons learned (such as adding that events should have a procurement impact as criteria for establishing a NIA code), and because it had not been revisited in 6 years. See table 2 for criteria from the agreements, changes in 2018, and examples of potential implications of those changes that we identified related to emergency or disaster events. The June 8, 2012 agreement criteria applied to the establishment of NIA codes for the 2017 disasters, while the June 1, 2018 updates applied to determinations to close or extend the NIA codes after this date for the 2017 disasters. DHS OCPO requested that a NIA code be established for each of the 2017 major hurricanes (Harvey, Irma, and Maria). However, the codes for Harvey and Irma closed on June 30, 2018, less than a full year after the hurricanes hit. The code for Maria was scheduled to close on December 15, 2018, and in August 2018 we began raising questions about the planned or actual NIA code closures for the three 2017 hurricanes. Since December 2018, DHS OCPO provided two additional extensions for Maria, with the code now valid through June 15, 2019, about 21 months after that hurricane made landfall. In contrast, the NIA code for Hurricane Sandy, which made landfall in October 2012, remained open until December 2017, more than 5 years after the disaster. The NIA code for Hurricane Katrina, which made landfall in August 2005, remained open until August 2018, 13 years after the disaster. We observed that DHS OCPO requested NIA codes for Hurricanes Florence and Michael in 2018, although we did not review the data associated with those events. After we sent this report to the agencies for comment on February 15, 2019, the agencies allowed the codes for Florence and Michael to expire, on March 15, 2019 and April 12, 2019, respectively. DHS OCPO officials offered several different rationales to support their decision to close the NIA codes for the 2017 hurricanes and cited the changes to the criteria in the 2018 agreement for closing the codes. However, we found that these rationales were inconsistent with the criteria in the agreement, did not consider key user needs, and did not fully explain the decisions to close these codes. For example: DHS OCPO officials told us that NIA codes for disasters should be closed when agencies no longer use the special emergency procurement authority such that the procurement thresholds—such as the simplified acquisition and micro purchase thresholds—return to the general (non-emergency) procurement thresholds in the FAR. Further, when FEMA requested to keep the codes open, DHS OCPO questioned why agencies would need to continue tracking with a NIA code after the thresholds had returned to general procurement thresholds. DHS officials stated that the updated agreement put an emphasis on this criterion; however, our analysis indicated that was not consistent with 2018 agreement, which includes multiple criteria and is not limited to this factor. Further, the agreement does not provide additional emphasis on one criterion over others. DHS OCPO officials stated that the purpose of the NIA code is to track federal procurement related to response, not recovery efforts. However, both the 2012 and 2018 agreements specifically state that the NIA code is intended to track disaster response and recovery efforts. Further, according to the National Response Framework and National Disaster Recovery Framework, we found that there are no clear lines of distinction between the start and end date of these two efforts, and often these stages of the process overlap. Additionally, FEMA officials from the Recovery Support Function Leadership Group’s Program Management Office stated that they use the NIA code to track government-wide contracting related to recovery efforts. The Recovery Support Function Leadership Group, an interagency body chaired by FEMA, tasked the Program Management Office with providing accountability and transparency of projects and outcomes for the 2017 disasters, among other things. DHS OCPO officials pointed to the Digital Accountability and Transparency Act of 2014 as providing alternatives to FPDS-NG. The Digital Accountability and Transparency Act of 2014 required improvements in the quality of data on federal spending, including disaster spending, by making data more accessible and transparent, such as by improving the quality of data submitted by federal agencies to USASpending—an online tool that tracks federal grant, loan, contract, and other awards. However, we found that USASpending provided some information on contract obligations using disaster response and recovery funds but does not separate obligations by disaster event. Further, our prior work on the Digital Accountability and Transparency Act of 2014 has found limitations with the data agencies provide, notably the completeness and accuracy of data. Specifically, we found that agencies routinely provided award descriptions in an abbreviated way and lacked clarity needed to compare data across the federal government. Moreover, we found inconsistencies in agencies’ ability to track contract actions by disaster. While FEMA has the capacity to provide contract information by disaster through a centralized contract tracking tool, USACE officials stated that they use a decentralized tracking process where they reach out to the districts and centers to identify and track disaster contracts without a NIA code. Prior to the June 30, 2018 decision to close the NIA codes for Harvey and Irma, DHS OCPO officials told us they found that the number of actions FEMA was making for these events had decreased. Our analysis of the NIA codes showed that components across ten departments, including within DHS and DOD, were executing contracts related to Harvey and Irma in June 2018. When we requested supporting documentation and analysis, DHS OCPO officials provided some correspondence with FEMA but did not provide government-wide data analysis to identify what other agencies were awarding and executing contracts related to these events. DHS OCPO officials stated they also sought input from DOD through the Defense Pricing and Contracting Office on whether to keep the codes open. According to DHS officials, DOD deferred to DHS on the decision because DHS was responsible for establishing the codes. Further, DOD officials did not provide evidence that would allow us to determine whether they assessed which defense components were executing contracts related to these events or sought the input of the components that were doing so, such as USACE and the Navy. FPDS-NG—a public, government-wide database of federal procurements—offers a resource the federal government can use to create recurring and special reports for key users, such as the President, Congress, executive agencies, and the general public. The NIA code in FPDS-NG provides consistent tracking and government-wide visibility into contracting related to disaster events through a publicly available database. Without clear criteria for establishing and closing NIA codes that consider the needs of data providers and users, such as FEMA, and the high visibility of the event being tracked and a mechanism to ensure consistent implementation of these criteria, insight into disaster contracting may be limited. Additionally, federal internal control standards state that management should use quality information, communicate quality information internally, and communicate quality information externally to achieve objectives. Management should accomplish this by considering appropriate methods for communicating externally, such as to the President, Congress, and the general public. As noted above, the 2018 agreement no longer includes the 2012 criteria that a NIA code can be closed if the NIA no longer has high visibility and there is no other interest in the NIA code. In our discussions with officials, DHS OCPO could not provide a rationale for these changes and the rationale is also not included in the updated agreement. Prior to DHS OCPO’s decision to close the codes for Hurricanes Harvey and Irma, a senior FEMA procurement official requested that they remain open, in part because of the high visibility of these events. As such, this official stated that there will be continued interest in the 2017 hurricanes including inquiries from Congress, which will require agency officials to pull data for interested parties, as that data can no longer be tracked and identified through public databases, such as FPDS-NG and USASpending. DHS OCPO officials denied FEMA’s request, pointing to the criteria in the 2018 agreement, which does not include consideration of the visibility of the event or key user needs. As the federal agency responsible for coordinating disaster response and recovery, FEMA is well positioned to understand the level of national and political interest in tracking procurement information for a disaster or emergency event. Yet, it is unclear why neither the 2012 nor the updated 2018 agreements included a role for or consideration of key users, such as FEMA and Congress. Further, as noted above, FEMA program officials expressed concern over closing the Harvey and Irma codes because they had planned to use the codes to assess recovery efforts for the 2017 disasters. As we have previously reported, it can take years to fully account for federal contract obligations related to response and recovery after a hurricane. Once a NIA code is closed, there is no publicly available, government-wide system to track contract obligations for specific events. Moreover, DHS OCPO officials were unable to provide data analysis conducted using available data from prior events to determine historical patterns in federal contracting obligations for disasters prior to closing the codes for Hurricanes Harvey and Irma. Figure 11 illustrates the lack of insight we have into disaster contracting activities related to the 2017 hurricanes, in comparison to what we know about prior storms with high federal procurement obligations. Further, using the description field in FPDS-NG, we found that between July 1 and September 30, 2018, after the NIA codes were closed, agencies obligated at least $136 million on contracts for Hurricane Harvey and $123 million on contracts for Hurricane Irma. While this provides some important insights regarding the continued contracting activity related to these hurricanes, the description field in FPDS-NG cannot be relied on to provide a full picture. Some agencies may include event- specific information in the description field; however, we found that, for the 2017 hurricanes, about 65 percent of contract obligations linked to a NIA code did not include event-specific information in the description. Without reopening the NIA codes for Hurricanes Harvey and Irma, and, to the extent practicable, retroactively populating the NIA codes for contract actions supporting response and recovery for these hurricanes during the period they were closed, decision makers are missing important information to understand the procurement impact of these disasters. Retroactively entering NIA code information is not unprecedented. For example, based on our analysis, the NIA codes for the 2005 hurricanes were established in October 2005, and contracting officers retroactively entered data for contracts related to these events which occurred as early as August of that year to enable full insight into contracting for these disasters. Challenges in Planning Post- Disaster Contracts Hindered Response and Recovery Efforts Based on the contracts we reviewed and officials we spoke with responsible for the planning of these contracts, we found that agencies experienced challenges planning for post-disaster contracts, especially when it came to contracting with local vendors. Additionally, FEMA also experienced challenges with requirements development—in that program officials did not always provide well-defined or sufficiently specific requirements for post-disaster contracts. However, FEMA has taken steps to address its challenges with requirements development, but it is too soon to tell the extent to which these steps will address the challenges we identified. Agencies We Reviewed Experienced Challenges Contracting with Local Vendors Steps to Implement Local Vendor Preference, as Outlined in the Post-Katrina Emergency Management Reform Act and the Federal Acquisition Regulation (FAR) Step 1: Identify the set-aside area in accordance with FAR § 26.202-1—Local Area Set-Aside and § 6.208—Set-asides for Local Firms During a Major Disaster or Emergency Step 2: Conduct market research to determine whether there are qualified vendors in the set-aside area. Step 3: Issue a solicitation that provides for local vendor preference to the extent feasible and practicable either through the use of a set-aside or an evaluation preference. Step 4: Review offers based on evaluation criteria in the solicitation. If using a local area set-aside, review information from potential vendors to determine if they reside or primarily do business in the set-aside area in accordance with FAR § 52.226-3—Disaster or Emergency Area Representation. Step 5: Award contract to qualified vendor. If the vendor selected is not local or no qualified vendors are in the set-aside area, justify the decision in writing. determine that a vendor resides or primarily does business in the local justify in writing awards that they made to vendors outside the set- aside area. Some Officials We Interviewed Were Not Consistently Aware of the Regulatory Definition of Local Area For the contracts we reviewed, contracting officials at FEMA correctly identified the local area for six set-aside contracts across the three hurricanes, and USACE correctly identified the local area for two set- aside contracts in Puerto Rico. However, based on the interviews we conducted during our review, USACE contracting officials were not consistently aware of the specific regulation for doing so and did not correctly identify the local area for two other USACE contracts awarded in support of the California wildfires. When awarding a local area set-aside or using an evaluation preference for local vendors, FAR § 26.202-1 states that a major disaster area can span several counties in several contiguous states, but need not include all the counties in the disaster area, and cannot extend beyond the counties designated in a Presidential disaster declaration. Figure 12 provides an example of a disaster declaration that depicts which counties could be included in the set-aside area. For all six local area set-aside FEMA contracts—awarded in response to Hurricanes Harvey, Irma, and Maria—we reviewed, FEMA officials defined the local area in accordance with regulation. This was an improvement from what we previously found. Specifically, in 2015, we found that FEMA contracting officers were confused about the definition of the set-aside area and recommended that the FEMA Administrator provide new or updated guidance to ensure all contracting officers are aware of requirements concerning contracting with local vendors, among other things. DHS concurred, and FEMA updated its annual disaster contracting webinar training to reiterate the requirement and clarify how to determine the geographic area using the disaster declaration. For the two local area set-aside USACE contracts awarded, officials responsible for those contracts told us that when awarding these contracts, they were not aware of the regulatory requirements for defining the geographic area of the local area set-aside. However, as the presidential disaster declaration for Hurricane Maria included the entire island of Puerto Rico, the local set-aside area covered the entire island. As a result, officials met the set-aside area requirement in accordance with regulation, even though they noted that they were not familiar with the requirement at the time. Officials told us they became aware of the regulation after conducting research pursuant to a protest related to the use of local vendor preference. We also reviewed two other USACE contracts that were used to support the debris removal mission following the California wildfires. Contracting officials stated that they conducted market research on the availability of local contractors, and they ultimately did not find qualified local firms. However, based on a review of contract file documentation, we found that USACE officials did not identify the local area in accordance with regulation for these contracts. Instead they used congressional districts that overlapped with impacted areas to identify the local area. We found that the areas USACE identified included areas outside of the geographic area defined by the presidential disaster declaration for the California wildfires. Contracting officials responsible for these debris removal contracts stated they were not aware of a policy or regulation for how to identify the geographic area for a local area set-aside, but that their office had internally determined the use of congressional districts impacted by a disaster to be the preferred method. A senior USACE official told us that there is no agency supplemental guidance or related training regarding the use of local vendor preference for contracts supporting disaster recovery and response, only that they expect USACE contracting officials to comply with the FAR. Without additional guidance or related training, contracting officers may be unaware of how to define the geographic area for a local area-set aside in accordance with regulation and may miss opportunities to support improving the local economies of disaster impacted areas by giving preference in awarding contracts to local vendors to the extent feasible and practicable, per the Stafford Act. Regulation for Determining Whether a Vendor Resides or Primarily Does Business in the Set-Aside Area Presents Challenges Despite contracting officers having a high degree of discretion to determine that an offeror qualifies as a “local firm,”—that is, a firm that resides or primarily does business in the designated set-aside area— contracting and legal officials at both FEMA and USACE told us they were unsure what or how much information is sufficient to determine that an offeror qualifies as a local firm under the FAR. After contracting officials have identified the geographic boundaries of the local “major disaster or emergency area” and included required clauses in the solicitation and issued it as a local area set-aside, offerors must represent in their offer that they reside or primarily do business in the set-aside area. Specifically, FAR § 52.226-3(c) outlines two criteria a contracting officer should use to determine whether an offeror is to be considered “local.” If an offeror does not meet these first two criteria, FAR § 52.226- 3(d) provides eight additional criteria contracting officers may consider to make this determination (see sidebar). under FAR § 52.226-3(c) An offeror is considered to reside or primarily do business in the set-aside area if, during the last 12 months, 1) the offeror had its main operating office in the area; and 2) that office generated at least half of the offeror’s gross revenues and employed at least half of the offeror’s permanent employees. If the offeror does not meet the criteria under FAR § 52.226-3(c) consider other factors listed in FAR § 52.226-3(d) including: 1) Physical location(s) of the offeror’s permanent office(s) and date any office in the set-aside area(s) was established; 2) Current state licenses; 3) Record of past work in the set-aside area(s); 4) Contractual history the offeror has had with subcontractors and/or suppliers in the set-aside area; 5) Percentage of the offeror’s gross revenues attributable to work performed in the set-aside area; 6) Number of permanent employees the offeror employs in the set-aside area; 7) Membership in local and state organizations in the set-aside area; and 8) Other evidence that establishes the offeror resides or primarily does business in the set-aside area. Of the eight local area set-aside contracts we reviewed, two were impacted by bid protests—which is when an offeror challenges an award or proposed award of a contract or a solicitation—related to the FAR criteria for determining that an offeror qualifies as a local firm. The following protests show examples of the criteria agencies reviewed to determine whether a firm resided or primarily did business in a set-aside area. FEMA contract for food: In a protest of the award of a contract for food on the basis that FEMA improperly determined the protester failed to meet the requirements in FAR§ 52.226-3(d), the protester stated it met the requirements of FAR § 52.226-3(d), because it had (1) done past work in the set-aside area; (2) maintained a warehouse in the set-aside area; (3) maintained a contractual history with subcontractors in the set-aside area; and (4) maintained a current state license and filed a franchise tax return. FEMA denied, the protest stating that the evidence the protester provided was not sufficient to qualify as “residing or primarily doing business” in the local area. USACE Blue Roof contract: To support the Blue Roof mission— which provides temporary blue plastic roofs for disaster-impacted residences to prevent further damage and allow homeowners to arrange for permanent repairs—following Hurricane Maria in Puerto Rico, contracting officials awarded two post-disaster contracts. In a protest of the awards filed with GAO, the protestor argued, among other things, that one of the awardees did not meet local firm criteria in FAR § 52.226-3(c). USACE had assessed information on the awardee, including its local business address in the System of Award Management and other documentation of prior work in Puerto Rico, prior to award and determined that the awardee met Stafford Act criteria for award to a local vendor. USACE officials told us that, after the protest was filed, they further assessed information on the awardee in question and determined that it was a subsidiary of a larger national company. According to USACE officials, in order to quickly continue work on the Blue Roof mission, which had increased in scale, USACE negotiated pricing with the protestor while the protest was ongoing and made a third award under the solicitation. The protestor withdrew the protest. Contracting and legal officials at FEMA and USACE described difficulty in determining whether a vendor resides or primarily does business in the local set-aside area and cited a lack of clarity and different interpretations of the FAR. Based on conversations with the agencies’ legal officials, we found that USACE and FEMA applied the eight criteria in FAR § 52.226- 3(d) differently. FEMA officials told us that in determining whether a firm is local, if the first two criteria are not met, they evaluate an offeror’s information related to the eight criteria in FAR §52.226-3(d) to see if the first two criteria can be met with this additional information. They added that they look to see if the firm’s main operating office is in the set-aside area and if that office generated at least half of the offeror’s gross revenues and employed at least half of its permanent employees, but stated that the eight criteria do not need to be met within the last 12 months. Alternatively, USACE officials told us that in determining if a firm is local, if the first two criteria are not met, they evaluate an offeror’s information against the eight criteria in FAR § 52.226-3(d) independent of the two criteria described under FAR § 52.226-3(c). Legal officials at both USACE and FEMA stated that the FAR criteria should be clarified. Further, agencies’ varying application of the criteria increases the risk that an offeror may be considered local by some agencies, but not others. FEMA legal officials told us that contracting officers have been instructed to ask offerors for information on a local firm status in post-disaster solicitations. USACE legal officials explained that it is not always clear what specific information or documents provide the necessary information to meet the criteria under FAR § 52.226-3. For example, it may not be clear what documentation adequately demonstrates the number of permanent employees the offeror employs in the set-aside area, or the percentage of the offeror’s gross revenue earned in the set-aside area. The Office of Federal Procurement Policy provides overall direction of government-wide procurement policies, regulations, procedures, and forms for executive agencies. However, Office of Federal Procurement Policy staff told us that they have not provided additional guidance or clarification related to this FAR clause. Federal internal control standards state that management should use quality information to achieve objectives. Management should accomplish this by identifying information requirements, collecting relevant data from reliable sources, and processing data into quality information to be communicated internally and externally. Without clarifying guidance, contracting and legal officials will likely continue to have varying interpretations on how to implement the FAR criteria for determining that an offeror qualifies as a local firm. Some Agencies We Reviewed Did Not Consistently Write Justifications for the Use of Non-Local Vendors When contracts for major disaster or emergency assistance activities are not awarded to local vendors, the Stafford Act, as implemented in the FAR, requires that the decision be justified in writing in the contract file. Contracting officers at three of the four agencies included in our review— FEMA, USACE, and the Coast Guard—did not consistently justify in writing the award of selected contracts to non-local vendors. Specifically, 12 of the 14 contracts in our review that were not awarded to local vendors did not contain the required written justifications in the files (see table 3). DLA included written justifications for the use of non-local vendors, as required. After the 2017 disasters, FEMA identified the absence of justifications for the use of non-local vendors as an area for improvement. According to FEMA officials, they subsequently released guidance and a pre-solicitation memorandum to assist contracting officers in identifying what documentation related to local vendor preference is required in a contract file. FEMA officials told us they expect these steps will improve compliance with the requirement to document the justification for using non-local vendors going forward. While the Coast Guard provided a memorandum ahead of the 2017 disaster response that addressed the use of local vendors, it did not reference the requirement under the Stafford Act, as implemented in the FAR, to justify in writing the use of non-local vendors. A senior USACE official told us the agency had not issued any guidance to address requirements for contracting with local vendors and was not aware of any guidance issued at the department level. USACE legal officials noted the lack of written justification may be due to abbreviated timeframes under which post-disaster contracts are awarded. However, we found that USACE contracts included consolidated justification documents outlining rationales for the use of limited competition or abbreviated solicitation timeframes, but they did not include justifications for the use of non-local vendors. Without additional guidance or tools, contracting officials may not be aware that they are required to include written justifications for the use of non-local vendors in contract files, and federal agencies are at risk of not complying with the Stafford Act requirement to do so. FEMA Has Begun to Address Challenge with Requirements Development for Post- Disaster Contracts Contracting officers responsible for the FEMA contracts we selected and senior procurement officials stated that during disaster response they received post-disaster requirements packages that were lacking in technical specificity or were otherwise deficient, but FEMA has begun to address this challenge. Program officials communicate contract requirements to contracting officers through requirements documents that include, among other items, a statement of work describing goods or services to be provided by an offeror, market research, and an independent government cost estimate. Contracting officials explained that when they received deficient documents, they had to conduct additional work to refine the requirements before soliciting for the contract—such as spending time assisting program officials to develop the required documentation. This additional work may add time to already tight award time frames for post-disaster contracts. When compared to large dollar value acquisitions, post-disaster contracts are awarded on significantly abbreviated time frames. For example, among the 12 FEMA contracts we assessed, time frames between the submission of a resource request and award date ranged from 1-26 days. This is faster than suggested; FEMA’s Procurement Administrative Lead Time guidance suggests preparation time frames of 60-300 days for new procurements based on the nature and value of an action. We found instances where FEMA program offices provided inaccurate or untimely estimates of the quantities of goods or services needed for the contracts we reviewed, in some cases leading to additional time and efforts spent to meet the need. For example: After Hurricane Harvey, FEMA awarded contracts to supply a food bank. Officials told us the initial requirement from the food bank through the program office to the contracting officer was expressed in terms of “truck loads” but did not specify, for example, how large the truck should be, or how many pallets should be loaded per truck. FEMA ultimately awarded three contracts to meet the post-disaster need—the first contract had a period of performance of 4 days and, according to FEMA officials, was intended to meet initial needs for food while the program and contracting officials determined the full scope of the requirement. The second contract—a $37 million contract with a period of performance of 52 days—was intended to fulfill the remaining requirement. However, due to miscommunication of the requirement as documented in the contract files and according to a program official responsible for the contracts, FEMA needed to award a third contract for an additional 2.5 months and $23 million to meet the need. Due to the value of the contracts, FEMA deemed that the subsequent contract required a new solicitation and award, rather than a modification to the existing contracts, thereby increasing the time and effort required of procurement personnel to meet the post- disaster need for food. In response to Hurricane Maria, FEMA awarded four post-disaster contracts for self-help tarps—which are used to cover small areas of roof damage. Of these contracts, two were terminated for convenience, both of which were included in our sample. The terminations were due in part to a national supply shortage. FEMA officials told us that under one of the contracts included in our review, at the request of the Commonwealth of Puerto Rico through program officials, FEMA ordered 500,000 40-foot-by-40-foot tarps, which differ from the size of the tarps normally ordered and stocked by the agency. Due to the supply shortage, FEMA received none, but officials noted that the impact of not receiving the tarps was minimal because the agency had initially overestimated the total number of tarps needed. Since the 2017 disasters, FEMA has started to address the issues with requirements development. Specifically, in 2018, FEMA officials told us the agency used portfolio managers in the field to assist with developing requirements for disaster response. Previously, in 2017, portfolio managers told us they supported the National Response Coordination Center but did not deploy to the disasters. Organizationally housed within FEMA’s OCPO, portfolio managers we spoke with told us they provide general templates for and guidance on acquisition documents for program officials to use and are primarily responsible for supporting steady-state acquisitions included in FEMA’s Master Acquisition Planning Schedule. Additionally, portfolio managers told us they provide informal, optional, “brown bag” training sessions for program officials. FEMA OCPO officials told us that they receive more requests for portfolio manager assistance than they can support, as the portfolio management section only maintains up to six staff. FEMA OCPO officials noted, however, that the agency expected to award an acquisition support contract to expand portfolio management capabilities. While the use of portfolio managers is an important step, it is too soon to tell the extent to which the use of portfolio managers in the field will address FEMA’s challenges with requirements development for post-disaster contracts. Agencies in Our Review Have Identified Some Lessons Learned in Disaster Response, but Interagency Contracting Coordination and FEMA Workforce Challenges Remain The agencies we reviewed each have a process for identifying lessons learned following a disaster, and we found they used these processes for the 2017 disasters. While agencies have identified actions they plan to take in response to the lessons they found following the 2017 disasters, additional challenges remain. Specifically, the agencies in our review encountered interagency contracting coordination challenges during the mission assignment process. Further, FEMA identified disaster contracting workforce shortages. Selected Agencies Have Processes for Identifying Lessons Learned FEMA, USACE, Coast Guard, and DLA each have processes for identifying lessons learned within their agencies through after-action reports. These reports identify lessons learned and areas for improvement and may be completed following a training exercise or a real-world event. Through these processes, agencies identified lessons learned during the 2017 disasters. Table 4 lays out each agency’s practice or requirement for identifying lessons learned and key findings— those related to contracting and mission assignments during the 2017 disasters. FEMA Established Interagency Lessons Learned Group but the Coast Guard and USACE Could Enhance Information Sharing FEMA has also taken steps to identify interagency lessons learned by leading the Emergency Support Function Leadership Group and developing a mechanism to regularly report to the Secretary of Homeland Security. This group consists of the national emergency support function coordinators from each of the functions (such as transportation and firefighting), along with FEMA headquarters and regional officials. This body of senior officials is tasked with coordinating responsibilities and resolving operational and preparedness issues relating to interagency response activities in support of the National Response Framework. According to its charter, the group is required to carry out post-incident and after-exercise critiques, and perform substantive reviews of after- action reports, with recommendations for federal interagency partners to address shortfalls. Following the 2017 disasters, in May 2018, the Emergency Support Function Leadership Group identified 19 corrective actions, including improvements to mission assignment submission documents. Federal internal control standards state that communicating internally is key to an entity achieving its objectives. Further, as part of this communication, management should receive quality information about the entity’s operational processes that flows up the reporting lines from personnel to help management achieve the entity’s objectives. FEMA officials stated that there are processes, such as data calls, in place to solicit input from agencies. However, we noted, and FEMA officials agreed, that there is no formal reporting mechanism to the leadership group, and that it is up to the representatives from these agencies to raise issues for the group’s consideration. However, this is not consistently happening within the Coast Guard because it does not have a formal reporting process for soliciting input from officials directly involved in responding to these disasters to share with the Emergency Support Function Leadership Group. Coast Guard officials stated that they actively collect input during and immediately after an event or incident response, and that Coast Guard responders are able to provide input and issues through their chain of command at any time, but there is no formal process for reporting to the interagency group. During the course of our review, USACE officials did not provide information that indicated they had a formal reporting process for soliciting input from officials directly involved in responding to these disasters to share with the Emergency Support Function Leadership Group. Some senior level USACE officials responsible for the agency’s public works and engineering mission stated that they were unsure of the process for raising concerns to the Emergency Support Function Leadership Group and that officials were sometimes hesitant to raise issues to the group. However, in response to our draft report, USACE stated it has a formal process called the USACE Remedial Action Program for soliciting input from officials directly involved in the agency’s response and recovery following a disaster. As discussed later, we will follow up with USACE as part of our recommendation follow-up process. While Emergency Support Function Leadership Group member agencies may raise issues to the group, additional opportunities exist within these agencies to enhance the lines of communication from responders to the senior officials that comprise this leadership group. For example, some of the interagency challenges we identified in our review were not identified by this group, such as challenges in managing state and local expectations of federal response, which is discussed in more detail below. Also, USACE officials told us that some of the interagency challenges they cited following the 2017 disasters related to the mission assignment process were still present during the response to Hurricane Florence, which struck the Carolina coast in 2018. Formal processes for Emergency Support Function agencies—such as the Coast Guard and USACE—to solicit and share input from officials directly involved in the response and recovery efforts would help ensure the Emergency Support Function Leadership Group does not miss additional opportunities to improve disaster response. Interagency Contracting Coordination Challenges within the Mission Assignment Process Remain As the federal disaster coordinator, FEMA obtains requirements from states and localities and tasks the appropriate federal agencies, based on their emergency support function, through the mission assignment process. The agency assigned to a specific mission is then responsible for fulfilling those requirements, and may use contracts to do so. For example, the Coast Guard fulfills its pollution mitigation mission by executing contracts, and utilizes its own workforce to execute its search and rescue mission. USACE officials we spoke with raised concerns about the mission assignment process for the debris removal and power restoration missions related to the 2017 disasters. Specifically, USACE officials noted concerns about coordination between state, local, and federal partners for the contracts we reviewed. USACE debris removal mission: In December 2018, we found that USACE and California state officials reported different expectations related to USACE’s debris removal contracts following the wildfires, such as what structures would be removed from private properties and what levels of soil contamination would be acceptable. USACE removed more than 2.2 million tons of debris from more than 4,500 properties following the northern California wildfires. Due to the size and scope of this mission, USACE used both its advance contracts and additional post-disaster contracts for debris removal. According to USACE officials, they relied on FEMA, the lead for coordinating federal disaster response, to manage communication with states and localities and to identify and manage expectations about the scope of work to be performed using their debris removal contracts. USACE officials cited challenges with communicating to state and local officials what the agency was permitted to do under its mission assignment. For example, USACE officials told us that local officials believed that USACE would replace soil removed as part of its debris removal efforts; however, this was not part of the mission assignment from FEMA. Further, officials added that different environmental standards created confusion regarding what types of soil should be removed. For example, Napa County officials said that USACE’s mission required them to ensure that no contaminated soil remained on the properties, without regard for the naturally occurring levels of arsenic and asbestos in Napa area soil. As a result, Napa County officials said that USACE removed more soil than was necessary. However, following discussions with Napa County officials, USACE obtained site-specific samples from some properties to understand pre-existing contamination levels prior to further debris removal. USACE power restoration mission: Hurricane Maria destroyed much of the electricity grid in Puerto Rico, leaving millions without power and resulting in the longest blackout in U.S. history. To restore power to its 3.3 million people, Puerto Rico requested federal assistance with its power grid. To coordinate this effort across all stakeholders, FEMA established a unified command structure—which included the federal agencies, the Puerto Rican government and its contractors, and utility companies providing mutual assistance. According to FEMA officials, this structure allowed stakeholders to target priority work, ensure crews could access the work areas, and identify the needed materials. USACE officials stated that they received direction from FEMA and had limited direct interaction with Puerto Rican officials. However, despite this structure, USACE officials noted that changing direction from FEMA contributed to inefficiencies in contract management. For example, the scope of power restoration work Puerto Rico was requesting changed several times—such as from transmission work to distribution. These changes necessitated adjustments in contractor workforce configurations and contributed to idle time and equipment, according to officials. FEMA’s mission assignment policy designates a Federal Disaster Recovery Coordinator as the person responsible for facilitating disaster recovery coordination and collaboration among federal, state, local, tribal, and territorial governments; the private sector; and voluntary, faith-based, and community organizations. However, neither FEMA’s mission assignment policy nor its guide—which provides guidance on how to open and close mission assignments—provide additional details on how that coordination is to take place. Further, FEMA’s Response Directorate—the office that oversees the mission assignment process— was unable to identify at what level this coordination should occur. USACE and Coast Guard officials also noted that the mission assignment process does not account for other contracting considerations, such as demobilization, which occurs when contractor personnel leave the work site and return to their headquarters. According to USACE and Coast Guard officials, demobilization is required to be completed by the end of the contract’s period of performance; therefore, contracting officers need to know when the mission will end so that they can build adequate time for demobilization into the contract. Coast Guard pollution mitigation mission: Under this mission, the Coast Guard is responsible for responding to threats to public health, welfare, or the environment caused by actual or potential oil and hazardous materials incidents. Coast Guard officials told us that mission timing and the length of requirements were not communicated by FEMA in a timely manner. They told us that they contacted FEMA multiple times to determine if its mission assignment would be continued, but they did not receive an answer until shortly before the end of a contract’s period of performance. As a result, officials told us they were unsure whether they would need to demobilize contractors before completing the work, which created uncertainty about the availability of subcontractors. A FEMA Response Directorate official stated that these issues are coordination and planning concerns that should be worked out in advance between FEMA and the mission assigned agency. Ultimately, FEMA extended the Coast Guard’s mission assignment for pollution mitigation following Hurricane Maria four times. Figure 13 depicts the number of times Coast Guard’s mission was extended by FEMA. USACE power restoration mission: USACE officials cited similar challenges during the power restoration mission in Puerto Rico following Hurricane Maria. For example, USACE officials stated they typically begin planning for demobilization as soon as a mission begins. However, in this instance, officials did not know the eventual end date in order to plan for demobilization activities. Officials added that demobilization may take about 30 days, but USACE cannot extend contracts or obligate funds without a FEMA mission assignment extension. For example, if the mission assignment is scheduled to end on June 30, contracting officials would need to direct the contractor to begin demobilization as early as May 31. Officials stated that a mission assignment extension or option period of 30 days beyond the anticipated mission end date would facilitate demobilization and reduce any undue burden or concern around demobilization efforts. FEMA’s mission assignment guide does not provide a process or mechanism to follow up on the status of a mission once it is assigned. A FEMA official stated that the Response Directorate is responsible for informing their leadership of expiring mission assignments and contacting the mission-assigned agency to make them aware of the impending expiration, but that there is no standard time frame for doing so. Further, the official stated that, in some cases, FEMA may be performing this work a few days before a mission is set to expire. However, officials at USACE and Coast Guard told us they are dependent upon FEMA to reissue, clarify, or extend mission assignments. Further, the FEMA official told us that contracting considerations—such as the time needed for a contractor to mobilize and demobilize—are not necessarily built into the period of performance of a mission assignment. FEMA identified issues related to the mission assignment process, both during the 2017 disasters and following Hurricane Sandy in 2012. For example, in its 2013 Hurricane Sandy After-Action Report, FEMA found that the mission assignment process was not optimally set up to quickly surge resources to the field in a large-scale incident. To address these challenges, FEMA convened an Executive Steering Committee to update the mission assignment process, among other actions, and subsequently updated its mission assignment policy in 2015. Following the 2017 disasters, the Emergency Support Function Leadership Group identified challenges related to the mission assignment process and made recommendations to: (1) ensure response officials are properly trained on their department or agency’s statutory authorities and FEMA’s mission assignment process, and (2) develop specific recommendations to the FEMA Response Directorate on ways to reform mission assignment submission documents. These recommendations have been assigned to working groups within the Emergency Support Function Leadership Group, which plans to track the status until they are implemented. While these actions may improve the mission assignment process, they do not specifically address the issues we identified related to coordination and contracting. While the emergency support functions lay out agencies’ general responsibilities, agencies are dependent upon FEMA’s mission assignment process to further define how to perform their roles. Federal internal control standards state that management should implement control activities through its policies. These control activities include periodically reviewing policies, procedures, and related control activities for continued relevance and effectiveness in achieving the entity’s objectives or addressing related risks. Further, these standards also state that communicating internally and externally are key to achieving an entity’s objectives. As part of its internal controls, entities should evaluate the methods to communicate quality information throughout and outside of the entity on a timely basis. While FEMA revised its mission assignment guide in 2017, it still does not require FEMA to lay out coordination responsibilities in detail when assigning a mission. Without a mission assignment policy and related guidance that better incorporates contracting considerations, such as demobilization, and requires FEMA to clearly define coordination responsibilities with federal, state, and local stakeholders during the mission assignment process, federal agencies may encounter challenges fulfilling their assigned missions and may not fulfill their disaster response and recovery missions efficiently. FEMA Identified Contracting Workforce Shortages, but Has Not Fully Assessed Its Needs During the 2017 disasters, FEMA leveraged contracting staff from its regions, headquarters, and the DART teams—FEMA’s deployable contracting workforce. However, FEMA’s after-action report and officials we spoke with cited workforce shortages as a continuing challenge for disaster response and recovery. For example, officials we spoke with in several regional offices stated that there are only one to three contracting officers per region. Further, information provided by FEMA OCPO shows that eight of FEMA’s 10 regional offices have only one permanent full- time contracting official. Some of FEMA’s regional offices have additional contracting staff through FEMA’s Cadre of On-Call Response/Recovery Employees, but this varies from region to region. Regional offices are responsible for managing post-disaster contracts, even if regional procurement staff were not involved in the initial award of those contracts, according to FEMA officials. As noted in table 4 above, FEMA’s after-action report recommended increasing contract support capacities; however, it did not provide a specific plan to do so. According to FEMA officials, the agency’s workforce needs have not been assessed since a FEMA workforce analysis pilot conducted in 2014. We have identified several key principles that strategic workforce planning should address, including: determining the critical skills and competencies that will be needed to achieve current and future programmatic results, and developing strategies that are tailored to address gaps in the number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies. Further, in our review of FEMA’s 2014 analysis, we found that FEMA evaluated contracting workforce needs, but did not specifically consider contracting workforce needs in the regional offices or address DART employees. The analysis was based on 5 years of workload data and conducted at the task or activity level, such as performing market research prior to making a contract award. However, the analysis did not prioritize skills or mission needs, nor did it identify critical competencies. In September 2018, FEMA procurement officials told us that, based on the 2014 analysis, they planned to hire 57 additional contracting staff. Officials noted that FEMA’s general operation funding does not support these additional hires, thus the agency plans to hire these staff as Stafford Act employees for 2-year appointments using disaster funding. While this is an important step, it is unclear when these staff will be hired or how they will be allocated across FEMA OCPO. For example, as of July 2018, FEMA OCPO had 72 vacant positions, including key leadership positions and contracting specialists. Without assessing its current contracting workforce needs—including staffing levels, mission needs, and skill gaps—and developing a plan to address these gaps that includes time frames, FEMA will not know whether it has the appropriate number of contracting officials with the key skills needed to meet its mission and is not likely to be well-positioned to respond to future disasters. Conclusions Contracting during a disaster can pose a unique set of challenges as officials face a significant amount of pressure to provide life-sustaining goods and services to survivors as quickly as possible. Given the scale and consecutive nature of the 2017 disasters, disaster contracts— particularly post-disaster contracts—played a key role in the response and recovery efforts. In these situations, it is important that the federal government be accountable for the contracting decisions it makes and the money it obligates, support the local economy and survivors as effectively as possible, and implement lessons learned before the next disaster strikes. Regarding accountability for the contracting decisions it makes and dollars obligated following disasters, without the ability to track disaster contracts using a NIA code in FPDS-NG, agencies, Congress, and the public lack full insight into post-disaster contracts. Providing clear criteria for establishing and closing the NIA code that accounts for the needs of users and consistently implementing these criteria will help ensure insight into high-visibility disaster events. Further, the ability to identify and track contracting dollars for disasters through a publicly available database, such as FPDS-NG, can reduce the burden on agencies to provide these data for interested parties, including Congress and other users, and offer a resource for historical data across major disasters. To help meet the needs of the local economy as effectively as possible, using a contracting preference for vendors in a disaster-affected area is an important component to early recovery efforts. Without guidance or training to ensure contracting officers are aware of the regulatory definition of the local area, agencies may miss opportunities to provide financial support to local vendors. Additionally, without clarifying how contracting officers determine whether offerors reside or primarily do business in a disaster area for the purposes of a local area set-aside, contract officials will remain uncertain on how to implement related FAR criteria. Similarly, guidance and tools to help ensure contracting officials are aware of the requirement to provide preference to the extent feasible and practicable to local vendors, including the need for written documentation on the use of non-local vendors for post-disaster contracts, will help ensure agencies comply with the requirement to do so. Taken together, these actions could enhance compliance with the Stafford Act provisions related to the award of contracts to local businesses in the disaster area, which could help jump-start the local economy. With regards to implementing lessons learned before the next disaster strikes, large scale disasters, like those that occurred in 2017, require effective coordination across emergency support function agencies. Given the Emergency Support Function Leadership Group’s responsibility to identify gaps or seams in the federal government’s efforts to respond to disasters, it is essential that the group have accurate and up-to-date information. Formal processes for soliciting and sharing information to communicate lessons learned to this group would help enhance agencies’ abilities to identify and address weaknesses in disaster response. Further, incorporating contracting considerations, such as demobilization, into the mission assignment policy, could enhance federal agencies’ ability to fulfill their disaster response and recovery missions efficiently. Lastly, without an assessment of FEMA’s contracting workforce needs, FEMA is at risk of not having a sufficient contracting workforce during a disaster. Recommendations for Executive Action We are making a total of 10 recommendations, including one to DHS, one to the Office of Federal Procurement Policy, two to FEMA, three to the Army, two to the Coast Guard, and one to GSA (in coordination with DOD and DHS). The Administrator of the General Services Administration, in coordination with the Secretaries of Defense and Homeland Security, should jointly revisit and assess the extent to which the criteria in the 2018 NIA code Memorandum of Agreement, including criteria for closing NIA codes, meet long-term visibility needs for high visibility events and account for the needs of users, such as FEMA, other agencies, and the Congress. At a minimum, the agreement should include criteria that take into account the roles of the federal agencies involved in response and recovery and provide a process that ensures consistent consideration and implementation of the criteria. (Recommendation 1) Until the NIA code Memorandum of Agreement between the General Services Administration and the Departments of Defense and Homeland Security is revised, the Secretary of Homeland Security should, in coordination with the Department of Defense and the General Services Administration, keep the existing NIA code for Hurricane Maria open, reopen the other NIA codes established for 2017 and 2018 hurricanes (Hurricanes Harvey, Irma, Florence, and Michael), and request that agencies retroactively enter NIA codes for contract actions for Hurricanes Harvey and Irma made after June 30, 2018, for Hurricane Florence made after March 15, 2019, and for Hurricane Michael made after April 12, 2019 into FPDS-NG to adequately capture contract obligations, to the extent practicable. (Recommendation 2) The Secretary of the Army should direct the Commanding General of the U.S. Army Corps of Engineers to provide guidance or related training to ensure contracting officers are aware of the regulatory definition of “local area”. (Recommendation 3) The Administrator of the Office of Federal Procurement Policy should provide additional clarification on how contracting officers should determine whether offerors reside or primarily do business in a disaster area for the purposes of a local area set-aside contract. (Recommendation 4) The Commandant of the Coast Guard should provide guidance and tools for contracting officials to use to ensure requirements concerning contracting with local vendors, including justification requirements for the use of non-local vendors, are consistently met. (Recommendation 5) The Secretary of the Army should direct the Commanding General of the U.S. Army Corps of Engineers to provide guidance and tools for contracting officials to use to ensure requirements concerning contracting with local vendors, including justification requirements for the use of non- local vendors, are consistently met. (Recommendation 6) The Secretary of the Army should direct the Commanding General of the U.S. Army Corps of Engineers to establish a formal process to solicit input from officials directly involved in the agency’s response and recovery following a disaster and to share that input with the Emergency Support Function Leadership Group. (Recommendation 7) The Commandant of the Coast Guard should establish a formal process to solicit input from officials directly involved in the agency’s response and recovery following a disaster and to share that input with the Emergency Support Function Leadership Group. (Recommendation 8) The FEMA Administrator should take the lead to work together with the Coast Guard and the U.S. Army Corps of Engineers to revise the mission assignment policy and related guidance to better incorporate consideration of contracting needs, such as demobilization, and to ensure clear communication of coordination responsibilities related to contracting. (Recommendation 9) The FEMA Administrator should assess its workforce needs—including staffing levels, mission needs, and skill gaps—for contracting staff, to include regional offices and DART; and develop a plan, including timelines, to address any gaps. (Recommendation 10) Agency Comments and Our Evaluation We provided a draft of this report to DOD, DHS, GSA, and OMB for review and comment. In written comments provided by DOD, DHS, and GSA (reproduced in appendixes III, IV, and V), as well as an email response from OMB, the agencies concurred with nine of the 10 recommendations. They generally provided steps they plan to take to address these recommendations. As discussed further below, USACE described actions it stated were sufficient to fully address the seventh recommendation, the steps described by FEMA would not fully meet the intent of the tenth recommendation, and DHS did not concur with our second recommendation. In response to the seventh recommendation as written in our draft report—to establish a formal process to solicit input from officials directly involved in the agency’s response and recovery following a disaster and to share that input with the Emergency Support Function Leadership Group—in its comments, USACE concurred and stated it has a formal process and it considered the recommendation completed. USACE noted that its Remedial Action Program solicits input from officials involved in response and recovery efforts and added that USACE shares findings from this program with the Emergency Support Function Leadership Group throughout the year and annually during the senior leaders seminar. During the course of our review, USACE did not provide information that indicated that they had such a formal process. As part of our recommendation follow-up process, we will request documentation regarding the process and how it solicits and shares information to the Emergency Support Function Leadership Group. In response to the tenth recommendation that FEMA assess its workforce needs—including staffing levels, mission needs, and skill gaps—for contracting staff, to include regional offices and DART; and develop a plan, including timelines, to address any gaps, FEMA stated that its Office of the Chief Component Procurement Officer assesses its workforce on an annual basis, with the last assessment conducted in January 2019. FEMA also noted that it entered into a contract for acquisition support services and plans to hire Cadre of On-Call Response and Recovery employees to provide dedicated support during disasters. Following FEMA’s response, we requested and received the FEMA Office of the Chief Component Procurement Officer’s 2019 workforce assessment. As with FEMA’s 2014 workforce analysis, the 2019 assessment calculated the number of employees needed based on the estimated time to complete a task. However, the assessment did not include an analysis of mission needs or skill gaps, and the assessment provided does not specify whether it includes the needs of regional offices and DART. FEMA estimates that it will implement this recommendation in September 2019, and we will continue to monitor FEMA’s planned efforts through our recommendation follow-up process. DHS did not concur with the draft report’s second recommendation regarding NIA codes. In its response, with regards to extending existing NIA codes and reinstating expired NIA codes, DHS stated that it is bound by the memorandum of agreement with GSA and DOD, unless or until all three signatory agencies agree to revise or suspend the agreement. We recognize that all three agencies are bound by the agreement, and also recommended in the first recommendation that GSA, DOD, and DHS jointly revisit the agreement. GSA concurred with this recommendation in its written comments reproduced in Appendix V. In an email sent from an official within DOD’s Defense Pricing and Contracting Office, DOD concurred. DHS did not respond to our first recommendation. As such, we have revised the second recommendation to state that DHS take action in coordination with DOD and GSA. We also note that the memorandum of agreement states that extending expiring or already expired NIA code end date is appropriate, in part, when two or more agencies do not have a reasonable alternative method of identifying and internally tracking those emergency acquisitions. We discuss in our report how once the NIA code is closed, there is no publicly available, government-wide system to track contract obligations for specific events. We also discuss how, using the description field (which does not provide a full picture) in FPDS-NG, agencies obligated more than $250 million on contracts for Hurricanes Harvey and Irma during the three months after the NIA codes for these two hurricanes were closed. Given this, we continue to believe DHS should consider reopening the codes for Hurricanes Harvey and Irma, in coordination with DOD and GSA. Moreover, in its response to the second recommendation DHS further stated that FEMA’s Office of the Chief Component Procurement Officer (who is not currently a party to the memorandum of agreement), believes the recommendation to extend the NIA codes for 2018 Hurricanes Michael and Florence goes beyond the scope of this audit. While the main focus of this report is the 2017 hurricanes and California wildfires, we discuss Hurricanes Florence and Michael in this draft with respect to the NIA codes, as the same issues and concerns we raised apply regardless of the year of the hurricane. However, after we sent the draft to the agencies for comment, the agencies let the codes for Hurricanes Florence and Michael expire on March 15, 2019 and April 12, 2019, respectively. We therefore revised the second recommendation to recommend that the codes for Hurricanes Florence and Michael should be reopened (rather than kept open). In its written comments, DHS also stated that neither DHS nor FEMA can unilaterally direct other agencies to retroactively enter FPDS-NG data for Hurricanes Harvey and Irma. We acknowledge this and have revised the recommendation to recommend that DHS request, rather than direct, other agencies to retroactively enter the information, to the extent practicable. As we state in the report, the NIA codes for the 2005 hurricanes were established in October 2005, and contracting officers retroactively entered data for contracts related to these events to enable full insight into contracting for these disasters. DHS further stated that retroactively entering data into FPDS-NG is not practical and places an unreasonable burden on contracting staff, and that the draft did not support the case that there were any benefits to be gained. We recognize that there is some burden associated with the recommendation, thus we recommended that DHS request agencies take action to the extent practicable. In terms of benefits, the report identifies benefits in terms of providing decision makers with important information to understand the procurement impact of such disasters. DOD and DHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the U.S. Army Corps of Engineers Director of Contracting, the Director of the Defense Logistics Agency, the Secretary of Homeland Security, the Administrator of the Federal Emergency Management Agency, the Federal Emergency Management Agency’s Chief Procurement Officer, the Commandant of the Coast Guard, the Administrator of the General Services Administration, the Director of the Office of Management and Budget, and the Administrator of the Office of Federal Procurement Policy. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI. Appendix I: Objectives, Scope, and Methodology This report specifically addresses the use of post disaster contracts and: (1) assesses the extent to which federal agencies obligated funds on post-disaster contracts in response to the 2017 major disasters; (2) assesses the extent to which selected agencies experienced challenges in the planning process for selected post-disaster contracts; and (3) describes selected agencies’ lessons learned as a result of the 2017 major disasters and assesses the extent to which they have taken action to address them. To identify the extent to which federal agencies obligated funds on post- disaster contracts in response to the 2017 disasters, we reviewed Federal Procurement Data System-Next Generation (FPDS-NG) data through June 30, 2018, the most recent and complete data at the time of our review. We adjusted the obligation data to constant fiscal year 2018 dollars using the Fiscal Year Gross Domestic Product price index. We identified hurricane obligations using the national interest action (NIA) code, as well as the contract description. Data on obligations for the California wildfires is limited to those contracts, if any, identified by the agencies with the highest obligations on post- disaster contracts for the hurricanes—the Federal Emergency Management Agency (FEMA), U.S. Army Corps of Engineers (USACE), Defense Logistics Agency (DLA), and the U.S. Coast Guard (Coast Guard)—because no NIA code was established in FPDS-NG. Coast Guard officials stated that they did not execute any contracts in response to the 2017 California wildfires. DLA officials stated that they maintain contracts, which for the most part provide inventory replenishment for DLA and the U.S. Forest Service within the U.S. Department of Agriculture, but they were unable to provide data on contracts awarded or executed specifically for the two wildfire disasters in the scope of our review. Therefore, our analysis only captures obligations for FEMA and USACE reported contracts related to the 2017 California wildfires. To determine which obligations were made through the use of post- disaster contracts versus advance contracts, we reviewed documentation provided by FEMA and USACE identifying the advance contracts they have in place and that were used in support of the 2017 disasters. We analyzed the FPDS-NG data against these contracts to identify obligations on post-disaster contracts and compared these to obligations on advance contracts by disaster. We analyzed competition procedures used and the types of goods and services procured for post-disaster contracts. In addition to advance contracts for disaster response, agencies can leverage other existing contract vehicles. For example, to respond to its pollution mitigation functions under emergency support function 10, the Coast Guard awards task orders off of its portfolio of basic ordering agreements. For the purposes of this report, post-disaster contracts include all contract awards and orders that were not identified by FEMA or USACE as advance contracts. To assess the extent to which disaster contract obligations can be tracked through FPDS-NG using the NIA code, we identified prior hurricane events with the highest contract obligations from 2005 through September 2018. We analyzed the data to determine when the highest level of federal contract obligations occurs following a hurricane. We also assessed the process for establishing and closing a NIA code. Specifically, we reviewed the criteria in the 2012 and 2018 memorandums of agreement between DHS, DOD, and the General Services Administration, and interviewed officials involved in the process. We assessed the reliability of FPDS-NG data by reviewing existing information about the FPDS-NG system and the data it collects— specifically, the data dictionary and data validation rules—and performing electronic testing. We also compared FPDS-NG data to the contract files in our review. Specifically, to review our selected post-disaster contracts for data reliability, we compared items such as, the extent competed, the use of a local area set-aside, NIA code, and termination status, based on the contract information and the information in FPDS-NG. Based on the steps we took, we determined the FPDS-NG data were sufficiently reliable for the purposes of describing agencies’ post- disaster contract obligations. To assess the extent to which agencies experienced challenges in the planning of selected post-disaster contracts, we reviewed relevant laws and regulations, including the Post-Katrina Emergency Management Reform Act (PKEMRA), the Federal Acquisition Regulation (FAR), the Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act), as well as agency policy and guidance. We identified a non-generalizable sample of 23 post-disaster contracts from the four agencies with the highest post-disaster obligations based on FPDS-NG data as of March 31, 2018—DHS’s FEMA, DOD’s USACE, DOD’s DLA, and DHS’s Coast Guard. We selected contracts across the four major 2017 disasters included in our scope (Hurricanes Harvey, Irma, and Maria, as well as the California wildfires) based on four selection criteria—(1) contracts using the urgency exception to full and open competition; (2) contracts using a local area set-aside; (3) contracts awarded to small businesses; and (4) contracts terminated for cause or convenience. Our goal in this selection was to ensure we selected a range of contracts within each of these four criteria so as to assess the extent to which these contracts implemented certain laws and regulations. Specifically, we selected contracts based on the use of urgency and local area set-asides in order to assess agencies’ implementation of relevant PKEMRA, Stafford Act and FAR criteria for post-disaster contracts. Because the obligations for local area set-aside contracts was low across all federal agencies, about 5 percent of total post-disaster obligations, we selected contracts that were awarded to small business vendors as a proxy to identify other awards to local vendors. Finally, we selected terminated contracts to assess additional challenges related to post- disaster contracts, such as the availability of contracted services and supplies and the requirement setting process. Based on these criteria, we selected 12 FEMA, 7 USACE, 2 DLA, and 2 Coast Guard contracts. Findings based on information collected from the 23 contracts cannot be generalized to all post-disaster contracts. Additional details on our selected contracts can be found in table 5. To assess how agencies used the urgency exception to full and open competition, we reviewed selected contracts for the inclusion of a justification and approval for other than full and open competition including sole source justifications and exclusion of sources justifications. To assess the extent to which agencies provided preference to local vendors for post-disaster contracts, we reviewed selected contract files for the use of a set-aside or an evaluation preference listed in the contract solicitation, and the inclusion of justifications for contracts not awarded to local vendors. Additionally, we reviewed applicable agency guidance and interviewed contracting and senior procurement officials across all four agencies regarding their use of local area set-asides, including the means by which they define the geographic set-aside area and determine that an offeror primarily resides or does business in the set-aside area. We also met with officials from the Office of Management and Budget’s Office of Federal Procurement Policy to discuss relevant FAR criteria. To assess how FEMA program offices develop and deliver requirements packages for use by contracting officers and the extent to which those packages are sufficiently specific to allow contracting officers to issue a contract solicitation, we interviewed contracting, program, and senior procurement officials responsible for the contracts in our selection sample. We discussed the specificity of initial versus final requirements, the nature of requirements changes, the process of requirements development, and training provided to program officials regarding the requirements development process. We also reviewed new post-disaster awards at FEMA to determine time frames between resource request to award on average for post-disaster contracts. We compared these findings to relevant agency guidance on acquisition planning. To describe lessons learned selected agencies identified related to the use of post-disaster contracts and assess the extent to which agencies have taken action to address them, we reviewed available completed after-action reports from the 2017 and prior disasters, including the Hurricane Sandy FEMA After-Action Report, the 2017 Hurricane Season FEMA After-Action Report, USACE’s Temporary Emergency Power Mission After Action Review for Hurricane Matthew, USACE’s Puerto Rico After Action Review, USACE’s Northern California Wildfires Debris Removal Mission After Action Review, the Coast Guard’s 2017 Hurricane Season Strategic Lessons Learned After Action Report, and the Defense Logistics Agency’s 2017 Hurricane After Action Meeting papers. We also reviewed findings from the Emergency Support Function Leadership Group related to interagency lessons learned. As part of our review, we identified requirements for agencies to document or practices agencies use to document lessons learned following a disaster, agency specific and interagency lessons learned specific to post-disaster contracts and mission assignments, and recommendations or actions planned by the agencies to address them. We reviewed federal internal control standards and the Emergency Support Function Leadership Group charter and the standard operating procedures for its Preparedness Evaluation/Corrective Action Working Group. To describe challenges related to coordination with state and local officials on the use of post-disaster contracts, we interviewed FEMA, USACE, DLA, and Coast Guard officials. To obtain perspectives and examples from state and local government officials involved in disaster response, we interviewed officials in California on the use of federal contracts. We also met with state and local officials in Texas, Florida, Puerto Rico, and the U.S. Virgin Islands to discuss the federal response to the 2017 hurricanes more broadly. The information gathered from these officials is not generalizable to all officials. To describe challenges related to the mission assignment process, we interviewed FEMA, USACE, and Coast Guard officials, including officials from FEMA’s Response Directorate and the contracting officials from USACE and the Coast Guard that awarded the contracts these agencies used to fulfill their missions. We also reviewed the mission assignment documents, where FEMA assigned USACE and Coast Guard missions and laid out their responsibilities. To assess workforce challenges, we reviewed DHS’s 2014 workforce assessment, which identified gaps in FEMA’s contracting workforce. We also obtained information from FEMA on its current contracting workforce in headquarters, regional offices, Disaster Assistance Response Team, and joint field offices. We also interviewed FEMA contracting officials to obtain their perspectives and experiences during the 2017 disaster season. We conducted this performance audit from March 2018 to April 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Emergency Support Functions Responsibilities across the Federal Government The National Response Framework identifies 14 emergency support functions (ESF) and designates a federal department or agency as the coordinating agency for each function. ESFs are the federal government’s primary coordinating structure for response, and under this structure, the Federal Emergency Management Agency (FEMA) acts as the federal coordinating agency. Appendix III: Comments from the Department of Defense Appendix IV: Comments from the Department of Homeland Security Appendix V: Comments from the General Services Administration Appendix VI: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Janet McKelvey (Assistant Director), Katherine Trimble (Assistant Director), Caryn E. Kuebler (Analyst in Charge), Lindsay Taylor, and Sarah Tempel were principal contributors. In addition, the following people made contributions to this report: Emily Bond, Lorraine Ettaro, Suellen Foth, Julia Kennon, Carol Petersen, Sylvia Schatz, Alyssa Weir, and Robin Wilson.