Summary

  • FEMA's 13 preparedness grants total $2.9 billion in fiscal 2026. That is the full suite, not the transit or port programme alone.
  • In the transit programme, GAO found a funding notice that misdescribed scoring and awards to some lower-scoring applications under a publicly stated merit process.
  • In the port programme, the notice omitted full scoring weights and non-merit factors, including a set-aside for highly effective projects in lower-risk ports.
  • The decision record that matters is a current, published rule joined to award-by-score results and an explanation for every departure from rank.

A score is an invitation to trust

The Federal Emergency Management Agency has a serious job. Its 13 preparedness grants for fiscal 2026 total $2.9 billion, supporting protection against terrorist threats and other hazards. Security at transit systems and ports is not an ornamental budget line. A failed investment can leave a crowded station or freight gateway with a risk its operators already knew how to reduce.

That is why an application score matters. It tells a city which security project to submit, what evidence to assemble and which risks the federal government wants reduced first. It also tells rejected applicants whether the contest had a rule. FEMA can weigh risk, national priorities and geographic coverage. But if applicants cannot see the weights and exceptions before bidding for public money, the score becomes theatre: a visible number attached to a decision made partly elsewhere.

GAO's November 2026 synthesis joins a set of findings that has survived several grant cycles. The $2.9 billion is the size of the 2026 preparedness suite; the detailed transit and port findings come from earlier audits, with their own dates and denominators. Mixing those time frames would make a dramatic headline and a bad ledger.

The transit score did not always decide

GAO examined the Transit Security Grant Program's fiscal 2015–2021 award decisions. The agency awarded $614 million across those years. In its fiscal 2021 funding notice, FEMA described a competitive merit review, but GAO found that the notice did not accurately describe key scoring criteria, including risk reduction. Some lower-scoring applications won while higher-scoring ones did not.

This is the point at which a public score needs a public explanation. A lower score can conceivably win for a stated policy reason. The reason has to exist in the rule applicants received and in the record of the award. Otherwise the agency has two systems: a front-office competition and a back-office choice. The applicants pay the cost of preparing for the first while the second does the deciding.

The same transit audit found that FEMA's fiscal 2021 risk model omitted cyber threats and lacked a documented account of its assumptions and weights. The current GAO recommendation record shows a genuine correction: the model-documentation recommendation is closed as implemented. Three other recommendations—accurate published criteria, awards consistent with the disclosed process and cyber-risk inclusion—remain open, partially addressed. FEMA said it lacked a cyber-risk dataset covering every eligible applicant. The relevant test is whether the model and funding notice now tell applicants exactly what gets measured, what cannot yet be measured and how awards follow the published procedure.

The port notice hid the extra levers

Port security presents a different version of the same governance problem. The GAO port audit records $690 million awarded across 82 port areas in fiscal 2018–2024, with more than half going to eight port areas. Its examination of the fiscal 2024 funding announcement found that FEMA did not fully or accurately describe the Coast Guard-led scoring criteria and relative weights. It also omitted some factors beyond project merit that could affect award selection. One was a five-percent set-aside for highly effective projects in lower-risk ports.

A national programme can reserve a slice for strong projects outside the highest-risk ports to secure a minimum capability where a pure rank order would leave a gap. The defect is hiding that lever from the people submitting proposals. A port that knows a set-aside exists can tailor a credible project to it; a port kept in the dark can only guess which contest it has entered.

GAO also found that projects aligned with a national priority received a 20-percent score increase, while FEMA had not assessed whether that boost actually produced more awards for priority-aligned projects. Twenty percent here is a change to a score, not a share of the budget. It is a lever whose real effect must be checked against award outcomes. All three port recommendations remained open on GAO's product page when checked on 13 November 2026.

The rule and the receipt

The agency has a legitimate power to choose among security needs. It also owns the scoring model, the published notice and the award file. Applicants own none of those instruments. That is the agency problem in miniature: the party asked to justify its decision also controls the evidence by which outsiders can test the justification.

The remedy is a joined record. Publish each criterion, weight and non-merit factor before applications close. After awards, publish enough of the score-to-decision trail to show where rank held and where a stated exception changed the result, protecting sensitive project detail. For the port programme, test whether the 20-percent priority boost and the lower-risk set-aside did what FEMA said they were for. For transit, show whether the updated notice and actual awards now match.

The National Priority Areas audit supplies a useful historical control. DHS once left its rationale for changing priorities underdocumented and FEMA's outreach thin. The two GAO recommendations are now closed as implemented. That correction proves a process can move. It does not answer whether today's transit and port award records make their scores intelligible.

A grant score is a statement by government about why one community's project outranked another's. FEMA has already made the statement. The missing public object is the receipt showing how the rule, the score and the cheque fit together.

Sources