Summary

  • FEMA replaced the National Risk Index's social-vulnerability data source in 2025, moving from the CDC Social Vulnerability Index to Census Bureau Community Resilience Estimates. Its comparison showed different county-level vulnerability values in more than half of counties, according to GAO.
  • FEMA compared component ratings, but GAO found no sensitivity analysis testing how the source substitution and concurrent updates affected the index's final composite risk scores. DHS said it had analyzed the change; GAO judged that comparison insufficient for the output question.
  • FEMA integrated NRI results into its Resilience Analysis and Planning Tool in December 2025. As of May 2026 it had no current plan for another NRI update. DHS rejected GAO's sensitivity-analysis recommendation while accepting two others on user guidance and systematic feedback.

The map changed at the input socket

The National Risk Index combines three things: expected annual loss from 18 natural hazards, social vulnerability and community resilience. FEMA publishes relative risk scores for counties and census tracts so planners can compare places and consider investments. In December 2025 it folded NRI results into the Resilience Analysis and Planning Tool, or RAPT. The scores therefore travel in an interface built for decisions, not merely a technical archive.

In November 2025 FEMA switched the main social-vulnerability source from the Centers for Disease Control and Prevention's Social Vulnerability Index to the Census Bureau's Community Resilience Estimates. FEMA said the choice fit administration priorities and the 2022 law governing community disaster resilience zones. It did evaluate the new source and compare county-level component values. GAO's review of those comparison records found that more than half of counties received different social-vulnerability values after substitution.

That is a change in one component, not proof that more than half of counties changed their overall risk ranking. The missing test is exactly that bridge. GAO's full report says FEMA did not evaluate what the new source and other simultaneous updates did to the composite risk scores. A sensitivity analysis would run the model with the alternative input and expose how much the finished result moves. Without it, a planner sees the new color on a map but cannot tell how much of the change came from the data-source decision.

The rejected source came back without the old test

The history makes the swap more than a routine refresh. When FEMA chose the prior social-vulnerability source in 2022, a working group considered the Census estimates and found them unsuitable under its then criteria. The group worried that the estimates did not reflect differences in impacts across communities and that source or model errors could reverse relative vulnerability. FEMA used sensitivity and other analyses during that earlier choice, examining how alternative sources changed risk ratings.

By 2025 FEMA judged the Census product suitable and adopted it. A public body can change its mind when data or goals change. The durable record should show what altered in the criteria, what the new source improves and what it does to the output. FEMA's comparison of component values was informative: it revealed a broad shift. GAO said it was not the experiment that would test the final composite score. DHS maintained in its response that it had performed sensitivity analysis. GAO examined the documentation, found the county-value comparison, and said the output test was still missing.

Their disagreement is about which result counts as validation.

This matters to a county that may use a risk rating to help set priorities among mitigation projects. A score is a compressed judgment about expected loss, vulnerability and resilience. If the weight or source of one ingredient changes, the composite can move in ways that a comparison of ingredients alone cannot explain. A planner should not have to reverse-engineer the update from a technical appendix while choosing which project receives attention.

A tool without a feedback loop

GAO found a second missing connection at the user end. FEMA had described the NRI's purpose and technical method and offered webinars and fact sheets. It had not given concrete examples showing emergency managers how to use NRI results alone or alongside RAPT and Hazus when deciding how to reduce risk. Some state hazard-mitigation officials told GAO they had no opportunity to comment on the index's utility and knew of no current mechanism for systematic feedback.

The agency's earlier public-comment exercise illustrates the scale of the queue. More than 600 responses were organized into 152 action items. As of April 2025, 14 were marked complete; the others were in progress, unstarted or delayed pending later updates. That date matters. It describes the feedback backlog at that point, not a measured November 2026 completion rate. FEMA later changed the index and moved it into RAPT, giving users more reason to ask how the new input affects the score they see.

GAO issued three recommendations: practical application guidance, consistent and disclosed sensitivity analysis, and a systematic continuing channel for user feedback. DHS agreed with the guidance and feedback recommendations, pointing to planned work by December 31, 2027. It disagreed with the sensitivity recommendation, citing its own analysis and the lack of planned ongoing NRI updates after the RAPT integration. GAO held its ground. In May 2026 FEMA officials said there was no current plan to update the NRI, while acknowledging statutory review and update duties.

Putting a model inside another application changes the doorway, not the need to understand its calculations.

Sources