In September 2017, Puerto Rico (PR) was ravaged by two powerful hurricanes, Irma and María, just two weeks apart. Hurricane María caused catastrophic damage to the Island’s roads, bridges, buildings, power, water, and communications infrastructure. The destruction was followed by a major disaster declaration that invoked several federal assistance programs, including the Federal Emergency Management Agency’s (FEMA) Public Assistance (PA) program.

Three audit reports from the Inspector General for the Department of Homeland Security (DHS) released this year reveal that FEMA and local agencies in Puerto Rico did not enact proper oversight mechanisms and internal controls in connection with these programs. The reports cover activities until December 14, 2018 by three PA grants subrecipients: the Puerto Rico Department of Transportation and Public Works (DTOP), the Puerto Rico Aqueduct and Sewer Authority (PRASA), and the Puerto Rico Department of Education (PRDE). Although the agencies attend to different needs, the DHS IG found some common issues: FEMA failed to ensure the agencies had established and implemented policies, procedures, and practices to ensure PA grant funds were accounted for; there was a lack of proper training of agency personnel to ensure compliance with Federal statutes, regulations, and terms and conditions of the awards; and, generally, there were few internal controls in the vendor selection process.

As for DTOP, the IG reported that FEMA and Puerto Rico’s Central Office for Recovery, Reconstruction, and Resiliency (COR3) – in charge of receiving and distributing the funds – “did not adequately oversee DTOP’s grant management activities.” In addition, agency personnel did not have proper procurement training and there was no central point of contact fully knowledgeable about PA grants. The IG highlighted that it was challenging to obtain answers to basic questions, and DTOP did not respond to audit requests in a timely manner, taking six weeks to provide substantially incomplete documentation. DTOP also failed to check vendor debarment and did not maintain sufficient documentation to support its vendor selection. The IG warned that failure to perform required procedures and adequate checks (as required by Federal regulations) increases the risk of awarding contracts at overestimated costs and incurring in costs ineligible for reimbursement.

Similarly, FEMA did not provide adequate oversight of PRASA, which did not take required steps to verify vendor eligibility prior to awarding contracts. The IG concluded that PRASA also needed additional training and monitoring to ensure compliance with accounting and procurement regulations. The IG found that PRASA overstated some cost reimbursement claims for the use of generators. Although it did not identify unallowable costs in the sample of 21 contracts, it warned that failure to check vendor eligibility might have put the agency at risk of awarding contracts to ineligible vendors.

The lack of adequate internal controls, proper documentation, and accounting and oversight practices puts agencies at risk of fraud, waste, and abuse of grant funds. More importantly, it also delays recovery efforts and puts lives at risk. The IG concluded the PRDE “did not have adequate expertise to complete its emergency work and submit timely requests for reimbursement” and did not have the funding and staff needed to promptly implement repairs “[b]ecause of delays in obtaining FEMA reimbursements.” The IG’s most worrisome finding: these delays “resulted in students and staff attending schools during the 2017-2018 and 2018-2019 school years in facilities that were determined to be unsafe to students, teachers, and other staff.” The report highlights that nearly all of PRDEs schools had roof damage, resulting in water infiltration and mold, and that delays in school repairs “could negatively affect the safety and security of students and staff in PRDE schools, potentially causing physical harm and other significant health conditions.” Although the audits cover what could be deemed as an early stage of the response – since much of the funds have yet to be disbursed – the findings are a cause for concern. Lack of oversight and internal controls, as well as knowledgeable and experienced personnel at the local agencies, increases the risk for fraud, waste, and abuse, prevents people from getting the help they so desperately need, and keeps the Island’s rebuilding efforts at a standstill. Three years after Hurricane María, FEMA has disbursed $14 billion out of a total of $32 billion allocated for recovery and reconstruction efforts. FEMA and COR3 must work together to implement the IG’s recommendations, mainly, that FEMA monitor and provide training and technical assistance to COR3 and make sure the subrecipient agencies adhere to procurement policies and implement internal controls and procedures to ensure compliance with the PA grants.