DISASTER RISK:

Report to Congressional Requesters

September 2026

GAO-26-107894

United States Government Accountability Office

A report to congressional requesters

Contact: Chris Currie CurrieC@gao.gov

What GAO Found

GAO found that the Federal Emergency Management Agency (FEMA) —a component within the Department of Homeland Security (DHS)— partially followed leading practices for risk assessment and information quality during the development, operation, and maintenance of the National Risk Index (NRI). The figure below lists these practices.

FEMA took steps to define and disseminate information about the purpose and scope of the NRI and provided additional information on the methodologies and data used to inform the index. However, FEMA did not consider what information users (e.g., emergency managers) would need to tangibly apply NRI results when making decisions about how to reduce risk.  Moreover, FEMA did not explain how users should apply NRI information in conjunction with other FEMA risk tools to generate effective risk insights. Lack of information about how to apply results undermines the NRI’s perceived utility.

FEMA took steps to use diverse sources to design the NRI, including consulting relevant sources and subject matter experts. FEMA also followed an established process to verify and validate hazard calculations and risk scores. However, FEMA did not consistently use sensitivity analyses to verify the model’s outputs or inform significant changes to data sources and methodologies. Conducting such analyses would enhance understanding of factors that could affect NRI results, such as methodological choices that could lead to over- or under-estimation of specific aspects of hazard risk. Disclosing results of any such analyses conducted would also enhance user understanding of how those factors could affect risk scoring in their specific circumstances.

FEMA established a process to communicate and engage with subject matter experts on future updates to NRI data. However, FEMA does not have an established mechanism to systematically collect ongoing user feedback and use it for continuous NRI improvement. Without such a mechanism, FEMA does not have the information it needs to assess whether the tool provides valuable information to its users to address their hazard mitigation planning needs.

Why GAO Did This Study

Natural disasters have become more costly and frequent. Jurisdictions can use the NRI to help address disaster risk. It is the only national-level index that combines disaster loss with social vulnerability and community resilience measures to score risk, according to FEMA officials.

GAO was asked to review the extent to which FEMA has applied leading practices to the NRI. This report examines leading practices for (1) defining the purpose of risk information; (2) designing a sound model and ensuring information quality; and (3) engaging with relevant stakeholders.

GAO consulted federal sources and international standards to develop leading practices for assessing risk. GAO then analyzed FEMA’s actions against these practices. GAO analyzed technical documentation and interviewed FEMA officials to assess practices. GAO also interviewed emergency management stakeholders from select states for user perspectives.

What GAO Recommends

GAO is making three recommendations, including that FEMA provide information to users on how to apply NRI results effectively and systematically solicit, collect, and incorporate user feedback to inform NRI improvements. DHS concurred with two recommendations and did not concur with one recommendation—that FEMA conduct sensitivity analyses and disclose the results when making significant changes to NRI data sources or methodologies. The department stated that the lack of planned NRI data updates removes the need for such analysis. GAO maintains its recommendation would ensure the NRI meets federal information quality standards.

 

 

 

 

DHS                            Department of Homeland Security

FEMA                          Federal Emergency Management Agency

ISO                              International Organization for Standardization

OMB                           Office of Management and Budget

NRI                              National Risk Index

RAPT                          Resilience Analysis and Planning Tool

 

                    

                    

September 10, 2026

The Honorable Gary C. Peters

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Sharice L. Davids

House of Representatives

Hurricanes, floods, wildfires, earthquakes, and other natural disasters affect hundreds of American communities each year, requiring significant resources for response and recovery. From fiscal years 2015 through 2025, federal appropriations for disaster assistance totaled at least $580.5 billion.[1] In recent years, natural disasters have become costlier and more frequent. For example, in 2018, the National Oceanic and Atmospheric Administration calculated that the United States sustained 14 disasters that each cost more than $1 billion in total economic damages. By 2024, that number almost doubled to 27.[2] The scale of economic and human impact underscores the need for effective federal disaster assistance that also reduces federal costs and fiscal exposure.

We have previously reported that investments in disaster resilience, from federal and non-federal sources, are promising avenues to address the economic and human consequences of disasters by reducing the risk of severe impacts.[3] Our Disaster Resilience Framework provides high-level principles to help federal officials consider how they might increase resilience to natural hazards using the policy and administrative tools available to them.[4] These principles include enabling decision makers to understand the risk to community assets and options they have to reduce that risk individually and across interrelated systems by making risk information available and accessible. In addition, in February 2025, we added Improving the Delivery of Disaster Assistance to our High-Risk List.[5] Enhancing investments in disaster resilience is one focus in this high-risk area.

The Federal Emergency Management Agency (FEMA), within the Department of Homeland Security (DHS), maintains various nationwide, geographic information system-based disaster risk assessment tools.[6] The purpose of these tools, according to FEMA, is to help state, territorial, tribal, and local officials; emergency managers; and other stakeholders assess their risk as they seek to improve community disaster resilience. The National Risk Index (NRI) is a measure of a community’s relative risk that combines estimates of potential loss from natural hazards with social factors (e.g., economic, demographic, and housing characteristics) and community resilience.[7] According to FEMA officials, the NRI is the only national-level risk index that combines all these factors.

As technical data disseminated by the federal government, NRI information is a resource for decision makers to assess hazard risk and prioritize investments. Principles in our Disaster Resilience Framework advise that for this kind of information to add value, users should perceive it as reliable and authoritative, and it should provide real insights for selecting among risk reduction strategies.[8] Given this type of information’s importance in supporting nationwide risk management actions, you asked us to examine the NRI as a tool to help decision makers prioritize community risk, including whether FEMA applied leading practices during its development.

This report assesses the extent to which FEMA’s actions are consistent with standards and leading practices for (1) defining the purpose of NRI risk information for decision making; (2) designing a sound risk assessment model and ensuring quality information has been used in the development, operation, and maintenance of the NRI; and (3) communicating and engaging with relevant stakeholders about the NRI.

To address all three objectives, we first identified leading practices for assessing the NRI, as described in more detail below. We then compared documentary and testimonial evidence that we collected from FEMA regarding the actions it took and management practices it had in place as it has developed, operated, and maintained the NRI against those leading practices. Our analysis included the latest version of the index’s technical documentation published in December 2025 and other available information that described the development history and current capabilities of the NRI. We also interviewed officials in FEMA’s Resilience Directorate, as well as other FEMA components, on the intended, current, and planned capabilities of the NRI.

To identify leading practices most applicable to the nature of the NRI, we focused on FEMA’s actions within the broader context of national risk reduction efforts for disasters. To further define that context, we focused particularly on principles from GAO’s Disaster Resilience Framework, which include the ideas that information with meaningful value for national disaster resilience should be received by users as reliable and authoritative.[9] To select sources of leading practices that correspond to this context, we considered available documentation from federal agencies and international standards-setting bodies that were directly relevant to effective risk modeling, risk management, and quality information. Our research found that there is currently no single established framework of leading practices specific to a multi-hazard risk model used to inform broad risk-reduction goals.

We thus adapted established standards relevant to risk assessment and information quality that would operationalize “leading practices” most applicable to the nature and purpose of the NRI and represent actions FEMA could take to improve its results. We considered (1) how comprehensively a single source covered the topics of risk assessment and information quality; (2) broad acceptance of the sources and their publishers; (3) ability of standards, principles, or practices presented in the sources to be translated into clear process-oriented activities; and (4) ability to adapt standards, principles, or practices across different risk contexts.

On the basis of these criteria, we selected (1) internationally recognized risk management process components established by the International Organization for Standardization (ISO), specifically ISO 31000, Risk Management — Guidelines (2018), and ISO 31010, Risk Management — Risk Assessment Techniques (2019); and (2) standards that the Office of Management and Budget (OMB) published to clarify agency responsibilities under section 515 of the Treasury and General Government Appropriations Act, 2001, known as the Information Quality Act.[10] We then assessed whether FEMA’s actions were aligned with the leading practice or standard as envisioned in the source language from these criteria.

Figure 1 shows the leading practices relevant to risk assessment and information quality that we used in our assessment.

Finally, to obtain the views of emergency management stakeholders from states and localities, we interviewed two state emergency directors and four state hazard mitigation officers with first-hand knowledge of FEMA hazard mitigation programs and risk assessment tools, selected based on their work in regions that have experienced high-profile, natural hazards in recent years. We also solicited written comments about the NRI from a group assembled by the leadership of the National Emergency Management Association. The group included seven state emergency directors and two state hazard mitigation officers. We used their responses to identify general themes about the NRI’s usefulness and challenges within a directly applicable user community. The information we obtained from these interviews is not generalizable, but it provided insights and context concerning the NRI’s capabilities and FEMA’s communications and outreach about how the NRI can assist potential users in hazard mitigation planning or other risk reduction activities.

For additional information on our scope and methodology, see appendix I.

We conducted this performance audit from January 2025 through September 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Disaster Risk Management and the Federal Role in Providing Information

Emergency management, including disaster risk management, is inherently an intergovernmental, multi-jurisdictional, and multi-sector undertaking. The federal government plays a variety of roles within this whole system, including providing data and technical assistance to state, local, and private sector decision makers. Decision makers from all levels of government and the private sector use different types of information, including federal data, to invest in disaster resilience and reduce risk.

Natural disasters result when natural hazards—such as hurricanes, wildfires, floods, and earthquakes—intersect with community and physical infrastructure and cause devastating consequences due to significant loss of function, property, and sometimes life. For the purposes of the NRI, FEMA defines a hazard as something that is potentially dangerous or harmful and often the root cause of an unwanted outcome. Further, according to FEMA, natural hazards are caused by natural events that pose a threat to lives, property, and other assets, and natural hazard risk as the potential for negative impacts due to natural hazards.

FEMA documentation notes that there is a wide range of environmental, social, economic, and ecological factors that can influence a community’s risk to natural hazards. Additionally, the likelihood that a community may experience a natural hazard can vary drastically, as can the associated consequences. Within this context, decision makers must consider how to manage risks associated with such hazards with incomplete information about unpredictable outcomes. Broadly defined, risk management is a strategic process for helping decision makers assess risk, allocate finite resources, and act under conditions of uncertainty.

The National Risk Index Uses National Data to Show Community Natural Hazard Risk

The NRI helps to illustrate the level of natural hazard risk different U.S. communities face relative to each other when considering multiple drivers of risk.[11] The index calculates these levels of risk using available nationwide data for 18 of the most common natural hazards and two other composite datasets that were created to identify social factors and existing resilience capabilities.[12] The NRI then allows users to visualize these risk levels using different map layers. Figure 2 shows an example of one of these visualizations for the 50 U.S. states and the District of Columbia.

Note: This map visualizes relative risk for each census tract in comparison to all other communities at the same level and is one view among many available to NRI users. Relative risk may vary with different geographic bounds—such as the borders of a single state or metropolitan statistical area.

According to FEMA, the NRI provides a baseline relative risk measurement for each county (or county-equivalent) and census tract for all 50 states, the District of Columbia, American Samoa, Commonwealth of the Northern Mariana Islands, Guam, Commonwealth of Puerto Rico, and the U.S. Virgin Islands.

The NRI is one of three FEMA-developed nationwide tools that each provide different risk insights, as shown in table 1. According to FEMA officials, these tools complement the NRI’s core function; collectively, they present an expanded picture of hazard risk. NRI program officials told us they frequently coordinate with other FEMA components to ensure the integration of these tools’ data and capabilities with one another.

Risk Assessment Tool	Description	Intended Use	Example of Use Case
National Risk Index (NRI)	Index and map-based visualization tool that uses national-level hazard, social vulnerability, and community resilience data to derive custom composite hazard risk scores and ratings for counties and census tracts. Originally available as a standalone, public facing Web-based application; now integrated with the Resilience Analysis & Planning Tool.	Supports hazard mitigation planning and risk communication by providing a high-level, composite snapshot of the areas with the highest risk relative to other areas within the same geographic boundaries.	The Maryland Department of Emergency Management used NRI data to identify and prioritize communities with limited transportation access and high coastal flood risk.
Resilience Analysis & Planning Tool	Tool to visualize and assess potential challenges to community resilience. Includes over 100 pre-loaded data layers in categories such as infrastructure, hazards, and community demographics.	Supports data-driven risk reduction decisions through data visualization of factors that increase vulnerability to hazards, such as population and household characteristics, housing, healthcare, and economic indicators.	In March 2021, Argonne National Laboratory used the tool to identify locations vulnerable to tornadoes, such as hospitals and nursing homes, and visualize tornadoes’ expected paths using National Weather Service data.
Hazards U.S. (Hazus)	Software application that estimates the physical, economic and social impacts of earthquakes, floods and hurricanes. Contains inventory databases (buildings, infrastructure, and population) for every state and territory in the U.S., and hazard data to estimate the impacts of disasters.	Supports understanding of potential consequences by using hazard, population, and built environment data to estimate consequences in terms such as direct costs, social costs, and loss of infrastructure function.	Public officials in Lewis County, Washington, used this software to model the potential impacts of a major earthquake and identify hazard mitigation projects, such as structural improvements to buildings.

Source: GAO analysis of Federal Emergency Management Agency (FEMA) documentation and interviews with FEMA officials.  |  GAO‑26‑107894

How the National Risk Index Estimates Natural Hazard Risk

To measure the risk for each of the 18 natural hazards, the NRI uses three components: a natural hazards risk component (Expected Annual Loss); a consequence enhancing component (Social Vulnerability); and a consequence reduction component (Community Resilience).

·         Expected Annual Loss. The average economic loss in dollars resulting from natural hazards each year. It is calculated for each hazard type and quantifies loss for relevant consequence types: buildings, people, and agriculture.

·         Social Vulnerability. The susceptibility of social groups to the adverse impacts of natural hazards, including death, injury, financial loss, or disruption of livelihood. It uses social, economic, demographic, and housing characteristics of a community when considering the impact of hazards.

·         Community Resilience. The ability of a community to prepare for anticipated natural hazards, adapt to changing conditions, and withstand and recover rapidly from disruptions.

Table 2 describes the elements of risk in the context of natural disasters and how the NRI accounts for them in its three components.

	Probability	Vulnerability	Consequence
DHS definition of risk component	The percentage chance that something will occur.	A physical feature or characteristic that contributes to susceptibility to a given hazard. Vulnerability can enhance or reduce consequence effects.	The effect of an event, incident, or occurrence. It is commonly measured in four ways: human, economic, mission, and psychological, but may also include other factors such as impact on the environment.
Natural disaster risk context	The likelihood and magnitude of a specific natural hazard resulting in devastating consequences for communities or populations.	The factors and degree to which characteristics of the community might result in susceptibility to adverse impacts from natural hazards, including death, injury, property loss, and disruption of livelihood.	The degree to which the hazard results in loss of function of critical community functions, economic loss, and human impacts.
How NRI reflects risk	The “expected annual loss” component of the NRI contains a risk factor for an anticipated frequency (mostly using historic data) that represents the probability of any of the 18 hazards intersecting with each county or census tract.	Social vulnerability: The NRI uses data from the U.S. Census Bureau’s Community Resilience Estimates, which measure how socially vulnerable every neighborhood in the United States is to the impacts of disasters. FEMA switched to this data source in December 2025 after previously using a social vulnerability index developed by the Centers for Disease Control and Prevention. Community resilience: The NRI includes a national dataset and methodology that considers 49 indicators that represent six types of resilience—social, economic, community capital, institutional capacity, housing/infrastructure, and environmental—to account for factors that enhance communities’ ability to cope. When community resilience factors reduce vulnerabilities, risk is reduced.	The “expected annual loss” component of NRI includes a historic loss ratio and a calculation of the exposure of critical community assets to each of the 18 hazards. Expected annual loss is measured in dollars as people, building, and agricultural loss.

Source: GAO analysis of Federal Emergency Management Agency (FEMA) and Department of Homeland Security (DHS) documentation.  |  GAO‑26‑107894

National Risk Index Updates Since Its Initial Development

Since its initial development beginning in 2016, FEMA has made periodic data updates and other adjustments to the NRI, as shown in figure 2. This includes how the NRI uses data to measure social vulnerability and community resilience.

^aThe Stafford Act, as amended, defines the federal government’s role during disaster response and recovery. The act also established programs and processes through which the government provides disaster assistance to state, tribal, territorial, and local governments, as well as certain nonprofit organizations and individuals. 42 U.S.C. § 5121 et seq. In 2022, the Community Disaster Resilience Zones Act of 2022 amended the Stafford Act to direct the President to create public products that show the risk of natural hazards across the United States. These products need to include ratings that consider potential losses, social vulnerability, and how resilient communities are. See Pub. L. No. 117-255, § 3(a), 136 Stat. 2363 (codified at 42 U.S.C. § 5136). FEMA officials told us they expanded the functionality of the NRI to accommodate these requirements.

Initial Development of NRI Risk Methodology through Release

From 2016 through 2019, FEMA collaborated with a variety of stakeholders and technical experts to define and develop the scope of the NRI. FEMA officials initially reviewed hazard mitigation and emergency management literature and analyzed state-level plans to select the 18 natural hazards. Officials then conducted multiple working group sessions to deliberate the methodologies for translating raw source data into natural hazard risk factors and identify the needs of planners and emergency managers at local, regional, state, and federal levels.

Specifically, FEMA convened three working groups composed of intended users, subject matter experts, and interested stakeholders from all levels of government, private industry, nonprofits, and academia. Each group was responsible for an aspect of the NRI methodology—Natural Hazards, Social Vulnerability and Community Resilience, and Data Analytics. Experts in each group helped guide data selection, analysis methodology, and technical capabilities. For example, the Natural Hazards Working Group assessed and recommended datasets associated with the identified 18 hazard types selected and determined the best ways to incorporate associated data.

Separately, FEMA relied on subject matter experts to conduct comprehensive reviews of NRI methodologies to determine the best ways to measure risk and the most valuable datasets for hazard mitigation. For example, from July through September 2019, more than 40 experts participated in over 20 review sessions to help reach concurrence on the validity and value of the NRI dataset.

Following final agreement on the methodology and data sources to assess the risks for the selected natural hazards, in November 2020, FEMA announced the availability of the NRI with limited access to data. In August 2021, FEMA released a full web application that enhanced data and report functionality.

Amendments to Stafford Act and Public Comment Period

In 2022, the Community Disaster Resilience Zones Act of 2022 amended the Stafford Act with a section that directed the President to designate community disaster resilience zones in the nation’s most at-risk and in-need communities.[13] Among other requirements, the law mandated the creation of publicly available products that define natural hazard risk across the nation and include ratings and data for loss exposure, social vulnerability, and community resilience.[14] FEMA officials told us that they designated the NRI to be the mechanism to meet the act’s requirements because its methodology was already compatible with those requirements.

The 2022 act also directed FEMA to review and receive public input on the underlying methodology and data it would use to designate Community Disaster Resilience Zones.[15] Accordingly, in 2023, FEMA sought public input on the methodology and data used for the NRI through public engagement sessions and a notice and request for information published in the Federal Register.[16]

Integration with Resilience Analysis and Planning Tool

In December 2025, FEMA integrated NRI results and the datasets that comprise the index into the Resilience Analysis and Planning Tool (RAPT). This tool offers a different set of data than the NRI does, such as real-time weather and infrastructure, for a different view of discrete risk drivers. While some NRI data is pre-loaded into the RAPT, users must activate available hazard and census tract data to conduct more complex comparisons of different risk factors using the tool’s built-in capabilities. According to FEMA, this change was part of ongoing efforts to streamline resources and usable resilience planning tools.

Alongside this integration, FEMA updated NRI data to make improvements related to hazard data and methodologies. According to FEMA, key updates include improved methods for assessing risks from hazards like tsunamis, inland flooding, landslides, and volcanic activity. For example, the tsunami data set underwent its first comprehensive national review, which FEMA officials say improves its accuracy, while volcanic hazard data have been significantly expanded. Other updates include enhanced frequency estimates and geographic coverage for disasters like winter weather, wildfire, lightning, heat and cold waves, and improved historic loss ratios for all hazards.

FEMA Has Articulated the NRI’s Purpose, but Has Not Provided Guidance on Using Results in Decision Making

FEMA Has Defined and Communicated the Purpose of the NRI

Our analysis identified defining purpose, scope, and use—describing why a risk assessment is needed, how to use it, and what it includes—as a leading practice. For example, ISO standards state that organizations should define the scope of a risk assessment to determine what risks should be included or excluded and why.

We found that FEMA took steps to define and disseminate information about the purpose and scope of the NRI and provided additional information on the methodologies and data used to inform the index. For example, according to FEMA’s publicly available technical documentation for the NRI, its purpose was to create a “broad, holistic view” of natural hazard risks that considers how social factors could affect communities. The NRI technical documentation and public-facing information on the former NRI website also described the kind of information contained in the index and how it could potentially be used by emergency management professionals and the public.

In NRI technical documentation both before and after the integration with the RAPT, FEMA described the NRI as a tool to support a “multi-hazard view of risk” with capabilities to measure likelihood, consequence, social factors, and resilience. Further, in December 2025, FEMA released two fact sheets that explain the benefits of the NRI in risk communication and hazard mitigation planning. For example, according to one fact sheet, relative risk scores can help public officials communicate with their constituents about the importance of resilience investments.

Finally, FEMA has taken steps to help prevent inappropriate or inaccurate user interpretations of NRI data. Specifically, the NRI technical documentation includes disclaimers to address misunderstandings of the tool’s capabilities. For example, the documentation states that the tool cannot be used to predict future outcomes. FEMA documentation also disclosed limitations by explaining that the NRI does not reflect intricate interdependence between communities.

FEMA Did Not Consider What Users Would Need to Apply NRI Results in Decision Making

Our analysis identified the incorporation of user perspectives to better understand their needs in order to ensure they can use risk assessment results effectively as a leading practice. For example, OMB standards state that agencies should consider the public’s perspective on the uses of information when making decisions about its usefulness and dissemination. ISO standards state that organizations should explicitly account for how risk information could be interpreted and used as part of a consideration of human factors when planning a risk assessment.

We found that FEMA did not consider what information users would need to help them understand how to tangibly apply NRI results when making decisions about how to reduce risk. Moreover, FEMA did not explain how users should apply its three separate risk information tools—the RAPT, NRI, and Hazus—in conjunction with one another for the most effective risk insight. During our review, FEMA officials told us that all FEMA’s risk assessment tools were meant to complement each other, and that their functions had begun to converge with one another. They acknowledged the need for greater communication with users to demonstrate how to leverage each tool for different missions. FEMA officials also told us that their vision for the NRI was that decision makers would be able to use its data to inform their decisions on risk reduction. Beyond FEMA’s role as a source of information for the public, however, officials said they did not plan out or diagram all the potential use cases of the NRI during its development, nor did agency leadership dictate the specific purpose of the tool.

Integrating NRI data into the RAPT is a step in the direction of supporting users’ ability to effectively use the separate risk insights each tool provides. The guidance FEMA released following the December 2025 update to the NRI notes that the integration allows users to explore NRI results with additional demographic, hazard, and geographic boundary layers in the RAPT, which can help pinpoint the underlying drivers of risk. For example, FEMA guidance states that a user can combine NRI extreme heat data with the RAPT’s population layers to review the extent of extreme heat exposure for areas with high populations aged 65 and over.

However, although FEMA updated the NRI’s technical documentation to address this integration, the agency did not provide users with specific guidance and illustrative examples for applying NRI results to make decisions pertaining to risk, either alone or in conjunction with Hazus and RAPT results. Although FEMA issued two fact sheets that describe the NRI’s value as a risk information tool—one for hazard mitigation and one for risk communication—they provide high-level and general information about the NRI’s purpose and scope without guidance for specific application of its results.

Emergency management professionals told us that FEMA does not provide guidance about how to use NRI data, which would help address their needs for using the tool to inform hazard mitigation planning. In a group interview convened by the International Association of Emergency Managers, members told us that the NRI is useful for communities with the capacity to understand and apply the results.[17] However, these members also said that although FEMA publishes large amounts of information regarding the NRI, many communities do not have the capacity to engage with and absorb all the materials. In addition, members said many communities do not have the expertise needed to apply the results meaningfully while navigating their limitations. In written comments based on a solicitation from the National Emergency Management Association to its members, some potential users shared with us that the NRI provides minimal value in their hazard mitigation planning and they were not certain where it fit in their planning processes.

When we discussed these challenges with FEMA officials, they acknowledged that there are several potential examples of how the NRI could be used, but they have not focused on helping users like state and local hazard mitigation and resilience planners understand how to apply the information, such as collecting and sharing use cases in a more systematic and wide-ranging manner to demonstrate effective applications for other users.

FEMA officials told us that the primary driver for the creation of the NRI was to fill a perceived gap in available risk information that integrated social vulnerability and community resilience with measures of hazard frequency and expected losses. Officials also noted that the NRI is a resource for communities that do not have access to analytical resources to consolidate and evaluate numerous data sets, and users should consider other information and tools, in conjunction with NRI data. Officials further said that the presentation of NRI data was intentional to account for the myriad needs and use cases of its users, and that this allows non-federal stakeholders to replicate the NRI’s results using location-specific data.

However, the lack of guidance on applying results alone or in conjunction with other risk information tools, with common use case examples, undermines the NRI’s perceived utility. Further, it limits the understanding of users—such as state and local hazard mitigation and resilience planners—on how to apply NRI results effectively when deciding how to reduce risk.

FEMA Used Diverse Sources to Design the NRI, but Does Not Consistently Conduct Sensitivity Analyses to Validate Results

FEMA Reviewed State Hazard Mitigation Plans and Academic Literature to Design the NRI

Our analysis identified consultation of diverse and sound sources when designing risk assessments as a leading practice. For example, ISO standards state that organizations base decisions on information gathered from a variety of sources, such as literature reviews, observations, and expert opinion. Similarly, data used for the assessment should be collected and generated using appropriate statistical and research methods.

FEMA established and followed a defined process with set criteria while initially designing the index. To inform selection of natural hazards for inclusion in 2016, FEMA officials identified the most common natural hazards and potential risk components in FEMA-approved State Hazard Mitigation Plans for all 50 states.[18] Based on this review, according to FEMA officials, they identified and selected 18 natural hazards that were included in at least half of the state plans or those that were deemed to be of regional significance like hurricanes and tsunamis. They excluded non-natural hazards, such as dam and levee failure, as well as hazards that lacked national public datasets like subsidence (i.e., when the ground compacts or sinks).

In 2017 FEMA officials reviewed various hazard mitigation and emergency management academic literature to identify multiple relevant datasets, risk indexes, and other sources. Officials used this review to identify important risk indicator categories (e.g., economic and social) and specific indicators, such as income and housing. According to FEMA officials, they continue to periodically review relevant literature to improve the NRI’s methodology and data used to develop its risk profiles. For example, FEMA updated NRI earthquake risk calculations based on updated 2023 data from the U.S. Geological Survey.

FEMA Obtained Subject Matter Expert Input on Data Sources and Methodologies

Our analysis identified engaging with appropriate subject-matter experts and using their feedback to inform risk assessment design as a leading practice. For example, ISO standards state that such experts can provide input on risk model components, analysis methodology, and appropriate data sources.

FEMA solicited input from a wide range of experts to develop the NRI’s methodological and technological foundations and considered the uncertainties of hazard data sources in that process. In 2017, FEMA convened three working groups responsible for the methodologies used for each of the three component pieces of the index. FEMA selected group members based on their technical expertise in disciplines needed to build and validate the NRI’s core components. For example, FEMA officials said they included hazard scientists to define annualized frequency and geospatial analysts to translate hazard footprints into realistic areas of impact.

The Natural Hazards Working Group assessed and recommended datasets associated with the 18 hazard types, while the Social Vulnerability and Community Resilience Working Group reviewed and evaluated which indices should be used as source data for those components.

Finally, the Data Analytics Working Group oversaw spatial processing, normalization, and aggregation of data to determine how the NRI would calculate risk and integrate datasets identified by the other two working groups.

According to FEMA officials, about 80 technical experts worked across these groups to provide input to the risk assessment design that underlies the NRI. This included identification and selection of appropriate datasets and indices to incorporate; definitions of index components; and data management strategies. FEMA officials added that the key objective of the working groups was to ensure the NRI used vetted risk equations and that factors were not inconsistently interpreted across the 18 hazard types.

FEMA Verified and Validated NRI Outputs

Our analysis identified verifying and validating information used for risk assessments, including sources, assumptions, and methodologies, as a leading practice. For example, ISO standards state that organizations should verify the analysis was done correctly and that the proper methods, models, and data were used.

FEMA officials told us they use a multi-step data review process to identify, evaluate, and correct potential issues that could unintentionally affect NRI hazard calculations and risk scores. First, FEMA conducts a systematic review of the origin, structure, and limitations for each hazard data set. This includes examining data collection steps and consulting with data providers to understand potential inaccuracies. This step enables them to trace results to original records in raw source data in cases where unusual values or swings appear in NRI results and helps to confirm whether anomalies reflect real-world conditions or data errors, according to officials.

FEMA officials said they then adjust hazard methodologies by overriding or excluding problematic elements if testing reveals errors or misleading patterns in source data. According to officials, this can help address situations when raw data produces inflated or deflated expected annual loss and risk scores. Finally, officials said they then evaluate these hazard methodologies through multiple forms of validation. This includes checking whether estimated hazard frequencies follow known geographic and historical patterns; comparing Expected Annual Loss estimates against documented annual averages; and conducting testing against historic loss ratio methodology. These techniques help identify whether the index’s outputs are systematically higher or lower than expected, providing an additional layer of quality control.

FEMA also reviewed the data, tools, and methodologies used to inform NRI risk information after initial release of the index. For example, in January 2022, FEMA established a new Social Vulnerability Working Group based on advances made in social vulnerability modeling for natural hazards since the initial working group sessions in 2017.[19] As part of that effort, FEMA officials conducted a sensitivity analysis to examine the correlation between different social vulnerability data sources to help guide their decision making. Based on the group’s recommendations, FEMA began using a social vulnerability index developed by the Centers for Disease Control and Prevention to incorporate social vulnerability into the risk calculations.

Additionally, FEMA established an NRI Technical Review Panel to periodically review and recommend updates to hazard source data and assessment methodologies. The panel held its initial session in September 2024, with principal member meetings in January 2025. The meetings addressed updates to hazard data sources (such as tsunami hazard data) and historic loss ratio methodology (which is part of the formula for the Estimated Annual Loss component of the risk model).

As part of the review panel effort, in 2024, FEMA introduced a formalized process in which subject matter experts conduct in-depth reviews of specific hazard data and methodologies. Specifically, for components marked for significant methodological overhauls, the NRI team established hazard-specific working groups to systematically collaborate with subject matter experts from professional organizations, state and local governments, and federal agencies. FEMA selected tsunamis and inland flooding as the first hazards to review under this process, resulting in increased collaboration with experts to address data and methodology concerns, according to FEMA documentation.

In May 2026, FEMA officials told us that there is not currently a plan in place to update the NRI. However, officials acknowledged the requirements to review and update risk assessment products to ensure compliance with the Community Disaster Resilience Zones Act of 2022.[20]

FEMA’s defined processes for reviewing hazard source data before their inclusion in the NRI was consistent with leading practices that help ensure accurate, nationally consistent risk information. Continuing with such practices to validate and verify data and methodologies, including involving expert stakeholders in refining and enhancing, will be important to ensure the ongoing quality and integrity of the NRI.

FEMA Did Not Consistently Use Sensitivity Analysis to Validate Results

With respect to verifying and validating information sources, ISO standards recommend that organizations conduct a sensitivity analysis to evaluate the significance of uncertainties in data or in underlying assumptions of risk analysis. This analysis can also be used to test the sensitivity of results to inputs that could influence them. Our analysis also identified disclosure of assumptions, limitations, and uncertainties that could affect results as another leading practice. For example, OMB standards state that organizations should provide sufficient transparency so that a qualified member of the public could conduct independent re-analysis or, if that is not possible, they should document the process, and disclose specific sources, methods, and assumptions.

Although limitations, uncertainties, and assumptions are an inherent aspect of conducting complex risk assessments, FEMA has not consistently used sensitivity analyses when designing and changing the NRI. FEMA officials acknowledged natural hazard risk modeling has challenges related to uncertainty and inaccuracy due to the inherent limitations in the application of a consistent and national-scale dataset.

Based on our analysis of FEMA’s matrix that documented comments in response to the Federal Register notice and request for information, working group deliberations, and interviews with State Hazard Mitigation Officers, we also found that potential NRI users raised concerns about some of the assumptions and results of the NRI. For example, some potential users raised concerns about how NRI calculations might over or under-represent risk, as well as uncertainty introduced by inconsistencies in the quality and quantity of natural hazard data available in different areas of the country. In addition, some State Hazard Mitigation Officers also told us that national-level data presented by the NRI misrepresents sparsely populated areas due to the lack of consistent data in those locations.

Moreover, potential users raised concerns about the underlying assumptions regarding how NRI weighs each of its risk components relative to each other. For example, some comments in response to the Federal Register notice and request for information suggested that FEMA should take steps to improve expected annual loss estimates and ensure risk is not overestimated. Additionally, comments suggested that equal variable weighting for social vulnerability does not work well for natural hazard risk assessments because it may not accurately measure factors that could help identify the most at-risk communities. FEMA highlighted weighting concerns for social vulnerability as one of the major themes from the comments it received.

FEMA officials said the structure of the NRI’s calculations inherently accounts for relative influence across the index’s components. They described a methodology that establishes the Expected Annual Loss as the core of the calculation. However, officials did not address why they did not conduct sensitivity analyses to verify the structure they chose or whether weighting might help address some of the issues potential users and public commenters have identified.

FEMA recently made a substantial change to the primary data source for one of the NRI’s three risk components and did not conduct a sensitivity analysis to validate the decision. In November 2025, FEMA changed the social vulnerability data source to the U.S. Census Bureau’s Community Resilience Estimates product.

When FEMA made a similar change to the social vulnerability data source in 2022, it used sensitivity and other analyses to understand the effects, including determining how the relative risk ratings would change when using each source. When selecting the prior social vulnerability data source—the Centers for Disease Control and Prevention’s Social Vulnerability Index—the Social Vulnerability Working Group considered the U.S. Census Community Resilience Estimates product and found it unsuitable. Specifically, the group found that the Estimates did not reflect the differences among impacts across communities, which was not consistent with the evaluation criteria the group had established to select a social vulnerability data source. Moreover, the group expressed concern that potential inaccuracies and errors in the Census Bureau’s source data and social vulnerability models may cause more vulnerable communities to be deemed less vulnerable and vice versa.

According to FEMA officials, they adopted Community Resilience Estimates for the social vulnerability component in 2025 to better align with administration priorities while remaining compliant with requirements from the Community Disaster Resilience Zone Act of 2022. Officials said they evaluated this data source internally and found it suitable for the NRI, noting that it contains individual and household-level components of social vulnerability, such as poverty, education, and other factors. According to officials, they evaluated how vulnerability and community resilience scores changed at the county level with the adoption of the Estimates. Although this rate change analysis is useful for providing some understanding of the effect on the change, it does not test the sensitivity of results to the different inputs—the Social Vulnerability Index and the Community Resilience Estimates.

By conducting sensitivity analyses in some contexts and in deliberations over methodological approaches, FEMA officials and experts have demonstrated the value of the analyses. Consistent use of sensitivity analysis and disclosure of its outcomes across all major assumptions, uncertainties, and significant changes to calculations would enhance the index’s overall utility. It would also enhance both FEMA and user understanding of effects on the potential accuracy of NRI results and how those factors could affect risk scoring in their specific circumstances, such as methodological choices that could lead to over- or under-estimation of specific aspects of hazard risk.

FEMA Has Engaged Users and Experts but Could Strengthen User Trust and Confidence

FEMA has Undertaken Efforts to Prevent Bias and Ensure Conflict of Interest Disclosure

Our analysis identified taking steps to ensure experts consulted for risk assessments minimize personal biases and disclose potential conflicts of interest as a leading practice. For example, OMB standards state that if agencies use experts to review risk assessment information, participants must disclose sources of personal and institutional funding to ensure objectivity.

FEMA officials told us they took steps to mitigate stakeholder bias during the development of the NRI. They relied on multi-disciplinary expertise of the three working groups to identify and mitigate biases, overconfidence, groupthink, and other influencing factors. Further, officials said that the working groups’ membership of subject matter experts from diverse fields brought varied perspectives and technical expertise, reducing the risk of groupthink and ensuring robust decision-making.

In addition, the guiding documentation for the Technical Review Panel, which established a code of conduct for its members, states that panel members must disclose conflicts of interest or any circumstances that might be perceived as constituting a conflict of interest as soon as possible. FEMA officials also described the controls they established to ensure panel members remain impartial and neutral. For example, members do not receive compensation for their involvement in the NRI reviews and cannot use panel information externally without FEMA’s permission. Further, FEMA records meeting notes and reviews all panel feedback before it incorporates updated hazard data into the NRI. According to FEMA officials, these mechanisms reduce the chance that an individual’s external interests could disproportionately shape NRI methods or outputs.

FEMA’s efforts are consistent with leading practices for ensuring objective input by mitigating personal bias and disclosing conflicts of interest. Maintaining these practices for future data updates will be an important step for continued confidence that both the inputs and outputs of the NRI meet objectivity standards.

FEMA Has Taken Steps to Disclose and Document Sources, Assumptions, and Limitations

OMB standards state that agencies should disclose the sources of information they disseminate and provide clear explanations of key assumptions, uncertainties, and probabilities of risk projects. Additionally, our analysis identified maintaining appropriate documentation for risk assessments as a leading practice. For example, ISO standards state that organizations should document and provide the reasoning behind decisions made during the assessment development process.

We found that FEMA disclosed substantive information about the NRI’s technical specifications in its publicly available documentation, which included disclaimers about its limitations. For example, FEMA described formulas that make up the NRI’s results, data sources, assumptions, and limitations inherent to hazard data sets, including potential misinterpretations. The technical documentation also discusses inherent uncertainty and inaccuracy in efforts to model natural hazard risk for the entire country. It details modeling uncertainties, assumptions, limitations, and future considerations for each hazard. For example, the inland flooding section explained that loss calculations may over- or underestimate damages because they rely on generalized building types rather than area-specific data.[21]

FEMA’s disclosure and documentation of key aspects of the NRI, such as assumptions and limitations, is a positive step that aligns to leading practices for disseminating information. Continuing to provide transparent information about assumptions, limitations, and uncertainties will position users to assess how to interpret results in their specific geographic and demographic contexts. It may also increase their trust and confidence in, and ability to apply, the results.

FEMA Lacks a Mechanism to Solicit Feedback on an Ongoing Basis

Our analysis identified collecting and incorporating user perspectives on an ongoing basis as a leading practice. For example, the ISO standards state that organizations should collect input from users routinely and continuously to obtain support for risk assessment results and obtain feedback over time to continually verify the risk model.

FEMA solicited and received feedback about the NRI at multiple points with user communities while developing the index and following its release. For example, during development, FEMA organized focus groups and a series of workshops of planners and emergency managers to inform choices about the purpose and functionality of the NRI. According to FEMA officials, many of the participants represented state-level emergency management agencies or associations, or federal officials who, in turn, worked with and could channel the needs of these kinds of users. After the NRI’s release, FEMA also hosted multiple public webinars in 2021 and 2023 to demonstrate to prospective users how to use the index, demonstrate and explain any changes, and solicit comments and questions to guide future enhancements.

FEMA also solicited feedback on the NRI through the public comment process in 2023, following its designation as the tool for identifying Community Disaster Resilience Zones in accordance with federal statute.[22] According to FEMA, the agency received responses from over 100 commenters, including stakeholders from federal, state, local, tribal, and territorial agencies; private industry; non-governmental organizations; and the public. Following the close of the public comment period, FEMA officials documented over 600 individual responses received and organized them by the affected NRI component, timeframe and duration of action, and level of effort required. This resulted in 152 individual items to address. FEMA officials said they took actions to address some of these recommendations, such as providing additional details in public communications about how the NRI incorporates building replacement costs in its calculations. However, as of April 2025, 14 of the 152 action items were marked complete, with the remaining either in progress, not started, or delayed pending future updates to the index.

Although the agency has taken various steps to obtain and address feedback, FEMA does not have an established mechanism to systematically collect ongoing user feedback and use it for continuous NRI improvement. For example, according to FEMA officials, input from emergency management agencies and associations was critical to informing the planned scope of the NRI’s capabilities during its initial design. However, State Hazard Mitigation Officers told us they have not had an opportunity to provide feedback on the utility of the NRI, nor are they aware of any current FEMA mechanism that to collect such feedback. State officials expressed a range of ideas about how the NRI might provide them with more useful information.

FEMA officials told us that they believed expert input during development, post-release webinars, and the single public comment process, along with periodic ad hoc outreach from users, to be sufficient to incorporate user perspectives. However, these efforts do not provide a mechanism to allow for the ongoing solicitation and collection of user feedback. FEMA officials also cited the NRI help page and email inbox as important mechanisms for feedback. While these tools can help the agency collect feedback, they do not constitute a method for FEMA to systematically and consistently collect feedback from NRI users, like state, territorial, tribal, and local officials; emergency managers; and other stakeholders who are responsible for assessing their risk to improve community disaster resilience. Moreover, while FEMA implemented some action items identified through the public comment period from 2023, the majority of corrective action remain open.

The recent changes and updates to NRI, including integration of the NRI dataset into FEMA’s RAPT, replacement of the social vulnerability data source, and other methodological updates present an opportunity for FEMA to collect additional user feedback that would provide more complete perspectives to help future updates to the NRI. Establishing a mechanism—such as a process, strategy, or user group—to systematically solicit, collect, and incorporate feedback from users who rely on NRI data for decision making would help FEMA ensure that updates to the tool provide the most valuable information for its users and address their hazard mitigation and resilience planning needs.

Conclusion

The NRI is a useful tool for FEMA to provide greater information about natural hazard risk to the emergency management community and inform potential resilience investments. Although FEMA has taken steps to publicly provide information on the purpose, scope, and methodology of the NRI, the lack of guidance on applying results alone or in conjunction with other risk information tools, with examples of common uses, undermines the NRI’s perceived utility. In addition, the lack of consistent sensitivity analyses on uncertainties in data and the impact of changes to data sources limit potential understanding of their effects for FEMA and users and potential accuracy of NRI results. Finally, without mechanisms to systematically collect feedback to inform updates and improvements to the NRI, FEMA is not well-positioned to assess the value of the index to users and thus know the extent to which the tool addresses their hazard mitigation and resilience planning needs.

Recommendations for Executive Action

We are making the following three recommendations to FEMA:

The FEMA Administrator should provide additional information for users—such as state and local hazard mitigation and resilience planners—based on common use cases, to help them understand how to apply NRI results effectively when deciding how to reduce risk. (Recommendation 1)

The FEMA Administrator should ensure the NRI program consistently uses and discloses the outcomes of sensitivity analyses to verify the NRI’s results and consider any significant changes to the index’s data sources or methodologies. (Recommendation 2)

The FEMA administrator should create a means—such as a process, strategy, or user group—to systematically solicit, collect, and incorporate user feedback while making ongoing NRI improvements and other updates. (Recommendation 3)

Agency Comments and Our Evaluation

We provided a draft of this report to DHS and FEMA for review and comment. DHS provided written comments, which are reprinted in appendix II, as well as technical comments, which we incorporated, as appropriate.

DHS concurred with our recommendation that FEMA provide additional information for users to understand how to apply NRI results. DHS stated it would update RAPT application documentation and user guides to help users understand how to use NRI data to reduce risk by December 31, 2027. If implemented, this action should address our recommendation.

DHS did not concur with our recommendation to ensure that the NRI program consistently uses and discloses outcomes of sensitivity analyses to verify NRI results and consider any significant changes to the calculations to the index’s data sources and methodologies. In its written comments, DHS stated that it conducted a sensitivity analysis for changes made to the NRI’s social vulnerability and community resilience datasets when the department last updated NRI data in December 2025. Further, DHS stated that the incorporation of the NRI into the RAPT application and lack of future ongoing updates means there is no longer a need for further such analysis of NRI data. DHS stated that FEMA will review the RAPT application and its datasets to ensure adherence to requirements from the Community Disaster Resilience Zones Act of 2022 that FEMA review and update applicable products at least every five years.

We maintain that DHS should implement this recommendation.

As technical and scientific information disseminated by the government, NRI data should meet utility, objectivity, and integrity requirements consistent with federal information quality standards. This includes disclosure of sources that can affect data quality and dissemination of any supporting data and models that the public can use to determine the objectivity of sources. Regardless of whether external users can access NRI results directly or within another application (such as the RAPT), taking steps to ensure that data meets information quality standards would help to address potential concerns about the utility, objectivity, and integrity of NRI results. Consistent use of sensitivity analysis and disclosure of its outcomes across all major assumptions, uncertainties, and significant changes to calculations would address such concerns. It would also enhance both FEMA and user understanding of effects on the potential accuracy of NRI results.

Further, based on our review of documentation provided by FEMA, we note that FEMA officials compared the vulnerability ratings from each source in conjunction with the change from the Social Vulnerability Index to the Community Resilience Estimates. This analysis identified counties (more than half) with different county-level social vulnerability values after substituting the new data source. However, FEMA did not evaluate the potential changes to the composite risk scores with the new data source or other concurrent data updates. As described in the report, the purpose of a sensitivity analysis is to test the impact of changing inputs or assumptions to the model results. The comparative data analysis that FEMA conducted for the data update, while valid, was not sufficient to meet the requirements of a sensitivity analysis. In this context, a sensitivity analysis would examine how different inputs like social vulnerability ratings from two different data sources—the Social Vulnerability Index and the Community Resilience Estimates—would influence NRI composite risk scores. FEMA did not provide evidence that it conducted this type of analysis prior to selecting the new data source for social vulnerability in 2025 or upon its incorporation into the NRI alongside the last major data update.

DHS concurred with our recommendation to create a means to systematically solicit, collect, and incorporate user feedback while making ongoing updates and improvements to the NRI. DHS stated that as FEMA creates regular updates to the RAPT application and NRI dataset, it will engage user groups as appropriate to solicit, collect, and incorporate user feedback, including feedback on NRI data, by December 31, 2027. If implemented as a systematic and ongoing process to routinely collect information from user groups, this action should address our recommendation.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, the Administrator of FEMA, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at CurrieC@gao.gov. Contact points for our Office of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to the report are listed in appendix III.

Chris Currie

Director, Homeland Security and Justice

This report assesses the extent to which the Federal Emergency Management Agency’s (FEMA) actions are consistent with standards and leading practices for (1) defining the purpose of NRI risk information for decision making; (2) designing a sound risk assessment model and ensuring quality information has been used in the development, operation, and maintenance of the NRI; and (3) communicating and engaging with relevant stakeholders about the NRI.

To address all three objectives, we identified leading practices for risk assessments and information quality. We obtained documentary and testimonial evidence from FEMA regarding the actions it took and management practices it had in place as it developed, operated, and maintained the NRI, and we compared FEMA’s actions to those leading practices.

To identify leading practices most applicable to the nature of the NRI, we examined FEMA’s actions to develop, maintain, and operate the NRI within the broader context of whole-of-nation disaster risk reduction efforts. To refine that context, we drew on principles from GAO’s Disaster Resilience Framework, which include the ideas that information with meaningful value for national disaster resilience should be received by users as reliable and authoritative.[23] To align with the framework’s principles, this kind of tool should also provide information that can inform selection of risk-reduction alternatives and provide information about interrelationships within and across systems and jurisdictions.

To identify potential sources of leading practices that correspond to the Framework’s context, we considered available documentation from Office of Management and Budget (OMB), the National Academies, Department of Homeland Security (DHS), and FEMA, and the International Organization for Standardization (ISO) that were directly relevant to effective risk modeling, risk management, and quality information. Through this process, we did not identify a specific established set of leading practices for multi-hazard risk models used to inform broad risk-reduction goals.

We thus adapted established standards relevant to risk assessment and information quality that would operationalize “leading practices” most applicable to the nature and purpose of the NRI. Accordingly, we considered a variety of sources that presented standards, principles, and practices related to one or both areas (risk assessment and information quality). In determining which of these sources were most useful, we considered: (1) how comprehensively a single source covered the topics of risk assessment and information quality; (2) the broad acceptance of the sources and their publishers; (3) the ability of standards, principles, or practices presented in the sources to be translated into clear process-oriented activities; and (4) the ability to adapt standards, principles, or practices across different risk contexts (e.g., enterprise risk management criteria that are presented broadly enough to inform a hazard risk context).

Using these principles, we selected the following key guidance documents as the basis for our leading practices criteria—(1) internationally recognized risk management process components established by the ISO, specifically ISO 31000, Risk Management — Guidelines (2018), and ISO 31010, Risk Management — Risk Assessment Techniques (2019); and (2) the OMB’s memoranda issued to federal agencies to meet requirements under the Information Quality Act; specifically Guidelines for Ensuring and Maximizing the Quality, Objectivity, Utility, and Integrity of the Information Disseminated by Federal Agencies (2002) and Improving Implementation of the Information Quality Act (2019).[24] We then assessed whether FEMA’s actions aligned with the leading practice or standard as envisioned in the source language from these criteria.

ISO 31000’s guidelines describe steps organizations should consider when identifying, analyzing, and evaluating risks, and selecting and applying systematic techniques for risk assessment. ISO also published a companion framework—ISO 31010, which provides detailed supporting guidance to 31000. The 31010 guidance describes standards, requirements, factors, and limitations of the risk assessment process. It also includes a selection of risk assessment techniques with descriptive information about how they should be used, the likely output, and the strengths and limitations of those models.

OMB’s information quality standards, published in 2002 and updated in 2019, require federal agencies to ensure and maximize the quality, utility, objectivity, and integrity of information they publicly disseminate in accordance with federal law. In addition, as provided by the Information Quality Act, OMB guidelines require federal agencies to issue their own implementing guidelines. Accordingly, we also consulted DHS-issued information quality guidelines, published in 2011 and 2019 to implement OMB’s requirements; the guidelines adopted the language and standards used by OMB in its instruction to DHS components, such as FEMA.

We analyzed the selected ISO and OMB documents to identify common categories of practices between them which we used to organize leading practices criteria into three main categories for assessing FEMA’s development, operation, and maintenance of the NRI: (1) providing clear and specific information about the context and purpose of the information; (2) soliciting information from stakeholders (experts and users) and ensuring transparent communication to users; and (3) applying generally accepted practices for risk assessment and production of scientific information.

To identify specific practices relevant to the NRI for all three categories, two GAO analysts independently reviewed the complete set of requirements to identify the main principles stated and determine whether each was relevant to the NRI’s context. The analysts then reconciled any disparate findings and consulted a GAO subject matter expert where any uncertainty remained.

Next, an analyst independently translated the relevant standards to plain language that describe how a risk information tool like the NRI should align to the standards described by the ISO and OMB publications. A GAO subject matter expert in risk assessment (for ISO) and methodologist (for OMB) verified the translations.

Using the plain-language practices, an analyst made a determination for each practice as to whether FEMA’s actions met, partially met, or did not meet the practice based on evidence collected from FEMA documents and interviews (as described below). A second analyst or subject matter expert (in the case of ISO) also independently verified these determinations.

To identify the actions FEMA had taken relative to the leading practices we identified, we analyzed relevant guidance and policies from FEMA related to the NRI, including the latest version of the tool’s technical documentation published in December 2025 and other available information that describe the development history and current capabilities of the NRI. We also analyzed documentation related to how FEMA monitors NRI performance, data quality and reliability, and user access. We analyzed documents that described FEMA’s communication and work with subject matter experts and other relevant stakeholders to select natural hazard data, conduct technical reviews, or ensure information quality prior to public release, as well as subsequent efforts to improve the NRI’s methodologies and data sources. To supplement our analysis of these documents we interviewed and obtained written responses from officials in FEMA’s Resilience Directorate, as well as other FEMA components, on the intended, current, and planned capabilities of the NRI.

Finally, to obtain the views of emergency management stakeholders from states and localities, we interviewed State Emergency Directors and State Hazard Mitigation Officers with first-hand knowledge of FEMA hazard mitigation programs and risk information tools. Specifically, we conducted four interviews with State Hazard Mitigation Officers from Utah, Michigan, California, and North Carolina. We selected these officers based on their work in regions that have experienced high-profile, natural hazards in the past few years (e.g., hurricanes in FEMA Region 4, wildfires in Region 9).

We also interviewed a group of emergency managers assembled by the International Association of Emergency Managers. The group included emergency managers from counties in Minnesota and Ohio. Additionally, we solicited written comments about the NRI from a group assembled by the leadership of the National Emergency Management Association. The group included seven State Emergency Directors and two State Hazard Mitigation Officers from South Dakota, Utah, Kansas, Washington, Pennsylvania, and Connecticut.

During the interviews we used standardized questions regarding their knowledge of the NRI, its utility as a tool to inform hazard mitigation planning for their states, and general feedback on its capabilities and FEMA’s management of the index. We used their responses to identify general themes about the NRI’s usefulness and challenges experienced by stakeholders in their respective geographic areas of responsibility. The information we obtained from these interviews is not generalizable, but it provided insights and context concerning the NRI’s capabilities and FEMA’s communications and outreach about how the NRI can assist potential users in hazard mitigation planning or other risk reduction activities.

We conducted this performance audit from January 2025 to September 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

GAO Contact

Chris Currie, CurrieC@gao.gov

Staff Acknowledgements

In addition to the contact named above, Kathryn Godfrey (Assistant Director), Jason Blake (Analyst in Charge), Phoebe Iguchi, Ryan Basen, Eric Hauswirth, Amber Sinclair, Lijia Guo, Tracey King, John Vocino, Hannah Weigle, Casie Venable, and Yuchan Son made key contributions to this report.

This appendix contains credit, copyright, and other source information for images, tables, or figures in this product when that information was not listed adjacent to the image, table, or figure.

The source for all clipart listed below is Icons-studio/stock.adobe.com.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us