The Threshold Was the Point
In 1988 Congress decided that FEMA’s disaster recovery apparatus was too slow, so it built a shortcut. Section 422 of the Stafford Act let the agency skip the paperwork for any “small project,” accepting an applicant’s own cost estimate instead of demanding receipts, inspections, or anything resembling scrutiny. The threshold started at $35,000. It has been raised six times since, most recently in 2022, when FEMA lifted the small project ceiling to a full $1 million, a number that would have seemed unthinkable to whoever wrote the original rule.
The logic was always the same; move fast, trust the applicant, save the field inspections for the projects big enough to matter. What nobody seems to have asked is what happens when a project is engineered to sit precisely at the line that separates “trust me” from “prove it.”
The DHS Office of Inspector General just answered that question in OIG-26-25, and the answer is not flattering. Auditors sampled 20 small projects across every FEMA region and found problems in 12 of them, questioning $3.1 million of the $8.9 million obligated (a rate that would get a private contractor blacklisted). Two projects in the sample deserve special attention, not because they were caught doing anything as crude as inventing storm damage, but because they expose the threshold itself as the vulnerability.
Exhibit One, the Bridge Built to Spec
Project number 240045, “Repair Bridge on Roy Brown Lane,” sits in FEMA Region 4. Its total project cost, as recorded in the OIG’s own appendix, is exactly $1,000,000. Not $998,000. Not $1,004,000. One million dollars, on the nose, the precise figure that separates a small project (light documentation, applicant estimates accepted at face value) from a large project (the kind that gets an actual FEMA cost review before the check is cut).
Maybe that number is coincidence. Bridges are expensive and round figures happen. But an applicant that lands its total cost exactly on a regulatory cliff edge is the textbook profile auditors call “structuring,” the same behavior banks flag when someone deposits $9,900 in cash nine days running to stay under the $10,000 reporting requirement. It does not prove intent. It does prove that the threshold, not the damage, may be doing the engineering.
Exhibit Two, the School That Cost Almost Twice the Cap
Project 173233, the Southwest Louisiana Charter College Prep site, tells a stranger story. Its total project cost was $1,873,814, comfortably inside “large project” territory. Yet it received small project treatment, and its federal cost share came out to $733,109, a reimbursement rate of roughly 39 percent. Every other project in the OIG’s twenty-project sample lands on the Stafford Act’s standard 75 or 90 percent cost share; this one does not, and nothing in the public record explains why.
Put the two exhibits together and you get a threshold operating in both directions at once. One applicant appears to have shaped its numbers downward to stay inside the light-touch lane. Another sailed nearly double the small project cap and still got waved through the same lane, at a reimbursement rate nobody else in the sample received. A door built to keep large, complicated projects out let a $1.87 million project walk straight past the guard.
The same undocumented trust shows up elsewhere in the sample, just in smaller dollar amounts. In Alabama, an applicant got $40,000 approved to install a pitched metal roof, then installed a cheaper flat, silicone-coated roof instead, after FEMA had already paid separately to remove the original roof under a different project. In New Hampshire, a town claimed storm damage to two miles of road and nine culverts; satellite imagery and an on-site inspection found damage to about a third of a mile and three culverts, a gap FEMA’s own simplified procedures were never built to catch, because simplified procedures do not ask for satellite imagery, they ask for a signature. None of that required a project engineered to a dollar figure. It only required an agency that had already decided, by policy, not to look.
It is worth noting where that guard was standing. Five of the twenty sampled projects, a quarter of the entire sample, came out of FEMA Region 6 (Louisiana and Texas), more than any other region, and Region 6 also produced three of the sample’s four utility projects, plus the levee case the OIG highlighted separately, in which a town’s claimed disaster damage predated the actual disaster by six months. A regional oversight gap is a management problem. A regional oversight gap sitting directly under the sample’s two biggest financial anomalies is a pattern.
What Twenty Projects Are Supposed to Tell Washington
The OIG’s sample was not a full census; it was 20 projects out of what is presumably thousands processed under simplified procedures since 2022. Auditors found trouble in 60 percent of what they looked at and said plainly that the full scope of wasted funds almost certainly is higher. That is not a rounding error in an otherwise sound program; that is an agency admitting its own sample size was too small to know how bad the problem actually is.
FEMA’s defenders will say the small project threshold exists because disaster survivors cannot wait for a bureaucrat to drive out and inspect a culvert while their town is still underwater, and they are not wrong. Speed matters after a hurricane. But speed and zero verification are not the same policy choice, and Congress did not authorize FEMA to accept an applicant’s word up to $1 million so that a charter school renovation could be waved through at a discount reimbursement rate nobody can explain, or so that a bridge repair could land, suspiciously, on the exact dollar that keeps it out of real review.
The OIG’s recommendations, as usual, will ask FEMA to tighten documentation requirements and improve its tracking systems. Tightened documentation is a fine start. It does not answer the harder question buried in this appendix, which is whether the $1 million line itself, the one Congress kept raising in the name of efficiency, has become less a speed limit than a target to aim for.
There is also the matter of what happens after the money is found to be wrong. FEMA has three years after a project’s completion to claw back improper payments administratively, absent evidence of fraud. That clock does not stop for a system migration, yet the same OIG report notes that FEMA closed 20 of 30 already-flagged de-obligation cases during a data migration without recovering the funds, only correcting most of them after auditors came looking, with three still unresolved as of last June. A three-year recovery window managed by an agency that loses track of its own flagged cases during a software update is not an oversight regime; it is a countdown timer nobody is watching.
None of this requires a villain. It requires only an incentive structure where the safest place for a project to live is just inside a line nobody checks, and the OIG’s twenty-project sample suggests applicants, whether by design or by drift, have found that address. Congress built the door to move money fast to towns that needed it. It did not ask what happens when the door itself becomes the destination.
Bureaucracies rarely get caught lying. They get caught doing exactly what the rules permit, at exactly the moment the rules stop looking.
