If you have looked up your county's disaster risk on a FEMA map, you have probably used the National Risk Index. It rates every county and census tract for 18 natural hazards, from floods to wildfire, and combines expected losses with how vulnerable and how resilient each place is. According to FEMA officials, it is "the only national-level index that combines disaster loss with social vulnerability and community resilience measures to score risk."
It is not only a reference. FEMA uses it to designate Community Disaster Resilience Zones under a 2022 law: census tracts with high hazard risk, high social vulnerability and low community resilience. State planners use it to decide where to spend on mitigation.
On September 10 GAO published a review of how it is built and kept.
What GAO found
Its inputs changed, untested. In late 2025 FEMA switched the index's source for social vulnerability to a Census Bureau product that a FEMA working group had looked at in 2022 and "found unsuitable." FEMA's own comparison found different social vulnerability values for more than half of counties. But "FEMA did not evaluate the potential changes to the composite risk scores," the numbers people actually see. GAO: "FEMA has not consistently used sensitivity analyses when designing and changing the NRI."
Users cannot do much with it. From the Fast Facts: "the tool doesn't help users, like emergency managers, apply its risk information." Some told GAO it provides "minimal value" for mitigation planning, and some state officials said national data "misrepresents sparsely populated areas."
Feedback went mostly unused. A 2023 comment period produced 152 action items. "As of April 2025, 14 of the 152 action items were marked complete."
It has stopped. "In May 2026, FEMA officials told us that there is not currently a plan in place to update the NRI." In December 2025 the standalone map was folded into FEMA's Resilience Analysis and Planning Tool. DHS's response adds that FEMA's authority to fund the index through the National Flood Insurance Program "expired in December 2025."
The recommendation DHS rejected
GAO made three recommendations. DHS agreed to two: guidance on how to use the results, and a standing way to collect user feedback, both by the end of 2027.
It rejected the third, to test the effect of changes before making them and disclose the results. DHS's reasoning, as GAO reports it: "the lack of planned NRI data updates removes the need for such analysis." GAO kept the recommendation, saying FEMA's comparison "was not sufficient to meet the requirements of a sensitivity analysis."
In other words, the index that decides the Resilience Zones had its inputs changed once without a test of the effect, and will not be updated again.
If you want your county's score
The standalone National Risk Index map no longer exists. The data, version 1.20, is in FEMA's Resilience Analysis and Planning Tool (linked below), where you have to switch on the hazard and census-tract layers yourself, and it is downloadable through OpenFEMA.
What the report does not show
- It does not find any county's score wrong. GAO's finding is that FEMA did not check what the change did.
- It does not say whether any Resilience Zone designation or funding decision changed as a result.
- It does not address FEMA grant programs or flood insurance rates.