Emergency and disaster procurement, explained

The call arrives before the paperwork does

The pattern is consistent. A county emergency manager, a state agency CIO, or a federal program officer calls a vendor they already know and asks whether the firm can start this week. There is no solicitation, no purchase order number, and often nothing signed. The buyer says the paperwork will catch up, and the vendor believes it, because in an emergency that is a reasonable thing for a decent person to believe.

The paperwork does catch up. It arrives as a monitoring visit, a single audit finding, or a call a year later saying the federal agency has questioned the cost and would like some of it back. By then the questions are not about whether the work was good. They are about which authority the buyer used, what the file said at the time, and whether the price can be shown reasonable by a standard written for a calm day.

What follows is drawn from the Federal Acquisition Regulation, the uniform grant rules at 2 CFR part 200, the Stafford Act and its regulations, and published Government Accountability Office work.

Two rulebooks, and the first question is which one you are under

Emergency work reaches a vendor through one of two channels. They have different rules, different auditors and different failure modes, and establishing which applies comes before scoping and pricing.

Direct federal contracts. A federal agency buys under the Federal Acquisition Regulation. A contracting officer signs. Emergency flexibilities come from FAR Part 18, and the money comes from an agency appropriation.

Federally funded state, local, tribal or nonprofit purchases. A grant recipient buys with federal grant money, most often disaster assistance. The FAR does not apply. The procurement standards at 2 CFR 200.318 through 200.327 do, along with the recipient's own procurement code. The recipient signs, owes the documentation, and gets audited.

The second channel is where most vendors get hurt. The buyer across the table does not think of themselves as running a federal procurement; they think of themselves as hiring somebody to fix a problem. The federal conditions ride along with the money either way.

What a declaration changes on the federal side

FAR Part 18 is short and worth reading in full. Subpart 18.1 lists flexibilities available in any contingency, most of which exist year-round and are simply underused: Federal Supply Schedule and multi-agency contract use, oral requests for proposals, letter contracts when performance must begin immediately (18.112), single-source purchases at or below the simplified acquisition threshold (18.110), waiver of bid guarantees, and the unusual and compelling urgency authority at FAR 6.302-2. Subpart 18.2 lists flexibilities that switch on only after a specific event: a contingency operation (18.201), defense against or recovery from a cyber, nuclear, biological, chemical or radiological attack (18.202), and an emergency or major disaster declaration (18.203).

The most visible change is dollar thresholds. The underlying statute is the special emergency procurement authority at 41 U.S.C. 1903, which names four qualifying categories. The FAR carries the operative amounts and adjusts them periodically for inflation, so confirm the current figure at FAR 2.101 before relying on a number from last year's memo.

Two conditions govern all of it. The head of the agency has to determine that the supplies or services support the qualifying event, and FAR 13.201(g) requires a clear and direct relationship to that purpose. A declaration somewhere in the country does not raise the threshold on unrelated buying.

Urgency is an exception to competition, not to documentation

FAR 6.302-2, unusual and compelling urgency, is the authority most often cited in the first week. It rests on 41 U.S.C. 3304(a)(2) or 10 U.S.C. 3204(a)(2) and applies where the government would be seriously injured unless the number of sources is limited. Three limits travel with it.

The agency still has to request offers from as many potential sources as is practicable. A written justification is still required under FAR 6.303 and 6.304. And the period of performance cannot exceed the time necessary to meet the urgent requirement, and in no case more than one year including all options, unless the head of the agency determines that exceptional circumstances apply.

That one-year ceiling surprises vendors. Work that began as emergency response and quietly became the ongoing system of record has outrun its authority. The recovery is a competed follow-on, far easier to win having spent the emergency building a clean, transferable record.

Grant-funded work: four ways to buy, and the one everyone reaches for

On the grant side, 2 CFR 200.320 sets out the methods. For a micro-purchase, a recipient may award without soliciting competitive price or rate quotations if it documents that the price is reasonable. Above that and below the simplified acquisition threshold, quotations must come from an adequate number of qualified sources. Above the simplified acquisition threshold, formal methods apply: sealed bids to the lowest responsive and responsible bidder, or proposals to the responsible offeror whose proposal is most advantageous.

The 2024 revisions to the uniform guidance also let a recipient self-certify a micro-purchase threshold up to $50,000 annually under 2 CFR 200.320(a)(1)(iv), with a documented internal justification, and request approval for more under (a)(1)(v). A recipient that raised its ceiling before the disaster has far more room on day two. It is a short policy memo written on a quiet day, and one of the highest-return preparations a local government can do.

Then there is noncompetitive procurement. 2 CFR 200.320(c) permits it in five circumstances, short enough to quote in full:

• (c)(1) — The aggregate amount of the procurement transaction does not exceed the micro-purchase threshold.
• (c)(2) — The procurement transaction can only be fulfilled by a single source.
• (c)(3) — The public exigency or emergency for the requirement will not permit a delay resulting from providing public notice.
• (c)(4) — The recipient or subrecipient requests in writing to use a noncompetitive procurement method, and the federal agency or pass-through entity provides written approval.
• (c)(5) — After soliciting several sources, competition is determined inadequate.

The exigency exception is narrower than the phrase suggests

Read (c)(3) again slowly. What it excuses is the delay resulting from providing public notice. It does not say competition is excused. It does not say documentation is excused. It says the recipient need not wait out a public advertising period when waiting would cost lives or property.

Everything a recipient can still do inside that window, it is expected to do. Calling three firms it already knows and taking the fastest credible answer is competition. Recording who was called, what they quoted and why one was chosen takes fifteen minutes. 2 CFR 200.318(i) requires records sufficient to detail the history of each procurement transaction, including the rationale for the method, the contract type, contractor selection or rejection, and the basis for the price. That requirement has no emergency carve-out.

The second limit is duration. The exception exists because of a condition, and the condition ends. Debris is cleared, systems come back up, and the ordinary methods apply again. A noncompetitive contract written in week one and still running in month fourteen has outlived its justification. The defensible pattern is a short noncompetitive award covering the emergency period, a competed follow-on for recovery work, and a written record of the moment the recipient decided the exigency had passed.

Who follows whose rules

2 CFR 200.317 draws a line most vendors do not know exists, and it changes the answer to nearly every compliance question. A state or Indian tribe procuring under a federal award follows the same policies and procedures it uses for non-federal funds, and must still comply with 2 CFR 200.321, 200.322, 200.323 and 200.327. Everyone else, including a city or county that is a subrecipient of a state, follows the full standards at 2 CFR 200.318 through 200.327.

When a state and a county are both in the chain, the county does not inherit the state's latitude. It is a subrecipient, and 200.317 sends it to the full standards. A vendor on a county job funded by state-passed federal dollars is on the strictest branch.

The local preference that decides who gets asked

Section 307 of the Stafford Act, at 42 U.S.C. 5150, directs that preference be given, to the extent feasible and practicable, to organizations, firms and individuals residing or doing business primarily in the affected area. 44 CFR 206.10 repeats it in FEMA's regulations. FAR subpart 26.2 implements it: 26.202-1 allows a local area set-aside under the authority at FAR 6.208, 26.202-2 allows an evaluation preference where agency procedures authorize it, 26.204 requires written justification in the contract file when emergency response work goes to a non-local firm, and 26.203 requires transitioning pre-declaration contract work to local firms unless the agency head determines in writing that it is not feasible or practicable. Section 5150(c) does not require breaking a contract that predates the disaster.

GAO examined how this worked after Hurricanes Harvey, Irma and Maria and the 2017 California wildfires. In GAO-19-281, published April 24, 2019, it reported that federal agencies obligated at least $5 billion in post-disaster contracts for those events, and found that contracting officers at FEMA, the U.S. Army Corps of Engineers and the Coast Guard did not consistently write justifications for awards to non-local vendors.

For a vendor the reading is direct. Being visible in the affected area is worth real money in the first weeks, and being a non-local firm means someone has to write a justification to hire you. That is friction, and friction is what a busy contracting officer avoids. The grant side carries the mirror-image trap: 2 CFR 200.319 requires full and open competition, so a recipient applying a homegrown local preference that no federal statute authorizes creates a finding rather than avoiding one.

Price gets judged later, at a calmer moment

This is the largest single source of disallowed cost in disaster work. 2 CFR 200.324(a) requires a cost or price analysis for every procurement transaction, including modifications, above the simplified acquisition threshold, and independent estimates before bids or proposals are received. 2 CFR 200.404 then defines a reasonable cost as one that does not exceed what a prudent person would incur under the circumstances prevailing when the decision was made, weighing whether the expense is ordinary and necessary, whether there was arm's-length bargaining, market prices for comparable costs for the geographic area, and whether the cost deviates from established written policies.

Two phrases do the work. "Circumstances prevailing when the decision was made" is the vendor's friend, because surge conditions are part of the analysis rather than excluded from it. "Market prices for comparable costs for the geographic area" is the auditor's, because it invites comparison against a rate card assembled in a normal month. A firm that bills an emergency rate with no written basis is relying on the reviewer's sympathy. A firm that documents its standard rate, the specific surge factors, and any comparable quotes obtained at the time has given the recipient the analysis it owes and given itself a defense that survives a change of personnel.

Contract shape, and where the risk lands

Time-and-materials. 2 CFR 200.318(j) allows it only after a determination that no other contract type is suitable, and only if the contract includes a ceiling price that the contractor exceeds at its own risk. Emergency work drifts toward time-and-materials because scope is unknown, so the ceiling clause is where risk transfers. A vendor working past the ceiling without a signed modification works for free and finds out at closeout.

Cost plus a percentage of cost. 2 CFR 200.324(c) prohibits the cost-plus-a-percentage-of-cost and percentage-of-construction-cost methods outright. Any arrangement where the fee rises automatically with incurred cost falls inside that prohibition, whatever the invoice calls it. A management fee set as a percentage of subcontractor spend is the prohibited structure wearing a different name.

The clean alternatives are firm-fixed-price for defined deliverables, or time-and-materials with a stated ceiling, a fixed rate schedule and a fee that does not float with cost. Where scope cannot be defined on day one, a short not-to-exceed task with a re-scoping point beats an open-ended arrangement nobody can price-analyze later.

The clauses that go missing in the first week

2 CFR 200.327 requires that a recipient's contracts contain the applicable provisions in Appendix II to 2 CFR part 200. Emergency contracts are often two pages and contain none of them, and a missing clause is a finding independent of whether the work or the price was fine. The list is finite; check it against whatever is put in front of you.

• Remedies for breach — contracts above the simplified acquisition threshold (Appendix II (A)).
• Termination for cause and for convenience — all contracts above $10,000, with manner of exercise and basis for settlement (B).
• Equal Employment Opportunity — federally assisted construction contracts, per 41 CFR 60-1.4(b) (C).
• Davis-Bacon and Copeland Anti-Kickback — prime construction contracts above $2,000 where the program statute requires it (D).
• Contract Work Hours and Safety Standards Act — contracts above $100,000 involving mechanics or laborers (E).
• Rights to inventions — where the award meets the funding-agreement definition at 37 CFR 401.2(a) (F).
• Clean Air Act and Federal Water Pollution Control Act — contracts and subgrants above $150,000 (G).
• Debarment and suspension — all awards, checked against the exclusions in SAM under 2 CFR part 180 (H).
• Byrd Anti-Lobbying certification — bids or applications above $100,000, under 31 U.S.C. 1352 (I).
• Covered telecommunications prohibition — 2 CFR 200.216, under section 889 of Public Law 115-232.
• Domestic preference and recovered materials — 2 CFR 200.322, 200.323.

Two deserve attention from a technology vendor. The covered telecommunications prohibition at 2 CFR 200.216 reaches equipment and services bought with grant funds and names Huawei, ZTE, Hytera, Hikvision and Dahua with their subsidiaries and affiliates, so a field deployment built from whatever cameras or radios were available locally can create a problem that has nothing to do with software. And the affirmative steps at 2 CFR 200.321 apply even to states otherwise using their own code: solicitation lists, soliciting small, minority, women-owned and veteran-owned firms whenever eligible, dividing procurements to permit participation, and requiring primes to do the same in subcontracts.

Contractor or subrecipient, and why the label matters

2 CFR 200.331 governs whether an agreement is a subaward or a procurement contract, and says plainly that the substance of the relationship matters more than the form. Subrecipient indicators include determining who is eligible to receive federal assistance, having performance measured against whether program objectives were met, and holding programmatic decision-making responsibility. Contractor indicators include providing goods and services within normal business operations, serving many different purchasers, and operating in a competitive environment.

Emergency engagements blur that line, because a vendor asked to stand up an intake system may end up influencing eligibility determinations. Classified as a subaward, the firm carries recipient-level obligations instead of vendor-level ones. Settle it in writing at the start: a two-sentence conversation in week one, an expensive argument in year two.

The audit arrives eighteen months later

Disaster money is examined by more parties, on a longer clock, than most vendors expect. A non-federal entity that expends $1,000,000 or more in federal awards in its fiscal year must have a single or program-specific audit under 2 CFR 200.501(a). The threshold rose from $750,000 in the 2024 revisions, but a disaster grant will push a small city or nonprofit over the line in one year. Their first single audit examines the contract signed in a hurry.

Records are retained three years from the date of submission of the final financial report under 2 CFR 200.334, with the clock extended if litigation, a claim or an audit starts first. 2 CFR 200.337 gives the federal agency or pass-through entity, inspectors general, the Comptroller General and their authorized representatives right of access to records pertinent to the award, and says that right is not limited to the retention period but lasts as long as the records are retained. A vendor's exposure runs through the contract's records and audit clauses, one more reason to read the agreement before signing.

Cost eligibility carries its own demand on FEMA-funded work. Under 44 CFR 206.225, emergency protective measures are eligible where they eliminate or lessen immediate threats to life, public health or safety, or immediate threats of significant additional damage to improved public or private property through measures that are cost effective, and the Regional Administrator may require certification from officials that a threat exists. For a data or software vendor, the record has to connect the work to the immediate threat, not to the disaster in general. A situational-awareness system feeding shelter operations during the response is a different eligibility question from the same system kept running afterward as a permanent capability, and the file should show which is being paid for.

The pre-positioned contract is the actual answer

Every problem in this article is easier if the contract was competed before the disaster. GAO reported in GAO-19-93, published December 6, 2018, that FEMA and the U.S. Army Corps of Engineers obligated about $4.5 billion through advance contracts for the 2017 hurricanes and California wildfires as of May 31, 2018, and found FEMA's advance contract strategy outdated and its coordination with state and local governments inconsistent.

That is the opening. A standby contract competed on a normal calendar, priced against a normal market, with a nominal minimum and activation on notice, turns an emergency scramble into an ordinary task order. The competition already happened, the price analysis exists, the Appendix II clauses are already in the document, and the file is complete before the first hour of the response.

Bottom line

A declaration buys speed at the front of the transaction and spends it at the back. Thresholds rise, notice periods collapse, and single-source awards stay defensible for as long as the emergency actually prevents public notice. None of that relaxes the file. The rationale for the method, the basis for the price, the required clauses, the records, and the moment the emergency ended still have to be written down, and they cost far less on the day than reconstructed for an auditor two years later. The vendors who finish with their margin intact treated documentation as part of the delivery, and put a competed vehicle in place before the next one.

Frequently asked questions