SBA OIG Report 24-09 — Restaurant Revitalization Fund Program Award Oversight

Record facts

Full text

U.S. SMALL BUSINESS ADMINISTRATION 
OFFICE OF INSPECTOR GENERAL 
SBA’s Restaurant Revitalization Fund 
Program Award Practices 
Audit Report 
Report 24-09 
March 26, 2024 
 

 
 
Make a Difference 
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s 
Office of Inspector General Hotline at https://www.sba.gov/oig/hotline. You can also write to the 
U.S. Small Business Administration, Office of Inspector General, 409 Third Street, SW (5th Floor), 
Washington, DC 20416. In accordance with the Inspector General Act of 1978, codified as 
amended at 5 U.S.C. §§ 407(b) and 420(b)(2)(B), confidentiality of a complainant’s personally 
identifying information is mandatory, absent express consent by the complainant authorizing the 
release of such information. 
NOTICE: 
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, 
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities 
identified in this report have the opportunity to submit a written response for the purpose of 
clarifying or providing additional context as it relates to any specific reference contained herein. 
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date. 
We request that any comments be no longer than two pages, Section 508 compliant, and free 
from any proprietary or otherwise sensitive information. The comments may be appended to 
this report and posted on our public website. 

U.S. Small Business Administration 
Office of Inspector General 
 
 
EXECUTIVE SUMMARY 
SBA’s Revitalization Fund Program Award Practices 
 (Report 24-09) 
What OIG Reviewed 
We reviewed the U.S. Small Business 
Administration’s (SBA) Restaurant Revitalization 
Fund (RRF) application review and approval 
process. The American Rescue Plan Act of 2021 
established the RRF to help small businesses in 
the food service industry adversely affected by 
the Coronavirus Disease 2019 pandemic. 
Beginning in May 2021, SBA received 278,300 
RRF applications requesting $72.2 billion in relief 
payments. SBA approved approximately 101,000 
applications and disbursed all $28.6 billion 
authorized for the program.  
The objective of this review was to determine 
whether the controls SBA implemented to 
award RRF program funds in accordance with 
the Act and other applicable guidance were 
effective. 
What OIG Found 
SBA developed an implementation plan 
including a risk framework that was intended to 
reduce the risk of making improper payments 
and awarding RRF funds to ineligible recipients. 
However, the plan did not include all program 
requirements and SBA did not always adhere to 
the plan or have sufficient controls to ensure 
program and statutory requirements were met 
by RRF applicants. As a result, we determined 
SBA awarded: 
• 
$552 million of improper payments to 
applicants with a history of “likely fraud” by 
not effectively leveraging fraud indicators 
available in Paycheck Protection Program 
(PPP) loan data as planned; 
• 
$6.0 billion to applicants without verifying 
historical data as planned; 
• 
$377 million to applicants that claimed to 
operate as an inn or brewery, through 
automated approval and without program 
eligibility review; and 
• 
$55 million to affiliate groups that 
collectively received amounts in excess of 
the statutory limit.  
After accounting for award amounts that we 
questioned for more than one eligibility 
requirement, we determined that SBA disbursed 
nearly $6.7 billion to applicants without 
sufficiently verifying they were eligible for 
award. 
What OIG Recommended 
We made five recommendations for SBA to 
improve the use of data to reduce risks of 
making improper payments, and to review and 
recover funds awarded to applicants that did not 
meet eligibility requirements or received funds 
that exceeded statutory limits. 
Agency Response 
SBA management agreed or partially agreed 
with all five recommendations. Management’s 
planned actions resolve recommendations 1 and 
4. Management plans to develop a fraud risk 
framework to reduce improper payment risks in 
SBA programs and recover funds paid to 
affiliated business groups that exceed statutory 
limits. We did not reach resolution on 
recommendations 2, 3, and 5. OIG will seek 
resolution in accordance with our audit 
resolution policies and procedures.  

OFFICE OF INSPECTOR GENERAL 
U.S. SMALL BUSINESS ADMINISTRATION 
MEMORANDUM 
409 Third St. SW, Washington, DC 20416  •  (202) 205-6586  •  Fax (202) 205-7382 
Date:  
March 26, 2024 
To: 
Isabella Casillas Guzman 
Administrator 
From: 
Hannibal “Mike” Ware 
Inspector General 
Subject: 
Audit of SBA’s Restaurant Revitalization Fund Award Practices (Report 24-09) 
This report presents the results of our audit of SBA’s Restaurant Revitalization Fund Award 
Practices. We considered management comments on the draft of this report when preparing the 
final report. SBA management agreed with two recommendations and partially agreed with 
three recommendations. Three recommendations are pending resolution.  
We appreciate the cooperation and courtesies provided by your staff. If you have any questions 
or need additional information, please contact Christina Sweet, Director, Business Development 
Programs Group, or Andrea Deadwyler, Assistant Inspector General for Audits, at (202) 
205-6586. 
Cc: 
Dilawar Syed, Deputy Administrator 
 
Arthur Plews, Chief of Staff 
 
Isabelle James, Deputy Chief of Staff 
 
Therese Meers, General Counsel, Office of General Counsel 
 
Kathryn Frost, Associate Administrator, Office of Capital Access 
 
John Miller, Deputy Associate Administrator, Office of Capital Access 
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and the Chief 
Financial Officer 
Jihoon Kim, Director, Office of Financial Program Operations, Office of Capital Access 
 
Michael Simmons, Attorney Advisor, Office of General Counsel 
 
Tonia Butler, Director, Office of Internal Controls 
 
Anna Maria Calcagno, Director, Office of Program Performance, Analysis, and Evaluation 
Walter Hill, Chief Risk Officer, Office of Enterprise Integrity  
 

 
i 
Contents 
Introduction .................................................................................................................................... 1 
Eligibility Requirements ................................................................................................................... 1 
Program Design ............................................................................................................................... 2 
RRF Application Risk Framework ..................................................................................................... 2 
Prior Audit Work .............................................................................................................................. 4 
Objective ......................................................................................................................................... 4 
Results ............................................................................................................................................. 4 
Finding 1: Critical Data Not Used as Planned to Prevent Awarding Funds to Ineligible Recipients . 5 
Recommendation ............................................................................................................................ 6 
Finding 2: Historical Sales for All RRF Applicants Not Validated as Planned When Determining 
Eligibility  ......................................................................................................................................... 6 
Recommendation ............................................................................................................................ 8 
Finding 3: Verification that Certain Types of Businesses Met Eligibility Requirements................... 8 
Recommendation ............................................................................................................................ 9 
Finding 4: Controls to Ensure Affiliated Businesses Complied with the Act’s Requirements .......... 9 
Recommendations ........................................................................................................................ 10 
Other Matters: SBA Paid Out Remaining and Unused RRF Funds ..................................... 11 
Evaluation of Agency Response ..................................................................................................... 11 
Summary of Actions Necessary to Close the Recommendations .................................................. 12 
Tables 
1: Risk Framework SBA Used to Process RRF Applications .............................................................. 3 
Figures 
 1: SBA’s System Design Flaw on Validating Historical Sales Against IRS Data for Tier 2 Applications
......................................................................................................................................................... 7 

 
ii 
Appendices 
1: Scope and Methodology .......................................................................................................... 1-1 
Use of Computer-Processed Data .................................................................................... 1-2 
Assessment of Internal Controls....................................................................................... 1-2 
Prior Audit Coverage ........................................................................................................ 1-3 
2: Monetary Impact ...................................................................................................................... 2-1 
3: Agency Response ...................................................................................................................... 3-1 

 
1 
Introduction 
The American Rescue Plan Act of 2021 (the Act) established the Restaurant Revitalization Fund 
(RRF) program with $28.6 billion to help small businesses in the food service industry adversely 
affected by the Coronavirus Disease 2019 (COVID-19) pandemic.1 
The program opened for applications in May 2021. The U.S. Small Business Administration (SBA) 
received 278,000 RRF applications requesting $72.2 billion in relief payments. SBA approved 
approximately 101,000 applications and disbursed $28.6 billion in funds authorized for the 
program. These included awards made in November 2022 using $83.4 million of remaining funds 
from awards returned from RRF applicants, unused funds set-aside for RRF litigation purposes, 
and other sources of funds not previously disbursed. 
This report presents the results of our audit of SBA’s procedures for ensuring that RRF program 
funds were properly awarded to eligible businesses. 
Eligibility Requirements 
Eligible entities are businesses that were not permanently closed at the time of application, and 
include those where the public or patrons assemble for the primary purpose of being served 
food or drink, such as restaurants, bars, caterers, and food trucks.2 Establishments such as inns, 
bakeries, wineries, distilleries, and breweries (hereafter referred to as “breweries or inns”) were 
required to provide proof that at least 33 percent of gross receipts were derived from onsite 
food or beverage sales to the public. State or local government-operated entities, entities that 
owned over twenty business locations (with affiliates), and publicly traded companies were not 
eligible. 
The Act permitted applicants to self-certify that they (1) needed the funds to support operations 
due to current economic uncertainty; and (2) did not have a pending application for or receive 
funds from the Shuttered Venue Operators Grant program. 
 
1 American Rescue Plan Act of 2021. Pub. L. No. 117-2, § 5003(a)(4) and § 5003(c)(6) (March 11, 2021). 
2 American Rescue Plan Act of 2021. Pub. L. No. 117-2, § 5003(a)(4) (March 11, 2021). 

 
2 
Program Design 
In accordance with the Office of Management Budget guidance, SBA submitted an RRF program 
implementation plan for approval.3 The RRF implementation plan was designed primarily in 
response to shortcomings in internal controls identified in the implementation of the Paycheck 
Protection Program (PPP).4 To address those concerns, SBA followed the Government 
Accountability Office’s (GAO) guidance on fraud risk management to better prevent, respond, 
and detect fraud for the RRF program.5 SBA designed a process for approving applications based 
on high or low risks associated with the applications’ type and traits prior to submission for 
automated or manual review. To assess some of these traits, all applications were screened 
against six pre-award controls: 
• Validate address; 
• Verify bank account info; 
• Cross-check franchise info; 
• Verify signatures; 
• Platform data evaluation for fraud and anomalies such as an applicant’s IP address, bank 
account changes, etc.; and 
• Documents were scanned for viruses and flagged for empty documents. 
SBA also planned to validate applications against private and public data sources, including SBA’s 
PPP loan data, the Department of Treasury’s Do Not Pay list, Internal Revenue Service (IRS) tax 
data, and fee-based data analytic providers as part of the automated and manual review 
process. 
RRF Application Risk Framework  
To implement the RRF program plan, SBA designed a framework to assign applications into four 
different risk tiers. SBA planned for the framework to have four tiers, starting with Tier 1 for 
applicants with the lowest risk and increasing through Tier 4 for applicants with the highest risk. 
 
3 Office of Management and Budget, Circular M-21-20, “Promoting Public Trust in the Federal Government 
through Effective Implementation of the American Rescue Plan Act and Stewardship of the Taxpayer Resources” 
(March 19, 2021). 
4 SBA, 2 CFR Implementation Plan Template for New Programs Authorized by the American Rescue Plan 
(April 2021). 
5 U.S. Government Accountability Office, GAO-15-593SP, A Framework for Managing Fraud Risks in Federal 
Programs (July 2022). 

 
3 
Program officials informed us they later added a tier to escalate applications flagged for 
unanticipated issues that emerged during the payment disbursement process. The review was 
limited to address the reason why the award failed to be disbursed after approval. 
SBA assigned applications to different risk tiers based on dollar amount of award and existing 
data known about the applicant. For example, if an RRF applicant also received a PPP loan, SBA 
attributed the applicant to be of lower risk because SBA now had the applicant’s loan data from 
the agency’s systems. 
Table 1: Risk Framework SBA Used to Process RRF Applications 
Tier 
Risk 
Review 
Type 
Requirement for Tier 
Application 
Distribution 
Awards Disbursed 
(in billions) 
Tier 1 
Low 
Automated 
Submitted through Point-
of-Sale (POS) Partner 
7% 
$1.1 
Tier 2* 
Low 
Automated 
PPP data validated. 
No PPP Flags or Holds 
Award < $360,000  
63% 
$8.0 
Tier 3 
High 
Manual 
PPP data validated. 
No PPP Flags or Holds 
 Award> $360,000 
8% 
$7.8 
Tier 4 
High 
Manual 
No PPP history available 
Award in any amount  
18% 
$9.8 
Escalated 
Tier 
Varied 
Manual 
Escalated applications 
flagged after approval but 
before disbursement 
5% 
$1.8 
Total 
- 
- 
- 
100% 
$28.5 
*Note:  Tier 2 application count includes applications that met the Tier 2 requirements but did not have a tier 
assignment in the RRF platform (see Finding 2 for additional details). 
Source: OIG analysis based on RRF program plan, application data, and awards disbursed as of May 23, 2022. 
 
According to the risk framework, SBA assessed risk as low for applications assigned to Tier 1, and 
designated Tier 1 for applications that were in partnership with point-of-sale partners whose key 
controls SBA relied on for verifying gross sales. Tier 2 was for all applications requesting less than 
$360,000. Applications processed through Tiers 1 and 2 went through an automated review 
process. By contrast, applicants assigned to Tiers 3 and 4 went through a manual review process 
by SBA personnel. In a manual review for Tiers 3 and 4, the reviewer’s primary task was to 
perform a cursory review of the required documentation to verify the award calculation. 

 
4 
Prior Audit Work 
In FY 2023, OIG also performed reviews of SBA’s oversight of RRF award recipients and of SBA’s 
inaction on reviewing potentially fraudulent RRF awards referred to SBA by a point-of-sale 
partner.6 The OIG’s concerns were consistent with SBA’s independent auditor reporting that SBA 
could not demonstrate that its treatment of RRF transactions were consistent with sound 
accounting practices.7 
GAO issued a report in FY 2022 year on how SBA established a process to detect fraudulent or 
ineligible applicants but raised concerns about the effectiveness of the procedures.8 
Objective 
To determine whether the controls SBA implemented to award RRF program funds in 
accordance with the American Rescue Plan Act of 2021 and other applicable guidance were 
effective. 
Results 
Program officials used lessons learned from other SBA COVID-19 pandemic relief programs to 
develop an implementation plan designed to reduce the risk of making improper payments and 
awarding RRF funds to ineligible recipients. However, SBA did not consider all eligibility 
requirements established in the authorizing legislation as a measure for the risk framework. SBA 
implemented the RRF application process by automating most of the verification procedures to 
expedite making awards but did not have sufficient controls to reduce risks of making improper 
payments or distributing money to ineligible applicants. 
SBA disbursed nearly $6.7 billion to potentially ineligible recipients due to not following planned 
review procedures, system design flaws, human intervention, and reliance on self-certification. 
 
6 SBA Office of Inspector General, 23-10, SBA’s Administrative Process to Address Potentially Fraudulent 
Restaurant Revitalization Funds Award (July 5, 2023) and 23-15, SBA’s Oversight of Restaurant Revitalization Fund 
Recipients (September 29, 2023). 
7 SBA Office of Inspector General, 23-02, Independent Auditor’s Report on SBA’s FY 2021 Financial Statements 
(November 15, 2022). 
8 U.S. Government Accountability Office, GAO-22-105442, Restaurant Revitalization Fund, Opportunities Exist to 
Improve Oversight (July 2022). 

 
5 
Specifically, despite plans to verify PPP loan hold codes for RRF applications, SBA did not 
establish procedures to detect the flagged files. We identified 901 applications that had active 
hold codes on their PPP loan files as of May 3, 2021, that SBA did not take into consideration 
before awarding $552 million in RRF funds to applicants. We also found SBA did not evaluate PPP 
data or the results of the IRS validation to confirm historical sales data as planned for 47,565 
applicants awarded $6 billion in RRF funds. 
In addition, SBA did not align RRF automated processes to enable verification that recipients met 
key eligibility requirements. Of the 4,724 applicants that self-certified that their breweries or 
inns had at least 33 percent of gross receipts from onsite sales to the public, 73 percent of them 
were processed automatically without any review of supporting documentation. These entities 
were required to provide documentation that at least 33 percent of gross receipts were 
comprised of onsite food or beverage sales to the public. As such, SBA did not ensure that it 
awarded nearly $377 million in RRF funds to business owners who significantly relied on onsite 
food and beverage sales. 
We also found that SBA did not have proper controls to ensure RRF applicants, who disclosed 
having at least one affiliated business, did not exceed the limit of $10 million to any one group. 
We identified 14 business affiliate groups that collectively received $55 million more than the 
statutory limit allowed per affiliate group. 
Finding 1: Critical Data Not Used as Planned to Prevent 
Awarding Funds to Ineligible Recipients  
Based on lessons learned from the PPP loan program, SBA developed its risk tier approach for 
reviewing RRF applications using GAO’s Fraud Risk Management Framework. A core tenet of the 
framework advised agencies to mine the data to identify suspicious activities and transactions, 
including any anomalies, outliers, and other red flags.9 
SBA used a variety of public and private data resources to validate the information contained in 
the application, which included using the PPP loan data. Nearly 90 percent of the RRF award 
recipients had an associated PPP loan. According to the RRF program implementation plan, using 
PPP loan data was supposed to allow SBA to leverage a significant amount of information 
 
9 U.S. Government Accountability Office, GAO-15-5935SP, A Framework for Managing Fraud Risks in Federal 
Programs (July 2015). https://www.gao.gov/assets/gao-15-593sp.pdf. 

 
6 
available to prevent making potentially improper payments. Moreover, SBA’s framework 
stipulated that tiers 2 and 3 were only for applicants with clean PPP data. 
When SBA launched the RRF program, it only factored in the existence of a PPP loan file to justify 
assigning the application to a low-risk tier for the RRF program. SBA did not leverage the 
information available in the PPP loan file such as historical sales data, bank accounts, business 
addresses, affiliated entities, system generated warnings, or eligibility concerns noted in the 
application as planned. According to program officials, SBA did not have access to this 
information because the lenders maintained the loan files. SBA merely used the PPP data to 
subtract the PPP loan value from the RRF request to reduce the award amount. SBA’s deviation 
from its plan to use known and available evidence of potential fraud in the PPP loan portfolio 
resulted in awarding 901 applications over $552 million in RRF funds to potentially ineligible 
recipients. 
SBA will conduct post award reviews of all RRF award recipients currently marked in the PPP loan 
data as potentially fraudulent or ineligible to implement a recommendation we made in our 
Audit of SBA’s Oversight of Restaurant Revitalization Fund Recipients (Report 23-15). Although 
SBA has finished making awards for the RRF program, SBA owns the software license and related 
intellectual properties for the PPP and RRF platforms and plans to continue using these platforms 
for future programs. 
Recommendation 
We recommend the Administrator direct the Associate Administrator of the Office of 
Performance, Planning, and the Chief Financial Officer to: 
Recommendation 1:  Develop a plan for future similar programs to leverage applicable existing 
SBA data sources when determining eligibility and monitoring awards. The plan should include 
requirements to evaluate effectiveness of the use of the data as controls to reduce risk of 
improper payments. 
Finding 2: Historical Sales for All RRF Applicants Not Validated 
as Planned When Determining Eligibility  
The Act required that the award amount be equal to the entity’s pandemic-related revenue loss. 
All applicants were required to complete IRS Form 4506-T for verification of tax information and 
provide documentation of gross receipts in support of their application. SBA’s implementation 

 
7 
plan stated that an applicant’s historical sales would be validated against at least one of the 
following sources: POS partner data, prior PPP loan submission data, or IRS data. 
For Tier 2 applications, SBA planned to use PPP loan data to validate historical sales information. 
SBA also included an automated step for Tier 2 applications to route through the IRS for 
validation when the RRF platform software was launched. 
SBA approved 46,297 Tier 2 applications, and 16,648 applications that were manually adjusted 
due to the system not assigning a tier but met the risk framework requirements for a Tier 2 
designation. 
Although program officials planned to use PPP data to validate sales, upon execution, only the 
value of the PPP loan amount was used to reduce the award amount authorized for the RRF 
program. PPP data was not used to validate any information within the award application, 
including historical sales. Given these facts, the IRS tax validation was the only other control that 
could have validated historical sales on Tier 2 applications. 
Figure 1: SBA’s System Design Flaw on Validating Historical Sales Against IRS Data 
for Tier 2 Applications  
Note: The total number of Tier 2 applications includes both Tier 2 and Tier 2-like categories 
Source:  OIG generated from data provided by SBA  
All applications approved using Tier 2 automated process, representing $7.9 billion in awards, 
were automatically approved regardless of whether tax information associated with the 
applicant was cleared, problematic, or null. Of the 62,945 applications awarded using the Tier 2 
automated process, 24 percent passed the IRS validation; 28 percent failed the validation; and 
48 percent were not validated at all (see Figure 1). 
SBA did not follow its original plan to use PPP data to validate historical sales and the IRS tax 
validation results were ignored. We found that 47,565 of Tier 2 awards, or 76 percent, valued at 
more than $6.0 billion were unsupported due to unverified historical sales (see Appendix 2). 

 
8 
Recommendation 
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to: 
Recommendation 2:  Validate historical sales for 47,565 awards designated or treated as Tier 2 
that failed or did not receive IRS validation. Recover any excess funds paid that are attributable 
to unverified historical sales data. 
Finding 3: Verification that Certain Types of Businesses Met 
Eligibility Requirements 
Applicants who claimed to operate as a brewery or inn type of business were required to provide 
documentation that at least 33 percent of gross receipts were comprised of onsite food or 
beverage sales to the public.10 We found SBA did not have controls to ensure applicants assigned 
to Tiers 1 and 2 provided the required documentation and did not have a process to review 
submitted documents to assess whether the gross receipts criteria were met. SBA’s automated 
process for Tiers 1 and 2 approved 3,443 of the 4,724 RRF award recipients that claimed to 
operate as a brewery or inn type of business, or 73 percent. The remaining 1,281 brewery and 
inn type of business applicants were processed as Tiers 3 and 4, or 27 percent of the overall 
awards for this type of business. 
For the awards that were processed through Tiers 3 and 4, program officials manually verified 
that the applicants’ sales met the requirement that 33 percent of gross receipts were comprised 
of onsite food or beverages to the public. 
For Tiers 1 and 2, SBA allowed applicants to self-certify that they conducted business as a 
brewery or inn. SBA’s application process also allowed them to self-certify that 33 percent of 
sales were from food and drink sales to the public. While program rules required applicants to 
provide supporting documents to substantiate the 33 percent assertion, Tiers 1 and 2 were 
approved automatically without any review of the supporting documentation provided. In total, 
the lack of controls resulted in automatically approving almost $377 million in award funds 
without review of required documentation. 
The Act authorized SBA to allow applicants to self-certify their priority status. However, program 
officials widely accepted self-certification in other areas for eligibility, and in this case, on the 
 
10 SBA, Restaurant Revitalization Fund Program Guide (April 28, 2021). 

 
9 
claim that the applicant met the definition of an eligible entity. As a result, program officials did 
not ensure that nearly $377 million in RRF funds were awarded to business owners who 
significantly relied on onsite food and beverage sales, consistent with the restaurant industry the 
program was targeted to help. 
Recommendation 
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to: 
Recommendation 3:  Review the 3,443 applicants awarded funds totaling $376,583,100 that self-
certified as a brewery or inn, to determine if they met the 33 percent onsite sales eligibility 
requirement and recover any funds from applicants that did not meet the requirement. 
Finding 4: Controls to Ensure Affiliated Businesses Complied 
with the Act’s Requirements 
The Act required that the amount awarded to affiliated businesses shall not exceed $10 million 
in total and shall be limited to $5 million per physical location. In addition, businesses were not 
eligible if there were more than 20 locations amongst all the affiliates.11 Program officials 
disbursed $7.7 billion (27 percent of all RRF funds) to 16,345 applicants who disclosed having at 
least one affiliate without any controls to limit the maximum award amount for affiliated 
business groups. For example, one affiliated group was awarded $37.5 million — $27.5 million 
more than the maximum award amount authorized. 
SBA relied on applicants to: 
• Self-disclose affiliated business relationships; 
• Self-monitor to ensure that total awards did not exceed the $10 million limit; and 
• Self-certify an applicant and its affiliates had no more than 20 locations combined. 
Since SBA allowed applicants to self-certify their affiliated status, they were able to request and 
receive more than $10 million by submitting applications for multiple affiliates. On the 
application form, SBA instructed applicants to adjust award requests to stay below the $10 
million total limit. However, as there were no controls in place to monitor or connect the 
 
11American Rescue Plan Act of 2021. Pub. L. No. 117-2, §5003 (a)(2) and §5003 (c)(4)(A). 

 
10 
submissions, we found that applicants submitted applications for multiple affiliated businesses 
that, in total, exceeded the limit. 
Although SBA asked if an applicant had affiliates, the intake design allowed applicants to answer 
“Yes,” without requiring applicants to provide additional information in the following text field 
intended to capture affiliate details. We found 1,431 applicants, who received $694 million in 
RRF payments, indicated “Yes” but did not provide sufficient information to reliably identify the 
affiliated businesses. When applicants did choose to provide affiliate information, the method of 
capturing information (such as the Employer Identification Number) was not standardized to 
effectively segregate, cross-check and to connect the affiliated groups. Although the 16,345 
applicants who indicated they had affiliations provided at least one affiliated business by name 
or other identifier, SBA did not establish a process to effectively capture the information 
necessary to determine whether affiliated businesses received RRF funds under a separate 
application. 
We identified 14 affiliated business groups that collectively received $195.1 million, which was 
$55.1 million more than the statutory limit of $140 million, with $10 million allowed per group. 
Program officials had the duty to implement controls to enforce rules established by the Act. 
Consequently, there is no assurance that SBA awarded RRF funds within the statutory limit of 
$10 million for affiliated businesses. 
Recommendations  
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to: 
Recommendation 4:  In accordance with Public Law 117-2, § 5003(a)(4)(A)(i) take immediate 
action to review and recover improper payments from the 14 affiliated business groups disclosed 
by RRF applicants for a total of $55,067,326 in excess funds paid, beyond the $10 million limit 
per affiliated group. 
Recommendation 5:  Review the 16,345 applicants that disclosed having an affiliated business to 
determine if the amounts collectively awarded to the applicant and affiliates exceeded the $10 
million maximum and recover any excess awards. 

 
11 
Other Matters: SBA Paid Out Remaining and Unused RRF Funds 
During our engagement, we reviewed SBA’s methodology to disburse $83.4 million of remaining 
and unused RRF funds in November 2022. Program officials disbursed these funds to 169 
applicants who had been previously approved for an award but had not received funds due to 
the funds authorized for the program being exhausted as of July 2, 2021. We verified SBA 
officials disbursed these funds to applications that were “fully approved” in the RRF platform by 
order of the date the application was submitted, like a “first in-first out” approach. 
Evaluation of Agency Response 
SBA management provided formal comments that are included in their entirety in Appendix 3. In 
their written response, management agreed with recommendation 1, partially agreed with 
recommendations 2, 3, and 5, and did not state a position on recommendation 4. However, 
subsequent to receiving management’s written response, we followed up with program officials 
to clarify that they agreed with recommendation 4 and obtained final action dates for four of the 
five recommendations. We found the agency’s planned actions are sufficient to resolve 
recommendations 1 and 4. 
However, management’s proposed corrective actions did not address recommendations 2, 3, 
and 5; therefore, these recommendations are unresolved. In accordance with our audit follow-
up policy, we will attempt to reach agreement with SBA management on the unresolved 
recommendations within 60 days after the date of this final report. If we do not reach 
agreement, OIG will notify the audit follow-up official. 
SBA management acknowledged the importance of recovering funds awarded to businesses that 
did not meet program or statutory eligibility requirements or received funds that exceeded 
statutory limits. Management stated the implementation of RRF was expedited per 
congressional mandate to quickly provide support to eligible entities that suffered revenue 
losses related to the COVID-19 pandemic. Management also stated they used a risk management 
framework consisting of automated, pre-award controls, supplemented by manual reviews of 
selected applications to expedite program delivery. Notwithstanding, we maintain our position 
that SBA’s plan did not include all program requirements, nor did SBA always adhere to the plan 
or have sufficient controls to ensure program and statutory requirements were met by RRF 
applicants. 

 
12 
Summary of Actions Necessary to Close the Recommendations 
The following section summarizes the status of our recommendations and the actions necessary 
to close them. 
Recommendation 1 
We recommend the Administrator direct the Associate Administrator of the Office of 
Performance, Planning, and the Chief Financial Officer to develop a plan for future similar 
programs to leverage applicable and existing SBA data sources when determining eligibility and 
monitoring awards. The plan should include requirements to evaluate effectiveness of the use of 
the data as controls to reduce risk of improper payments. 
Status: Resolved  
SBA management agreed with the recommendation and stated that SBA’s Fraud Risk 
Management Board is currently developing a standardized fraud risk framework for SBA in 
coordination with Office of Performance Systems Management and other SBA programs. 
Management plans to leverage the framework for future programs to evaluate available data to 
determine effectiveness and applicability to eligibility requirements. We will work with 
management to establish a target date for implementing corrective actions through the audit 
follow-up process. 
This recommendation can be closed when management provides evidence that the program 
office adopted the fraud risk framework developed by SBA’s Fraud Risk Management Board that 
will reduce risks of making improper payments in future similar programs. 
Recommendation 2 
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to validate historical sales for 47,565 awards designated or treated as Tier 2 that failed or 
did not receive IRS validation. Recover any excess funds paid that are attributable to unverified 
historical sales data. 
Status: Unresolved 
SBA management partially agreed with our recommendation stating SBA is currently reviewing 
10 percent of total RRF awards (10,050 awards) for potential fraud or misused program funds, 
including funds paid that are attributable to unverified historical sales data. Management plans 
to seek recovery of any excess funds paid and complete final action by May 30, 2025. 

 
13 
We maintain our position that SBA should specifically validate historical sales for the 47,565 
awards we identified and recover any excess funds paid. As stated earlier, SBA calculated the 
award amount based on the applicant’s sales data. Managements’ plans to review 10 percent of 
the total RRF awards (10,050 awards) will not include all, if any, of the 47,565 applicants that SBA 
paid more than $6.0 billion without adequate support for the amount awarded.  
This recommendation can be closed when program officials provide evidence that they validated 
historical sales for the 47,565 awards we identified and recovered any excess funds paid. 
Recommendation 3 
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to review the 3,443 applicants awarded funds totaling $376,583,100 who self-certified as 
a brewery or inn, to determine if they met the 33 percent onsite sales eligibility requirement and 
recover any funds from applicants that did not meet the requirement. 
Status: Unresolved 
SBA management partially agreed with our recommendation. SBA management stated that the 
implementation plan did not require a manual review of all awards to recipients who self-
certified as a brewery or an inn to determine if they met the 33 percent onsite sales 
requirement. SBA is currently reviewing 10 percent of the total RRF awards (10,050 awards) to 
address potential fraud or misused program funds, including funds paid without determining 
whether applicants met the minimum onsite sales requirement. Management plans to seek 
recovery of any excess funds paid to ineligible recipients and complete final action by May 30, 
2025. 
We maintain our position that program officials should specifically review the 3,443 applicants 
awarded funds totaling $376,583,100 that self-certified as a brewery or an inn and determine if 
they met the 33 percent onsite sales eligibility requirement. Program officials should recover any 
funds from applicants that did not meet this requirement. Management’s planned post-award 
review of 10 percent of the total award population does not guarantee they will review the 
3,443 awards we identified in our audit. 
This recommendation can be closed when program officials provide evidence that they 
determined whether the 3,443 applicants met the 33 percent onsite sales eligibility requirement 
and recovered funds from any ineligible award recipients. 
 
 

 
14 
Recommendation 4 
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to, in accordance with Public Law 117-2, § 5003(a)(4)(A)(i), take immediate action to 
recover improper payments from the 14 affiliated business groups disclosed by RRF applicants 
for a total of $55,067,326 in excess funds paid, beyond the $10 million limit per affiliated group. 
Status: Resolved 
SBA management agreed with the recommendation. Management stated they are currently 
analyzing the data OIG provided and agreed to seek recovery of any excess funds paid to 
affiliated groups beyond the $10 million limit. Management plans to seek recovery of any excess 
funds paid to affiliated groups and complete final action by May 30, 2025. 
This recommendation can be closed when program officials provide evidence that they reviewed 
the 14 RRF applicants with an affiliated business and recovered improper payments for amounts 
paid that exceeded the statutory limit. 
Recommendation 5 
We recommend the Administrator direct the Associate Administrator of the Office of Capital 
Access to review the 16,345 applicants that disclosed having an affiliated business to determine 
if the amounts collectively awarded to the applicant and affiliates exceeded the $10 million 
maximum and recover any excess awards. 
Status: Unresolved 
SBA management partially agreed with our recommendation stating that SBA is currently 
reviewing 10 percent of the total RRF awards (10,050 awards) to address potential fraud or 
misused program funds, including excess funds paid to applicants and affiliates that exceeded 
the $10 million maximum limit. Management plans to seek recovery of any excess funds paid to 
ineligible recipients and complete final action by May 30, 2025. 
Management’s proposed actions do not satisfy the intent of this recommendation because SBA’s 
planned post-award reviews of 10 percent of the total award population does not guarantee any 
review of the 16,345 applicants we identified. This recommendation can be closed when 
program officials provide evidence that they determined the 16,345 applicants who disclosed 
having an affiliated business were not collectively awarded more than $10 million as an affiliated 
group and recovered any excess funds.

 
1-1 
Appendix 1:  Scope and Methodology 
The scope of the audit focused on SBA’s Restaurant Revitalization Fund (RRF) award practices 
used to review, approve, and fund approximately 101,000 applications totaling $28.6 billion from 
May 3, 2021, to December 31, 2022. 
To meet our audit objective, we reviewed the American Rescue Plan Act of 2021, SBA’s 
Implementation Plan and Application Risk Framework for the RRF program, U.S. Government 
Accountability Office’s (GAO) A Framework for Managing Fraud Risks in Federal Programs, and 
other applicable public laws, federal regulations, and agency guidance related to SBA’s 
implementation of the RRF program and its award practices. We interviewed SBA program 
officials and RRF platform contractors to understand award practices and to obtain 
documentation that support those practices. 
We analyzed the information in the applications for all 101,000 RRF award recipients to identify 
the following: 
• Number of RRF applicants that had associated Paycheck Protection Program (PPP) loan 
hold codes at the time of application; 
• Outcomes of Internal Revenue Service (IRS) validation for RRF applications; 
• Number of RRF applicants in Tiers 2 and 3 that identified as a business type requiring 
proof of onsite sales of at least 33 percent; 
• Number of RRF applicants with affiliated businesses; and 
• Information collected in the RRF application text boxes and those applicants who 
provided at least one Employer Identification Number, to identify affiliate groups that 
received RRF funds. 
We conducted this performance audit in accordance with GAO’s Generally Accepted Government 
Auditing Standards. These standards require that we plan and perform audits to obtain sufficient 
and appropriate evidence to provide a reasonable basis for our findings and conclusions based 
on our audit objectives. We believe the evidence obtained provides a reasonable basis for our 
findings and conclusions. 

 
1-2 
Use of Computer-Processed Data 
We relied on computer-processed data in SBA’s RRF online application platform and E-Tran, 
SBA’s payment disbursement database. We obtained access to the RRF online application 
platform and retrieved applications, award information, and SBA’s evaluation record for all RRF 
applicants. We generated a report of all RRF applications' information from SBA’s online 
application platform and award information as of May 9, 2022. We tested the reliability of 
computer-processed data in the RRF online application platform and E-Tran database by 
comparing reports generated by program officials of application and award information. We 
tested the reliability of the data by comparing data received from the RRF online application 
platform and E-Tran to SBA’s PPP loan database and source documents such as IRS tax returns, 
income statements and bank statements. We believe the computer-processed information is 
reliable for the purposes of this audit. 
Assessment of Internal Controls 
For this audit, we identified the following internal control components and underlying internal 
control principles (Table 2) as being significant to the audit objectives. 
Table 2:  Internal controls assessed 
Internal Control Component 
Internal Control Principle 
Control Environment  
• 
Tone at the Top.  
• 
Establish structure, assign responsibility, and 
delegate to achieve the entity’s objective.  
Risk Assessment  
• 
Identify, analyze, and respond to risk.  
Control Activities  
• 
Management should design control activities 
to achieve objectives and respond to risk.  
• 
Management should implement control 
activities through policies.  
Information and Communication  
• 
Management should use quality information 
to achieve the entity’s objectives.  
 
 

 
1-3 
Prior Audit Coverage 
The following OIG and GAO previous audit coverage related to the objective of this report: 
Report Number 
Report Title 
Report Date 
SBA OIG Report 23-02 
Independent Auditor’s Report on SBA’s Fiscal 
Year 2022 Financial Statements 
November 15, 
2022 
SBA OIG Report 23-09 
COVID-19 Pandemic EIDL and PPP Loan Fraud 
Landscape 
June 27, 2023 
SBA OIG Report 23-10 
SBA’s Administrative Process to Address 
Potentially Fraudulent Restaurant Revitalization 
Fund Awards 
July 5, 2023 
GAO-22-105442 
Restaurant Revitalization Fund 
Opportunities Exist to Improve Oversight 
July 14, 2022 
SBA OIG Report 23-15 
SBA’s Oversight of Restaurant Revitalization 
Fund Recipients 
September 29, 
2023 

 
2-1 
Appendix 2:  Monetary Impact 
Monetary Impact identified in this report is categorized as “questioned costs”. Questioned costs 
are expenses not supported by adequate documentation at the time of the audit, or which 
otherwise do not comply with legal, regulatory, or contractual requirements. 
Table 2-1. OIG Schedule of Monetary Impact of SBA’s Restaurant Revitalization Fund 
Program Award Practices at the Time of Audit 
Description 
Amount 
(Dollars) 
Explanation 
Ineligible Costs 
$552,139,455* Funds paid on 901 applications that were 
not reviewed in accordance with SBA 
program implementation plans for 
consideration of PPP flags and codes.  
Unsupported Costs 
6,033,837,878 Awards made without historical sales 
validated via PPP data or IRS validation. 
Unsupported Costs 
376,583,100 Awards made without support for meeting 
eligibility requirements for 33 percent of 
onsite sales.  
Ineligible Costs 
55,067,326 Funds paid more than the allowable limit for 
affiliated business groups in accordance 
with Section 5003(A) of the American 
Rescue Plan Act of 2021.  
Total Questioned Costs 
$7,017,627,759 
- 
Less: Duplicate Costs Removed for 
Overlap Across Multiple Eligibility 
Criteria 
(339,952,607) Questioned costs removed due to being 
questioned based on multiple eligibility 
criteria for the RRF program.  
Net Questioned Costs 
$6,677,675,152 
- 
*Note:  SBA will conduct post award reviews of all RRF award recipients currently marked in the PPP loan data as 
potentially fraudulent or ineligible to implement a recommendation we made in our Audit of SBA’s Oversight of 
Restaurant Revitalization Fund Recipients (Report 23-15), recommendation 2. We will track questioned costs and 
monitor SBA’s actions to review the awards and recover funds to any ineligible recipients through the audit follow-
up process for that report.  
Source: OIG analysis of RRF award data.

 
3-1 
Appendix 3:  Agency Response 
 
 
SBA RESPONSE TO THE AUDIT REPORT 

1 
U.S. SMALL BUSINESS ADMINISTRATION 
WASHINGTON, DC 20416 
To: 
Hannibal “Mike” Ware 
Inspector General 
U.S. Small Business Administration 
From: 
Jihoon Kim 
Director 
Office of Financial Program Operations 
Office of Capital Access 
Date: 
March 1, 2024 
Subject: 
Response to OIG Draft Report - SBA’s Restaurant Revitalization Fund Program Award 
Practices - Project 23001  
We appreciate the role the Office of Inspector General (OIG) plays in working with management in 
ensuring that our programs are effectively managed, and for the feedback provided in this draft report. 
The SBA team reviewed the OIG Draft Report. SBA acknowledges the importance of recovering funds 
awarded to businesses that did not meet program or statutory eligibility requirements or received funds 
that exceeded statutory limits.   
The implementation of RRF was expedited per congressional mandate to quickly provide support to 
eligible entities that suffered revenue losses related to the COVID-19 pandemic. To comply with the 
Congressional mandate to expedite delivery of RRF funds while balancing the need to protect against 
fraud and ineligibility, SBA implemented a risk management framework consisting of automated, pre-
award controls, supplemented by manual reviews of selected applications, in accordance with leading 
practices prescribed in GAO’s fraud risk framework.  

 
 
 
 
 
Additionally, SBA designed its post-award review process to maximize program integrity and optimize 
use of SBA’s limited resources and will perform manual post-award reviews of 10 percent of the total 
award population for potential fraud or misuse of program funds.    
 
Recommendation 1 – We recommend the Administrator direct the Associate Administrator of the 
Office of Performance, Planning, and the Chief Financial Officer (OPPCFO) to develop a plan for future 
similar programs to leverage applicable existing SBA data sources when determining eligibility and 
monitoring awards. The plan should include requirements to evaluate effectiveness of the use of the data 
as controls to reduce risk of improper payments. 
 
 
SBA Response: SBA agrees. SBA’s Fraud Risk Management Board (FRMB) is currently developing a 
standardized fraud risk framework for SBA in coordination with OPSM and other SBA programs. This 
framework will be leveraged by future programs to evaluate available data to determine its effectiveness 
and applicability to eligibility requirements of SBA programs administered through the platform. 
  
Recommendation 2 – We recommend the Administrator direct the Associate Administrator of the 
Office of Capital Access to validate historical sales for 47,565 awards designated or treated as Tier 2 
that failed or did not receive IRS validation. Recover any excess funds paid that are attributable to 
unverified historical sales data. 
 
SBA Response: SBA partially agrees. SBA is performing manual post-award reviews of 10 percent of 
the total award population for potential fraud or misuse of program funds, including funds paid that are 
attributable to unverified historical sales data. SBA plans to seek recovery of any excess funds paid to 
ineligible recipients.  
 
Recommendation 3 – We recommend the Administrator direct the Associate Administrator of the 
Office of Capital Access to review the 3,443 applicants awarded funds totaling $376,583,100 that self-
certified as a brewery or inn, to determine if they met the 33 percent onsite sales eligibility requirement 
and recover any funds from applicants that did not meet the requirement. 
 
SBA Response: SBA partially agrees. The implementation plan did not require a manual review of all 
awards to recipients that self-certified as a brewery or inn to determine if they met the 33 percent onsite 
sales requirement. SBA is performing manual post-award reviews of 10 percent of the total award 
population for potential fraud or misuse of program funds, including applicants that self-certified as a 
brewery or inn to determine if they met the 33 percent onsite sales requirement. SBA plans to seek 
recovery of any excess funds paid to ineligible recipients. 
 
Recommendation 4 – We recommend the Administrator direct the Associate Administrator of the 
Office of Capital Access to, in accordance with Public Law 117-2, § 5003(a)(4)(A)(i), take immediate 
action to recover improper payments from the 14 affiliated business groups disclosed by RRF applicants 
for a total of $55,067,326 in excess funds paid, beyond the $10 million limit per affiliated group. 
 

 
 
 
 
SBA Response: SBA requested specific data from OIG to assist us in analyzing this finding.  We 
received that data but are still analyzing OIG’s findings.  If our analysis of the data confirms that the 
affiliated groups received funds beyond the $10 million limit, we agree to seek recovery of any excess 
funds.     
 
Recommendation 5 – We recommend the Administrator direct the Associate Administrator of the 
Office of Capital Access to review the 16,345 applicants that disclosed having an affiliated business to 
determine if the amounts collectively awarded to the applicant and affiliates exceeded the $10 million 
maximum and recover any excess awards. 
 
SBA Response: SBA partially agrees. SBA is performing manual post-award reviews of 10 percent of 
the total award population for potential fraud or misuse of program funds, including excess funds paid to 
applicants and affiliates that exceeded the $10 million maximum limit. SBA plans to seek recovery of 
any excess funds paid to ineligible recipients.

File and source

File

24-09-rrf-program-award-oversight.pdf

Size

753,224 bytes

SHA-256

fae560ad5e192fbefce3ca5b27fc0c14ab807c463c05acdef80f342080e56744

Our copy

24-09-rrf-program-award-oversight.pdf

Original

www.oversight.gov