Top Management and Performance Challenges report (FY 2023) - SBA Office of Inspector General — pandemic lending oversight (2022-10-14)

Record facts

Full text

1 
U.S. Small Business Administration 
Office of Inspector General 
TOP MANAGEMENT AND PERFORMANCE CHALLENGES  
FACING THE SMALL BUSINESS ADMINISTRATION  
IN FISCAL YEAR 2023 
October 14, 2022 
Report 23-01 
 

i 
CONTENTS 
Message From the Inspector General ........................................................................................................................... iv 
Color Coding to Indicate Progress in Challenges ..................................................................................................... iv 
Table 1. Color Code Definitions ................................................................................................................................... v 
FY 2023 Challenges and Issues .................................................................................................................................. v 
Table 2. Top Management and Performance Challenges Facing SBA in FY 2023 .................................................... vi 
Challenge 1: SBA’s Economic Relief Programs Are Susceptible to Significant Fraud Risks and Vulnerabilities ............... 1 
Why This Is a Challenge ............................................................................................................................................. 1 
Paycheck Protection Program ..................................................................................................................................... 1 
COVID-19 Economic Injury Disaster Loan ................................................................................................................... 2 
Issue: Paycheck Protection Program Susceptible to Abuse and Fraud ................................................................... 2 
Borrowers in the Do Not Pay Database ...................................................................................................................... 3 
Taxpayer Identification Number Registered after February 15, 2020 ...................................................................... 4 
Duplicate Loans Made Under the Paycheck Protection Program ............................................................................. 4 
Paycheck Protection Program Loan Forgiveness ....................................................................................................... 4 
Program Changes Expanded the Opportunity for Sole Proprietor and Independent Contractor Fraud ................ 5 
SBA’s Handling of Potentially Fraudulent Paycheck Protection Program Loans ...................................................... 5 
Agency Progress ......................................................................................................................................................... 6 
Remaining Challenges .................................................................................................................................................. 6 
Issue: Paycheck Protection Program Eligibility ........................................................................................................ 7 
Businesses Exceeding Maximum Loan Amounts ....................................................................................................... 7 
Businesses that Exceeded Maximum Size Standards ................................................................................................ 7 
Agency Progress ......................................................................................................................................................... 7 
Issue: Paycheck Protection Program Data Reliability .............................................................................................. 8 
Underserved Market Data Was Incomplete ............................................................................................................... 8 
North American Industry Classification System (NAICS) Data Was Incomplete ....................................................... 9 
Job Statistics Were Inaccurate and Incomplete ......................................................................................................... 9 
Agency Progress ......................................................................................................................................................... 9 
Issue: SBA Must Review COVID-19 EIDLs and Grants for Potential Fraud Identified in Previous OIG Reports .. 10 
Agency Progress ....................................................................................................................................................... 11 
Challenge 2: Inaccurate Procurement Data and Eligibility Concerns in Small Business Contracting Programs 
Undermine the Reliability of Contracting Goal Achievements ..................................................................................... 12 
Why This Is a Challenge ........................................................................................................................................... 12 
Issue: Agencies Receive Credit for Ineligible Firms or Those No Longer in the HUBZone or Women-Owned 
Small Business Programs ......................................................................................................................................... 12 
Agency Progress ....................................................................................................................................................... 14 
Issue: Women-Owned Small Business Federal Certification Program Susceptible to Abuse .............................. 14 
Agency Progress ....................................................................................................................................................... 15 
Challenge 3: SBA Faces Significant Challenges in IT Investment, System Development, and Security Controls ........... 16 
Why This Is a Challenge ........................................................................................................................................... 16 

ii 
Issue: SBA’s IT Investment Controls Need Improvement ...................................................................................... 16 
Agency Progress ....................................................................................................................................................... 17 
Issue: Existing System Development and Monitoring Controls Need to Reflect Changing IT Design Risks ........ 17 
Agency Progress ....................................................................................................................................................... 19 
Issue: Additional Progress Needed in IT Security Controls .................................................................................... 19 
Agency Progress ....................................................................................................................................................... 19 
Challenge 4: SBA Risk Management and Oversight Practices Need Improvement to Ensure the Integrity of Loan 
Programs ...................................................................................................................................................................... 20 
Why This Is a Challenge ........................................................................................................................................... 20 
Issue: SBA’s Oversight of High-Risk Lending Participants ...................................................................................... 20 
Agency Progress ....................................................................................................................................................... 21 
Issue: Increased Risk Introduced by Loan Agents .................................................................................................. 21 
Agency Progress ....................................................................................................................................................... 22 
Issue: Increased Risk Introduced by Lender Service Providers ............................................................................. 22 
Agency Progress ....................................................................................................................................................... 23 
Challenge 5: SBA’s Management and Monitoring of the 8(a) Business Development Program Needs Improvement . 24 
Why This Is a Challenge ........................................................................................................................................... 24 
Issue: SBA Continues to Address Its Ability to Develop Firms in the 8(a) Program and Measure Results .......... 24 
Agency Progress ....................................................................................................................................................... 25 
Challenge 6: Identification of Improper Payments in SBA’s 7(a) Loan Program Remains a Challenge ......................... 26 
Why This Is a Challenge ........................................................................................................................................... 26 
Issue: Improvements Needed to Ensure High-Risk 7(a) Loan Reviews Reduce the Risk of Losses ..................... 26 
Agency Progress ....................................................................................................................................................... 27 
Challenge 7: SBA’s Disaster Assistance Program Must Balance Competing Priorities to Deliver Prompt Assistance but 
Prevent Fraud .............................................................................................................................................................. 28 
Why This Is a Challenge ........................................................................................................................................... 28 
Issue: Reserve Staff Need Training to Sustain Productivity During Mobilization ................................................. 28 
Agency Progress ....................................................................................................................................................... 29 
Issue: Improper Payment Quality Assurance Process Needs Strengthening ....................................................... 29 
Agency Progress ....................................................................................................................................................... 30 
Issue: Unprecedented Increase in Servicing COVID-19 EIDLs ............................................................................... 30 
Agency Progress ....................................................................................................................................................... 31 
Challenge 8: SBA Needs Robust Grants Management Oversight ................................................................................. 33 
Why This Is a Challenge ........................................................................................................................................... 33 
Issue: SBA’s Grants Management System Needs Improvement ........................................................................... 33 
Agency Progress ....................................................................................................................................................... 33 
Issue: Better Performance Measurements Needed to Monitor Grant Program Achievements ........................ 34 
Agency Progress ....................................................................................................................................................... 36 
Issue: Comprehensive Oversight Plan with Strong Controls Will Help SBA Better Assess Risk, Distribute 
Payments, and Audit the Shuttered Venue Operators Grant and Restaurant Revitalization Fund Programs ... 36 
Agency Progress ....................................................................................................................................................... 37 

iii 
Issue: Leveraging SBA’s Workforce to Ensure Effective Administration of New and Significantly Expanded 
Grant Programs to Aid Small Businesses ................................................................................................................ 38 
Agency Progress ....................................................................................................................................................... 38 
 

iv 
Message From the Inspector General 
I am pleased to present the Office of Inspector General (OIG) Report on the Top Management 
and Performance Challenges Facing the Small Business Administration in Fiscal Year 2023. 
Over 2 years have passed since the start of the Coronavirus Disease 
2019 (COVID-19) pandemic economic crisis, and OIG continues to 
provide independent and objective oversight of the U.S. Small 
Business Administration (SBA). SBA has faced a steady stream of 
unprecedented new challenges as the primary agency responsible 
for providing nationwide assistance to small businesses during the 
crisis. 
However, even before the pandemic, SBA faced major challenges in 
managing enormous financial lending programs, information 
technology, and other areas. This report discusses eight major 
performance challenge areas and the issues that contribute to the 
challenges, many of which we have discussed in previous OIG reports (see Table 2). 
I believe managing COVID-19 stimulus lending is the greatest overall challenge facing SBA, and it 
may likely continue to be for many years as the agency grapples with fraud in the programs, 
particularly in the Economic Injury Disaster Loan Program and the processing of Paycheck 
Protection Program loan forgiveness. Pandemic response has, in many instances, magnified the 
challenging systemic issues in SBA’s mission-related work. 
OIG remains committed to protecting the interests of all American taxpayers by promoting 
positive change within SBA and across government. Our audits and investigations continue to 
keep watch over government contractors for business ethics, integrity, honesty, and competency 
along with SBA programs, ensuring taxpayer dollars are spent efficiently according to intent. 
Color Coding to Indicate Progress in Challenges 
In this report, we use a color gauge as a visual indicator of the agency’s progress in confronting 
the issues that make a particular function a top management challenge. Each issue that 
contributes to the main challenge includes a small color gauge image that indicates whether the 
agency has made little, no, or significant progress on the issue to date. (See Table 1). 
 
 

v 
Table 1. Color Code Definitions 
Color 
Definition 
Color Indicator 
Green 
Issue Resolved or Appropriately 
Reduced 
 
Yellow 
Substantial Progress 
Orange 
Moderate or Limited Progress 
 
Red 
No Progress 
N/A 
New, Not Rated 
 
N/A 
Not Rated (extenuating 
circumstances) 
 
FY 2023 Challenges and Issues 
Identification of an issue as a top challenge does not necessarily denote significant deficiencies 
or lack of attention on SBA’s part. Many of the top management challenges are longstanding, 
inherently difficult, and may likely continue to be challenges in the coming years. Addressing the 
challenges will require consistent, focused attention from agency management and ongoing 
engagement with Congress, the public, and other stakeholders. It is also important to note that 
the top challenges are not listed in order of importance or magnitude, except for the COVID-19 
challenge, which we address first in this report. We view all eight challenges as critically 
important to SBA operations. 
Overall, the agency has made progress addressing this year’s list of management challenges. We 
removed three issues this year related to the 8(a) Business Development Program, which had 
been included in Challenge 5. One issue was how SBA’s streamlined application process may 
expose the 8(a) program to higher fraud risk. The second issue we removed dealt with the 
processes and reducing risks of ineligible firms participating in the 8(a) program. We believe that 
progress mitigating these issues is in large part attributable to the agency’s continued effort to 
address outstanding internal control recommendations from our audits and evaluations. 
The third issue had related to economically disadvantaged determination criteria. SBA plans to 
conduct an assessment of the FY 2020 changes to the economic disadvantage thresholds for the 
8(a) program next year, using FY 2021 and FY 2022 data. We believe the agency’s commitment 
to montoring the effects of the networth threshold changes mitigate this risk and the issue is no 
longer a top management challenge for the agency. 

vi 
The management challenges report is an important tool to help the agency prioritize its work to 
improve program performance and enhance operations. These challenges will guide OIG work in 
the coming year; we look forward to continuing to work with SBA’s leadership team to address 
the agency’s top management and performance challenges. 
Table 2. Top Management and Performance Challenges Facing SBA in 
FY 2023 
Challenge 
Issue 
Challenge 1 
SBA’s Economic Relief Programs Are 
Susceptible to Significant Fraud Risks and 
Vulnerabilities 
Paycheck Protection Program Susceptible to Abuse and Fraud 
Paycheck Protection Program Eligibility 
Paycheck Protection Program Data Reliability 
SBA Must Review COVID-19 EIDLs and Grants for Potential 
Fraud Identified in Previous OIG Reports 
Challenge 2 
Inaccurate Procurement Data and 
Eligibility Concerns in Small Business 
Contracting Programs Undermine the 
Reliability of Contracting Goal 
Achievements 
Agencies Receive Credit for Ineligible Firms or Those No 
Longer in the HUBZone or Women-Owned Small Business 
Programs 
Women-Owned Small Business Federal Certification Program 
Susceptible to Abuse 
Challenge 3 
SBA Faces Significant Challenges in IT 
Investment, System Development, and 
Security Controls 
SBA’s IT Investment Controls Need Improvement 
Existing System Development and Monitoring Controls Need 
to Reflect Changing IT Design Risks 
Additional Progress Needed in IT Security Controls 
Challenge 4 
SBA Risk Management and Oversight 
Practices Need Improvement to Ensure 
the Integrity of Loan Programs 
SBA’s Oversight of High-Risk Lending Participants 
Increased Risk Introduced by Loan Agents 
Increased Risk Introduced by Lender Service Providers 
Challenge 5 
SBA’s Management and Monitoring of 
the 8(a) Business Development Program 
Needs Improvement 
SBA Continues to Address Its Ability to Develop Firms in the 
8(a) Program and Measure Results 
Challenge 6 
Identification of Improper Payments in 
SBA’s 7(a) Loan Program Remains a 
Challenge 
Improvements Needed to Ensure High-Risk 7(a) Loan Reviews 
Reduce the Risk of Losses 
Challenge 7 
SBA’s Disaster Assistance Program Must 
Balance Competing Priorities to Deliver 
Prompt Assistance but Prevent Fraud 
Reserve Staff Need Training to Sustain Productivity During 
Mobilization 
Improper Payment Quality Assurance Process Needs 
Strengthening 
Unprecedented Increase in Servicing COVID-19 EIDLs 

vii 
Challenge 8 
SBA Needs Robust Grants Management 
Oversight 
SBA’s Grants Management System Needs Improvement 
Better Performance Measurements Needed to Monitor Grant 
Program Achievements 
Comprehensive Oversight Plan with Strong Controls Will Help 
SBA Better Assess Risk, Distribute Payments, and Audit the 
Shuttered Venue Operators Grant and the Restaurant 
Revitalization Fund Programs 
Leveraging SBA’s Workforce to Ensure Effective Administration 
of New and Significantly Expanded Grant Programs to Aid 
Small Businesses 

1 
Challenge 1: SBA’s Economic Relief Programs Are 
Susceptible to Significant Fraud Risks and Vulnerabilities 
Why This Is a Challenge 
More than 30 million small businesses in the United States have been adversely affected by the 
Coronavirus Disease 2019 (COVID-19) pandemic economic crisis. The President signed the Coronavirus 
Aid, Relief, and Economic Security (CARES) Act into law on March 27, 2020 to provide economic relief to 
our nation. 
In response to the economic crisis, SBA disbursed CARES Act funds through the Paycheck Protection 
Program (PPP) and the Economic Injury Disaster Loan (EIDL) program in amounts unprecedented in 
SBA’s history. The programs needed proper controls to ensure they operated as intended in this high-
risk environment. The absence of a proper control environment led to significant fraud risk and 
vulnerabilities, which is why this continues to be a top challenge in Fiscal Year (FY) 2023. 
OIG’s PPP and EIDL oversight and investigative work has resulted in 449 indictments, 354 arrests, and 
303 convictions as of July 31, 2022. As of July 31, 2022, OIG has received more than 208,000 Hotline 
complaints since the start of SBA’s pandemic relief programs. Additionally, OIG collaboration with SBA 
and the U.S. Secret Service has resulted in the seizure of more than $1 billion stolen by fraudsters from 
the EIDL program. We also played a key role in assisting financial institutions in the return of another $8 
billion to SBA’s EIDL program. In addition, SBA has also received over $20 billion in EIDL funds returned 
by borrowers. 
To date, we have issued 10 reports related to the PPP program and 10 reports related to the COVID-19 
EIDL program. 
Paycheck Protection Program 
In early April 2020, SBA launched the $349 billion PPP in collaboration with the U.S. Department of the 
Treasury. On April 24, 2020, Congress appropriated an additional $310 billion for the PPP through the 
Paycheck Protection Program and Health Care Enhancement Act, bringing the total for the program to 
$659 billion. 
Under the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act , the PPP was 
extended on December 27, 2020 to provide more than $284 billion in SBA-guaranteed loans. On March 
11, 2021, the American Rescue Plan Act of 2021 provided an additional $7.2 billion to the PPP, which 
increased the total program funding to $813.7 billion. On March 30, 2021, the President signed the PPP 
Extension Act of 2021, which allowed SBA to continue accepting new applications until May 31, 2021. 
By the end of the program, SBA had processed 11.8 million PPP loans, totaling $799.8 billion, through 
more than 5,400 private lenders, far more than all of SBA’s combined lending under the 7(a) program 
from 1990 to 2019. In contrast, from FY 2000 to 2019, SBA made about 1.2 million 7(a) loans totaling 
$333 billion. During that 20-year period, SBA made about 62,000 loans a year totaling about $16.7 
billion on average. 

2 
Under the CARES Act, SBA-guaranteed PPP loans for eligible small businesses, individuals, and nonprofits 
can be forgiven if proceeds were used in accordance with law. Eligible expenses include payroll, rent, 
utility payments, and other limited uses. 
To quickly distribute funds during an economic crisis, SBA eased internal controls that could have helped 
to mitigate fraud and misuse of taxpayer funds. We believe this is the tip of a much larger iceberg, and 
we are working to identify the full extent of PPP fraud. The true magnitude of fraud in SBA pandemic 
assistance programs will be coming to light for many more years as these programs move through 
remaining stages, including loan forgiveness, repayment, and guaranty purchase. 
COVID-19 Economic Injury Disaster Loan 
In FY 2020, the CARES Act and the Paycheck Protection Program and Health Care Enhancement Act 
provided $470 billion for disaster assistance and $20 billion for emergency grants for eligible entities. 
In FY 2021, the Economic Aid Act and the American Rescue Plan Act of 2021 together provided an 
additional $30 billion in Targeted EIDL Advances and $5 billion in Targeted Supplemental EIDL Advances 
to eligible entities that met additional criteria. 
From March 2020 to the end of December 2021, SBA received more than 27.7 million COVID-19 EIDL 
applications and approved 3.7 million loans totaling $303.6 billion. The COVID-19 EIDL program closed in 
May 2022. The severity of the economic crisis, and the demand for aid, is apparent when you compare 
these numbers to all other disaster loan spending outside the pandemic. Since the agency’s inception in 
1953, SBA has approved 2.2 million non-COVID-19 disaster loans for a total of $66.7 billion. 
SBA’s existing application portal and processing system were initially overwhelmed by the 4.5 million 
EIDL applications submitted by April 10, 2020. To ease the strain and meet high demand for COVID-19 
EIDLs, SBA contracted with a vendor that had previously assisted SBA in streamlining disaster loan 
processing. However, setting up a new application processing system quickly presented significant risks. 
Because of the unprecedented demand, SBA relaxed internal controls. This expeded funds to affected 
businesses, but also significantly increased the risk of program misuse and fraud. 
The extent of the suspected fraud will become apparent as EIDL payments start coming due in October 
2022. SBA anticipates that 30 to 50 percent of the 2.9 million COVID-19 EIDLs with an original loan 
amount of $100,000 or less will default. 
Issue: Paycheck Protection Program Susceptible to Abuse and 
Fraud 
Because the PPP program has closed, the issue has evolved from 
preventing fraud in the PPP to identifying and remedying potential and 
suspected fraud that has already occurred. Since the program began, 
reports of suspected fraud have come in from OIG Hotline complaints, 
financial institutions, and other law enforcement agencies. 
Examples of fraud schemes include: 
 

3 
• False statements on applications 
• Fraudulent supporting documentation (such as payroll and tax forms) 
• Accounts established using stolen identities 
• Corporate and personal identity theft 
• Inflation of payroll 
• Misuse of proceeds 
• Lender fraud 
We have received an unprecedented number of OIG Hotline PPP complaints, including these potential 
fraud or scams: 
• Loan applicants asserting a business that did not exist 
• Business owners who received a loan but did not use the funds for allowable operational 
expenses 
• Business owners who laid off employees to reduce employment numbers to qualify for a PPP 
loan 
• Business owners who have refused to allow employees to return to work, telling them to 
continue unemployment assistance 
• Online fraudsters who offered to prepare applications for a fee 
• Business owners and individuals reporting identity theft 
Internal control weaknesses limited SBA’s ability to actively reduce and combat fraud and increased the 
risk of fraudulent and ineligible applicants receiving PPP loans and loan forgiveness. Strong internal 
controls will help reduce fraud risk and enhance program integrity for the PPP and similar programs 
enacted in the future. 
It is important to note that these loans are considered potentially fraudulent because OIG has not 
completed a document-by-document review of loan files to confirm or resolve the suspicious activity; 
however, our investigations have substantiated these concerns which underscores the need for SBA to 
review loans identified as suspicious. Below is a description of issues OIG has identified related to 
potential fraud in the PPP. 
Borrowers in the Do Not Pay Database 
We coordinated with the U.S. Department of the Treasury to compare Taxpayer Identification Numbers 
and name data provided in PPP data files against Treasury’s Do Not Pay debt, exclusions, and death data 
sources. We found tens of thousands of loans that matched a Treasury Do Not Pay data source record 
indicating potential loan ineligibility (Report 21-06). 
The Treasury Department Do Not Pay system helps agencies fulfill the obligation to deny federal loans, 
loan insurance, and loan guarantees to businesses delinquent on federal debts and obligations. To be 
eligible to receive PPP funds, a business must not have any current federal debarments or suspensions, 

4 
and the applicant must not have delinquent federal loans or have defaulted on any federal loans in the 
last 7 years. In March 2021, SBA published an interim final rule that removed the eligibility restriction 
that prevents business owners who are delinquent or default on their federal student loans from 
obtaining PPP loans. 
Taxpayer Identification Number Registered after February 15, 2020 
The CARES Act required that businesses must have been in operation before February 15, 2020 to be 
eligible for a PPP loan. We found thousands of businesses obtained PPP loans with identification 
numbers that were not registered until after that date, which may indicate the businesses were created 
to fraudulently gain access to program funds (Report 21-07). We note that multiple borrowers in this 
group of identified loans have already been arrested and others are under active investigation. 
Duplicate Loans Made Under the Paycheck Protection Program 
SBA did not always have sufficient controls in place to detect and prevent duplicate PPP loans (Report 
21-09). OIG has pursued multiple PPP criminal fraud cases related to duplicate loans made to the same 
business. Additionally, other federal agencies have pursued cases involving businesses with duplicate 
PPP loans. Based on our earlier review of PPP loan data as of August 31, 2020, we found that lenders 
made more than one PPP disbursement to 4,260 borrowers, which totaled about $692 million and 
involved 8,731 loans. 
Paycheck Protection Program Loan Forgiveness 
Our evaluation of PPP loan review processes (Report 22-09) shows that the large number of borrowers 
who have not applied for forgiveness could be a strong indicator of fraud. Borrowers who fraudulently 
obtained a PPP loan are unlikely to apply for loan forgiveness because they have already obtained the 
funds with no intention to use them appropriately or to repay the loan. 
Borrowers may submit a loan forgiveness application any time before the maturity date of the loan up 
to 5 years from loan origination. However, after the 10-month deferral period, if a borrower has not 
applied for loan forgiveness, they must begin making principal and interest payments. Most 2020 
borrowers were likely to apply for forgiveness by October 31, 2021 to avoid making loan payments. 
Lenders then had 60 days to review a forgiveness application. Therefore, these forgiveness applications 
should have been submitted by lenders to SBA by December 30, 2021. 
However, based upon further analysis by OIG as of May 30, 2022, we found about 150,000 PPP 
recipients, with loans totaling over $6.3 billion, have not applied for forgiveness with SBA or made any 
principal payments. Over 52,000 of these loans have defaulted and had their guaranty honored by SBA 
for over $2.8 billion. OIG is working on a project regarding these potentially fraudulent loans. PPP funds 
were intended to assist struggling business owners during a national economic crisis. We believe these 
150,000 loan recipients either did not spend the money according to Congressional intent and therefore 
knew the loans would not be forgiven, or they had always intended to default and let the taxpayer pick 
up the bill. 

5 
Program Changes Expanded the Opportunity for Sole Proprietor and 
Independent Contractor Fraud 
Changes made by SBA to expand access to the program for certain borrowers appear to have been 
exploited by unscrupulous applicants. In March 2021, SBA issued an interim final rule that allowed 
individuals who filed an IRS Form 1040, Schedule C, to calculate their maximum loan amount using gross 
income rather than net income (Report 22-09). This change led to a significant increase in the number of 
loans of $20,833 or less, the maximum allowable loan amount for a Schedule C business with no 
employees. 
In addition to OIG Hotline complaints, multiple financial institutions have contacted us about a 
significant number of PPP deposits in personal accounts, or made to those whom the financial 
institutions believe do not own businesses. 
Based on our analysis of the PPP loan data, many of the Schedule C loans were made by lenders that 
relied exclusively on third-party loan processing or software platform vendors they hired to complete 
loan processes. These vendors do not often have a relationship with SBA. Data shows that 7 of the top 
15 lenders made more than 2.4 million loans in 2021, or more than 18,000 loans per day, after having 
made fewer than 22,000 PPP loans combined in 2020. These seven lenders included financial 
technology (fintech) lenders, Community Development Financial Institutions, and small business lending 
companies. 
We believe that these lenders and their reliance on third-party vendors could present SBA with several 
challenges moving forward, including access to loan documents. Within the context of the PPP eligibility 
and forgiveness process, we believe it is important for SBA to focus targeted efforts on these types of 
loans and review appropriate documentation to ensure these smaller loans were made to eligible 
businesses and minimize the losses associated with forgiveness of fraudulent loans. 
SBA’s Handling of Potentially Fraudulent Paycheck Protection Program 
Loans 
In our inspection of potentially fraudulent PPP loans (Report 22-13), we found SBA did not have an 
organizational structure with clearly defined roles, responsibilities, and processes to manage and handle 
potentially fraudulent PPP loans. The agency did not establish a centralized entity to design, lead, and 
manage fraud risk because the agency did not establish a sufficient fraud risk framework. This was partly 
due to the speed in which SBA was required to launch the PPP, which was 15 days after enactment of 
the CARES Act, and the continuous and rapid discovery of different kinds of fraud schemes. 
In addition, lenders were not always clear on how to handle PPP fraud or recover funds obtained 
fraudulently from the PPP that remained in the borrower’s account. SBA did not provide lenders 
sufficient specific guidance to effectively handle potentially fraudulent PPP loans. Our report noted that 
SBA should provide information on the type of fraud lenders are finding and best practices for detecting 
and reporting that fraud to SBA and OIG. Specifically, SBA should instruct lenders on how to document 
and report the return of funds from the financial institution. This should include the reason for the 
return and any findings of fraud found by the financial institution and lender. Furthermore, SBA should 
provide instructions for lenders to report notice of seizures, forfeitures, and restitution to SBA. OIG has 
seen an increase in inquiries from financial institutions seeking guidance on how to address potentially 

6 
fraudulent loans. The loan forgiveness process could potentially trigger more fraud. The instructions 
would help SBA properly flag loans for potential fraud and account for the loan balance. This would help 
determine if there are any funds due to SBA if the loan had been forgiven or guaranty purchased. 
Agency Progress 
SBA has made substantial progress to reduce fraud risks and prevent further losses. When the PPP 
launched in 2020, SBA’s fraud risk management approach for PPP loans was intentionally developed 
with more fraud and eligibility controls at the loan forgiveness phase rather than the application stage. 
SBA was mandated by Congress to swiftly pay out, or disburse, funds to millions of struggling small 
businesses. Speed became the highest priority in complying with the mandate. SBA has since 
implemented fraud and eligibility controls and taken corrective actions to combat PPP fraud, including: 
• Establishing a Fraud Risk Management Board in 2022 
• Developing a webpage dedicating to preventing fraud and identity theft, which includes a section 
entitled “Lenders and Fraud Response” 
• Developing aggregate review processes to identify different fraud scenarios 
• Developing and implementing a Master Review Plan that established guidelines for loan and 
forgiveness reviews 
• Increasing antifraud controls for loans originating in 2021, including checking application data 
against Treasury’s Do Not Pay database 
• Developing and implementing SBA and contractor fraud risk management policy and framework 
• Increasing post-disbursement antifraud controls for loans that originated in 2020 
• Commencing manual loan and forgiveness reviews 
• Engaging a contractor with expertise in detection and identification of potential fraud 
• Using a contractor’s automated review tool and the SBA Paycheck Protection Platform to analyze 
loans for fraud and eligibility 
• Implementing machine learning functionality to focus on areas of higher risk 
• Providing outreach and training 
• Implementing processes to refer potential fraud to SBA OIG 
Remaining Challenges 
Although SBA has made substantial progress in reducing fraud risks and preventing further loss, 
difficulties and challenges remain. The need to establish and utilize effective fraud, eligibility, and 
compliance controls while reviewing for loan eligibility, forgiveness, and guaranty purchase remains an 
ongoing challenge. 
SBA’s approach to fraud risk management allowed funds to disburse quickly, but presented risks of fraud 
when loans were originated. The method essentially relies on the post-origination controls to identify 

7 
and report instances of fraud and abuse that has already occurred, with funds also already disbursed. 
For funds disbursed on a fraudulent loan, the back-end controls established for the forgiveness stage 
may never be used. 
SBA’s plans and actions to reduce fraud risks and prevent further losses will determine how this 
challenge will continue to be rated in the future. Our investigations into suspected fraud and suspicious 
activities continue. We have ongoing or planned audit work on PPP loan eligibility, loan forgiveness, 
guaranty purchase, and lender activities to determine the effectiveness of agency implemented 
controls, and we will continue to monitor agency actions to assess and reduce fraud risk and address 
vulnerabilities in the PPP. 
Issue: Paycheck Protection Program Eligibility 
OIG reviews have found deficiencies with internal controls related to 
eligibility of borrowers. Our review of SBA’s implementation of PPP 
identified thousands of loans erroneously provided to potentially 
ineligible borrowers. Review our sections above on the Do Not Pay 
database and Taxpayer Identification Numbers, which also reveal 
program eligibilty issues. SBA lenders also inappropriately approved 
loans for businesses that exceeded maximum loan amounts for the 
number of employees, and exceeded the maximum size allowed. 
Businesses Exceeding Maximum Loan Amounts 
We found tens of thousands of approved and disbursed loans were made to borrowers for amounts that 
exceeded the loan maximum based on the number of employees and compensation rates, as defined in 
the CARES Act (Report 21-07). The Cares Act states that the maximum loan amount is obtained by 
multiplying the average total monthly payments by the applicant for payroll costs incurred during the 1-
year period before the date on which the loan is made times 2.5, plus any outstanding amounts of 
Economic Injury Disaster Loans made beginning January 31, 2020. 
Businesses that Exceeded Maximum Size Standards 
We found hundreds of businesses obtained PPP loans that may have been erroneously approved 
(Report 21-07). These businesses exceeded both 500 employees and the applicable employee-based 
size standard for the business industry. Under the CARES Act, an eligible business cannot exceed the 
greater of 500 employees or the SBA size standard for number of employees in the industry, if 
applicable. 
Agency Progress 
SBA has made substantial progress in strengthening controls to validate eligibility. Most notably, SBA 
initiated several corrective actions to enhance and develop additional controls to address loan reviews, 
loan forgiveness, and fraud, including: 
 

8 
• Developing the Master Review Plan, establishing guidelines for loan and forgiveness reviews 
(October 2020, revised June 2021) 
• Developing and implementing SBA and contractor fraud risk management policy and framework 
• Developing machine learning models to focus on areas of higher risk 
• Implementing automated screening to detect potentially ineligible loans 
The fraud control framework also includes a variety of antifraud controls in place designed to detect and 
mitigate possible instances of eligibility fraud. These controls include approved lender lists, verification 
with the Treasury Do Not Pay database, and compliance checks. 
SBA also integrated affiliation data, which shows business affiliation through ownership and maximum 
number of employees, as well as maximum loan amount. SBA instituted an affiliation worksheet for PPP 
loan and forgiveness reviews. Swift management action to identify and review potentially ineligible 
loans could prevent improper payments to lenders because the associated loan forgiveness may still be 
in process. 
As we complete current reviews and conduct future audit work, SBA’s plans and actions to reduce and 
prevent improper payments in addition to SBA’s corrective actions to address OIG recommendations will 
determine how we will rate this challenge in the future. 
Issue: Paycheck Protection Program Data Reliability 
OIG’s inspection of SBA’s implementation of the PPP found the data 
SBA reported and the loan-level PPP data was inaccurate and 
incomplete. Without accurate and complete data, SBA cannot reliably 
and accurately inform SBA management and Congress about 
program effectiveness and measures needed to inform program 
decisions. 
Underserved Market Data Was Incomplete 
At the beginning of the PPP program, our May 2020 flash report found that SBA’s demographic 
information for underserved markets for PPP borrowers was incomplete (Report 20-14). SBA’s borrower 
application for PPP did not include standard SBA fields to request demographic information. One week 
after we issued our flash report, SBA issued the initial PPP loan forgiveness application, which included 
an optional page for borrower demographic information. Notwithstanding, sufficient data may still not 
be collected. 
Some borrowers may not apply for loan forgiveness while others may choose not to complete the 
optional page. Although ethnic demographic information is optional for SBA’s traditional loan programs 
and the PPP, SBA generally requests the demographic information as a section on a mandatory form. 
Borrowers have the option to decline to provide the information. 

9 
North American Industry Classification System (NAICS) Data Was 
Incomplete 
We found SBA’s loan-level data on PPP NAICS codes was incomplete (Report 21-07). SBA did not require 
the borrower to provide the industry classification code on the application, so lenders did not have the 
information to put in the loan processing platform. As of June 30, 2020, there were 222,096 loans 
totaling approximately $9.9 billion that were identified as “Unclassified Establishments” because there 
was no industry classification data on the application. 
Job Statistics Were Inaccurate and Incomplete 
We found SBA’s loan-level data for job statistics was inaccurate and incomplete (Report 21-07). We 
found that 191,003 loans totaling about $11 billion did not include employment information in the 
required job field for the number of current employees. SBA officials said because of a backlog of loan 
applications before the beginning of the second round of PPP funding, lenders were allowed to submit 
loan applications in bulk. The officials said they turned off system controls to allow faster approval 
times. Of the 191,003 applications that did not have data for the number of current employees, 83,374 
were approved during the first week of the second round of funding. Because SBA removed the internal 
control to check data in the “number of current employees” field, these loans, totaling about $4 billion, 
were not validated before approving and issuing loan numbers to PPP lenders. 
Agency Progress 
SBA implemented a number of additional controls to ensure the integrity of the key data fields noted 
above, including: 
• Adding mandatory fields in borrower and lender application processes, including NAICS code, 
demographic data, and number of employees 
• Updating controls to ensure data accuracy and completeness of lender-reported data 
• Instituting a procedure for lenders and borrowers to correct publicly available PPP loan data 
provided to SBA by delegated PPP lenders 
• Adding controls for Taxpayer Identification Number data submission, Do Not Pay, and LexisNexis 
at origination 
We have an ongoing audit reviewing PPP loan eligibility, loan forgiveness, and guaranty purchase. We 
will continue to assess the reliability of PPP loan data and monitor the agency’s efforts to ensure data 
reliability. 
 

10 
Issue: SBA Must Review COVID-19 EIDLs and Grants for Potential 
Fraud Identified in Previous OIG Reports 
Because the COVID-19 EIDL program has closed, the issue has evolved 
from preventing fraud in the program to identifying and remedying 
potential fraud that has already occurred. 
Several reports issued by OIG since the start of the pandemic have 
identified potential fraud resulting from serious control weaknesses in 
the system SBA used to process COVID-19 EIDL and grants. Our 
October 2020 inspection report of SBA’s initial disaster assistance response to COVID-19 identified $78.1 
billion in potentially fraudulent loans and Targeted EIDL Advances to ineligible entities (Report 21-02). 
Our May 2021 inspection report of SBA’s handling of identity theft allegations in the COVID-19 EIDL 
program (Report 21-15) found $6.7 billion in loans and advances related to identity theft allegations. 
Our October 2021 inspection report of SBA emergency EIDL grants to sole proprietors and independent 
contractors (Report 22-01) found SBA provided $4.5 billion more in advances and grants than the 
applicants were entitled to receive. The report identified 542,897 sole proprietors and 161,197 
independent contractors who received a grant of more than $1,000. 
Lastly, our November 2021 inspection of the COVID-19 EIDL program recipients on the Department of 
Treasury’s Do Not Pay List (Report 22-06) identified over $3.1 billion in EIDLs and over $550 million in 
emergency EIDL grants to potentially ineligible applicants in the Department of Treasury’s Do Not Pay 
database. OIG has launched numerous investigations into the fraudulent activities found in these 
reports. 
The agency is tasked with identifying and confirming potentially fraudulent loans and grants reported by 
OIG. The loans and grants in the reports listed above may overlap with each other so that the total of 
potentially fraudulent loans and grants may not equate to the total of all the numbers above. The loans 
and grants were potentially fraudulent because of these issues: 
• Duplicate Internet Protocol (IP) addresses 
• Duplicate email addresses 
• Duplicate physical addresses 
• Duplicate bank accounts 
• Applicants found in Treasury’s Do Not Pay database 
• Applicants who registered Employee Identification Numbers (EIN) after the cut-off date 
• Applicants with no EIN claiming numerous employees 
• Applicants who changed their bank account numbers prior to disbursement 
Although there is some overlap, there are a significant number of loans and grants that require further 
investigation. If fraud is confirmed or suspected, there are administrative actions the agency should take 
to hold the fraudsters accountable. SBA should refer the potentially fraudulent loans and grants to OIG 

11 
for investigation. It will be a significant challenge for SBA to review the potentially fraudulent loans and 
grants and subsequently remedy those determined to be fraudulent. 
Agency Progress 
The fraud review team in the Processing and Disbursement Center, the Chief Data Officer within the SBA 
Office of Performance, Planning, and the Chief Financial Officer collaborated on a data analytics project 
to help identify COVID-19 EIDLs that may be associated with identity theft or fraud. The results of this 
project are being used by the fraud review team in the Processing and Disbursement Center with their 
ongoing effort to research suspected cases of identity theft and fraud. 
If it is determined that a file should be flagged for suspected fraud or identity theft, an agency hold (or 
hold funding) is added to the processing system. Holds are added to an application at any stage. They 
alert staff that special attention is required and that it should be reviewed. SBA is still reviewing loans 
that have been in hold for review to make a fraud determination. 
The agency hold review system allowed staff to review an average of up to 1,500 files a day and 
recategorize or refer agency holds to the SBA Office of Disaster Assistance fraud review team. The SBA 
completed 157,705 reviews of electronic loan files on hold as of June 17, 2022. 
While SBA has made progress in identifying and reviewing fraud and agency holds, we believe the sheer 
volume of potential fraudulent loans and grants discovered in OIG reports will be a continuing challenge 
to the agency as the deferment period ends for some EIDLs in October 2022 and borrowers are 
expected to begin making payments on these loans. 
 
 

12 
Challenge 2: Inaccurate Procurement Data and Eligibility 
Concerns in Small Business Contracting Programs 
Undermine the Reliability of Contracting Goal 
Achievements 
Why This Is a Challenge 
The government-wide goal of the Small Business Act is to ensure that 23 percent of all prime contracts 
are awarded to small businesses each fiscal year. Since FY 2013, the SBA has reported in its annual Small 
Business Procurement Scorecard that the federal government has met or exceeded that goal. This year 
SBA announced the federal government exceeded the FY 2021 goal, awarding 27 percent of prime 
countracts to small businesses. These contracts awarded to small businesses totaled $154.2 billion, an 
$8 billion increase from the previous fiscal year. SBA reported the federal government earned an “A” on 
this year’s government-wide scorecard. 
Over the years, Congress has expressed concerns about the accuracy of the report. OIG and 
Government Accountability Office (GAO) audits have revealed a widespread problem of misreporting by 
agencies that award contracts to small firms with provisions or other contract language that allows 
larger companies to do most of the work. We recently found this to be the case in our evaluation of 
SBA’s set-aside contract awarded for COVID-19 EIDL recommendation services at the beginning of the 
pandemic (Report 22-10). SBA awarded the contract to a small business that subcontracted with a large 
business without assessing whether the relationship made the two businesses affiliated. Also, we found 
the subcontractor exceeded the subcontracting limits for this contract, which totaled $773.8 million, at 
the time of our review. 
As the federal government’s primary advocate for small business, SBA must continue to strive to ensure 
federal agencies award small business contracts only to eligible entities and that those qualifying 
businesses are counted in the assessment. SBA’s achievement reports do not portray federal contracting 
dollars obligated only to small businesses, and this reduces the ability of Congress and other federal 
policymakers to determine whether the government is maximizing contracting opportunities for small 
businesses. 
Issue: Agencies Receive Credit for Ineligible Firms or Those No 
Longer in the HUBZone or Women-Owned Small Business 
Programs 
SBA has changed HUBZone program requirements, widening eligibility 
and deviating from Congressional intent. These small, disadvantaged 
businesses are located in historically underutilized business zones. OIG 
continues to find that SBA does not consistently detect ineligible firms 
in its small business contracting certification programs. 

13 
A disadvantaged small business enters a 9-year program and is designated as an SBA 8(a) business. 
Agency contracting officers have reported ineligible firms as certified either in the HUBZone or 8(a) 
Business Development programs in the System for Award Management (SAM.gov). In 2020, the General 
Services Administration Office of Inspector General found $89 million in contracting dollars erroneously 
recorded as awarded to small businesses in the Federal Procurement Data System–Next Generation, the 
contract reporting system of record at the time of the audit. 
In 2018 and 2019, we found SBA did not ensure only eligible firms entered the HUBZone program. In 
2020, SBA changed a HUBZone requirement, allowing certified businesses to have employees who are 
not current HUBZone residents. Under the new requirements, the business continues to meet the 
requirement as long as it has employees who lived in a HUBZone for at least 180 days after the business 
was first certified. 
HUBZone businesses could have no employees residing in the HUBZone at all and still qualify because 
employees initially hired as HUBZone residents moved out of the HUBZone after the 180-day period. 
The requirements of the rule are clearly inconsistent with legislative intent. 
SBA program success and integrity could be adversely affected if the agency admits ineligible firms into 
programs intended for disadvantaged small businesses. Before 2008, SBA certified small, disadvantaged 
businesses. SBA terminated its small, disadvantaged business certification program in 2008 as a result of 
court decisions, and since then, firms have self certified. The awards made to these firms count toward 
the agency’s contracting goals. 
The Small Business Act requires that 5 percent of all prime and all subcontracts for the federal 
government be awarded to contractors with small, disadvantaged business status. In December 2021, 
the Office of Management and Budget raised the prime contracting goal for such businesses to 11 
percent for FY 2022. Participants in the 8(a) program are considered small, disadvantaged businesses 
and awards made to them are also counted toward agency goals. 
As of October 2022, SBA’s Dynamic Small Business Search database included 149,326 firms that self 
certified as small, disadvantaged businesses. Firms that falsely certify they are socially and economically 
disadvantaged may receive federal contracts counting toward the agency’s goal achievements. 
Even though self-certification is inherently risky, SBA removed regulations allowing for protests of a 
firm’s disadvantaged business status in FY 2020. While firms are still subject to protests related to their 
small business size, business owners’ status as socially or economically disadvantaged cannot be 
challenged. On September 9, 2022, SBA proposed to authorize reviews and protests of the small, 
disadvantaged business status in connection with prime contracts and subcontracts to a federal prime 
contract. SBA requested comments on that proposal and others by November 8, 2022. 
Based on FY 2021 contract data retrieved from SAM.gov, as much as $12.4 billion in prime contracts was 
awarded to small, disadvantaged businesses that were not certified as 8(a), a Woman-owned Small 
Business, an economically disadvantaged women-owned small business, HUBZone, service-disabled 
veteran-owned small business, or a joint venture that included a firm with one of these designated 
certifications. Given the large amount of federal contracting dollars awarded to these self-certified 
small, disadvantaged businesses, it is crucial for SBA to ensure that only eligible firms are counted. 
Federal agencies will need to expand procurement activities to deliver on the President’s goal of 
increasing the share of federal contracts awarded to small, disadvantaged businesses from 5 to 15 

14 
percent by 2025. Program officials should consider the impact this regulatory void could have on the 
accuracy of the goaling achievements agencies report annually. 
Agency Progress 
SBA has made substantial progress in adding controls to detect ineligible firms in the 8(a) and HUBZone 
programs. In FY 2020, SBA updated and trained staff on its HUBZone policy directives to standardize 
analysis and oversight. SBA started requiring that HUBZone firms annually recertify that they meet 
program eligibility requirements. SBA also requires each firm to complete a program examination every 
3 years. As a result of implementing these program changes, SBA has taken action to decertify firms that 
are no longer eligible for the program. Since initiating the annual recertifications and triannual program 
examinations in FY 2021, SBA decertified 2,548 firms as of May 31, 2022. 
SBA instituted procedures to ensure program officials justified their recommendations to admit firms 
into the 8(a) program. The agency is also tracking complaints about firms’ eligibility to participate in the 
program. 
While recent regulatory and procedural changes improved SBA’s oversight of firms continuing in the 
HUBZone program, the changes also removed certain controls that are essential for proper oversight. 
The new HUBZone employee residency requirement may reduce the program’s ability to meet 
legislative intent. Allowing certified businesses to count employees who are not current HUBZone 
residents does not ensure continual employment of individuals who live in distressed areas. We 
question if the full economic benefits of the HUBZone program will be realized in these areas. 
Similarly, SBA’s removal of regulations allowing for protest of a firm’s small, disadvantaged business 
status jeopardizes the integrity of the federal government’s small, disadvantaged business contracting 
and subcontracting achievements. SBA should continue to strengthen its oversight of these certification 
programs to ensure only eligible firms are participating. 
Issue: Women-Owned Small Business Federal Certification 
Program Susceptible to Abuse 
SBA’s Women-Owned Small Business (WOSB) program is intended to 
give eligible companies greater access to federal contracting 
opportunities, ensuring a level playing field for women business 
owners. Both OIG and GAO have reported weaknesses in SBA’s 
controls intended to ensure only eligible firms receive federal 
contracts set aside for these businesses. 
The federal government’s annual contracting goal for WOSBs is 5 
percent of all federal contracting dollars. The WOSB program is a subset of this larger goal, but not the 
sole driver. The government limits competition for set-aside WOSB and economically disadvantaged 
women-owned small business federal contracts to participants in the WOSB Federal Contracting 
Program. Some contracts are awarded directly with no competitive bidding. Such contracts are known 
as sole-source awards. This means significant contracting dollars and taxpayer funds are at stake, 
beginning with program eligibility and certification of the designation. 

15 
The 2015 National Defense Authorization Act required qualifying small businesses to be certified by a 
federal agency, a state government, SBA’s Administrator, or a national certifying entity approved by the 
Administrator. 
Women business owners seeking to participate in the WOSB program may submit an application and 
supporting documents to SBA at no cost using the website beta.Certify.sba.gov or pay a fee to be 
certified by an official third-party organization. As mandated in FY 2015, SBA has four approved third-
party certifiers that are allowed to charge a fee to certify the WOSB or an economically disadvantaged 
women-owned small business. 
Government contracting officers have a history of improperly awarding WOSB contracts because of 
certification complexities. In a 2018 audit (Report 18-18), OIG found contracting officers at various 
federal agencies made sole-source awards without having the necessary documentation to determine 
WOSB eligibility. 
In September 2022, we reported that SBA established its WOSB certification process to collect 
documents to verify applicants met most program eligibility requirements, but did not require any 
documentation to ensure businesses met SBA size standards (Report 22-20). SBA analysts also did not 
always ensure women were the majority owners and controlled the business. In our analysis, we found 
3 of the 25 firms we reviewed did not have documentation that supported a woman controlled the 
business. To ensure that only small businesses owned and controlled by women benefit from the WOSB 
certification program, SBA must create a control environment requiring all eligibility requirements to be 
verified. 
Further, despite relying on third-party certifier’s decisions on a firm’s eligibility to participate in the 
program, SBA did not conduct consistent reviews of these organizations. This has been a challenge for 
the agency since 2014, when GAO first recommended SBA establish procedures to assess the 
performance of the third-party certifiers. 
Agency Progress 
SBA has made limited progress toward addressing this challenge. In July 2020, SBA launched 
beta.Certify.sba.gov, the operational platform used to manage the certification process for the Women-
Owned Small Business and economically disadvantaged women-owned small business programs. In 
October 2020, SBA began conducting WOSB certification determinations. SBA hired additional WOSB 
analysts, a program director, and increased the number of staff supporting the program. 
However, the agency did not develop a reliable system that accurately reports data and interfaces with 
other essential databases that contracting officers across the federal government rely on for awarding 
WOSB set-aside contracts. 
Also, SBA did not ensure the staffing levels were appropriate to handle the initial surge of applications, 
resulting in processing times that exceeded the established timeframes. As of May 31, 2022, the WOSB 
program has approved 5,780 firms into the program and denied 214. Additionally, as part of SBA’s 
review process, 12,000 applications were screened and returned to the applicant for more information. 
The slow progress in issuing prompt certifications affects SBA’s ability to adequately serve the needs of 
women-owned businesses. 
 

16 
Challenge 3: SBA Faces Significant Challenges in IT 
Investment, System Development, and Security Controls 
Why This Is a Challenge 
Over the past decade, the agency has struggled with big, high-dollar information technology (IT) 
projects. Development challenges and risks have increased as SBA used outward facing third-party 
systems to provide emergency COVID-19 and disaster economic assistance. The inherent risks and 
related controls outlined in this challenge are comparable to three areas on GAO’s federal high-risk list: 
IT investments, SBA’s emergency loan process, and cybersecurity. According to GAO, this list comprises 
federal programs and operations that need reform because they are vulnerable to waste, fraud, abuse, 
and mismanagement. 
SBA contracted with third-party providers to provide application processing services for multiple 
disaster assistance programs, including PPP loan forgiveness, EIDL processing, and the Shuttered Venue 
Operators Grant (SVOG) program. Federal guidance, such as OMB Circular A-123 and the Federal 
Information Security Modernization Act (FISMA), requires agency management to validate the adequacy 
of controls by third-party service providers. Presidential Executive Order 14028 further emphasizes the 
importance of strengthening supply chain controls. The security of software used by the federal 
government is vital to its ability to perform critical functions. Commercial software development 
requires transparency, ability to resist attack, and controls to prevent tampering by malicious actors. 
Consequently, SBA needs to implement rigorous and predictable programs to improve security. 
The SBA Business Technology Investment Council (BTIC) oversees significant IT investments and 
monitors system development, design, and security controls. The BTIC is responsible for implementing 
key provisions of the Clinger-Cohen Act (Information Technology Management Reform Act), which 
charges chief information officers with the duty to monitor, evaluate, and report agency performance of 
IT programs. The BTIC monitors development performance against requirements and baseline controls, 
facilitates corrective actions, and provides transparency to the investment control process. 
IT investments, system development, and security controls are managed primarily through entity-level 
control activities. These activities allow the agency to meet its objectives, address related risks, and 
ensure information technology continues to properly operate. SBA must maintain and establish IT 
design and security control baselines essential to protect information and preserve data integrity. 
Issue: SBA’s IT Investment Controls Need Improvement 
SBA must establish effective IT investment controls and ensure they 
meet functional requirements, projected schedules, and estimated 
costs. Our review of the Certify project in July 2020 (Report 20-17) 
showed that the project’s investment cost, schedule, and performance 
baseline data needed to be submitted for BTIC review. This data shows 
the amount of work accomplished and incurred costs against the 
original investment baseline to provide critical management visibility 

17 
on the achievement of, or deviation from, goals. Although the SBA BTIC is the principal governance body 
in managing SBA IT investments, it appears the most recent board meeting was on September 15, 2021. 
Past BTIC minutes showed limited vetting and oversight of third-party system contracts and related 
system development activities. BTIC minutes show limited evidence of project performance oversight on 
IT investments in the last 2 years. SBA used systems developed by third-party service providers to 
deliver the majority of its pandemic assistance. 
SBA’s Standard Operating Procedure IT Investment Performance Baseline Management Policy requires 
that the BTIC be involved for the whole life of the IT project/investment. The policy further states the 
BTIC should provide direction on reviewing and approving the SBA IT portfolio. The council should be 
helping the agency create the optimum return on its IT investment. The BTIC should be supporting the 
agency’s mission and ensuring the accountability of SBA business and IT investments. 
Agency Progress 
A major focus of last year’s challenge was related to agency investment controls. This year’s work 
showed that the recommendations we made for the Certify.gov (its current version is 
beta.Certify.sba.gov) investment controls were not fully implemented across the agency. Our 
recommendations addressed agency-wide development activities. The BTIC has not published meeting 
minutes since September 2021. Consequently the BTIC is not providing effective oversight of IT 
investments. 
Issue: Existing System Development and Monitoring Controls Need 
to Reflect Changing IT Design Risks 
During the past 2 years, SBA procured new systems from third-party 
service providers to deliver emergency COVID-19 disaster assistance. 
For example, two newly procured systems delivered $808.5 billion of 
disaster assistance from 2020-2021. These outward facing systems 
allowed accelerated delivery of critical disaster assistance funds, 
performing mission critical functions. These systems processed large 
volumes of sensitive data and were subject to cyber threats, incidents, 
and risks. Our audit work found the agency allowed the third-party systems to be put into service 
without conducting baseline control assessments. With no baseline, the agency could not perform 
effective continuous monitoring. Also, we found that control processes did not identify, communicate, 
capture privacy or identity risks. These risks include identity theft, misappropriated social security 
numbers, and modified applicant addresses. 
The following control areas require improvement: 
Enterprise-wide communication of privacy and identity risks 
From 2020 to 2022, OIG identified and communicated to the agency potential privacy and identity 
internal control weaknesses in the disaster assistance systems. Subsequently, OIG was unable to obtain 
evidence that the previously identified privacy and identity risks were communicated across the agency 
to be considered for mitigation in other systems. The agency responds to security incidents through the 
Enterprise Cybersecurity Service to address cybersecurity intelligence, risk management, and incident 

18 
response. However, improvement is needed to ensure identity and privacy risks are fully integrated into 
the risk management process. 
Improved coordination for system contracts and data management 
System acquisition controls play a significant role in the effective management of an information 
system. OCIO and program officials need to ensure third-party system security and data migration 
contract provisions are followed in accordance with federal guidance. Effective coordination of activities 
is needed throughout the project life cycle from project inception to decommissioning of a system. In 
our report on COVID-19 IT security controls (Report 22-19), we found SBA did not provide 
documentation to validate that system functionality and security was included and reviewed in the 
acquisition contracts. In July 2022, we found (Report 22-16) management did not follow its policies 
when migrating COVID-19 EIDL program data from the service provider’s cloud platform to SBA’s data 
warehouse. Without advanced planning for data migration and defined acceptance criteria, SBA took 
reactive measures when the contract ended. 
Oversight of third-party systems used to process transactions integral to SBA’s mission 
SBA has an outdated system development policy which is a roadmap for the purchase, launching, and 
management of software and related application development activities. Updated system guidance is 
crucial for monitoring third-party systems used to process transactions integral to the mission of SBA. 
The agency must update its guidance for purchasing and related system development to validate 
essential controls exist before a system is put into production. 
System and Organization Controls (SOC) 1 Type 2 reports for all new and existing external financial 
systems 
OIG’s Independent Public Accountant was unable to obtain reasonable assurance regarding the 
reliability and integrity of reported financial data for critical third-party systems, which contributed to 
two disclaimer audit opinions for FYs 2020 and 2021. A disclaimer of opinion results when an auditor 
cannot obtain sufficient information to render an opinion on an organization’s financial statements. The 
SOC 1 Type 2 report provides assurance that reported financial data is complete and reliable. 
System acceptance controls and continuous monitoring to limit security and processing risks 
SBA expedited pandemic aid to eligible taxpayers, but the agency must still ensure design of system 
controls meets federal guidance in delivering program funds. For that reason, testing protocols must be 
fully addressed, even within limited timeframes, and then independently tested to ensure they operate 
as intended. Acceptance criteria specify the minimum desired functionality acceptable for a system to 
be put into operation. 
The agency did not fully implement a robust internal control baseline that addressed the need for 
essential security controls and continuous monitoring over the third-party systems. A baseline is a set of 
minimum-security controls for an information system. Parts of the assessment and authorization 
process were incomplete or completed more than 9-14 months after the systems were put into 
operation. 

19 
Agency Progress 
Since this challenge area was introduced last year, the agency has made limited progress by introducing 
a supply chain risk management policy and updating its IT Investment Performance Baseline 
Management Policy. The agency should continue to establish policies that address essential entity-wide 
controls. Some examples of these controls include independent assurance reviews of third-party 
financial systems, processes to identify and communicate privacy and identity risks, and an enterprise-
wide system development process that ensures consistency in system design. 
The agency should also continue its oversight of IT investments and related system development 
controls through the Business Technology Investment Council. The BTIC performs an essential 
governance role in implementing key provisions of the Clinger-Cohen Act, which includes monitoring, 
evaluating, and reporting agency performance of IT programs. 
Issue: Additional Progress Needed in IT Security Controls 
Inspectors general are required by FISMA to assess the effectiveness of 
information security programs on a maturity model spectrum and 
assess security capability in eight domains. 
The current benchmark for an effective program within the context of 
the maturity model is level 4, managed and measurable. In the 
maturity model, domain performance that scores below the level of 
managed and measurable, such as ad hoc, defined, or consistently implemented, means IT security is 
ineffective. 
For FY 2022, the scope of the FISMA evaluation required an accelerated evaluation timeframe. It 
focused on a reduced core set of 20 metrics with supplemental metrics being introduced in future fiscal 
years. This evaluation of core metrics across the nine domains indicated that SBA continued to achieve 
level 4 in the area of incident response but is at level 2, defined, or level 3, consistently implemented, in 
the remaining eight areas. The maturity model criteria places SBA at an overall level of not effective. 
Agency Progress 
SBA quickly responded to identified vulnerabilities but continues to experience security control 
challenges in areas of user access, configuration management, security training, and risk management. 
SBA made progress in supply chain risk management. The agency continues to be rated at the effective 
maturity level in the area of incident response. However, continued improvement is needed in the areas 
of risk management, including hardware and software inventories, configuration management controls 
around patch management, security training and access controls particularly for administrator 
privileges. 
 

20 
Challenge 4: SBA Risk Management and Oversight 
Practices Need Improvement to Ensure the Integrity of 
Loan Programs 
Why This Is a Challenge 
SBA’s Office of Credit Risk Management manages credit risk for the agency’s loan portfolio of 
approximately $240 billion (as of March 2022), and this includes the remaining outstanding loans made 
through the Paycheck Protection Program (PPP). As discussed in Management Challenge 1, SBA’s lack of 
internal controls led to significant fraud risk and vulnerabilities. Additionally, we found that SBA did not 
have an organizational structure with clearly defined roles, responsibilities, and processes to manage 
and handle potentially fraudulent PPP loans. As of March 2022, SBA has made forgiveness payments 
exceeding $700 billion to over 4,700 PPP lenders, which the Office of Credit Risk Management has the 
responsibility to oversee. PPP loans are originated by lenders and other companies that often have a low 
degree of expertise in SBA loan program requirements, which is why this continues to be a challenge for 
FY 2023. 
Lenders often rely on the services of fee-based and other third-party agents to help originate, close, 
service, and liquidate SBA loans. Most traditional SBA-guaranteed 7(a) and 504 Certified Development 
Company loans are originated by lenders with delegated approval authority. Generally, these lenders 
are subject to only limited SBA oversight and quality control unless a borrower defaults on a loan. 
Our previous audits have found SBA has not adequately recognized or managed significant lender 
weaknesses. In an audit of SBA’s oversight of high-risk lenders (Report 20-03), we identified additional 
internal control weaknesses in lender oversight. 
Previous OIG audits have also shown that SBA did not effectively identify and track third-party agent 
involvement in its 7(a) and 504 loan portfolios. Tracking such agents is crucial in managing the portfolios 
because many lenders rely on the services of fee-based and other third-party agents to help originate, 
close, service, and liquidate SBA loans. 
Issue: SBA’s Oversight of High-Risk Lending Participants 
The risks inherent in delegated lending require effective oversight to 
monitor compliance with SBA policies and procedures and corrective 
actions to address noncompliance. However, OIG’s 2019 audit of SBA’s 
oversight of high-risk lenders (Report 20-03) found that the SBA Office 
of Credit Risk Management did not always effectively oversee high-risk 
lenders to identify and mitigate risks. SBA did not always 

21 
• conduct planned high-risk lender reviews, 
• recommend appropriate and consistent risk mitigation actions for the deficiencies identified 
during the oversight reviews of high-risk lenders, or 
• communicate loan deficiencies noted during high-risk lender reviews to SBA approval and 
purchase loan centers. 
Agency Progress 
SBA has worked to address issues with its oversight of lenders in response to our audit 
recommendations. In FY 2021, SBA took three actions to improve its ability to oversee high-risk lenders: 
1. Issuance of the Final 7(a) Lending Oversight Rule and publication of Standard Operating 
Procedure (SOP) 50 53 (2) on supervision and enforcement 
2. Realignment of the organizational structure of the Office of Credit Risk Management to 
strengthen lender oversight and add resources to the review teams for effective oversight 
3. Implementation of quarterly meetings to ensure adequate oversight of lenders with elevated risk 
profiles 
In FY 2022, SBA continues to revise SOP 51 00 and document the process for on-site lender reviews and 
examinations. SBA is testing the viability of improvements to oversight activities, such as a new 
approach to monitor lenders with higher risk profiles by performing quarterly loan file reviews and 
providing timely feedback. 
The Office of Credit Risk Management has implemented the communications protocol that was 
developed in FY 2020 to document deficiencies identified during loan file reviews and to then share this 
information with SBA loan centers and other internal stakeholders. The communications protocol will be 
included in the revised SOP 51 00 2. 
Although SBA has made substantive progress, agency management has indicated it needs time to 
finalize and implement oversight policies and procedures, including SOP 51 00 2. Agency management 
needs to obtain additional information to confirm that identified deficiencies have been corrected. 
We will continue to monitor SBA’s ongoing efforts to address open recommendations in Report 20-03, 
including developing effective oversight policies and procedures and a comprehensive database or 
workflow management tool to manage oversight of high-risk lenders. 
Issue: Increased Risk Introduced by Loan Agents 
Previous OIG audits and investigations have shown SBA could not 
effectively identify and track loan agent involvement in its 7(a) and 504 
loan portfolios. OIG investigations have also revealed a pattern of 
fraud by loan packagers and other fee-based agents in the 7(a) loan 
program involving hundreds of millions of dollars. Despite the 
prevalence of fraud in its loan portfolios, SBA’s oversight of loan agents 
was limited. 

22 
SBA requires lenders to provide a loan agent disclosure form (Form 159) to SBA’s fiscal and transfer 
agent for 7(a) loans that involve a loan agent. The fiscal and transfer agent is a contractor who supports 
SBA by serving as paying agent for all investor payments, processes lender loan reporting, and payment 
remittance reconciliations. The fiscal and transfer agent also serves as the central registry for all 
guaranteed secondary-market interests. The fiscal and transfer agent must enter the data into a 
database accessible to SBA. Prior OIG audits identified significant issues in the data quality of Form 159 
being tracked by the fiscal agent. We also found that SBA had not begun tracking Form 159 in the 504-
loan program. 
Agency Progress 
SBA’s oversight of loan agents has been a long-standing challenge that the agency has made great 
progress in resolving. SBA determined the best way to gather information on loan agents was by 
improving Form 159. The improved Form 159 allows SBA to aggregate and report on loan agent activity 
to analyze the lender’s portfolio. SBA initiated targeted Form 159 reviews of lenders to determine 
compliance with SBA requirements. SBA also undertook a new, more effective method of disclosing and 
tracking loan agent involvement in the 504 loan program. SBA requires 504 lenders to electronically 
submit Form 159 directly into SBA’s electronic lending system. 
SBA contracted with a new fiscal and transfer agent who developed application and follow-up controls, 
including requiring lenders to electronically submit Form 159s through the Capital Access Financial 
System. These controls ensure critical fields on each form are completed. Lenders put information into 
the system, such as broker name, service provided, and the amount of compensation paid, which then 
populates Form 159. The lender signs the form and may upload the form into the system. 
Because loan agent involvement in the 7(a) program is significant, it is important for SBA to have 
oversight tools that monitor loan agent involvement in this sizeable program. SBA also needs to 
effectively manage the risk introduced by high-risk loan agents. OIG plans to conduct work related to 
agents involved in the PPP and monitor risks related to SBA’s oversight of loan agents. 
Issue: Increased Risk Introduced by Lender Service Providers 
In August 2021, five former officers and employees at one of the 
largest lender service providers were convicted on all charges in a 13-
year conspiracy to defraud SBA in connection with programs to 
guarantee loans made to small businesses. 
The officers fraudulently obtained guarantees for loans SBA deemed 
ineligible. The officers hid signs of ineligibility from SBA by 
misrepresenting the use of SBA loan proceeds and unlawfully diverting previously denied loan 
applications into expedited approval channels. The officers originated dozens of loans, totaling more 
than $10 million in disbursements, that were not eligible for SBA guarantees. SBA has had to contend 
with risks introduced by the outsourcing of traditional lender functions to lender service providers, a 
type of loan agent, for some time. 
The number of SBA-approved lender service provider agreements has grown significantly, in part 
because of SBA’s effort to better control access to its systems by lender service providers. SBA assigns 

23 
an identifying number to all lender service providers that access SBA systems and records all SBA-
approved agreements. 
Use of the identification number has made it possible for the SBA Office of Credit Risk Management to 
develop initial statistics on provider participation in SBA’s 7(a) program, but the agency’s oversight is still 
limited. SBA’s analysis of the performance of loan agents does not include loan-level information from 
lenders to make it possible to identify high-risk lender service providers. 
Agency Progress 
Since we first reported on these issues in 2015, SBA has implemented internal controls related to the 
tracking and monitoring of lender service provider involvement in SBA’s loan programs. SBA established 
a method to track lender service provider involvement at the loan level. 
In FY 2020, SBA worked with a contractor to develop a performance analysis for lender service provider 
portfolios to identify any high-risk providers. In FY 2021 and FY 2022, SBA worked with the contractor to 
analyze whether lender service providers add risk to the lenders’ loan portfolios. The analyses indicated 
that loans with a service provider generally performed worse than those without provider involvement 
in both guaranty purchase and early default rates. 
As lender service provider involvement in the 7(a) program increases, it will be important for SBA to 
continue to evaluate performance and act when necessary to effectively reduce the incurred risks. OIG 
will continue to monitor SBA’s oversight of lender service providers, assess risks, and conduct audits and 
reviews as necessary. 
 

24 
Challenge 5: SBA’s Management and Monitoring of the 8(a) 
Business Development Program Needs Improvement 
Why This Is a Challenge 
SBA’s 8(a) Business Development Program was created to provide business development assistance to 
eligible small, disadvantaged businesses seeking to compete in the federal marketplace. A major benefit 
of the 8(a) program is that these certified firms can receive sole source and set-aside contracts. Sole-
source awards are contracts proposed for award without competition. A set-aside award is a proposed 
contract with competition limited to small businesses. This means small businesses do not have to 
compete against large businesses that may have an industry advantage. The goals of these contracts and 
certification programs are that the federal government receives the needed services for the benefit of 
taxpayers and also helps diversify the economy by supporting small business. 
SBA has adequately addressed issues we raised about ensuring that only eligible firms are admitted into 
and remain in the 8(a) program, but the agency continues to address challenges in providing effective 
business development assistance, as well as measuring and reporting the outcomes of the program. In 
February 2022, OIG issued Report 22-08, which found SBA’s processes did not consistently allow for SBA 
or stakeholders to determine whether firms met their individual goals to successfully complete the 9-
year program. 
Issue: SBA Continues to Address Its Ability to Develop Firms in the 
8(a) Program and Measure Results 
SBA has historically emphasized business development to enhance 
the ability of 8(a) firms to better compete for federal contracts. SBA 
offers individualized development assistance to program participants 
and also makes referrals to its resource partners, Small Business 
Development Centers, SCORE, a volunteer mentor network 
composed of retired executives and entrepreneurs, Women’s 
Business Centers, Veterans Business Outreach Centers, and affiliate 
Procurement Technical Assistance Centers. 
Despite this, SBA has not fully established an IT system to perform regular performance monitoring and 
reporting for 8(a) participants to ensure progress within their business plans. Without an effective IT 
system to monitor 8(a) participant progress in meeting individualized business development goals, SBA 
may not be able to consistently determine if 8(a) participants have demonstrated the ability to compete 
in the open marketplace without program assistance (see Challenge 3 for details on Certify.sba.gov). 
SBA is considering next steps for IT development that would provide those features and capabilities that 
can facilitate tracking, measuring, and monitoring progress. To bridge the gap in the interim, SBA in FY 
2020 created the Business Opportunity Specialist Annual Review Workbook. When used, the specialist 

25 
uses this Excel workbook to determine continuing eligibility and summarizes current financial conditions 
for each business during annual reviews. 
SBA’s IT challenge is not the sole reason the 8(a) program has not improved in measuring the 
development of firms over the years. In our February 2022 Report 22-08, we found SBA’s processes did 
not consistently allow for SBA or stakeholders to determine whether firms met their individual goals to 
successfully complete the 9-year program. 
SBA did not ensure specialists regularly monitored a participant’s business goals, assessed business 
development needs, and followed up with actions for training and accountability. We found that 15 of 
the 40 firms tested did not have approved business plans with identified goals, making them ineligible to 
receive 8(a) contracts. We questioned $93 million in 8(a) set-aside or sole-source contracts that four of 
the firms were awarded. 
SBA also did not establish performance measures at the program level to know whether the 8(a) 
program was successful as an SBA program. There are no relevant performance metrics to gauge the 
outcomes from the program or to know the effects the program is having on small businesses. 
Without consistent procedures, there is no assurance that participants received the business 
development assistance needed for them to become viable competitors in the contracting arena. As a 
result, the agency continues to face challenges on how it can best manage a program that will 
effectively increase the participation of small businesses in the American economy. 
Agency Progress 
SBA made some progress to address OIG recommendations issued this year. 
To address OIG’s most recent report findings, SBA implemented a standard process to ensure initial 
business plans are monitored and annual reviews capture the 8(a) participant’s business plan updates. 
An SBA Procedural Notice, effective August 10, 2022, requires all district offices to ensure that 8(a) firms 
obtain their business plan approval prior to the first contract being awarded. Program officials are 
working on improving the FY 2023 Business Opportunity Specialist Annual Review Workbook to better 
measure business development. SBA added questions to the business opportunity specialist workbook 
to place emphasis on monitoring a firm’s strengths, financial targets, and business goals. The 
enhancements will help emphasize business development rather than solely focusing on eligibility and 
annual compliance. 
SBA plans to mandate the use of the workbook for all 8(a) firms that will be admitted to the program in 
the near future. Until the new procedures are fully in place, the effectiveness of the workbook has yet to 
be determined. The agency is also working on updating standard operating procedures by August 1, 
2022. SBA continues to respond to emerging issues related to the pandemic economic crisis, providing 
timely guidance and resources to 8(a) program participants. 
 
 

26 
Challenge 6: Identification of Improper Payments in SBA’s 
7(a) Loan Program Remains a Challenge 
Why This Is a Challenge 
OIG audits and reviews have identified 7(a) loans that were ineligible, given to borrowers who did not 
have the ability to repay, or were not properly closed, resulting in improper payments. Improper 
payments occurred in part because SBA did not adequately review related loans, which is why this 
remains a management challenge this year. 
In FY 2021, the dollar amount of SBA’s 7(a) loan approvals totaled $36.8 billion. Most of these loans 
were made by lenders with delegated approval authority. When a loan goes into default, SBA reviews 
the lender’s actions on the loan to determine if it is appropriate to pay the lender the guaranty, which 
SBA refers to as a “guaranty purchase.” “Guaranty” is a variant of “guarantee” used in financial 
terminology. 
About 8 years ago, OIG established a High-Risk 7(a) Loan Review Program to evaluate lender compliance 
with SBA requirements for high-dollar, early defaulted 7(a) loans. High-dollar, early defaulted loans are 
$500,000 or more and default within the first 18 months of initial disbursement. The 7(a) loan has been 
the agency’s largest financing program for general business needs, so it is vital that SBA identify and 
reduce the risk of improper payments in order to meet its objectives for the program. 
Issue: Improvements Needed to Ensure High-Risk 7(a) Loan 
Reviews Reduce the Risk of Losses 
Between 2014 and 2019, OIG conducted risk based reviews of 7(a) 
loans and recommended recoveries on 17 loans totaling more than 
$19.3 million. In addition, we identified suspicious activity on five loans 
totaling nearly $4 million, which were ultimately referred to our 
Investigations Division. Although SBA completed purchase and quality 
control reviews on all the loans, the agency did not identify or fully 
address the material deficiencies noted in the OIG review. 
The OIG High-Risk 7(a) Loan Review Program uses an internal scoring system to prioritize loans for 
review by level of risk. This evaluation includes a review of high-risk loans purchased by SBA to 
determine whether lenders complied with SBA requirements and identified suspicious activity. 
Our reviews of high-risk loans have consistently identified issues regarding eligibility, repayment ability, 
size standards, franchise agreements, business valuations, appraisals, equity injection, and debt 
refinance. Our review program also has helped us identify concerns with change of ownership 
transactions and SBA’s identification of improper payments. 

27 
Agency Progress 
SBA has made significant progress in addressing the identification of improper payments in the 7(a). In 
FY 2020, SBA began to allow loan specialists more time to review complex early defaulted loans. In 
addition, the agency improved its review of loans, training loan specialists, and updating the loan review 
checklist. 
In FY 2020, SBA internally evaluated its purchase process and quality control reviews for 7(a) guaranteed 
loans to determine why the loan center reviews did not identify or correct lenders’ noncompliance with 
SBA requirements, as has also been noted in OIG reports. 
In FY 2021, SBA held a training session at the loan center that focused on the requirements and SBA 
review of documentation related to the source of funds used for equity injection, which has been a 
continuing issue in our reviews and in the agency’s own internal evaluations. 
In FY 2022, SBA continued to provide monthly feedback to management and staff at the National 
Guaranty Purchase Center. Additionally, SBA is drafting revisions to the 7(a) loan servicing and 
liquidation requirements. SBA has stated they are finalizing and plan to issue revised requirements 
designed to reduce improper payments, which should result in continued progress. We continue to 
communicate with the agency about previous recommendations for recoveries as part of the audit 
follow-up process. We will monitor risks in this area and conduct audits and reviews as necessary. 

28 
Challenge 7: SBA’s Disaster Assistance Program Must 
Balance Competing Priorities to Deliver Prompt Assistance 
but Prevent Fraud 
Why This Is a Challenge 
This SBA loan program plays a vital role in the aftermath of disasters by providing long-term, low-
interest loans to affected homeowners, renters, businesses of all sizes, and nonprofits. SBA must 
continually balance the priority of quickly assisting disaster survivors in the immediate aftermath of a 
devastating event with the need to mitigate fraud risk and ensure program integrity. To do so, the 
agency faces challenges in staffing, quality assurance, and increased loan servicing requirements. 
As a result of the pandemic’s widespread economic effects on the U.S. economy, Congress approved 
legislation that increased funding to SBA’s disaster loan program, providing over $520 billion in funding 
to the Economic Injury Disaster Loan (EIDL) program. Since the start of the pandemic, SBA has approved 
$390 billion in COVID-19 EIDL assistance, which is a significant increase over all disaster loan funding 
disbursed in the agency’s 70-year history. SBA’s existing disaster assistance infrastructure could not 
keep up with the unprecedented demand caused by the pandemic, so the agency contracted out for 
new systems to deliver vital aid to struggling small businesses. SBA’s infrastructure must be properly 
equipped to ensure that staffing, processing systems, and servicing capabilities can efficiently adjust to 
meet future needs. 
Issue: Reserve Staff Need Training to Sustain Productivity During 
Mobilization 
The magnitude of the pandemic relief demand (27.7 million 
applications received as of December 31, 2021) required SBA to rapidly 
increase and train staff; staffing numbers rose to historic levels. The 
number of personnel needed to serve during the pandemic was almost 
twice the previous record high staff total. In addition, the agency had 
to develop the needed training to address the new criteria for COVID-
19 EIDLs. 
SBA’s Office of Disaster Assistance increased its trained staff from 800 to more than 5,000 employees in 
December 2017 to respond to hurricanes Harvey, Irma, and Maria. In response to the COVID-19 
pandemic, the Office of Disaster Assistance increased its permanent and temporary staff size from 
about 1,200 at the onset of the pandemic to more than 11,500 by December 2020. In those 9 months, 
the staff increased nearly 10 times. 
SBA outsourced the COVID-19 EIDL processing to a subcontractor to make recommendations for 
approval or denial of loan applications. SBA staff made the final decision to approve or deny COVID-19 
EIDLs. SBA had to train the existing staff and the newly hired employees on the new contractor’s system, 
a tremendous undertaking. 

29 
Agency Progress 
SBA management made good progress on this long-term issue during the pandemic. SBA had previously 
made progress in this area by implementing a cross-functional training plan, as well as online and 
automated tutorials, a change that resulted from an after-action report’s findings on SBA’s response to 
prior major disasters. The COVID-19 pandemic required SBA to train and mobilize the largest number of 
new employees ever in its history. 
Effective July 5, 2022, the agency moved the entire disaster lending program from the Office of Disaster 
Assistance to the Office of Capital Access. The Office of Disaster Assistance will continue to manage the 
agency’s non-lending aspects of the disaster program (such as the immediate response group). 
Bringing on a large temporary staff in response to a major natural disaster will always be a challenge for 
any organization, including SBA. However, during the past couple of years, SBA was able to increase its 
staff by almost tenfold to provide COVID-19 pandemic financial assistance. The new disaster assistance 
employees expanded the pool of reserve staff that can be activated for future disasters. The lessons 
learned from this surge inform the agency’s current hiring and training practices; therefore, this issue 
has achieved a rating of yellow. 
Although the agency has now achieved a rating of yellow for this issue, the Office of Capital Access is 
urged to keep monitoring the need to revise and update its plan for rapid staff surge and the associated 
need up to update its training. This is needed to ensure a high level of customer service with reduced 
applicant processing times, and to ensure eligible applicants receive the federal assistance they need in 
a timely manner. 
Issue: Improper Payment Quality Assurance Process Needs 
Strengthening 
SBA received a historic number of loan applications in FY 2020 and FY 
2021 when COVID relief programs were established. SBA tests a 
statistical sample of these loans for improper payments. Because the 
total of the number of loans that have been approved and disbursed 
is so large, the statistical sample is also large, which has highlighted 
issues in SBA’s improper payment process. 
An improper payment is any federal government payment made to an ineligible recipient or for an 
ineligible good or service, duplicate payment, or payment for goods or services not received (except for 
such payment authorized by law). 
In February 2020, we reported on weaknesses we found in the improper payment quality assurance 
process (Report 20-07). We found the improper payments appeal process effectively assessed improper 
payments, but the initial review process was inefficient. 
The Payment Integrity Information Act of 2019 requires agencies to evaluate fraud risks and use a risk-
based approach for financial and administrative controls to counter identified fraud risks. The law 
reinforces the requirement for agencies to review prepayment and pre-award procedures. Further, the 
law specifies use of the Treasury Do Not Pay database to determine award eligibility. Agencies are 

30 
required to thoroughly review the databases to determine award eligibility and prevent improper 
payments. 
SBA removed typical controls in the EIDL program and relied on self-certification by the applicants to get 
funding out quickly to struggling businesses at the beginning of the pandemic. This led to significant 
fraudulent activity in the program. 
OIG Report 22-06 identified a lack of pre-award controls during the period March 2020 to November 
2020, resulting in over $3.1 billion in COVID-19 EIDL and $550 million emergency EIDL grants distributed 
to potentially ineligible recipients found in Treasury’s Do Not Pay databases. 
SBA did not report an estimate improper payments rate for the COVID-19 EIDL program in FY 2021 
because they received an exemption from OMB for this new program. 
Agency Progress 
SBA has made significant improvements to the process since our February 2020 report was issued. The 
agency has 
• conducted monthly audits for issues of non-compliance; 
• conducted focused/targeted audits, reviewing a specific area to focus future training efforts; 
• targeted training to quality control specialists, leads, and supervisors to continually improve 
knowledge necessary to accurately identify improper payments; 
• established quality assurance team with an agile database to review agency holds in the agency 
review hold system; and 
• employed an independent fraud review team to look at potential fraud activities that can be 
referred at any time in the loan or grant process. 
Additionally, SBA issued ODA Memo 21-13 on April 28, 2021, which included a requirement to check 
against the Treasury Do Not Pay system prior to approval of COVID-19 EIDLs. 
Overall, SBA has made substantial progress in improving the improper payment quality assurance 
process.OIG will conduct an inspection of the effectiveness of the new controls established to use 
Treasury’s databases to determine SBA’s effectiveness in reducing improper payments. Additionally, SBA 
will be reporting the estimated COVID-19 EIDL improper payments rate for the first time in FY 2022. OIG 
will perform its annual evaluation of the estimation process which will include determining whether the 
process addresses the significant fraud risk present in the COVID-19 EIDLs as identified in prior OIG 
reports. 
Issue: Unprecedented Increase in Servicing COVID-19 EIDLs 
SBA has two Disaster Loan Servicing Centers, one in Birmingham, 
Alabama and the other in El Paso, Texas, servicing disaster loans that 
have been approved and fully disbursed. The two centers manage the 
portfolio and provide customer service, including accepting and 

31 
processing loan payments, making routine collection efforts by phone, email, and postal letters, and 
handling any loan-related issues, such as insurance, title, or lien matters. 
After a disaster loan becomes 90 days delinquent, it is transferred to a third center known as the 
National Disaster Loan Resolution Center in Santa Ana, California. The loan resolution center manages 
the portfolio of defaulted disaster loans with increased collection efforts, including foreclosure when 
necessary. 
The center also handles other loan servicing activities, such as processing loan payments. When disaster 
loans are deemed ultimately uncollectable and charged-off, or removed from the agency’s loan 
portfolio, the borrowers and guarantors are referred to the Treasury Department. 
Treasury has the authority to take stronger efforts to collect, including offset of other federal payments. 
In this context, offset means diverting federal payments to satisfy the delinquent loan. 
Before the COVID-19 pandemic, SBA was servicing about 263,000 outstanding disaster loans, totaling 
approximately $9 billion, across the three servicing centers. As of May 31, 2022, because of the 
unprecedented number of pandemic relief loans, SBA was servicing about 4 million outstanding disaster 
loans. This is over 15 times what the agency was doing before the pandemic. The current total dollar 
amount is about $390 billion, over 43 times the pre-pandemic disaster loan portfolio. A total of 30 
months of payment deferment was instituted for all COVID EIDLs. The end of this deferment period will 
start to in October 2022. Because the COVID-19 EIDLs were approved with repayment terms of 30 years, 
the expected servicing duration of this portfolio is long term. Simply put, the number of payment 
transactions estimated for this portfolio is 1.4 billion (based on 4 million loans x 12 months x 30 years). 
Because SBA loaned billions in pandemic relief loans, the agency has millions of additional loans in its 
portfolio that must be serviced. SBA does not currently have the staff or infrastructure to manage this 
volume. We anticipate the agency will face significant challenges in managing this volume going 
forward. 
Agency Progress 
SBA officials informed us the agency is adding additional staff and resources across the disaster servicing 
and liquidation centers to meet the increasing demand. As of May 31, 2022, the loan servicing staff 
totaled 344 across the three centers. SBA plans to achieve a COVID-19 EIDL service staff of up to 2,000 
full-time employees by the end of Q2 FY23. This increase is mostly coming from the 1,500 full-time loan 
processing agents who will be transitioned to servicing during 2022. 
To meet the increased call demand, SBA officials said they overhauled customer service by changing 
management and contractors, streamlined the process for adding customer service agents, added 
performance and quality metrics, improved call scripts and customer service guidelines. 
To increase servicing efficiencies, SBA officials stated they will enhance their servicing platform. They 
have been developing a series of new initiatives allowing SBA to directly service the entire portfolio over 
the long term. These include a new e-billing capability that replaces traditional paper billing processes, a 
borrower self-service portal, and automated transactions for routine requests, such as loan charge off. 
This enhanced servicing platform is expected to be operational by the second quarter of FY 2023. 

32 
Because this issue is a significant challenge for SBA, staffing and process changes are planned but not 
yet in place. SBA’s servicing portfolio has increased so significantly, this issue is being rated moderate or 
limited progress because more attention and monitoring is warranted. 
 
 

33 
Challenge 8: SBA Needs Robust Grants Management 
Oversight 
Why This Is a Challenge 
In FY 2021, pandemic relief legislation authorized new, multibillion-dollar grant programs in addition to 
SBA’s existing entrepreneurial development grant program portfolio. Congress had authorized $45.3 
billion for SBA to administer as grants to provide economic relief and technical assistance, nearly 
doubling SBA’s existing technical assistance programs. 
Because of the government-wide emphasis on grants management reform, it is SBA’s responsibility to 
maximize the value of its grant funding to ensure its programs accomplish program objectives. In recent 
OIG audits, we have found ineffective oversight of grant recipients and systemic issues with the accuracy 
of SBA grant data in both financial and performance reporting. 
Issue: SBA’s Grants Management System Needs Improvement 
Previous OIG reports have found SBA used an inefficient and error-
prone system to manage its grant awards. The federal Procurement 
Request Information System Management (PRISM) that SBA used to 
award, monitor, and report on technical assistance programs required 
substantial manual data entry, which can lead to input errors. 
Data inaccuracies inhibit the ability to effectively track federal 
spending. Errors also affect the agency’s ability to report complete and 
accurate information on time, as required by the Digital Accountability and Transparency Act of 2014. In 
March 2018, we issued an advisory memorandum (Report 18-15) on material weaknesses identified by 
an independent accounting firm in SBA’s controls over the accuracy of grant award data reported in 
USASpending.gov. 
Immediately after the alert was issued, program officials requested an internal A-123 review of the grant 
management process to assess and verify OIG’s findings. SBA’s internal auditors found that all 45 of the 
sampled awards included inaccuracies and reported a number of deficiencies per award. 
PRISM was not completely integrated with SBA’s financial system and required additional manual entry 
to obligate funds and authorize payments to grant recipients. The lack of an integrated system increased 
the need for grants management personnel to manually input entries. Reliable data in a grants 
management system ensures the federal funds are awarded to eligible recipients, disbursements are 
accurate, and that management can make informed decisions to effectively administer programs. 
Agency Progress 
SBA has made substantial progress in modernizing its grants management system. In 2019, SBA entered 
into an interagency agreement with the U.S. Department of Health and Human Services for transition 

34 
analysis, infrastructure setup, and training services to launch GrantSolutions.gov. SBA will spend $2.5 
million over 5 years to help the agency 
• improve funding management, awarding of grants, processing payments, and closeouts; 
• enhance ability to develop accurate performance metrics reporting; 
• reduce compliance violations; and 
• increase auditability, accountability, and transparency. 
During FYs 2020 and 2021, the SBA Office of Grants Management implemented the GrantSolutions 
system for program office use. In 2021 and 2022, SBA and the Health and Human Services 
GrantSolutions team trained program officials on how to use the system. The SBA Office of Grants 
Management also works with each program office to identify program-specific system customizations 
that ensure the agency complies with federal and SBA policies. 
Although most of the program offices adopted the system in 2021, the Shuttered Venue Operators 
Grant (SVOG) program opted to use Salesforce, a contracted customer relationship management 
system, to manage its grants. Also, instead of using the GrantSolutions system, the Restaurant 
Revitalization Fund (RRF) program developed its own application portal that interfaced with the SBA 
Office of Capital Access’s systems to manage the application intake, processing, and award approvals for 
pandemic assistance. Both the SVOG and RRF programs were integrated into SBA’s Joint Administrative 
Accounting Management System. 
Since 2020, SBA has been working to integrate the SBA’s Joint Administrative Accounting Management 
System with GrantSolutions.gov. Until the agency integrates the financial interface, program offices are 
still required to use the PRISM system, which is not completely integrated with SBA’s financial system 
and requires manual entry to obligate funds and authorize payments to grant recipients. While SBA 
continues to have to work around the limitations, grants management officials perform monthly data 
quality assessments of the manually input data and reports deficiencies to program offices to correct 
the errors. Without an effective grants management system, the agency must continue manual and 
burdensome processes to manage compliance requirements, which may continue to hinder its ability to 
effectively oversee and manage SBA grant programs. 
Issue: Better Performance Measurements Needed to Monitor Grant 
Program Achievements 
An OIG review of SBA’s administration of the SVOG program (Report 
21-13) found SBA did not establish performance goals and 
measurements for the grant recipients. 
We also found in our review of CARES Act entrepreneurial 
development cooperative agreements and grants (Report 21-11) that 
the agency did not establish clearly defined goals with targets for the 
grant recipients. 

35 
Because of this, SBA cannot effectively measure and accurately report performance results to assess 
whether the grant recipient’s performance met objectives, ensuring the pandemic relief programs were 
effective. 
Federal regulations require awards to include performance goals. The agency must provide a standard 
to effectively measure grantee performance, such as the estimated number of jobs saved or created, tax 
revenue generated, or entity operational status. 
Without specific grantee performance reporting measures and requirements, SBA may have disbursed 
$14.6 billion in SVOG funds without knowing whether the program successfully aided small businesses in 
the live arts and entertainment industry. GAO recently reported similar concerns about how SBA took 
limited steps in enforcing RRF reporting. Thirty-two percent of RRF recipients have not yet reported how 
they used their funds for 2021 (GAO-22-105442). 
Program officials did establish performance goals and indicators for the supplemental CARES Act funds 
provided to Small Business Development Centers, Women’s Business Centers, and the Resource Partner 
Training Portal, but SBA should have clearly defined the goals and set targets to more effectively ensure 
they were achieved as intended. 
We first identified oversight of grant program performance as a top management challenge in FY 2019. 
To address these weaknesses, SBA updated its grant management policies and procedures. The agency 
required grant officers to enforce performance requirements and verify reported information as well as 
to ensure applicants’ proposals include plans to measure performance in a way that will help SBA 
achieve program goals. 
The SBA Office of Entrepreneurial Development had until September 2020 to fully adopt the updated 
policies, which are not reflected in the CARES Act Entrepreneurial Development grants. Without clearly 
defined performance goals and targets, SBA cannot effectively measure and accurately report 
performance results. In 2022, we reported that SBA and its grant recipient that implemented the 
Resource Partner Training Portal, an initiative authorized under the CARES Act, did not set targets for 
performance goals to assess whether the portal met the intended purpose (Report 22-07). We found 
the portal did not serve as a major source for COVID-19 information; SBA’s Resource Partner counselors 
and mentors generally did not use the training portal. SBA awarded the grant recipient $18.6 million and 
less than 1 percent of 30 million eligible small businesses used the portal within the first year of the 
pandemic. Only about 62 resource partner counselors and mentors out of approximately 13,000 
completed any of the training modules. 
Without performance targets, program officials could not hold the Resource Partner training portal 
grant recipient accountable for ensuring the hub served as a major source of COVID-19 related 
resources for small businesses and a training portal for resource partner counselors and mentors. 
The authorizing language for the SVOG program included no specific performance measurements, so 
SBA created a logic model in March 2021. The model helped identify outputs and outcomes for the 
program. 

36 
Agency Progress 
SBA has made substantial progress establishing performance measures for its grant programs. In FY 
2022, the SBA Office of Grants Management collaborated with all of SBA’s grants-making program 
offices to oversee an overall approach for implementing effective performance monitoring. 
The SBA Office of Entrepreneurial Development applied lessons learned from OIG’s review of 
entrepreneurial development CARES Act awards (Report 21-11) and established a variety of output and 
outcome-focused measures for the Community Navigator pilot program, authorized by the American 
Rescue Plan Act of 2021. In the announcement for the program, SBA required grant applicants to 
establish realistic targets for the goals to measure achievements during grant performance. 
In FY 2022, the SVOG program established performance measures, developed a customer experience 
and award outcomes survey, and finalized program evaluation framework to examine the effects the 
program had on venues’ survival and other program outcomes across industry, geography, and business 
owner demographics. SVOG program plans to survey all award recipients on their customer experience 
and award outcomes as part of the grant closeout process. 
Issue: Comprehensive Oversight Plan with Strong Controls Will 
Help SBA Better Assess Risk, Distribute Payments, and Audit the 
Shuttered Venue Operators Grant and Restaurant Revitalization 
Fund Programs 
We alerted management to concerns about SBA’s initial plans for 
assessing applicant risk and setting payment disbursements in the 
SVOG program. 
Since the majority of SVOG grant awards were under a certain dollar 
threshold, they were categorized as low risk. These awards were 
disbursed in lump sum payments with minimal financial reporting 
requirements and expectations for post-award accountability. 
SBA reported that as of July 5, 2022, the agency completed processing applications for the SVOG 
program. In total, SBA awarded $14.6 billion to 13,011 grant recipients, of which 9,800 received 
supplemental awards. 
The Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act of 2020 required SBA to 
submit the policies and procedures used to conduct oversight and audits of the grants to Congress. It 
also required measurement standards to determine which grants should undergo an audit. The SBA 
Office of Disaster Assistance based its audit plan for this program on the risk level established for the 
payment distributions and financial reporting requirements for the grant recipients. 
All grant recipients who received $10 million, which is the maximum amount for any single award, were 
going to be audited. It is likely a minimal number of recipients will be subject to an audit. The office’s 
initial audit plan exposed the $16.25 billion grant program to potential misuse of funds because the bulk 
of grant funds will not be subject to a reasonable degree of scrutiny. SBA has finalized its oversight plan 

37 
to include monitoring, audit, and closeout strategies that address the agency’s obligation to uphold 
federal grant regulations and other applicable requirements. 
Some of the issues we identified on SVOG were identified by GAO for the Restaurant Revitalization Fund 
program. GAO’s FY 2022 report (GAO-22-105442) on SBA’s RFF found that while SBA emphasized 
putting pre-award controls in place to manage risk, there were weaknesses in the design and operation 
of the internal controls. As a result, the agency did not effectively prevent systemic control weaknesses 
throughout the award process. 
Program officials did not design a fraud risk framework that assigned appropriate levels of risk to 
categories of applications, which left the program vulnerable to making payments to potentially 
fraudulent applicants. GAO found that SBA had relied heavily on third-party controls without fully 
leveraging data the agency already had from administering its other COVID-19 relief programs, such as 
the PPP. GAO found SBA underestimated the number of manual reviews that would be needed and did 
not thoroughly review all awards that met the criteria for a manual review. In response, SBA officials 
stated that they did not plan to assess the effectiveness of the controls and whether they operated as 
expected. OIG is working on an audit of SBA’s post-award monitoring efforts. 
Agency Progress 
In FY 2022, we reported that even after determining multiple disbursements would better protect grant 
funds from fraud or misuse, SBA switched to a riskier single advance payment for all grantees (Report 
22-15). This lump sum payment method may have hastened award disbursement, but multiple 
disbursements are a better way to protect taxpayer funds. Multiple disbursements enable program 
officials to verify that grant recipients used initial award funds for allowable activities, before then 
disbursing the remaining award. Because SBA made this change, program officials will not be able to 
monitor grantees’ use of the proceeds until the end of the award, when closing out the grant, after all 
the funds have been disbursed. 
In a sample of 10 awards we reviewed, program officials did not ensure they had adequate support for 3 
of the grant amounts. SBA awarded these three recipients $2.6 million above the total amount that they 
had requested. The higher grant award amounts did not correspond to the recipients’ budgets. Nor was 
there supporting documentation to show why SBA awarded each recipient higher amounts than they 
had requested. 
In addition, SBA did not consistently ensure the recipient’s budget accurately summarized the financial 
plan for the award amount. Awards made to 1,849 recipients, totaling $1.49 billion, did not have a 
budget that reconciled to the award amount. It is essential that SBA approve budgets that match the 
award amount to hold grant recipients accountable for meeting program requirements. 
SBA finalized its revised oversight plan for the SVOG program and established procedures to monitor, 
audit, and closeout awards. The agency contracted with a firm that provided support to develop the 
strategy and oversight plan. SBA will audit a statistically significant sample of low, moderate, and high-
risk level SVOG recipients. The contractor also developed training materials on audit and grant 
management policies and procedures for both SBA staff and SVOG grant recipients. 

38 
Issue: Leveraging SBA’s Workforce to Ensure Effective 
Administration of New and Significantly Expanded Grant 
Programs to Aid Small Businesses 
Although the SVOG program started with only one official and 
temporary staff, SBA has since trained a substantial workforce to 
review and approve applications. 
As of July 5, 2022, SBA has awarded 13,011 grants, totaling $14.6 
billion. With more than 13,000 grants to service through monitoring, 
audit, and closeout, SBA will need to leverage and maintain a skilled 
workforce to meet the demands of ongoing grant management and 
administration of new awards. 
According to SBA’s federal assistance directive, only warranted grant officers can commit the agency to 
enter into a federal assistance agreement, such as a grant, obligating federal funds. Despite the federal 
assistance directive, the SBA acting Chief Operating Officer waived several of the criteria necessary for 
new grants management staff, including training and certification requirements. 
This waiver negated the previous progress SBA had made on addressing the skills gap of the grants 
management workforce. We have recommended that SBA train all grants officers and program 
personnel on the policies, procedures, and best practices for awarding and monitoring grants (Report 
19-02). To address this challenge, SBA established a training plan for all grants officers and program 
officials responsible for monitoring grant recipients to address the systemic weaknesses OIG found in 
previous audits of SBA’s grants management. 
Since SBA decided to make single advanced payments with minimal financial reporting requirements 
and agency oversight to all SVOG award recipients, the application reviewing officials must carefully 
review the applicants’ proposed budgets to ensure funds will be used for allowable, allocable, and 
reasonable expenses. 
GAO’s FY 2022 report (GAO-22-105442) on SBA’s Restaurant Revitalization Fund found that there was a 
greater than expected need for manual reviews because of the number of applications flagged by 
automated controls. In contrast to the program officials’ early planning estimate of 10 percent, SBA data 
indicates 71 percent of applications should have been manually reviewed, of which 25 percent were 
considered higher risk for characteristics such as high dollar request or missing documentation. 
Furthermore, GAO found that there is no evidence that manual reviews were done on about 17 percent 
of all awards that met the criteria for requiring one. 
Agency Progress 
SBA made progress on ensuring the SVOG had staff, both permanent employees and contract support 
staff, to support the application processing. During the peak, the office had 500 staff to support the 
manual reviews. Similarly, for RRF, GAO found that program officials had a staff level of 400 employees 
to perform manual reviews, sufficient to meet anticipated needs, and therefore not a factor as to why 
SBA did not complete the needed manual reviews. 

39 
The program has trained staff on oversight procedures now that it has transitioned to monitoring the 
13,011 shuttered venue grants. The agency detailed a grants management specialist to provide strategic 
guidance on all monitoring, auditing, and closeout activities.

File and source

File

23-01-tmpc-fy2023.pdf

Size

682,778 bytes

SHA-256

fa3ece541bd8ab4c0fbaf5098e337edc489e7bc64a1fc09116fddb245924ccdb

Our copy

23-01-tmpc-fy2023.pdf

Original

www.oversight.gov