Top Management and Performance Challenges report (FY 2024) - SBA Office of Inspector General — pandemic lending oversight (2023-10-16)

Record facts

Full text

U.S. Small Business Administration 
Office of Inspector General 
Top Management and Performance Challenges 
Facing the Small Business Administration 
in Fiscal Year 2024 
1 
October 16, 2023 
Report 24-01 

i 
Contents 
Message From the Inspector General ................................................................................... iii 
FY 2024 Challenges and Issues ............................................................................................... v 
Table 1: Top Management and Performance Challenges Facing SBA in FY 2024 ................. v 
Table 2: Color Code Definitions ........................................................................................... vi 
Challenge 1: SBA’s Economic Relief Programs Are Susceptible to Significant Fraud Risks and 
Vulnerabilities ................................................................................................................. 1 
Why This Is a Challenge ....................................................................................................... 1 
Paycheck Protection Program ............................................................................................. 2 
Issue: Paycheck Protection Program Susceptible to Abuse and Fraud ................................ 3 
Remaining Challenges ......................................................................................................... 7 
Issue: Paycheck Protection Program Eligibility .................................................................... 7 
Issue: Paycheck Protection Program Data Reliability .......................................................... 9 
COVID-19 Economic Injury Disaster Loan .......................................................................... 11 
Issue: SBA Must Review COVID-19 EIDLs and Grants for Potential Fraud Identified in OIG 
Reports .................................................................................................................. 12 
Issue: Unprecedented Increase in Servicing COVID-19 EIDLs ............................................ 16 
Challenge 2: Eligibility Concerns in Small Business Contracting Programs Undermine the 
Reliability of Contracting Goal Achievements ................................................................. 19 
Why This Is a Challenge ..................................................................................................... 19 
Issue: Agencies Receive Credit for Ineligible Firms or Those Not Participating in SBA’s 
Contracting Programs............................................................................................ 20 
Issue: Women-Owned Small Business Federal Certification Program Susceptible to Abuse
............................................................................................................................... 23 
Challenge 3: SBA Faces Significant Challenges in IT Investments, System Development, and 
Security Controls ............................................................................................................ 25 
Why This Is a Challenge ..................................................................................................... 25 
Issue: SBA’s IT Investment Controls Need Improvement .................................................. 25 
Issue: Existing System Development and Monitoring Controls Need to Reflect Changing IT 
Design Risks ........................................................................................................... 27 
Issue: Additional Progress Needed in IT Security Controls ................................................ 29 
Challenge 4: SBA Risk Management and Oversight Practices Need Improvement to Ensure 
the Integrity of Loan Programs ....................................................................................... 30 
Why This Is a Challenge ..................................................................................................... 30 
Issue: SBA’s Oversight of High-Risk Lending Participants .................................................. 30 
Issue: Increased Risk Introduced by Loan Agents .............................................................. 32 
Issue: Increased Risk Introduced by Lender Service Providers .......................................... 33 

ii 
Challenge 5: SBA’s Management and Monitoring of the 8(a) Business Development Program 
Needs Improvement ...................................................................................................... 35 
Why This Is a Challenge ..................................................................................................... 35 
Issue: SBA Continues to Address Its Ability to Develop Firms in the 8(a) Program and 
Measure Results .................................................................................................... 35 
Challenge 6: Identification of Improper Payments in SBA’s 7(a) Loan Program Remains a 
Challenge ....................................................................................................................... 38 
Why This Is a Challenge ..................................................................................................... 38 
Issue: Improvements Needed to Ensure High-Risk 7(a) Loan Reviews Reduce the Risk of 
Losses .................................................................................................................... 38 
Challenge 7: SBA’s Disaster Assistance Program Must Balance Competing Priorities to Deliver 
Prompt Assistance but Prevent Fraud ............................................................................ 40 
Why This Is a Challenge ..................................................................................................... 40 
Issue: Reserve Staff Need Training to Sustain Productivity During Mobilization .............. 40 
Issue: Improper Payment Quality Assurance Process Needs Strengthening ..................... 41 
Challenge 8: SBA Needs Robust Grants Management Oversight ........................................... 43 
Why This Is a Challenge ..................................................................................................... 43 
Issue: SBA’s Grants Management System Needs Improvement ....................................... 43 
Issue: Better Performance Measurements Needed to Monitor Grant Program 
Achievements ........................................................................................................ 45 
Issue: Comprehensive Oversight Plan with Strong Controls Will Help SBA Better Assess 
Risk, Distribute Payments, and Audit the Shuttered Venue Operators Grant and 
Restaurant Revitalization Fund.............................................................................. 47 
Issue: Leveraging SBA’s Workforce to Ensure Effective Administration of New and 
Significantly Expanded Grant Programs to Aid Small Businesses .......................... 49 
 

iii 
Message From the Inspector General 
SBA’s role in the nation’s pandemic response was unprecedented and immense. Even before the 
pandemic, SBA faced major challenges in its internal control environments for large financial 
lending programs, information technology, and business development assistance programs. The 
strain on the agency’s capacity to meet the needs of delivering 
more than $1.2 trillion in pandemic assistance to America’s small 
businesses laid bare these challenges. SBA continues to be 
responsive to OIG’s recommended corrective actions to promote 
efficiency and effectiveness in the programs and mitigate the eight 
challenges identified in this report. 
Major consequences of internal controls that do not provide 
assurance of identity and eligibility include a loss of public trust, 
improper payments, and fraud. OIG’s white paper COVID-19 
Pandemic EIDL and PPP Loan Fraud Landscape estimated that SBA 
disbursed over $200 billion in potentially fraudulent COVID-19 Economic Injury Disaster Loans 
(EIDL), EIDL Targeted Advances, Supplemental Targeted Advances, and Paycheck Protection 
Loans (PPP) loans. Every fraudulent transaction also is an improper payment. With SBA’s flagship 
contracting, capital, and counseling programs having identified challenges in mitigating improper 
payments and ensuring only eligible entities gain access to its programs, action to eliminate self-
certification as a practice and strengthen internal controls is at the forefront of our 
recommended corrective actions. 
OIG also shares SBA’s concern in its capacity to service its EIDL portfolio. SBA is now servicing 
about 4 million outstanding disaster loans — 15 times the amount the agency was managing 
before the pandemic. SBA must be responsive to recipients of these loans and perform its due 
diligence to mitigate loss to the taxpayer. 
SBA’s pandemic response also offered an opportunity to learn new ways to meet America’s small 
business owners in underserved areas. This principally involved SBA lending partners leveraging 
financial technology and SBA expanding the reach of its Supervised Lenders, which are Non-
Federally Regulated Lenders. Technology must be integrated within programs in a manner that 
assures eligibility criteria are met, to include identity, and that robust verification and validation 
are inherent in the internal control framework. SBA must fully meet its lender oversight 
responsibilities to avoid missteps that occurred in its pandemic response. 

iv 
The nation can depend on OIG to provide independent, objective, and timely oversight of SBA. 
We will focus our resources on systems and processes that present serious management and 
performance challenges within SBA programs with a goal of improving the integrity, 
accountability, and performance of those programs for the benefit of the American people. 
 
Hannibal “Mike” Ware 
SBA Inspector General 
 
 

v 
FY 2024 Challenges and Issues 
Identification of an issue as a top challenge does not necessarily denote significant deficiencies 
or lack of attention on SBA’s part. Many of the top management challenges are longstanding, 
inherently difficult, and will likely continue to be challenges in the coming years. Addressing the 
challenges will require consistent attention from agency management and ongoing engagement 
with Congress, the public, and other stakeholders. 
Table 1: Top Management and Performance Challenges Facing 
SBA in FY 2024 
Challenge 
Issue 
Challenge 1 
SBA’s Economic Relief Programs Are 
Susceptible to Significant Fraud Risks and 
Vulnerabilities 
Paycheck Protection Program Susceptible to Abuse and Fraud 
Paycheck Protection Program Eligibility 
Paycheck Protection Program Data Reliability 
SBA Must Review COVID-19 EIDLs and Grants for Potential 
Fraud Identified in OIG Reports 
Unprecedented Increase in Servicing COVID-19 EIDLs 
Challenge 2 
Eligibility Concerns in Small Business 
Contracting Programs Undermine the 
Reliability of Contracting Goal 
Achievements 
Agencies Receive Credit for Ineligible Firms or Those Not 
Participating in SBA’s Contracting Programs 
Women-Owned Small Business Federal Certification Program 
Susceptible to Abuse 
Challenge 3 
SBA Faces Significant Challenges in IT 
Investments, System Development, and 
Security Controls 
SBA’s IT Investment Controls Need Improvement 
Existing System Development and Monitoring Controls Need 
to Reflect Changing IT Design Risks 
Additional Progress Needed in IT Security Controls 
Challenge 4 
SBA Risk Management and Oversight 
Practices Need Improvement to Ensure 
the Integrity of Loan Programs 
SBA’s Oversight of High-Risk Lending Participants 
Increased Risk Introduced by Loan Agents 
Increased Risk Introduced by Lender Service Providers 

vi 
Challenge 5 
SBA’s Management and Monitoring of 
the 8(a) Business Development Program 
Needs Improvement 
SBA Continues to Address Its Ability to Develop Firms in the 
8(a) Program and Measure Results 
Challenge 6 
Identification of Improper Payments in 
SBA’s 7(a) Loan Program Remains a 
Challenge 
Improvements Needed to Ensure High-Risk 7(a) Loan Reviews 
Reduce the Risk of Losses 
Challenge 7 
SBA’s Disaster Assistance Program Must 
Balance Competing Priorities to Deliver 
Prompt Assistance but Prevent Fraud 
Reserve Staff Need Training to Sustain Productivity During 
Mobilization 
Improper Payment Quality Assurance Process Needs 
Strengthening 
Challenge 8 
SBA Needs Robust Grants Management 
Oversight 
SBA’s Grants Management System Needs Improvement 
Better Performance Measurements Needed to Monitor Grant 
Program Achievements 
Comprehensive Oversight Plan with Strong Controls Will Help 
SBA Better Assess Risk, Distribute Payments, and Audit the 
Shuttered Venue Operators Grant and the Restaurant 
Revitalization Fund 
Leveraging SBA’s Workforce to Ensure Effective Administration 
of New and Significantly Expanded Grant Programs to Aid 
Small Businesses 
The management challenges report is an important tool to help the agency prioritize its work to 
improve program performance and enhance operations. OIG remains committed to protecting 
the interests of American taxpayers by promoting positive change within SBA and across 
government, ensuring taxpayer dollars are spent efficiently according to intent. I am confident 
SBA leaders are willing partners in ensuring their programs have integrity and meet the needs of 
the nation’s small businesses. 
Table 2: Color Code Definitions 
We use a color gauge as a visual indicator of the agency’s progress in confronting the issues that 
make a particular function a top management challenge. The color gauge indicates whether the 
agency has made little, no, or significant progress on the issue to date. 

vii 
Color 
Definition 
Color Indicator 
Green 
Issue Resolved or Appropriately 
Reduced 
 
Yellow 
Substantial Progress 
 
Orange 
Moderate or Limited Progress 
 
Red 
No Progress 
 
N/A 
New, Not Rated 
 
N/A 
Not Rated (extenuating 
circumstances) 
 
 

1 
Challenge 1: SBA’s Economic Relief Programs Are Susceptible 
to Significant Fraud Risks and Vulnerabilities 
Why This Is a Challenge 
In the wake of the Coronavirus Disease 2019 (COVID-19) pandemic, action was needed to avert an 
economic crisis caused by lockdowns, business closures, and other economic impediments. More than 
30 million small businesses in the United States were adversely affected by the economic crisis. In 
March 2020 the Coronavirus Aid, Relief, and Economic Security (CARES) Act was enacted, authorizing 
the U.S. Small Business Administration (SBA) to administer an unprecedented amount of funds through 
the Paycheck Protection Program (PPP) and COVID-19 Economic Injury Disaster Loan (EIDL) program. 
These funds were intended to help eligible small business owners and entrepreneurs adversely affected 
by the economic crisis. 
Executive and legislative actions intended to expedite aid during the crisis led SBA to reduce or eliminate 
key internal controls that could have helped to mitigate fraud and misuse of taxpayer funds. The agency 
also relied on a mandated self-certification of eligibility for PPP loans to expedite aid. We have 
determined the agency has made progress in strengthening internal controls, but several issues remain 
open, which we highlight in this report, and should be considered for future economic relief programs 
like the PPP and COVID-19 EIDL. 
Our PPP and EIDL investigative work has resulted in 1,090 indictments, 906 arrests, and 576 convictions 
as of August 31, 2023. The Office of Inspector General (OIG) has received more than 250,000 Hotline 
complaints since the start of SBA’s pandemic relief programs. Additionally, OIG collaboration with SBA 
and the U.S. Secret Service has resulted in the seizure of more than $1 billion stolen from the EIDL 
program. OIG played a key role in assisting financial institutions in the return of another $8 billion to 
SBA’s EIDL program. SBA has received over $20 billion in EIDL funds returned by borrowers prior to the 
deferment period ending. We are also aware of approximately $168 million in additional PPP seizures 
and funds that may have been returned. However, due to the informal, ad hoc nature of SBA’s tracking, 
the full scope of PPP seized and returned funds is not presently known, as detailed in our management 
advisory Serious Concerns Regarding the Return of Paycheck Protection Program Funds (Report 23-08). 
To date, we have issued 12 reports related to the PPP program and 12 reports related to the COVID-19 
EIDL program. 
Since both programs have closed to new loans, the challenge has evolved from preventing fraud to 
bringing wrongdoers to justice and identifying and recovering funds that were misused or illegally 
obtained. Thanks to swift congressional action, the statute of limitations for COVID-19 EIDL and PPP 

2 
fraud was increased to 10 years. As SBA conducts automated and manual reviews of PPP loans regarding 
forgiveness and guaranty purchasing, it could still identify ineligible loans, work to recover funds, and 
refer potential fraud for investigation. Fraud can be identified in these loans at any stage, even after 
they have been forgiven. See Figure 1 for important stages of these programs that are ongoing through 
2026 and beyond. 
Figure 1: Current and Ongoing Actions Relating to the PPP and COVID-19 EIDL 
Source: OIG generated from SBA data 
 
Paycheck Protection Program 
As a result of the pandemic’s widespread economic effects on the U.S. economy, Congress approved 
legislation to create and fund SBA’s PPP, which was gradually increased to $813.7 billion in 2021. 
PPP loans were made through more than 5,400 private lenders and can be fully forgiven if proceeds 
were used in accordance with law. Often, the lenders had existing relationships with the borrowers. PPP 
loans were made through existing SBA lenders and non-traditional lenders, including online financial 
technology companies (fintechs), which did not have the same relationships with borrowers as 
traditional lenders. 
The pandemic radically affected the agency tasked with economic assistance to America’s small 
businesses. From FY 2000 to 2019, before the pandemic, SBA-guaranteed 7(a) lending amounted to 
about 1.2 million loans, totaling $333 billion. By the end of the PPP program, SBA had processed 11.8 

3 
million PPP loans, totaling $800 billion. In just over a year the agency handled more demand than in the 
previous 20 years combined. The unprecedented demand and stress on SBA systems were considerable 
challenges for the agency, and fraudsters took advantage. 
Issue: Paycheck Protection Program Susceptible to Abuse and Fraud 
SBA’s fraud risk management approach in 2020 for PPP loans was 
intentionally developed with more fraud risk controls at the loan 
forgiveness phase, the final phase, rather than at application. For 
funds disbursed on a fraudulent loan, the back-end controls 
established for the forgiveness stage may never be applied because 
it is unlikely that forgiveness will be sought. This has led to the 
current environment, where we and other law enforcement partners are chasing taxpayer funds that 
have already been stolen. 
We explored this issue in detail in our COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Report 
23-09) white paper. We estimated that SBA disbursed $64 billion in potentially fraudulent PPP loans, 
which represents 8 percent of total disbursed funds. 
Based on the various fraud schemes identified in our ongoing and adjudicated criminal investigations, 
we expanded rule-based analytics through link analysis — an investigative technique that identifies 
fraud clusters through shared data attributes. As a result, we identified multiple fraud indicators and 
schemes fraudsters used to steal from the American taxpayer and exploit programs meant to help those 
in need. The potential fraud estimates directly correlate to our investigative casework, adjudicated and 
ongoing criminal cases, and to schemes OIG and other oversight agencies are continuing to unravel and 
then prosecute. These indicators will continue to evolve as more data becomes available to us. 
Indicators of potential PPP fraud include: 
• Hold codes — loans flagged by SBA or third-party lenders that identified potential indicators 
of fraud. 
• Internet Protocol (IP) addresses — loan applications submitted from a foreign country, so 
likely ineligible, or from an IP address that matches another application found to have a 
higher likelihood of fraud. 
• Defaulted/no loan forgiveness — borrowers have not made any payments, are in default, or 
have not asked for loan forgiveness because they never intended to use the loan according 
to program requirements. 

4 
• Employer Identification Numbers (EIN) — borrowers who appeared to have established their 
business after the qualifying date; EINs that match those of other PPP loans. 
• Hotline complaints — the loan was the subject of an OIG Hotline complaint with a high 
probability of fraud, such as a business misusing funds or identity theft. 
• Suspicious email addresses — borrowers whose email addresses are from potentially 
temporary domains, have modifications such as dots, dashes, or pluses, or match those in 
other applications found to have a higher likelihood of fraud. 
• Bank accounts — SBA lenders disbursed PPP loan funds to bank accounts matching other 
applications found to have a higher likelihood of fraud. 
See Figure 2 for the total disbursed dollar value estimate of each PPP fraud indicator. The aggregate of 
each group total differs from the total potential fraud estimate because duplicates across groups may 
exist, while duplicates are removed from the total potential fraud estimate. 
Figure 2: Summary of Potentially Fraudulent PPP Loans by Fraud Indicator 
 
Source: OIG analysis of PPP data 
We have several concerns from past audit work that falls under this issue, so we highlight here major 
concerns which are still being addressed by the agency. 
Returning Potentially Fraudulent Paycheck Protection Program Funds 
In our management advisory Serious Concerns Regarding the Return of Paycheck Protection Program 
Funds (Report 23-08), we found SBA’s guidance to borrowers and lenders on returning PPP funds was 
insufficient. SBA did not explain how funds could be returned after forgiveness was approved. Also, SBA 
did not have specific guidance for financial institutions that needed to return PPP funds. At the time, 
SBA was tracking return of PPP funds on an ad hoc basis using a spreadsheet. Due to the informal and ad 
hoc nature of SBA’s tracking, the full scope of returned PPP funds is not presently known. 

5 
When an agency implements a process ad hoc, it means program managers have no set procedure, 
which could lead to financial loss. We made four suggestions related to SBA establishing clear and 
detailed guidance for borrowers, lenders, and financial institutions on how to return PPP funds and 
implementing a process to accurately handle and track the returned funds to mitigate the risk of 
financial loss. 
Duplicate Paycheck Protection Program Loans 
Because SBA did not always have sufficient controls in place to detect and prevent duplicate PPP loans 
(see Duplicate Loans Made Under the Paycheck Protection Program, Report 21-09), OIG and other 
federal agencies have worked to track criminal fraud cases related to duplicate loans made to the same 
business. Based on our review of PPP loan data as of August 31, 2020, we found that lenders made more 
than one PPP disbursement to 4,260 borrowers, which totaled about $692 million and involved 8,731 
loans. These disbursements were made during rounds 1 and 2 when only one PPP loan was permitted. 
We made four recommendations to SBA to strengthen controls related to detecting and preventing 
duplicate loans to include ensuring duplicate PPP loans are not forgiven, taking action to recover 
improper payments, and ensuring appropriate controls are in place for future PPP type programs. 
Program Changes Expanded the Opportunity for Sole Proprietor and 
Independent Contractor Fraud 
In our evaluation report SBA’s Paycheck Protection Program Loan Review Processes (Report 22-09), we 
noted changes SBA made to expand access to the program for certain borrowers could have been 
exploited by unscrupulous applicants. In March 2021, SBA issued an interim final rule that allowed 
individuals who filed an Internal Revenue Service (IRS) Form 1040, Schedule C, to calculate their 
maximum loan amount using gross income rather than net income. This change led to a significant 
increase in the number of loans of $20,833 or less, the maximum allowable loan amount for a Schedule 
C business with no employees. 
Based on our analysis of the PPP loan data, many of the Schedule C loans were made by lenders that 
relied exclusively on third-party loan processing or software platform vendors (i.e., loan service 
providers) they hired to complete loan processes. Data shows that 7 of the top 15 lenders made more 
than 2.4 million loans in 2021, or more than 18,000 loans per day, after having made fewer than 22,000 
PPP loans combined in 2020. These seven lenders included fintech lenders, Community Development 
Financial Institutions, and small business lending companies. SBA Lenders should be providing oversight 
of their third-party vendors. 
We believe that these lenders and their reliance on third-party vendors could present SBA with several 
challenges moving forward, including access to loan documents. Within the context of the PPP eligibility 

6 
and forgiveness process, we believe it is important for SBA to focus targeted efforts on these types of 
loans and review appropriate documentation to ensure these smaller loans were made to eligible 
businesses and minimize the losses associated with forgiveness of fraudulent loans. 
Managing the Oversight of Potentially Fraudulent Paycheck Protection 
Program Loans 
We found SBA did not have an organizational structure with clearly defined roles, responsibilities, and 
processes to manage and handle potentially fraudulent PPP loans in our inspection SBA’s Handling of 
Potentially Fraudulent Paycheck Protection Program Loans (Report 22-13). The agency did not establish 
a centralized entity to design, lead, and manage fraud risk because it did not establish a sufficient fraud 
risk framework. This was partly due to the speed in which SBA was required to launch the PPP, which 
was 15 days after enactment of the CARES Act, and the continuous and rapid discovery of different kinds 
of fraud schemes. 
In addition, lenders were not always clear on how to handle PPP fraud or recover fraudulently obtained 
funds that remained in the borrower’s account. SBA did not provide lenders sufficient and specific 
guidance to effectively handle potentially fraudulent PPP loans. To better mitigate fraud, we made two 
recommendations for SBA to establish clearly defined and detailed roles, responsibilities, and processes 
and provide lenders formal guidance for managing and handling potentially fraudulent loans. 
Agency Progress 
SBA has made substantial progress in reducing fraud risk moving forward, including: 
• Establishing a Fraud Risk Management Board in 2022; 
• Developing a webpage dedicated to preventing fraud and identity theft, which includes a 
section titled “Lenders and Fraud Response”; 
• Developing aggregate review processes to identify different fraud scenarios; 
• Developing and implementing a Master Review Plan that established guidelines for loan and 
forgiveness reviews; 
• Increasing antifraud controls for loans originating in 2021, including checking application 
data against Treasury’s Do Not Pay database before loans were approved; 
• Developing and implementing SBA and contractor fraud risk management policy and 
framework; 
• Increasing post-disbursement antifraud controls for loans that originated in 2020; 
• Commencing manual loan and forgiveness reviews; 

7 
• Engaging a contractor with expertise in detection and identification of potential fraud; 
• Using a contractor’s automated review tool and the SBA Paycheck Protection Platform to 
analyze loans for fraud and eligibility; 
• Implementing machine learning functionality to focus on areas of higher risk; 
• Providing outreach and training; 
• Implementing processes to refer potential fraud to SBA OIG; 
• Developing a plan for recovering PPP funds; and 
• Developing and implementing controls to enhance the loan review process, specifically for 
loans with a no further action decision made by contractors. 
Remaining Challenges 
Although SBA has made substantial progress in this area, the need to establish and use a clearly defined 
and comprehensive approach for managing and handling potentially fraudulent PPP loans, to include 
sufficient guidance when implementing similar future programs, remains an ongoing challenge. 
SBA’s plans and actions to reduce fraud risks and prevent further losses will determine how this 
challenge will continue to be rated in the future. Our investigations into suspected fraud and suspicious 
activities continue. We have ongoing or planned audit work on PPP loan eligibility, loan forgiveness, 
guaranty purchase, and lender activities to determine the effectiveness of agency implemented 
controls. We will continue to monitor agency actions to assess and reduce fraud risk and address 
vulnerabilities in the PPP. Strong internal controls will help reduce fraud risk and enhance program 
integrity for the PPP and similar programs enacted in the future. 
Issue: Paycheck Protection Program Eligibility 
PPP funds could still be returned to Treasury as loan forgiveness 
reviews continue. SBA’s PPP risk management approach was 
intentionally developed with eligibility controls at the loan forgiveness 
phase, the final phase, rather than at application. 
OIG reviews have found deficiencies with internal controls related to 
eligibility of borrowers. Our review of SBA’s implementation of the 
PPP identified thousands of loans provided to potentially ineligible borrowers. SBA lenders also 
inappropriately approved loans for businesses that exceeded maximum loan amounts for the number of 
employees and exceeded the maximum size allowed. Also, SBA lenders approved loans for nonprofit 
organizations that did not meet SBA’s eligibility requirement for size standards. 

8 
We have several concerns from past audit work that falls under this issue, so we are highlighting here 
major concerns which are still being addressed by the agency. 
Businesses Exceeding Maximum Loan Amounts 
In our Inspection of SBA’s Implementation of the Paycheck Protection Program (Report 21-07), we found 
tens of thousands of approved and disbursed loans were made to borrowers for amounts that exceeded 
the loan maximum based on the number of employees and compensation rates, as defined in the CARES 
Act. The CARES Act states that the maximum loan amount is generally obtained by multiplying the 
average total monthly payments by the applicant for payroll costs incurred during the 1-year period 
before the date on which the loan is made times 2.5, plus any outstanding amounts of Economic Injury 
Disaster Loans made beginning January 31, 2020. We made six recommendations to improve SBA’s 
program and reduce the risk of financial loss from PPP loans made to ineligible or fraudulent borrowers. 
Businesses that Exceeded Maximum Size Standards 
In Report 21-07, we also identified hundreds of businesses that exceeded the maximum size standard 
and may have been erroneously approved for PPP loans. These businesses exceeded both 500 
employees and the applicable employee-based size standard for the business industry. Under the CARES 
Act, an eligible business cannot exceed the greater of 500 employees or the SBA size standard for 
number of employees in the industry, if applicable. 
Eligibility for Nonprofit Organizations 
In our inspection report Paycheck Protection Program Eligibility for Nonprofit Organizations (Report 22-
21), we identified 179 PPP loans, totaling approximately $684 million, made to potentially ineligible 
nonprofits that may have exceeded SBA’s requirements for business size at the time of application. 
We also reviewed PPP loans for three large nonprofits. We determined that two of the three large 
nonprofits met the eligibility requirements and one of the large nonprofits did not meet the eligibility 
requirements. We recommended SBA review the 179 PPP loans to ensure eligibility requirements were 
met and seek remedy or repayment for all loans deemed ineligible. 
Borrowers with Treasury's Do Not Pay Data Matches 
In our management alert Paycheck Protection Program Loan Recipients on the Department of Treasury’s 
Do Not Pay List (Report 21-06), we found SBA did not use Treasury’s Do Not Pay system data to screen 
borrowers for eligibility before approving PPP round one loans. Following OIG oversight and 
communication with the agency, SBA started checking loan applicants against Treasury’s Do Not Pay 
database. The U.S. Department of the Treasury’s Do Not Pay system is the designated source of 
centralized data and analytics services to help agencies verify eligibility. The Payment Integrity 

9 
Information Act of 2019 requires agencies to establish pre-award procedures to determine eligibility and 
prevent improper payments before the release of any federal funds. The law further specifies the use of 
Do Not Pay data sources as a control to determine program or award eligibility. 
Agency Progress 
SBA has initiated several corrective actions to enhance and develop additional controls to address loan 
reviews, loan forgiveness, and fraud, including: 
• Developing the Master Review Plan, establishing guidelines for loan and forgiveness reviews; 
• Implementing SBA and contractor fraud risk management policy and framework; 
• Developing machine learning models to focus on areas of higher risk; 
• Implementing automated screening to detect potentially ineligible loans; 
• Developing a plan for recovering PPP funds; and 
• Continuing manual reviews of loans flagged for potential eligibility issues. 
The fraud control framework also includes a variety of antifraud controls in place designed to detect and 
mitigate possible instances of eligibility fraud. These controls include approved lender lists, verification 
with the Treasury Do Not Pay database, and compliance checks. 
SBA also integrated affiliation data, which shows business affiliation through ownership and maximum 
number of employees, as well as maximum loan amount. SBA instituted an affiliation worksheet for PPP 
loan and forgiveness reviews. Swift management action to identify and review potentially ineligible 
loans could prevent improper payments to lenders because the associated loan forgiveness may still be 
in process. 
As we complete current reviews and conduct future audit work, SBA’s plans and actions to reduce and 
prevent improper payments in addition to SBA’s corrective actions to address OIG recommendations will 
determine how we will rate this challenge in the future. 
Issue: Paycheck Protection Program Data Reliability 
OIG’s flash report SBA’s Implementation of the Paycheck Protection 
Program Requirements (Report 20-14) found the data SBA reported 
and the loan-level PPP data was inaccurate and incomplete. Without 
accurate and complete data, SBA cannot reliably and accurately 
inform SBA management and Congress about program effectiveness 
and measures needed to inform program decisions. 

10 
Underserved Market Data Was Incomplete 
At the beginning of the PPP program, our flash report found that SBA’s demographic information for 
underserved markets for PPP borrowers was incomplete. SBA’s borrower application for PPP did not 
include standard SBA fields to request demographic information. One week after we issued our flash 
report, SBA issued the initial PPP loan forgiveness application, which included an optional page for 
borrower demographic information. We believe sufficient data still may not be collected. 
Some borrowers may not apply for loan forgiveness while others may choose not to complete the 
optional page. Although ethnic demographic information is optional for SBA’s traditional loan programs 
and the PPP, SBA generally requests the demographic information as a section on a mandatory form. 
Borrowers have the option to decline to provide the information. 
North American Industry Classification System Data Was Incomplete 
In our Inspection of SBA’s Implementation of the Paycheck Protection Program (Report 21-07), we found 
SBA’s loan-level data on PPP NAICS codes was incomplete. SBA did not require the borrower to provide 
the industry classification code on the application, so lenders did not have the information to put in the 
loan processing platform. As of June 30, 2020, there were 222,096 loans, totaling approximately $9.9 
billion, identified as unclassified establishments because there was no industry classification data on the 
application. 
Job Statistics Were Inaccurate and Incomplete 
Also in Report 21-07, we found SBA’s loan-level data for job statistics was inaccurate and incomplete. 
We found that 191,003 loans approved in 2020, totaling about $11 billion, did not include employment 
information in the required job field for the number of current employees. SBA officials said because of 
a backlog of loan applications before the beginning of the second round of PPP funding, lenders were 
allowed to submit loan applications in bulk. The officials said they turned off system controls to allow for 
faster approval. Of the 191,003 applications that did not have data for the number of current 
employees, 83,374 were approved during the first week of the second round of funding. Because SBA 
removed the internal control to check data for the number of current employees, these loans, totaling 
about $4 billion, were not validated before approval and issuance of loan numbers to PPP lenders. 
Agency Progress 
SBA implemented additional controls to ensure the integrity of the key data fields noted above, 
including: 
 
 

11 
• Adding mandatory fields in borrower and lender application processes; 
• Updating controls to ensure data accuracy of lender-reported data; 
• Instituting a procedure for lenders and borrowers to correct publicly available PPP loan data 
provided to SBA by delegated PPP lenders; and 
• Launching a new data reporting webpage for public and SBA stakeholders with links to 
several public SBA reports and datasets. 
We have an ongoing audit reviewing PPP loan eligibility, loan forgiveness, and guaranty purchase. We 
will continue to assess the reliability of PPP loan data and monitor the agency’s efforts to ensure data 
reliability. 
COVID-19 Economic Injury Disaster Loan 
As a result of the pandemic’s widespread economic effects on the U.S. economy, Congress approved 
legislation that increased funding to SBA’s disaster assistance program, providing $470 billion in funding 
to the Economic Injury Disaster Loan (EIDL) program and $20 billion for emergency grants for eligible 
entities, which was then increased to $35 billion in 2021. 
This program was different from the PPP in that a COVID-19 EIDL was a direct loan from the 
government, requiring collateral or personal guarantees from borrowers depending on the amount of 
the loan. SBA relied initially on a quick online application and self-certification of eligibility. Later, once 
authorized by Congress to do so, the agency required Internal Revenue Service (IRS) tax transcripts to 
confirm business income and expenses. 
The COVID-19 EIDL represented a significant increase over all disaster loan funding disbursed in the 
agency’s 70-year history. Since the agency’s inception in 1953, SBA has approved 2.2 million disaster 
assistance loans, totaling $66.7 billion. From March 2020 to the end of the program in May 2022, so in a 
little over 2 years, SBA approved approximately 4 million COVID-19 EIDLs totaling $387 billion. 
Like the PPP, the significant increase in demand for disaster funding and the stress on SBA systems 
created considerable challenges. Again, fraudsters took advantage of the crisis and weak internal 
controls in SBA’s programs. The magnitude of fraud in this program will become more apparent as 
delinquent loans are liquidated and charged-off and investigations are adjudicated. 
 
 

12 
Issue: SBA Must Review COVID-19 EIDLs and Grants for Potential 
Fraud Identified in OIG Reports 
Because the COVID-19 EIDL program has closed, the issue has evolved 
from preventing fraud in the program to identifying and remedying 
fraud that has already occurred. In our white paper COVID-19 
Pandemic EIDL and PPP Loan Fraud Landscape (Report 23-09), we 
estimated SBA disbursed over $136 billion in potentially fraudulent 
COVID-19 EIDLs, which represents 33 percent of total disbursed funds. 
As described above in the PPP section of this report, we identified multiple fraud indicators and schemes 
used by fraudsters to steal from the American taxpayer and exploit programs meant to help those in 
need. The potential fraud estimates directly correlate to our investigative casework, adjudicated and 
ongoing criminal cases, and to schemes OIG and other oversight agencies are continuing to unravel and 
then prosecute. These indicators will continue to evolve as more data becomes available to us. 
Indicators of potential COVID-19 EIDL fraud include: 
• Internet Protocol (IP) addresses — loan applications submitted from a foreign country, so 
likely ineligible, or from an IP address that matches another application, indicating possible 
duplication of loan requests. 
• Hold codes — loans flagged by SBA or a third party that identified potential indicators of 
fraud. 
• Bank accounts — SBA disbursed funds for multiple loans to the same bank account; 
borrowers who changed their bank account information during the application process, or 
those whose bank account matches other applications. 
• Employer Identification Numbers (EIN) — borrowers who appeared to have established their 
business after the qualifying date, EINs matching those of other COVID-19 EIDLs, and 
borrowers with an EIN that is improperly formatted or begins with an invalid prefix, masking 
a nonexistent or ineligible business. 
• Sole proprietors/independent contractors without an EIN — borrowers who claim to employ 
more than one person but did not use an EIN in their application. The IRS requires all 
businesses that employ more than one person to register for an EIN. 
• Hotline complaints — the loan was the subject of an OIG Hotline complaint. 
• Suspicious phone numbers — borrowers whose phone numbers match those in other 
applications. 

13 
• COVID-19 EIDL Targeted Advances — applicants who received advances SBA identified as 
potentially fraudulent. 
• Suspicious physical addresses — borrowers whose addresses match other applications found 
to have a higher likelihood of fraud. 
• Suspicious email addresses — borrowers whose email addresses are from potentially 
temporary domains, have modifications or match those in other applications. 
See Figure 3 for the total disbursed dollar value estimate of each COVID-19 EIDL fraud indicator. The 
aggregate of each group total differs from the total potential fraud estimate because duplicates across 
groups may exist, while duplicates are removed from the total potential fraud estimate. 
Figure 3: Summary of Potentially Fraudulent COVID-19 EIDLs by Fraud 
Indicator 
 
Source: OIG analysis of COVID-19 EIDL data 
We have several concerns from past audit work that falls under this issue, so we are highlighting here 
major concerns which have not yet been addressed by the agency. Although the loans and grants we 
have cited may overlap with each other, the total potential fraud estimate presented in our fraud 
landscape white paper removed duplicate loans. Per our estimate, there are over $136 billion in COVID-
19 EIDLs and grants that require further investigation. 
Ending Collections 
In our management advisory Ending Active Collections on Delinquent COVID-19 Economic Injury Disaster 
Loans (Report 23-16), we reported that in April 2022, SBA decided to cease some active collection 
activities, such as foreclosure on property collateral and wage garnishment, on all delinquent COVID-19 

14 
EIDLs with an outstanding balance of $100,000 or less. While SBA indicated it will not end collection 
efforts on any amount that appears to be, or has been, reported as fraudulent, false, or misrepresented, 
these loans only represent $11.2 billion of the $70.9 billion COVID-19 EIDLs that are $100,000 or less. 
As indicated in our fraud landscape white paper, $136 billion COVID-19 EIDLs were determined to be 
potentially fraudulent. Of this amount, $25.9 billion were for loans valued at $100,000 or less. We 
estimate that SBA will cease active collection activities on $14.7 billion potentially fraudulent COVID-19 
EIDLs valued at $100,000 or less, which could violate the federal law that prohibits agencies from ending 
collections on fraudulent, false, or misrepresented claims. 
Foreign IP Applications 
Our evaluation report COVID-19 Economic Injury Disaster Loan Applications Submitted From Foreign IP 
Addresses (Report 22-17) found that SBA approved and disbursed 41,638 potentially fraudulent COVID-
19 EIDLs, advances, and grants totaling $1.3 billion that were submitted from foreign IP addresses. 
Although applicants that reside overseas may qualify for this assistance, transnational crime entities in 
foreign countries have fraudulently obtained funding from this and other U.S. programs in the past. The 
numerous applications submitted from foreign IP addresses are an indication of potential fraud that 
could involve international criminal organizations. OIG has ongoing investigations into international 
organized crime operations that applied for and stole pandemic relief funds. 
We recommended the agency review the loans in our test sample and the $1.3 billion disbursed to 
applicants from foreign IP addresses. We also recommended SBA recover any disbursed loans and 
advances determined to be ineligible or fraudulent. Additionally, we recommended that the agency 
examine controls related to foreign IP addresses and ensure these controls are more effective in future 
disaster processing systems. 
Treasury’s Do Not Pay List 
Our management advisory COVID-19 EIDL Program Recipients on the Department of Treasury’s Do Not 
Pay List (Report 22-06) identified over $3.1 billion in EIDLs and over $550 million in emergency EIDL 
grants to potentially ineligible applicants in the Department of Treasury’s Do Not Pay database. OIG has 
launched numerous investigations into the suspect loans identified in this report. 
We made three recommendations for SBA to use the Do Not Pay system to prevent improper payments, 
including for SBA to use the batch match or continuous monitoring functions available in Treasury’s Do 
Not Pay portal to identify potentially ineligible applicants. We are currently assessing whether SBA 
effectively implemented controls, utilizing the Treasury Do Not Pay databases to ensure only eligible 
recipients received COVID-19 EIDLs and grants. 

15 
Fraudulent Advances and Grants 
Our inspection of SBA’s Emergency EIDL Grants to Sole Proprietors and Independent Contractors (Report 
22-01) found SBA provided $4.5 billion more in advances and grants than the applicants were entitled to 
receive. Eligible applicants were entitled to receive $1,000 per employee up to the CARES Act mandated 
maximum amount of $10,000. The report identified 542,897 sole proprietors and 161,197 independent 
contractors who received a grant of more than $1,000 but did not have an Employer Identification 
Number (EIN). The absence of a provided EIN may indicate the applicants should have claimed no 
employees. We recommended SBA remedy $4.5 billion in funds disbursed in excess of its statutory 
allowance to sole proprietors and independent contractors. 
Control Weaknesses 
Since the start of the pandemic, we have identified potential fraud resulting from serious control 
weaknesses in the system SBA used to process COVID-19 EIDL and grants. Our Inspection of SBA’s Initial 
Disaster Assistance Response to the Coronavirus Pandemic (Report 21-02) identified $78.1 billion in 
potentially fraudulent loans and grants to borrowers who changed their bank account from the original 
account listed on the loan application prior to disbursement; borrowers who used the same IP address, 
email address, bank account, or physical address; and potentially ineligible businesses. We made 10 
recommendations to SBA to strengthen its controls to lower fraud risk and recover funds from ineligible 
businesses. Of those, seven recommendations have been closed. 
Our Follow-up Inspection of SBA’s Internal Controls to Prevent COVID-19 EIDLs to Ineligible Applicants 
(Report 22-22) found that SBA did not implement the IRS tax transcript requirement in a timely manner, 
potentially disbursing COVID-19 EIDLs to ineligible entities. In the 4 months after Congress removed the 
tax return prohibition, SBA disbursed $92 million to businesses with suspect tax ID numbers. Also, SBA 
approved and disbursed 20 loans totaling $1.9 million to businesses that did not exist on or before 
January 31, 2020, had an unknown start date, or had other red flags, including change of registered 
agent shortly before the application date, evidence of falsified documents, or evidence that the 
applicant did not own the business. Ten of these loans were flagged by SBA for suspected fraud. We 
recommended SBA recover funds disbursed to ineligible applicants identified in our sample and review 
the remaining COVID-19 EIDL disbursements with suspect tax ID numbers to determine if the business 
applicant was legitimate. 
Agency Progress 
SBA made some progress in addressing this issue, implementing new controls in the EIDL program in 
2021, such as: 

16 
• Reviewing correspondence and making loan referrals to OIG in response to identity theft 
complaints; 
• Validating business addresses with the U.S. Postal Service and location indicators; and 
• Implementing multi-factor authentication and automated reviews, such as checking 
Treasury’s Do Not Pay database. 
In addition, the fraud review team within the SBA Office of Performance, Planning, and the Chief 
Financial Officer collaborated with the Office of Capital Access on a data analytics project to help 
identify COVID-19 EIDLs that may be associated with identity theft or fraud. The results of this project 
are being used by the fraud review team to research suspected cases of identity theft and fraud. 
According to SBA, if it is determined that a file should be flagged for suspected fraud or identity theft, an 
agency hold is added to the processing system. Holds are added to an application at any stage. They 
alert staff that special attention is required and that it should be reviewed. SBA is still reviewing loans 
that have been on hold for review to make a fraud determination. The agency hold review system 
allowed staff to review and recategorize or refer agency holds to the disaster fraud review team. 
SBA has made progress in identifying and reviewing fraud and agency holds, but the sheer volume of 
potential fraudulent loans and grants discovered in OIG reports will be a continuing challenge for the 
agency. The deferment period ended for some COVID-19 EIDLs in October 2022, and borrowers were 
expected to begin making payments on these loans. As of October 2023, approximately 20 percent of 
active performing loans, totaling $77 billion, are past due, delinquent, or in liquidation. SBA anticipates 
the majority of these loans will require liquidation and charge-off. Another $47.7 billion in COVID-19 
EIDLs has already been charged-off. We discuss this issue to a greater extent in this report. OIG’s 
ongoing reviews will continue to assess SBA’s progress in addressing potential fraud in the COVID-19 
EIDL program. 
Issue: Unprecedented Increase in Servicing COVID-19 EIDLs 
Before the COVID-19 pandemic, SBA was servicing about 263,000 
outstanding disaster loans, totaling approximately $9 billion, across the 
three servicing centers. SBA maintains two Disaster Loan Servicing 
Centers, one in Birmingham, Alabama and the other in El Paso, Texas, to 
service disaster loans that have been approved and fully disbursed. The 
two centers manage the portfolio and provide customer service, 
including accepting and processing loan payments, making routine collection efforts by phone, email, 
and postal letters, and handling any loan-related issues, such as insurance, title, or lien matters. 

17 
After a disaster loan becomes 90 days delinquent, it is transferred to a third center known as the 
National Disaster Loan Resolution Center in Santa Ana, California. The loan resolution center manages 
the portfolio of defaulted disaster loans with increased collection efforts, including foreclosure when 
necessary. 
The center also handles other loan servicing activities, such as processing loan payments. When disaster 
loans are deemed ultimately uncollectable and charged-off, or removed from the agency’s loan 
portfolio, the borrowers and guarantors are referred to the Treasury Department. 
Treasury has the authority to take stronger efforts to collect, including offset of other federal payments. 
In this context, offset means diverting federal payments to satisfy the delinquent loan. 
As a result of the unprecedented number of pandemic relief loans, SBA is now servicing about 3.7 
million outstanding disaster loans — 15 times what the agency was doing before the pandemic. A total 
of 30 months of payment deferment was instituted for all COVID EIDLs. The end of this deferment 
period began in October 2022. Because the COVID-19 EIDLs were approved with repayment terms of 30 
years, the expected servicing duration of this portfolio is long term. 
SBA indicated there were over 764,000 COVID-19 EIDLs, totaling $77 billion, that are either past due, 
delinquent, or in liquidation as of October 2023. In addition, $47.7 billion in COVID-19 EIDLs have been 
charged-off. We have not yet validated this data. 
Agency Progress 
SBA officials have made some progress to service a historic number of outstanding loans, such as: 
• Establishing the standalone COVID-19 EIDL Servicing Center in Fort Worth, Texas, which 
became fully functional in the first quarter of FY 2023 with 500 employees handling the first 
loans that entered repayment status. Hiring continued at an intentionally measured pace as 
more loans reentered repayment status. By the first quarter of FY 2024, 1,841 employees 
were servicing over 3.7 million loans with a total value of $349 billion. Recently, SBA stated it 
is servicing more than 90 percent of the COVID-19 EIDL portfolio after deferments were 
ended. 
• Establishing a dedicated phone number (1-833-853-5638) and general email address inbox 
(covideidlserviciing@sba.gov). Loan servicers use an internal tracking system with controls to 
administer and monitor servicing in a timely manner. 
• Transitioning to a borrower portal, MySBA Loan Portal, active as of the second quarter of 
2023, that allows all SBA borrowers to access their loan details, obtain billing notices, and 
make payments and includes a link for submitting suspected identity theft claims. The loan 

18 
portal is automated to mail letters, send emails, and call past-due borrowers at regular 
intervals. 
• Enabling a pay-by-phone capability in the third quarter of 2023. 
• Issuing Policy Notice 5000-840468, COVID-19 EIDL Servicing and Liquidation, effective 
December 2022, giving specific requirements on collecting documentation and deciding on 
different servicing requests. 
• Implementing a new hardship accommodation process in November 2022, which allows 
COVID-19 EIDL borrowers to obtain 6 months of reduced payments, which remains available 
in FY 2023. 
This issue remains a significant challenge for SBA because it is still unclear if the agency will be able to 
service and collect its entire COVID-19 EIDL portfolio. 
 
 

19 
Challenge 2: Eligibility Concerns in Small Business 
Contracting Programs Undermine the Reliability of 
Contracting Goal Achievements 
Why This Is a Challenge 
The government-wide goal of the Small Business Act is to ensure that 23 percent of all prime contracts 
are awarded to small businesses each fiscal year. Since FY 2013, SBA has reported in its annual Small 
Business Procurement Scorecard that the federal government has met or exceeded that goal. This year, 
SBA announced the federal government exceeded the FY 2022 goal, awarding 26 percent of prime 
contracts to small businesses. Though the overall percentage awarded decreased from FY 2021 goaling 
achievements, the contracts awarded to small businesses in FY 2022 totaled $162.9 billion, an $8.7 
billion increase from the previous fiscal year. SBA reported the federal government earned an “A” on 
this year’s government-wide scorecard. 
SBA’s achievement reports do not portray federal contracting dollars ultimately earned by small 
businesses, and this reduces the ability of Congress and other federal policymakers to determine 
whether the government is maximizing contracting opportunities for small businesses. 
This risk is revealed in OIG audits on how federal agencies award contracts to small firms with provisions 
or other contract language that allows larger companies to do most of the work. Although the agencies 
report these awards as part of their small business contracting goaling achievements, the true 
percentage of work performed is misreported in these instances. We found this to be the case in our 
Evaluation of SBA’s Contract for Disaster Assistance Loan Recommendation Services (Report 22-10). SBA 
awarded the contract using procedures that restricted the competition for the award to small 
businesses. The business SBA made the award to then subcontracted with a large business. SBA did not 
adequately assess whether the relationship between the small and large businesses made them 
affiliated. Also, we found the contractor exceeded the limit for how much of the work it could 
subcontract. 
We found the subcontracting limits were exceeded in another recent evaluation of an SBA agreement 
that was awarded as a set-aside for an 8(a) small business in SBA’s Awards for Staffing Support for 
COVID-19 Economic Relief Loan Programs (Report 23-11). Specifically, we found SBA did not ensure the 
small business complied with the subcontracting limitations for 5 of the 29 contracts we reviewed. For 
those five orders, the small business subcontracted an average of 93 percent of the work to firms that 
were not similarly situated and exceeded the 50 percent limitations on subcontracting. 

20 
As the federal government’s primary advocate for small business, SBA must continue to strive to ensure 
federal agencies award small business contracts only to eligible entities and that those qualifying 
businesses are counted in the assessment. 
Issue: Agencies Receive Credit for Ineligible Firms or Those Not 
Participating in SBA’s Contracting Programs 
SBA program success and integrity could be adversely affected if 
the agency admits ineligible firms into programs intended for 
disadvantaged small businesses. OIG continues to find that SBA 
does not consistently detect ineligible firms in its small business 
contracting certification programs. SBA needs to further 
strengthen its controls in reviewing eligibility to ensure that only 
businesses meeting program requirements are awarded contracts. 
Agency contracting officers have incorrectly reported awards were made to firms certified as HUBZone 
or 8(a) Business Development program businesses in the System for Award Management (SAM.gov). In 
2020, the General Services Administration (GSA) Office of Inspector General found $89 million in 
contracting dollars erroneously recorded as awarded to small businesses in the Federal Procurement 
Data System–Next Generation, the contract reporting system of record at the time of the audit. 
The Small Business Act requires that 5 percent of all prime and all subcontracts for the federal 
government be awarded to contractors with small, disadvantaged business status. In December 2021, 
the Office of Management and Budget raised the prime contracting goal for small, disadvantaged 
businesses to 11 percent for FY 2022. Participants in the 8(a) program are considered small, 
disadvantaged businesses and awards made to them are also counted toward agency goals. 
We also found SBA’s Dynamic Small Business Search database did not consistently update when SBA 
made decisions on applicants’ WOSB certifications. Contracting officers throughout the government rely 
on the certification status reported in the database, the system of record for SBA’s small business 
contracting programs. The Dynamic Small Business Search database integrates with SAM.gov. Without 
reliable information, contracting officers may be awarding contracts set aside for disadvantaged small 
businesses to ineligible firms. 
We have several concerns from past audit work that falls under this issue, so we are highlighting here 
major concerns which are still being addressed by the agency. 
 
 

21 
HUBZone Eligibility Requirement 
GAO’s Small Business Administration Could Further Strengthen HUBZone Eligibility Reviews in Puerto Rico 
and Programwide (GAO-18-666) and OIG’s audit SBA’s HUBZone Certification Process (Report 19-08) 
found SBA did not ensure only eligible firms entered the HUBZone program. 
This program was created to bring more economic opportunity to small, disadvantaged businesses and 
workers located in areas categorized as historically underutilized business zones. In late 2019, SBA 
changed a HUBZone requirement allowing the businesses to employ a large percentage of its workforce 
outside the HUBZone, widening eligibility and, we believe, deviating from congressional intent. Under 
the new requirement, the business continues to qualify as long as it has employees who lived in a 
HUBZone for at least 180 days leading up to the date of recertification. This means HUBZone businesses 
could have no employees residing in the HUBZone and still qualify. 
Small, Disadvantaged Business Goaling 
Federal agencies will need to expand procurement activities to deliver on the President’s goal of 
increasing the share of federal contracts awarded to small, disadvantaged businesses from 5 to 15 
percent by 2025. SBA program success and integrity could be adversely affected if the agency admits 
ineligible firms into programs intended for disadvantaged small businesses. SBA terminated its small, 
disadvantaged business certification program in 2008 as a result of past court decisions. Since then, 
firms have been allowed to self-certify, opening up the designation to risk. As of September 2023, SBA’s 
Dynamic Small Business Search database included 300,836 firms that self-certified as small, 
disadvantaged businesses. Firms that falsely certify they are socially and economically disadvantaged 
may receive federal contracts counting toward the agency’s goal achievements. 
Based on FY 2022 contract data retrieved from SAM.gov, as much as $16.5 billion in prime contracts was 
awarded to small, disadvantaged businesses without a certification overseen by SBA. Given the large 
amount of federal contracting dollars awarded to these self-certified small, disadvantaged businesses, it 
is crucial for SBA to ensure that only eligible firms are counted. 
Even though self-certification is inherently risky, SBA removed regulations allowing for protests of a 
firm’s small, disadvantaged business status in FY 2020. SBA manages a protest process, which means 
interested parties to the contract that had been set aside for small businesses can challenge the size or 
status of an entity in line to receive the award. This process is intended to instill integrity within SBA’s 
small business contracting programs. 
While firms were still subject to protests related to their small business size, business owners’ status as 
socially or economically disadvantaged could not be challenged. We discovered this oversight and 
reported it to SBA. In September 2022, SBA proposed to authorize reviews and protests of the small, 

22 
disadvantaged business status in connection with prime contracts and subcontracts to a federal prime 
contract. SBA requested comments on that proposal and others by November 8, 2022. The agency 
recently issued a final rule, effective May 30, 2023, to allow for reviews of the small, disadvantaged 
businesses status. 
Agency Progress 
SBA has made substantial progress in adding controls to detect ineligible firms in the HUBZone program, 
such as: 
• Updating procedures and training staff on its HUBZone policy directives to standardize 
analysis and oversight; 
• Requiring each firm complete a program examination every 3 years; 
• Taking action to decertify firms that are no longer eligible for the program, decertifying 3,750 
firms as of June 1, 2023; and 
• Educating HUBZone firms on meeting part-time employee requirements. 
While recent regulatory and procedural changes improved SBA’s oversight of firms in the HUBZone 
program, the changes also removed a certain control that we believe is essential for proper oversight. 
The new HUBZone employee residency requirement could reduce the program’s ability to meet 
legislative intent. Allowing certified businesses to count employees who are not current HUBZone 
residents does not help provide economic opportunity to HUBZone residents. 
SBA has achieved significant progress on the issue involving small, disadvantaged business goaling by 
making the following improvements during FY 2023: 
• SBA recently issued a final rule, effective May 30, 2023, to allow for reviews of the small, 
disadvantaged businesses status. 
• SBA strengthened the process it uses to alert other federal agencies of potentially inaccurate 
contracting data in SAM.gov, the system SBA relies on to assess government-wide goaling 
achievements and grading federal agencies using the small business contracting scorecard. 
• SBA improved its regulations for handling protests, requiring that program officials review 
entities representing themselves as a small, disadvantaged business on a federal prime 
contract or subcontract whenever the agency receives credible information. 
• SBA also worked with GSA to add clarifying language to SAM.gov so that business owners 
self-certifying as a small, disadvantaged businesses are prompted to review the definition in 
the Federal Acquisition Regulation. 

23 
Issue: Women-Owned Small Business Federal Certification Program 
Susceptible to Abuse 
SBA’s Women-Owned Small Business (WOSB) program is intended to 
give eligible companies greater access to federal contracting 
opportunities, ensuring a level playing field for women business owners. 
Both OIG and GAO have reported weaknesses in SBA’s controls intended 
to ensure only eligible firms receive federal contracts set aside for these 
businesses. 
The federal government’s annual contracting goal for WOSBs is 5 percent of all federal contracting 
dollars. The WOSB program is a subset of this larger goal, but not the sole driver. The government limits 
competition for set-aside WOSB and economically disadvantaged women-owned small business federal 
contracts to participants in the WOSB Federal Contracting Program. Some contracts are awarded 
directly with no competitive bidding. Such contracts are known as sole-source awards. This means 
significant contracting dollars and taxpayer funds are at stake, beginning with program eligibility and 
certification of the designation. 
The 2015 National Defense Authorization Act required qualifying small businesses to be certified by a 
federal agency, a state government, SBA’s Administrator, or a national certifying entity approved by the 
Administrator. 
Women business owners seeking to participate in the WOSB program may submit an application and 
supporting documents to SBA at no cost via WOSB.Certify.sba.gov, or pay a fee to be certified by an 
official third-party organization. As mandated in FY 2015, SBA has four approved third-party certifiers 
that are allowed to charge a fee to certify the WOSB or the economically disadvantaged women-owned 
small business. 
In our audit SBA’s Implementation of the Women-Owned Small Business Certification Program (Report 
22-20), we reported that SBA established its WOSB certification process to collect documents to verify 
applicants met most program eligibility requirements, but did not require any documentation to ensure 
businesses met SBA size standards. SBA analysts also did not always ensure women were the majority 
owners and controlled the business. In our analysis, we found 3 of the 25 firms we reviewed did not 
have documentation showing that a woman controlled the business. To ensure that only small 
businesses owned and controlled by women benefit from the WOSB certification program, SBA must 
create a control environment requiring all eligibility requirements to be verified. 
SBA and other agencies rely on a third party for many WOSB certifications, but SBA is still not conducting 
consistent reviews of these organizations to make sure only qualifying women-owned businesses 

24 
receive the benefit. This has been a challenge for the agency since 2014, when GAO first recommended 
SBA establish procedures to assess the performance of the third-party certifiers. 
Agency Progress 
SBA has made progress toward addressing risks in the Women-Owned Small Business program, 
including: 
• Launching WOSB.Certify.sba.gov, the operational platform used to manage the certification 
process for the WOSB and economically disadvantaged women-owned small business 
programs in July 2020; 
• Conducting WOSB certification determinations in October 2020; 
• Hiring additional WOSB analysts, a program director, and increased the number of staff 
supporting the program; 
• Holding bi-weekly webinars to help prepare the firms whose applications were returned for a 
more successful reapplication; 
• Implementing new measures to verify WOSB program data and develop repairs or 
workarounds to reduce the risk of reporting inaccurate data in FY 2023; 
• Cross-checking data between databases to identify and remedy errors on a semi-annual 
basis; and 
• Establishing a desk guide in December 2022 for staff to follow when reviewing applications. 
Although SBA has drafted standard operating procedures for application reviews, SBA managers 
determined they would not implement OIG’s recommendations to review documentation to verify that 
applicants meet small business size standards. SBA disagreed with OIG’s interpretation that the 2015 
National Defense Authorization Act required SBA to verify that the business was small in addition to the 
requirement that the business be owned and controlled by a woman. We alerted the Audit Follow-up 
Official of our concerns in accordance with our policy. The Audit Follow-Up official decided the agency 
would continue to allow applicants to self-certify that the business met size standards. While OIG 
believes that removing self-certification from the WOSB program is essential to reducing the risk, OIG 
will not take further action and has closed the recommendation. 
 
 

25 
Challenge 3: SBA Faces Significant Challenges in IT 
Investments, System Development, and Security Controls 
Why This Is a Challenge 
The inherent risks and related internal controls related to this challenge are included on the 
Government Accountability Office’s (GAO) federal high-risk list: IT investments, SBA’s emergency loan 
process, and cybersecurity. According to GAO, this list comprises federal programs and operations that 
need reform because they are vulnerable to waste, fraud, abuse, and mismanagement. 
SBA uses third-party providers to provide application processing services for multiple assistance 
programs, including veteran assistance and loan processing. Federal guidance, such as OMB Circular A-
123 and the Federal Information Security Modernization Act (FISMA), requires agency management to 
validate the adequacy of controls by third-party service providers. Commercial software development 
requires transparency, ability to resist attack, and controls to prevent tampering by malicious actors. 
Moreover, SBA needs to implement rigorous and predictable programs to monitor supply chain security 
over this software. 
IT investments, system development, and security controls are managed primarily through entity-level 
control activities. These activities allow the agency to meet its objectives, address related risks, and 
ensure information technology continues to properly operate. SBA must maintain and establish IT 
design and security control baselines essential to protect information and preserve data integrity. 
Issue: SBA’s IT Investment Controls Need Improvement 
Effective IT system design and development improve business processes 
and reduces the cost of providing essential government services. SBA 
must establish effective IT investment controls to ensure the agency 
meets performance metrics, projected schedules, and estimated costs. 
The SBA Business Technology Investment Council (BTIC) oversees 
significant IT investments and monitors system development, design, and security controls. The BTIC is 
responsible for implementing key provisions of the Clinger-Cohen Act, also known as the Information 
Technology Management Reform Act. It charges chief information officers with the duty to monitor, 
evaluate, and report agency performance of IT programs. The BTIC monitors development performance 
against requirements and baseline controls, facilitates corrective actions, and provides transparency to 
the investment control process. This oversight is critical to ensure systems are delivered in a cost-
effective manner and that SBA’s technical infrastructure is designed and maintained properly. 

26 
The BTIC met in September 2022 to start a re-design of its oversight controls. These controls will 
address project investment cost, schedule, and performance. The re-design will provide improved 
oversight of project schedules and costs. 
Standard Operation Procedure (SOP) 90 82, Procedure for Managing SBA IT Investments Investment 
Review Board, requires an investment control framework to integrate investment planning and 
execution. This policy specifically requires reviews be conducted on an annual basis to determine the 
overall health of an existing investment, approve project level requests, and assign project resources if 
needed. SBA’s SOP IT Investment Performance Baseline Management Policy requires that the BTIC be 
involved for the whole life of the IT project/investment. The policy further states the BTIC should 
provide direction on reviewing and approving the SBA IT portfolio. The council should be helping the 
agency create the optimum return on its IT investment. The BTIC should be supporting the agency’s 
mission and ensuring the accountability of SBA business and IT investments. 
Agency Progress 
After reviewing February 2023 SBA BTIC meeting minutes, we found many investment controls 
previously identified as missing in the FY 2020 – 2022 timeframe, were still not in place. We found the 
BTIC did not consistently report on the performance of previous IT investments or provide the basis of 
its acceptance or continuation of new and existing investments. 
Until this process is implemented there will be little oversight over SBA’s IT investments. The agency 
made progress in designing a new investment oversight framework, but preliminary implementation of 
this re-design is not planned until the second quarter of FY 2024. 
SBA can improve in these specific areas: 
• Full adherence to preliminary design criteria and agency SOPs, which includes approval by 
the BTIC and Architectural Review Board. 
• Effective project baseline management, which allows planned results to be assessed against 
investment performance and then actions taken to improve performance. 
• Ongoing quality assurance reviews to assess development progress, improvement, baseline 
management policy controls. 
• Periodic analysis of investment performance throughout the project lifecycle to identify 
improvement areas. 
Full implementation of the above controls will allow senior agency leaders, Congress, and other 
stakeholders to better gauge SBA’s IT oversight and performance. These controls will deter fraud and 
better protect the identity of taxpayers who have received SBA assistance. 

27 
Issue: Existing System Development and Monitoring Controls Need 
to Reflect Changing IT Design Risks 
Our past audit work identified multiple areas in system development 
and monitoring controls requiring improvement. Through our FISMA 
evaluations and monitoring of open recommendations, we found the 
agency made progress in these areas. SBA updated its policy for 
System and Organization Controls (SOC) 1 Type 2 reports. Yet we 
found these issues with SBA’s system development methodology and 
system acceptance controls. Many of the control areas identified below will be tested in our ongoing 
audits and evaluations. 
Communication and Mitigation of Privacy Risks 
In the last 3 years, OIG has identified potential privacy and identity internal control weaknesses. In 
COVID-19 and Disaster Assistance Information Systems Security Controls (Report 22-19), we 
recommended that a process be established to communicate identified privacy and identity risks. FISMA 
criteria recommends the development of performance metrics to monitor the effectiveness of SBA’s 
privacy internal controls. The agency has revised its privacy impact assessment process to address this 
issue. 
Coordination of System Contracts and Data Management Oversight 
In our Report 22-19, we also found SBA managers did not fully implement controls to show that external 
service providers adhered to federal cybersecurity and supply chain risk management requirements. 
Also, SBA management did not document assessment and review of the supply chain-related risks as 
required by FISMA guidance. 
We recommended that SBA enforce the requirement to establish and implement internal controls to 
ensure program officials perform and document contract reviews. This will ensure that information 
security is addressed in the contract language, as required by OMB Circular A-130 and SBA SOP 90 47 6. 
FISMA guidance requires continuous monitoring of third-party software security controls. SBA officials 
stated they would revise their IT Governance Framework to ensure contracts are updated with the 
appropriate security language. 
Monitoring of Third-Party Systems 
In our Repot 22-19, we recommended SBA fully update its policy to provide a roadmap for the purchase, 
launching, and management of software and related application development activities. Updated 
system guidance is crucial for monitoring third-party systems used to process transactions integral to 

28 
the mission of SBA. The agency must update its guidance for purchasing and related system 
development to validate essential controls exist before a system is put into production. 
In response to Report 22-19, SBA plans to revise the agency’s SBA System Development Methodology 
and provide procedural guidance over supply chain risk management practices including applications 
with high-value asset system designation. 
Updated System and Organization Controls Reports 
In the Independent Auditors’ Report on SBA’s Fiscal Year 2022 Financial Statements (Report 23-02), the 
OIG’s independent public accountant was unable to obtain reasonable assurance regarding the 
reliability and integrity of reported financial data for critical third-party systems, which contributed to 
two disclaimer audit opinions for FYs 2020 and 2021. The SOC 1 Type 2 report provides assurance that 
reported financial data is complete and reliable. 
SBA has updated its policies to ensure that prior to issuing a contract, SOC 1 has been reviewed and 
impact assessed on SBA internal controls as well as modify ongoing contracts where a SOC 1 may be 
necessary. 
System Acceptance Controls and Monitoring to Limit Risk 
In our Repot 22-19, we recommended SBA meet federal guidance in delivering program funds to eligible 
taxpayers. Testing protocols must be fully implemented, even within limited timeframes, and then 
independently tested to ensure they operate as designed. Acceptance criteria must also specify the 
minimum desired functionality acceptable for a system to be put into operation. 
Agency Progress 
Through our FISMA evaluations and monitoring of open recommendations, we found the agency made 
progress updating its polices to ensure that prior to issuing a contract, security controls have been 
reviewed and impact assessed and modifying ongoing contracts where a SOC 1 may be necessary. 
In response to OIG Report 22-19, SBA plans to revise the agency’s System Development Methodology; 
and provide procedural guidance over supply chain risk management practices, including applications 
with high-value asset system designation. 
The agency stated it will update policy to require that all systems include an assessment of security risk 
management activities via the Cyber Risk Management Platform by July 31, 2024. 
 
 

29 
Issue: Additional Progress Needed in IT Security Controls 
Inspectors general are required by FISMA to assess the effectiveness of 
information security programs on a maturity model spectrum and 
assess security capability in eight domains. 
For FY 2023, the scope of the FISMA evaluation included a core set of 
20 metrics and a supplemental set of an additional 23 metrics. The 
maturity model criteria places SBA at an overall level of “not effective.” 
Agency Progress 
The current benchmark for an effective program within the context of the maturity model is managed 
and measurable. SBA quickly responds to identified vulnerabilities but continues to experience 
reoccurring control challenges in the areas of user access, configuration management, and security 
training and risk management. 
 
 

30 
Challenge 4: SBA Risk Management and Oversight Practices 
Need Improvement to Ensure the Integrity of Loan Programs 
Why This Is a Challenge 
SBA’s Office of Credit Risk Management manages credit risk for the agency’s loan portfolio of 
approximately $173 billion (as of December 2022), and this includes the remaining outstanding loans 
made through the Paycheck Protection Program (PPP). As discussed in Management Challenge 1, SBA’s 
lack of internal controls led to significant fraud risk and vulnerabilities. Additionally, we found SBA did 
not have an organizational structure with clearly defined roles, responsibilities, and processes to 
manage and handle potentially fraudulent PPP loans. As of December 2022, SBA has made forgiveness 
payments exceeding $750 billion to over 4,700 PPP lenders, which the SBA Office of Credit Risk 
Management has the responsibility to oversee. PPP loans were originated by lenders and other 
companies that often have a low degree of expertise in SBA loan program requirements, which is why 
this continues to be a challenge for FY 2024. 
Lenders often rely on the services of fee-based and other third-party agents to help originate, close, 
service, and liquidate SBA loans. Most traditional SBA-guaranteed 7(a) and 504 Certified Development 
Company loans are originated by lenders with delegated approval authority. Generally, these lenders 
are subject to only limited SBA oversight and quality control unless a borrower defaults on a loan. 
Our previous audits have found SBA has not adequately recognized or managed significant lender 
weaknesses. In our Audit of SBA’s Oversight of High-Risk Lenders (Report 20-03), we identified additional 
internal control weaknesses in lender oversight. 
Previous OIG audits have also shown that SBA did not effectively identify and track third-party agent 
involvement in its 7(a) and 504 loan portfolios. Tracking such agents is crucial in managing the portfolios 
because many lenders rely on the services of fee-based and other third-party agents to help originate, 
close, service, and liquidate SBA loans. 
Issue: SBA’s Oversight of High-Risk Lending Participants 
The risks inherent in delegated lending require effective oversight to 
monitor compliance with SBA policies and procedures and corrective 
actions to address noncompliance. However, in Report 20-03, we 
found that the SBA Office of Credit Risk Management did not always 
effectively oversee high-risk lenders to identify and mitigate risks. 
Specifically, SBA did not always: 

31 
• Conduct planned high-risk lender reviews, 
• recommend appropriate and consistent risk mitigation actions for the deficiencies identified 
during the oversight reviews of high-risk lenders, and 
• communicate loan deficiencies noted during high-risk lender reviews to SBA approval and 
purchase loan centers. 
Agency Progress 
SBA has worked to address issues with its oversight of lenders in response to our audit 
recommendations and, in FY 2021, improved its ability to oversee high-risk lenders by: 
• Issuing the Final 7(a) Lending Oversight Rule and publication of Standard Operating 
Procedure (SOP) 50 53 (2) on supervision and enforcement, 
• Realigning the organizational structure of the Office of Credit Risk Management to 
strengthen lender oversight and add resources to the review teams for effective oversight, 
and 
• Implementing quarterly meetings to ensure adequate oversight of lenders with elevated risk 
profiles. 
In FY 2023, SBA continues to revise SOP 51 00 2, On-Site Lender Reviews/Examinations, and document 
the process for on-site lender reviews and examinations, which is planned to be finalized by the agency 
in December. This revision will include the communications protocol that was developed by SBA to 
document deficiencies identified during loan file reviews and to then share this information with SBA 
loan centers and other internal stakeholders. 
In FY 2023, SBA took additional actions to improve its ability to oversee high-risk lenders by issuing SOP 
50 56, Lender Participation Requirements. The agency increased frequency of review activities for 7(a) 
Lenders with portfolios of $350 million or greater and SBA Supervised Lenders. It increased review 
activity with the Office of Performance and Systems Management and Fiscal and Transfer Agent to assist 
lenders with loan reporting compliance. 
The agency implemented a scaled down review for 7(a) lenders with delegated authority and 7(a) loan 
portfolios between $1 million and $10 million to review between one and three recently disbursed 
loans. It implemented quarterly reviews where the sample is taken from high-dollar loans coded as early 
defaults. SBA formalized quarterly high-risk lender meetings where lenders with an elevated risk profile 
are discussed and SBA leaders ensure that oversight activity is adequate. 
Although SBA has made substantive progress, it has not addressed the remaining three 
recommendations in Report 20-03. Agency management has indicated it needs time to finalize and 

32 
implement oversight policies and procedures, including SOP 51 00 2. Agency managers need to obtain 
additional information to confirm that identified deficiencies have been corrected. 
While SBA has made substantial progress in its oversight of high-risk lending participants, in Report 23-
05, White Paper: 7(a) Loan Program During SBA’s Response to the COVID-19 Pandemic, we found 
oversight staffing levels in the Office of Credit Risk Management decreased from 42 to 26 employees, or 
by 38 percent. This staff reduction could affect SBA’s FY 2023 goal for oversight reviews, which help 
ensure lender compliance with program requirements and sustain the progress SBA has achieved 
addressing this issue. The report indicated that to ensure 7(a) loan program integrity and reduce the risk 
of financial loss, SBA should consider potential risks related to staffing shortages in its 7(a) risk strategy. 
Since Report 23-05 was issued, SBA stated that the Office of Credit Risk Management has been 
successful in recruiting additional staff and utilizing staff from other departments and contract 
personnel. 
OIG will continue to monitor SBA’s ongoing efforts to address open recommendations in this report, 
including developing effective oversight policies and procedures and a comprehensive database or 
workflow management tool to manage oversight of high-risk lenders. 
Issue: Increased Risk Introduced by Loan Agents 
Previous OIG audits and investigations have shown SBA could not 
effectively identify and track loan agent involvement in its 7(a) and 
504 loan portfolios. OIG investigations have also revealed a pattern 
of fraud by loan packagers and other fee-based agents in the 7(a) 
loan program involving hundreds of millions of dollars. Despite the 
prevalence of fraud in its loan portfolios, SBA’s oversight of loan 
agents was limited. 
SBA requires lenders to provide a loan agent disclosure form (Form 159) to SBA’s fiscal and transfer 
agent for 7(a) loans that involve a loan agent. The fiscal and transfer agent is a contractor who supports 
SBA by serving as paying agent for all investor payments, processes lender loan reporting, and payment 
remittance reconciliations. The fiscal and transfer agent also serves as the central registry for all 
guaranteed secondary-market interests. The fiscal and transfer agent must enter the data into a 
database accessible to SBA. Prior OIG audits identified significant issues in the data quality of Form 159 
being tracked by the fiscal agent. We also found that SBA had not begun tracking Form 159 in the 504-
loan program. 
 
 

33 
Agency Progress 
SBA’s oversight of loan agents has been a long-standing challenge that the agency has made great 
progress in resolving. SBA took actions to improve the information collected on loan agents by 
enhancing Form 159, which improved its ability to oversee loan agents. The improvements included: 
• Requiring lenders to electronically submit Form 159s through the Capital Access Financial 
System, 
• Developing application and follow-up controls to ensure critical fields on each form are 
completed, 
• Aggregating and reporting on loan agent activity to analyze lender portfolios, and 
• Considering the loan agent activity for lenders under review and regularly reporting on risks 
associated with loan agents across the 7(a) portfolio. 
Because loan agent involvement in the 7(a) program is significant, it is important for SBA to have 
oversight tools that monitor loan agent involvement in this sizeable program. SBA also needs to 
effectively manage the risk introduced by high-risk loan agents. OIG plans to conduct work related to 
agents involved in the PPP and monitor risks related to SBA’s oversight of loan agents. 
Issue: Increased Risk Introduced by Lender Service Providers 
In August 2021, an SBA OIG investigation resulted in the conviction 
of five people on all charges in a 13-year conspiracy to defraud SBA 
in connection with programs to guarantee loans made to small 
businesses. 
The five people fraudulently obtained guarantees for loans SBA 
deemed ineligible. They hid signs of ineligibility from SBA by 
misrepresenting the use of SBA loan proceeds and unlawfully diverting previously denied loan 
applications into expedited approval channels. They originated dozens of loans, totaling more than $10 
million in disbursements, that were not eligible for SBA guarantees. SBA has had to contend with risks 
introduced by the outsourcing of traditional lender functions to lender service providers, a type of loan 
agent, for some time. 
The number of SBA-approved lender service provider agreements has grown significantly, in part 
because of SBA’s effort to better control access to its systems by lender service providers. SBA assigns 
an identifying number to all lender service providers that access SBA systems and records all SBA-
approved agreements. The limited oversight capacity within the Office of Credit Risk Management to 

34 
oversee its lenders also may challenge its ability to monitor the Lender Service Providers operating on 
behalf of these lenders. 
Agency Progress 
Since we first reported on these issues in 2015, SBA has implemented internal controls related to the 
tracking and monitoring of lender service provider involvement in SBA’s loan programs. Specifically, SBA: 
• Established a method to track lender service provider involvement at the loan level; 
• Established procedures to assess provider activities and oversight, as part of lender risk-
based reviews that include file inspection; and 
• Worked with a contractor to aggregate lender usage of lender service providers and to 
develop a performance analysis for lender service provider portfolios to identify any high-risk 
providers and identify the lender with whom they are aligned. 
SBA’s analyses since 2021 have indicated that loans with a lender service provider generally performed 
worse than those without provider involvement in both guaranty purchase and early default rates. 
It remains critically important for SBA to continue to evaluate performance and act when necessary to 
effectively reduce the incurred risks. We will continue to assess risks and conduct further audits and 
reviews as necessary. 
 
 

35 
Challenge 5: SBA’s Management and Monitoring of the 8(a) 
Business Development Program Needs Improvement 
Why This Is a Challenge 
SBA’s 8(a) Business Development Program was created to provide business development assistance to 
eligible small, disadvantaged businesses seeking to compete in the federal marketplace. A major benefit 
of the 8(a) program is that these certified firms can receive sole source and set-aside contracts. Sole-
source awards are contracts proposed for award without competition. A set-aside award is a proposed 
contract with competition limited to small businesses. This means small businesses do not have to 
compete against large businesses that may have an industry advantage. 
The goals of these contracts and certification programs are that the federal government receives the 
needed services for the benefit of taxpayers and also helps diversify the economy by supporting small 
business. In looking ahead to how courts are weighing in on the aspect of social disadvantage, we 
anticipate effects to several of SBA’s certification programs like the 8(a) program. A review of SBA’s 
process for determining eligibility will be planned in the future. The agency continues to address the 
challenges in providing effective business development assistance, as well as measuring and reporting 
the outcomes of the program. 
Issue: SBA Continues to Address Its Ability to Develop Firms in the 
8(a) Program and Measure Results 
SBA has historically emphasized business development to enhance the 
ability of 8(a) firms to better compete for federal contracts. SBA offers 
individualized development assistance to program participants and 
also makes referrals to its resource partners, Small Business 
Development Centers, a volunteer mentor network composed of 
retired executives and entrepreneurs, Women’s Business Centers, 
Veterans Business Outreach Centers, and affiliate Apex Accelerators (formerly known as Procurement 
Technical Assistance Centers). 
Despite this, SBA has not fully established an information technology system to perform regular 
performance monitoring and reporting for 8(a) participants to ensure progress within their business 
plans. Without an effective IT system to monitor 8(a) participant progress in meeting individualized 
business development goals, SBA may not be able to consistently determine if 8(a) participants have 
demonstrated the ability to compete in the open marketplace without program assistance. 

36 
SBA has not finalized next steps for IT development that would facilitate tracking, measuring, and 
monitoring individual business progress. To bridge the gap in the interim, SBA in FY 2020 revised the 
Business Opportunity Specialist Annual Review Workbook. The specialist uses this Excel workbook for 
each firm during annual reviews to evaluate business development, competitive business mix of 8(a) and 
non-8(a) revenue, and financial condition. The specialist also reviews other business proficiencies, such 
as marketing and government contracting goals. 
SBA’s IT challenge is not the sole reason the 8(a) program has not improved in measuring the 
development of firms over the years. In our report SBA’s Business Development Assistance to 8(a) 
Program Participants (Report 22-08), we found SBA’s processes did not consistently allow for SBA or 
stakeholders to determine whether firms met their individual goals to successfully complete the 9-year 
program. 
SBA did not ensure specialists regularly monitored a participant’s business goals, assessed business 
development needs, and followed up with actions for training and accountability. We found that 15 of 
the 40 firms tested did not have approved business plans with identified goals, making them ineligible to 
receive 8(a) contracts. We questioned $93 million in 8(a) set-aside or sole-source contracts that four of 
the firms were awarded. 
SBA also did not establish performance measures at the program level to know whether the 8(a) 
program was successful as an SBA program. There are no relevant performance metrics to gauge the 
outcomes of the program or to know the effects the program is having on small businesses. 
Without consistent procedures, there is no assurance that participants received the business 
development assistance needed for them to become viable competitors in the contracting arena. As a 
result, the agency continues to face challenges on how it can best manage a program that will 
effectively increase the participation of small businesses in the American economy. 
Agency Progress 
Notwithstanding the issues noted above, SBA has made substantial progress to improve its ability to 
develop firms in the 8(a) program and measure results. The agency has completed these things: 
 
 

37 
• Implemented a standard process to ensure initial business plans are monitored and annual 
reviews capture the 8(a) participant’s business plan updates; 
• Issued Procedural Notice 6000-836899 (effective August 2022), which standardized 8(a) 
business processes and required all district offices to ensure that 8(a) firms obtain their 
business plan approval prior to the first contract being awarded; and 
• Mandated the use of the updated Business Opportunity Specialist Annual Review Workbook 
that track development of firms throughout the 9-year program, across all district offices 
when conducting annual reviews. 
Officials added sections for capturing data on a firm’s competencies in marketing, human resources, 
financial condition, sales trends, management experience, and government contracting goals. The 
agency is initiating plans to include a business proficiency matrix in the workbook so the specialist can 
use stated metrics to evaluate a firm’s skill level in each competency and make referrals to resource 
partners or training available through SBA’s 7(j) Management and Technical program, in line with the 
firm’s business development needs. 
The enhancements to the workbook will allow SBA to aggregate and analyze the data to identify trends 
at the 8(a) program level, which will improve SBA’s ability to provide timely and accurate results of 
program measures and outcomes for an annual congressional report. SBA is developing a long-term 
strategic plan that aims to provide all 8(a) certified firms throughout the country with equitable business 
development assistance. When fully implemented, the enhanced processes could help emphasize 
business development rather than solely focusing on eligibility and annual compliance. 
 
 

38 
Challenge 6: Identification of Improper Payments in SBA’s 
7(a) Loan Program Remains a Challenge 
Why This Is a Challenge 
OIG audits and reviews have identified 7(a) loans that were made to ineligible borrowers, given to 
borrowers who did not have the ability to repay, or were not properly closed, resulting in improper 
payments. Improper payments occurred in part because SBA did not adequately review related loans, 
which is why this remains a management challenge this year. 
In FY 2022, the dollar amount of SBA’s 7(a) loan approvals totaled $25.9 billion. Most of these loans 
were made by lenders with delegated approval authority. When a loan goes into default, SBA reviews 
the lender’s actions on the loan to determine if it is appropriate to pay the lender the guaranty, which 
SBA refers to as a guaranty purchase. 
About 9 years ago, OIG established a High-Risk 7(a) Loan Review Program to evaluate lender compliance 
with SBA requirements for high-dollar, early defaulted 7(a) loans. High-dollar, early defaulted loans are 
$500,000 or more and default within the first 18 months of initial disbursement. The 7(a) loan program 
has been the agency’s largest financing program for general business needs, so it is vital that SBA 
identify and reduce the risk of improper payments to meet its objectives for the program. 
Issue: Improvements Needed to Ensure High-Risk 7(a) Loan Reviews 
Reduce the Risk of Losses 
Between 2014 and 2019, OIG conducted risk-based reviews of 7(a) 
loans and recommended recoveries on 17 loans totaling more than 
$19.3 million. In addition, we identified suspicious activity on five 
loans totaling nearly $4 million, which were ultimately referred to our 
Investigations Division. Although SBA completed purchase and quality 
control reviews on all the loans, the agency did not identify or fully 
address the material deficiencies noted in the OIG review. 
The OIG High-Risk 7(a) Loan Review Program used an internal scoring system to prioritize loans for 
review by level of risk. This evaluation included a review of high-risk loans purchased by SBA to 
determine whether lenders complied with SBA requirements and identified suspicious activity. 
Our reviews of high-risk loans have consistently identified issues regarding eligibility, repayment ability, 
size standards, franchise agreements, business valuations, appraisals, equity injection, and debt 

39 
refinance. Our review program also has helped us identify concerns with change of ownership 
transactions and SBA’s identification of improper payments. 
In May 2023, we reported that SBA did not demonstrate improvements to payment integrity for 7(a) 
loan guaranty purchases as the improper payment estimate increased between FYs 2021 and 2022, as 
detailed in the Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the Payment 
Integrity Information Act of 2019 (Report 23-07). 
Agency Progress 
Despite the issues identified in the May 2023 report, we noted that SBA has made progress in 
addressing the identification of improper payments in the 7(a) program since FY 2020, including: 
• Allowing loan specialists more time to review complex early defaulted loans; 
• Improving its review of loans; 
• Training loan specialists and updating the loan review checklist; 
• Providing regular feedback to loan center management and staff regarding improper 
payments, root causes, and corrective actions; 
• Internally evaluating its purchase process and quality control reviews for 7(a) guaranteed 
loans to determine why the loan center reviews did not identify or correct lenders’ 
noncompliance with SBA requirements; 
• Conducting a training session at the loan center focused on the requirements and SBA review 
of documentation related to the source of funds used for equity injection; and 
• Providing training at lender conferences on the most common root causes of the improper 
payments. 
SBA revised and issued SOP 50 57 3, 7(a) Loan Servicing and Liquidation Standard Operating Procedure, 
in August 2023. SBA will provide training to staff and lenders on the new SOP. 
We continue to communicate with the agency about previous recommendations for recoveries as part 
of the audit follow-up process. We will monitor risks in this area and conduct audits and reviews as 
necessary. 
 
 

40 
Challenge 7: SBA’s Disaster Assistance Program Must 
Balance Competing Priorities to Deliver Prompt Assistance 
but Prevent Fraud 
Why This Is a Challenge 
SBA contributes to disaster recovery by providing long-term, low-interest loans to affected 
homeowners, renters, businesses of all sizes, and nonprofits. SBA must continually balance the priority 
of quickly assisting survivors in the immediate aftermath of a disaster with the need to mitigate fraud 
risk and ensure program integrity. To do so, the agency faces challenges in staffing, quality assurance, 
and increased loan servicing requirements. 
Issue: Reserve Staff Need Training to Sustain Productivity During 
Mobilization 
The magnitude of the pandemic relief demand (27.7 million applications 
received as of December 31, 2021) required SBA to rapidly increase and 
train staff; staffing numbers rose to historic levels. The number of 
personnel needed to serve during the pandemic was almost twice the 
previous record high staff total. In addition, the agency had to develop 
the needed training to address the new criteria for COVID-19 EIDLs. 
Effective July 3, 2022, the agency reorganized its Office of Disaster Assistance. SBA moved the entire 
disaster lending program from the Office of Disaster Assistance to the Office of Capital Access. The 
Office of Disaster Recovery and Resilience manages the agency’s non-lending aspects of the disaster 
program (such as the immediate response group). 
SBA’s Office of Disaster Assistance increased its trained staff from 800 to more than 5,000 employees in 
December 2017 to respond to hurricanes Harvey, Irma, and Maria. In response to the COVID-19 
pandemic, the Office of Disaster Assistance increased its permanent and temporary staff size from 
about 1,200 at the onset of the pandemic to more than 11,500 by December 2020. In those 9 months, 
the staff was increased nearly 10 times. 
Agency Progress 
SBA management made good progress on this long-term issue during the pandemic. SBA implemented a 
cross-functional training plan, as well as online and automated tutorials, a change that resulted from a 

41 
previous report. The COVID-19 pandemic required SBA to train and mobilize the largest number of new 
employees ever in its history. 
Bringing on a large temporary staff in response to a major natural disaster will always be a challenge for 
any organization, including SBA. However, during the past couple of years, SBA was able to increase its 
staff by almost tenfold to provide COVID-19 pandemic financial assistance. The new disaster assistance 
employees expanded the pool of reserve staff that can be activated for future disasters. The lessons 
learned from this surge inform the agency’s current hiring and training practices; therefore, this issue 
has achieved a rating of yellow. 
Although the agency has now achieved a rating of yellow, the Office of Capital Access is urged to keep 
monitoring the need to revise and update its plan for rapid staff surge and the associated need to 
update its training. This is needed to ensure a high level of customer service with reduced applicant 
processing times, and to ensure eligible applicants receive the federal assistance they need in a timely 
manner. The strain of the pandemic response effort made these concerns more evident. This is 
significant because SBA is developing a new computer system to process disaster loan applications. SBA 
is currently running a test of its Unified Lending Platform, with full implementation planned to roll out in 
late 2023. 
Issue: Improper Payment Quality Assurance Process Needs 
Strengthening 
SBA received a historic number of loan applications during FY 2020 
through FY 2022 when COVID-19 relief programs were established. 
SBA tests a statistical sample of these loans for improper payments. 
Because the total of the number of loans that have been approved and 
disbursed is so large, the statistical sample also is large, which has 
highlighted issues in SBA’s improper payment process. As a result, providing an accurate estimate of the 
improper payment poses a significant challenge to the disaster program. 
An improper payment is any federal government payment made to an ineligible recipient or for an 
ineligible good or service, duplicate payment, or payment for goods or services not received (except for 
such payment authorized by law). While not every improper payment is fraudulent; every fraud is an 
improper payment. This highlights the need to ensure internal controls result in eligible recipients 
gaining access to programs. 
In our Audit of the Office of Disaster Assistance Improper Payment Appeal Process (Report 20-07), we 
found the improper payments appeal process effectively assessed improper payments, but the initial 
review process was inefficient. 

42 
Our Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the Payment Integrity 
Information Act of 2019 (Report 23-07) found the sampling and estimation methodology plans were not 
statistically acceptable for SBA disaster assistance loans, COVID-19 Economic Injury Disaster Loans, and 
Economic Injury Disaster Loan Targeted advanced programs and activities. The population of outlays 
reported in the agency financial report were not reconciled to the general ledger and were not 
complete. Consequently, certain transactions were omitted from the population and excluded from 
SBA’s review procedures. As a result, these programs and activities did not comply with the requirement 
of the Payment Integrity Information Act of 2019 to publish improper and unknown payment rates of 
less than 10 percent. 
The Payment Integrity Information Act of 2019 requires agencies to publish improper payments 
information within an agency financial report or performance accountability report for each fiscal year. 
To be in compliance with the act, SBA must report an estimated gross improper payment rate of less 
than 10 percent for each program. 
Agency Progress 
While SBA had previously made significant progress to improve the quality assurance process, the 
results of our report regarding SBA’s compliance with the Payment Integrity Information Act for FY 2022 
indicate that issues continue to exist in the improper payment estimation process. To address the 
findings of that report, SBA entered into a contract with an independent statistician in December 2022, 
who has: 
• Developed a statistically valid sampling and estimation plan. The plan for FY 2023 has been 
developed with sufficient documentation to support the methodology identified in the plan. 
• Performed monthly reconcilements of the agency’s outlays for the disaster assistance loan 
program. The contractor will continue to perform monthly reconcilements for the upcoming 
fiscal year. This action has been completed for FY 2023 and is ongoing for FY 2024. 
• Developed a statistically valid sample of outlays in the disaster assistance loan program. This 
action has been completed for FY 2023 and is ongoing for FY 2024. 
• Plans to develop statistical estimates of improper and unknown payment rates. This action 
will be completed to report rate estimates in the agency’s annual financial report, as of 
September 2023. 
Overall, while SBA has stated that it took actions to address our recent findings, it is too early to assess 
the agency’s progress. OIG will perform its annual audit of the agency’s compliance with the Payment 
Integrity Information Act for FY 2023. We will assess, at that time, whether the actions taken above 
addressed our concerns. At this time, we consider the agency to have made limited progress. 

43 
Challenge 8: SBA Needs Robust Grants Management 
Oversight 
Why This Is a Challenge 
In FY 2021, pandemic relief legislation authorized new, multibillion-dollar grant programs in addition to 
SBA’s existing entrepreneurial development grant program portfolio. Congress authorized $45.3 billion 
for SBA to administer as grants to provide economic relief and technical assistance, nearly doubling 
SBA’s existing technical assistance programs. This remains a challenge because SBA must ensure more 
than 111,000 grant recipients used the funds appropriately and measure the performance results of the 
pandemic grant programs. SBA administers grants to organizations that aid in counseling and training 
small business owners and emerging entrepreneurs. These entrepreneurial development programs are 
part of SBA’s core mission to support and grow small businesses. 
Because of the government-wide emphasis on grants management reform, it is SBA’s responsibility to 
maximize the value of its grant funding to ensure its programs accomplish program objectives. In recent 
OIG audits, we have found ineffective oversight of grant recipients and systemic issues with the accuracy 
of SBA grant data in both financial and performance reporting. 
Issue: SBA’s Grants Management System Needs Improvement 
Previous OIG reports have found SBA used an inefficient and error-
prone system to manage its grant awards. The grant management 
system SBA used to award, monitor, and report on technical 
assistance programs required substantial manual data entry, which 
can lead to input errors. 
Data inaccuracies inhibit the ability to effectively track federal spending. Errors also affect the agency’s 
ability to report complete and accurate information on time, as required by the Digital Accountability 
and Transparency Act of 2014. Our advisory memorandum Improvement Needed in the Accuracy of SBA 
Data Reported on USASpending.gov (Report 18-15) detailed material weaknesses identified by an 
independent accounting firm in SBA’s controls over the accuracy of grant award data reported on 
USASpending.gov. 
Immediately after our alert was issued, program officials requested a review of the internal controls of 
the grant management process to assess and verify OIG’s findings. SBA’s internal auditors found that all 
45 of the sampled awards included inaccuracies and deficiencies. 

44 
The grant management system was not completely integrated with SBA’s financial system and required 
additional manual entry to obligate funds and authorize payments to grant recipients. Without a fully 
integrated system, the agency must continue manual and burdensome processes to manage compliance 
requirements. Manual workarounds were the main cause for the errors in the data reported on 
USASpending.gov. Reliable data in a grants management system ensures the federal funds are awarded 
to eligible recipients, disbursements are accurate, and that management can make informed decisions 
to effectively administer programs. 
Agency Progress 
SBA has made substantial progress in modernizing its grants management system over the last 5 years. 
It entered into an interagency agreement in 2019 with the U.S. Department of Health and Human 
Services for transition analysis, infrastructure setup, and training services to launch GrantSolutions.gov. 
SBA spent $2.5 million to implement the system to help the agency do these things: 
• Improve funding management, award of grants, and process payments and closeouts; 
• Enhance ability to develop accurate performance metrics reporting; 
• Reduce compliance violations; and 
• Increase auditability, accountability, and transparency. 
The SBA Office of Grants Management implemented the GrantSolutions system for program office use, 
providing training to program officials on how to use the system during FY 2023. The office also works 
with each program office to identify program-specific system customizations that ensure the agency 
complies with federal and SBA policies. 
As of FY 2023, the GrantSolutions management system is used by all grant making program offices, 
excluding those offices issuing pandemic related grants. The Shuttered Venue Operators Grant (SVOG) 
program opted to use a contracted customer relationship management system to manage its grants. 
The Restaurant Revitalization Fund (RRF) program developed its own application portal that interfaced 
with the SBA Office of Capital Access’s systems to manage the application intake, processing, and award 
approvals. Both the SVOG and RRF programs were integrated into SBA’s Joint Administrative Accounting 
Management System. 
Since 2020, SBA has been working to integrate the SBA’s Joint Administrative Accounting Management 
System with GrantSolutions.gov. Until the agency integrates the financial interface, program offices are 
still required to use the grant management system that they used prior to GrantSolutions, which was 
also not completely integrated with SBA’s financial system. It requires manual entry to obligate funds 
and authorize payments to grant recipients. While SBA continues to have to work around the 

45 
limitations, grants management officials perform monthly data quality assessments of the manually 
input data, reporting deficiencies. 
Issue: Better Performance Measurements Needed to Monitor Grant 
Program Achievements 
Our management alert on Serious Concerns About SBA’s Control 
Environment and the Tracking of Performance Results in the Shuttered 
Venue Operators Grant Program (Report 21-13) found SBA did not 
establish performance goals and measurements for the grant 
recipients before disbursing $14.6 billion in SVOG funds. 
After our management alert, SBA created a logic model in March 2021. The model helped identify 
outputs and outcomes to assess whether the program successfully aided small businesses in the live arts 
and entertainment industry. 
We found in our Evaluation of SBA’s Award Procedures for the CARES Act Entrepreneurial Development 
Cooperative Agreements (Report 21-11) that the agency did not establish clearly defined goals with 
targets for the award recipients. Because of this, SBA cannot effectively measure and accurately report 
performance results to assess whether the award recipient’s performance met objectives, ensuring the 
pandemic relief programs were effective. 
Federal regulations require awards to include performance goals. The agency must provide a standard 
to effectively measure grantee performance, such as the estimated number of jobs saved or created, tax 
revenue generated, or entity operational status. 
GAO reported similar concerns about how SBA took limited steps in enforcing RRF reporting. Thirty-two 
percent of RRF recipients have not yet reported how they used their funds for 2021 (GAO-22-105442). 
Our audit report on SBA’s Oversight of Restaurant Revitalization Fund Recipients (Report 23-15) found 
that as of June 2023, 20 percent of all recipients, with awards totaling $3.5 billion, had not yet filed the 
required report. 
Program officials did establish performance goals and indicators for the supplemental CARES Act funds 
provided to Small Business Development Centers, Women’s Business Centers, and the Resource Partner 
Training Portal, but SBA should have clearly defined the goals and set targets to more effectively ensure 
they were achieved as intended. 
We first identified oversight of grant program performance as a top management challenge in FY 2019. 
To address these weaknesses, SBA updated its grant management policies and procedures. The agency 
required grant officers to enforce performance requirements and verify reported information as well as 

46 
to ensure applicants’ proposals include plans to measure performance in a way that will help SBA 
achieve program goals. 
The SBA Office of Entrepreneurial Development had until September 2020 to fully adopt the updated 
policies, which are not reflected in the CARES Act entrepreneurial development grants. Without clearly 
defined performance goals and targets, SBA cannot effectively measure and accurately report 
performance results. Our evaluation SBA's Oversight of the Grant Recipient's Implementation of the 
CARES Act Resource Partners Training Portal (Report 22-07) found that SBA and its grant recipient that 
implemented the Resource Partner Training Portal, an initiative authorized under the CARES Act, did not 
set targets for performance goals to assess whether the portal met the intended purpose. We reported 
the portal did not serve as a major source for COVID-19 information. SBA awarded the grant recipient 
$18.6 million and less than 1 percent of 30 million eligible small businesses used the portal within the 
first year of the pandemic. Only about 62 resource partner counselors and mentors out of 
approximately 13,000 completed any of the training modules. 
Without performance targets, program officials could not hold the Resource Partner Training Portal 
grant recipient accountable for ensuring the information hub served as a major source of COVID-19 
related resources for small businesses and a training portal for resource partner counselors and 
mentors. 
Agency Progress 
SBA has made substantial progress in establishing performance measures for its grant programs. In FY 
2022, the SBA Office of Grants Management collaborated with all of SBA’s grants-making program 
offices to oversee an overall approach for implementing effective performance monitoring. 
The SBA Office of Entrepreneurial Development applied lessons learned from our Evaluation of SBA’s 
Award Procedures for the Coronavirus Aid, Relief, and Economic Security Act Entrepreneurial 
Development Cooperative Agreements (Report 21-11). The office established a variety of output and 
outcome-focused measures for the Community Navigator pilot program, authorized by the American 
Rescue Plan Act of 2021. 
In the announcement for the program, SBA required grant applicants to establish realistic targets for the 
goals to measure achievements during grant performance. The Office of Entrepreneurial Development 
enforced its procedures by requiring clearly defined performance goals. The office included 
performance targets in all future Small Business Development Centers and Women’s Business Centers 
cooperative agreements to objectively measure performance results. 
In June 2021, SVOG program officials finalized a program evaluation framework. This framework 
examined venue survival and other outcomes across industry, geographic location, and business owner 

47 
demographics. Additionally, program officials implemented SVOG performance metrics, such as revenue 
dollars earned, a shuttered entity’s capacity to continue operation, and planned versus actual 
expenditures. This information will be collected as part of the close-out process. 
SVOG program officials developed a customer experience and award outcomes survey. As of June 5, 
2023, nearly 9,000 award recipients have received invitations to complete the survey. SBA expects a 
final report of the survey results and program evaluation by the end of FY 2024. 
Issue: Comprehensive Oversight Plan with Strong Controls Will Help 
SBA Better Assess Risk, Distribute Payments, and Audit the 
Shuttered Venue Operators Grant and Restaurant Revitalization 
Fund 
In our management alert on Serious Concerns About SBA’s Control 
Environment and the Tracking of Performance Results in the Shuttered 
Venue Operators Grant Program (Report 21-13), we alerted 
management to concerns about SBA’s initial plans for assessing 
applicant risk and setting payment disbursements. 
Since the majority of SVOG grant awards were under a certain dollar threshold, they were categorized 
as low risk. These awards were disbursed in lump sum payments with minimal financial reporting 
requirements and expectations for post-award accountability. 
SBA reported that as of July 5, 2022, the agency completed processing applications for the SVOG 
program. In total, SBA awarded $14.6 billion to 13,011 grant recipients, of which 9,800 received 
supplemental awards. 
The Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act of 2020 required SBA to 
submit the policies and procedures used to conduct oversight and audits of the grants to Congress. It 
also required measurement standards to determine which grants should undergo an audit. The SBA 
Office of Disaster Recovery and Resilience based its audit plan for this program on the risk level 
established for the payment distributions and financial reporting requirements for the grant recipients. 
All grant recipients who received $10 million, which is the maximum amount for any single award, were 
going to be audited. It is likely a minimal number of recipients will be subject to an audit. The office’s 
initial audit plan exposed the $16.25 billion grant program to potential misuse of funds because the bulk 
of grant funds will not be subject to a reasonable degree of scrutiny. SBA has finalized its oversight plan 
to include monitoring, audit, and closeout strategies that address the agency’s obligation to uphold 
federal grant regulations and other applicable requirements. 

48 
In our inspection SBA’s Award and Payment Practices in the Shuttered Venue Operators Grant Program 
(Report 22-15), we reported that even after determining multiple disbursements would better protect 
grant funds from fraud or misuse, SBA switched to a riskier single advance payment for all grantees. This 
lump sum payment method may have hastened award disbursement, but multiple disbursements are a 
better way to protect taxpayer funds. Multiple disbursements enable program officials to verify that 
grant recipients used initial award funds for allowable activities, before then disbursing the remaining 
award. Because SBA made this change, program officials will not be able to monitor grantees’ use of the 
proceeds until the end of the award, when closing out the grant, after all the funds have been disbursed. 
Some of the issues we identified in SVOG were also identified in the Restaurant Revitalization Fund 
program. In FY 2022, GAO reported that SBA had emphasized putting pre-award controls in place to 
manage risk but identified weaknesses in the design and operation of the internal controls (GAO-22-
105442). As a result, the agency did not effectively prevent systemic control weaknesses throughout the 
award process. 
Our inspection SBA’s Administrative Process to Address Potentially Fraudulent Restaurant Revitalization 
Fund Awards (Report 23-10) found SBA designed the RRF application validation and approval processes 
using the GAO’s A Framework for Managing Fraud Risks in Federal Programs. However, 3,790 
applications submitted through a point-of-sale partner were processed without verifying gross sales, a 
key control designed to prevent ineligible entities from receiving awards. 
In our recent audit of SBA’s Oversight of Restaurant Revitalization Fund Recipients (Report 23-15), OIG 
identified issues with SBA’s post-award process for the RRF program. The Office of Capital Access 
developed a post award report process to monitor the use of funds by awardees. All RRF awardees are 
expected to submit a post-award report to SBA itemizing the use of funds. 
SBA is also performing a manual audit of approximately 10 percent of the 10,000 awards to confirm 
eligibility, award calculation, and use of funds. Although SBA developed a plan for monitoring and 
auditing RRF recipients, program officials did not implement the process as planned. 
OIG found program officials did not obtain sufficient information to monitor the RRF program to ensure 
funds were used as intended. RRF recipients were required to submit their final use of funds report to 
SBA by April 30, 2023. As of June 2023, 20 percent of all recipients, with awards totaling $3.5 billion, had 
not yet filed the required report. 
In addition, program officials selected 10 percent of the awards to review; however, they did not select 
all awards considered to be potentially fraudulent or ineligible, as originally planned. We identified 210 
awards with indicators of potential fraud or ineligibility were not included in SBA’s sample selection 

49 
plan. We also found program officials did not implement procedures for recipients to return unused or 
improperly awarded funds to Treasury. 
Agency Progress 
SBA has made progress in its oversight of the SVOG and RRF programs. For the SVOG program, agency 
officials accomplished these things: 
• Finalized a revised oversight plan and established procedures to monitor, audit, and close out 
awards; 
• Drafted standard operating procedures to identify and recover improper payments; 
• Modified the SVOG budget form to include constraints on budget submissions for certain 
cost categories to help recipients comply with program requirements; 
• Contracted with a firm to help develop the strategy and oversight plan; 
• Trained staff and SVOG grant recipients on audit and grant management policies and 
procedures; and 
• Established a plan to audit a statistically significant sample of low, moderate, and high-risk 
level SVOG recipients. 
For the RRF program, agency officials accomplished these things: 
• Approved the RRF Award Recovery Plan in May 2023, which detailed the process for 
notifying awardees when funds must be returned; 
• Developed an outreach strategy to notify awardees who did not file the final financial report 
to comply or return funds. SBA alerted awardees through all known contact information. 
• Initiated plans with the RRF platform developers to identify the most efficient way to 
implement the plan and begin notifying awardees of the intent to recover funds. 
Issue: Leveraging SBA’s Workforce to Ensure Effective 
Administration of New and Significantly Expanded Grant Programs 
to Aid Small Businesses 
SBA will need to leverage and maintain a skilled workforce to meet 
the demands of ongoing grant management and administration of 
awards. SBA did not have enough staff to handle the new and 
significantly expanded grant programs to aid and assist small 
businesses during the pandemic. When SBA began implementing the 

50 
SVOG program, it had only one official and a few temporary staff to start the program. Once 
implemented, SBA had to onboard and train a substantial workforce to review and approve applications. 
SBA awarded 13,011 grants, totaling $14.6 billion. With more than 13,000 grants to service through 
monitoring, audit, and closeout. 
To oversee the RRF program, SBA selected 10,050 RRF recipients, or 10 percent, to manually verify that 
awarded funds were used for allowable costs. In our audit SBA’s Oversight of Restaurant Revitalization 
Fund Recipients (Report 23-15), we found that SBA was not on track to review awards in a prompt 
manner. We identified imbalances in the number of personnel assigned to review a single award, 
leading to an inefficient review process that will need to be addressed in the near term. The agency 
assigned a team of 22 reviewers and 6 approvers to complete the 10,050 reviews. As of August 2023, 
program officials have completed over 1,400 reviews. At this rate of review, we estimate it will take 
nearly 5 years to complete the remaining reviews, which raises concerns because the reviews would 
extend beyond the required timeframe for retaining award records. 
Agency Progress 
SBA had made the following progress on ensuring the SVOG had staff to support grant monitoring 
activities in FY 2023: 
• SVOG realigned its workforce to better use the workforce strengths and skills and provided 
opportunities for staff members to participate in cross-functional training and knowledge 
sharing. 
• Program officials trained staff on oversight procedures now that it has transitioned to 
monitoring the 13,011 shuttered venue grants. 
• The agency detailed a grants management specialist to provide strategic guidance on all 
monitoring, auditing, and closeout activities. 
For the RRF program, SBA made the following progress: 
• SBA increased the staff assigned to conduct the 10,050 planned post-award reviews. 
• SBA plans to maintain current staffing levels of 40 employees to complete post-award 
reviews through Q1 FY25. 
• As of August 2023, SBA completed over 1,400 or 14 percent of the planned post-award 
reviews.

File and source

File

24-01-tmpc-fy2024.pdf

Size

996,998 bytes

SHA-256

95a85c581db835ef0cbc95a44367065fb1de7411867389021845b3ff1ed5f56d

Our copy

24-01-tmpc-fy2024.pdf

Original

www.oversight.gov