Top Management and Performance Challenges report (FY 2026) - SBA Office of Inspector General — pandemic lending oversight (2025-12-18)

Record facts

Full text

2026 Top Management and Performance Challenges | 1 
U.S. Small Business Administration 
Office of Inspector General 
Top Management and 
Performance Challenges 
Facing the Small Business Administration 
in Fiscal Year 2026 
Report 26-01 | December 18, 2025

Contents 
Message From the Deputy Inspector General .............................................................................. iii 
Introduction ................................................................................................................................ iv 
Table 1: Top Management and Performance Challenges Facing SBA in Fiscal Year 2026..........iv 
Challenge 1:Protecting the Integrity of SBA Programs ...................................................................1 
Managing Fraud Risk .................................................................................................................. 1 
Improving Verification of Eligibility............................................................................................. 3 
Mitigating Improper Payments................................................................................................... 5 
Seizure and Return of Funds....................................................................................................... 7 
Challenge 2: Managing SBA’s Loan Portfolio and Participating Lenders .........................................9 
Servicing Disaster Loans ............................................................................................................. 9 
Figure 1: The Increased Burden of COVID-19 EIDL Servicing on SBA............................ 10 
Planning and Modeling for Future Disaster Responses ............................................................ 10 
Figure 2: Total Dollar Amount of Approved Disaster Loans.......................................... 11 
Overseeing Lenders .................................................................................................................. 12 
Ensuring Retention of Loan and Award Records .......................................................... 13 
Challenge 3: Measuring Performance and Monitoring SBA Programs..........................................16 
Measuring Program Performance ............................................................................................ 16 
Monitoring Program Performance Results............................................................................... 16 
Ensuring Funds Are Used as Intended ...................................................................................... 17 
Challenge 4: Financial Reporting and Managing Data ..................................................................20 
Improving Internal Controls Through Financial Statements Audit Remediation ...................... 20 
Figure 3: SBA Audit Deficiencies From Pre-Pandemic Through Pandemic Recovery ... 21 
Authorized Data Sharing........................................................................................................... 22 
Challenge 5: Managing Risks in Information Technology Systems................................................25 
Figure 4: Risk Management Best Practices Strategy..................................................... 25 
Improving Information Technology Systems Management ..................................................... 25 
Preparing for Artificial Intelligence Challenges......................................................................... 26 
Deploying and Monitoring New Third-Party Systems............................................................... 28 
Cybersecurity and Modernization ............................................................................................ 28 
Make a Difference ......................................................................................................................30 
2026 Top Management and Performance Challenges | i 

NOTICE: 
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Public Law 
117-263, Section 5274, any nongovernmental organizations and business entities identified in this 
report have the opportunity to submit a written response for the purpose of clarifying or providing 
additional context as it relates to any specific reference contained herein. Comments must be 
submitted to AIGA@sba.gov within 30 days of the final report issuance date. We request that any 
comments be no longer than two pages, Section 508 compliant, and free from any proprietary or 
otherwise sensitive information. The comments may be appended to this report and posted on our 
public website. 
2026 Top Management and Performance Challenges | ii 

Message From the 
Deputy Inspector General 
Each year, in accordance with the Reports Consolidation Act of 2000, the 
U.S. Small Business Administration (SBA) Office of Inspector General (OIG) 
provides a vital assessment of the agency’s top management and performance 
challenges. It is our statutory responsibility to detect and deter fraud, waste, 
abuse, and mismanagement in agency programs and services. 
While the immediate economic crisis of the Coronavirus 2019 pandemic is 
behind us, the vulnerabilities it exposed are not. These persistent challenges 
— including improper payments, ensuring program eligibility, and 
strengthening internal controls — are not relics of the past. They are systemic 
issues that continue to challenge SBA's flagship capital, contracting, 
counseling, and disaster assistance programs. Our work remains focused on 
how these risks persist and how we can best support the agency in mitigating 
them for the future. 
OIG has conducted a significant body of work to inform this assessment. Our 
audits have explored critical areas, such as the effective use of technology and 
the alignment of technology with the comprehensive review of eligibility criteria, which are essential 
safeguards against fraud and abuse. We are actively engaged with our strategic partners to further use the 
U.S. Department of the Treasury’s Do Not Pay system and other measures to identify and eliminate improper 
payments. As SBA pursues new priorities, such as an increased focus on manufacturing loans, we are 
committed to providing independent and objective oversight of these and other critical SBA programs to 
promote effective and efficient implementation. 
We recognize that SBA has undergone significant changes in its operations, including organizational 
restructuring and workforce reductions. Our continuing oversight will consider the effects of these changes on 
program operations within our prioritized work. Our partnership with SBA is vital to our shared goal of 
protecting the integrity of the agency’s programs. We acknowledge SBA’s continued commitment to being 
responsive to our recommended corrective actions. 
The nation can depend on OIG to continue to leverage our strategic partnerships and risk-based approaches to 
identify and address the most serious challenges facing SBA. Our ultimate goal is to improve the integrity, 
accountability, and performance of the agency's programs, ensuring they operate as effectively as possible for 
the American people and are free from fraud, waste, and abuse. 
  
Sheldon Shoemaker 
Deputy Inspector General 
2026 Top Management and Performance Challenges | iii 
U.S. Small Business Administration | Office of Inspector General 

Introduction 
The Top Management and Performance Challenges Facing the Small Business Administration (SBA) in 
Fiscal Year (FY) 2026 is an important tool to help the agency prioritize its work to improve program 
performance and enhance operations. OIG remains committed to protecting the interests of 
American taxpayers by promoting positive change within SBA and across government, ensuring 
taxpayer dollars are spent efficiently according to intent. 
Identification of an issue as a top challenge does not necessarily denote significant deficiencies or 
lack of attention on SBA’s part. Many of the challenges are longstanding, inherently difficult, and will 
likely continue to be challenges in the coming years. Addressing the challenges will require consistent 
attention from agency management and ongoing engagement with Congress, the public, and other 
stakeholders. We continue to collaborate with SBA program officials in identifying and mitigating the 
top challenges and associated issues facing the agency. 
Table 1: Top Management and Performance Challenges 
Facing SBA in Fiscal Year 2026 
Challenge 
Issues 
Challenge 1 
Protecting the Integrity of SBA Programs 
Managing Fraud Risk 
Improving Verification of Eligibility 
Mitigating Improper Payments 
Seizure and Return of Funds 
Challenge 2 
Managing SBA’s Loan Portfolio and 
Participating Lenders 
Servicing Disaster Loans 
Planning and Modeling for Future Disaster Responses 
Overseeing Lenders 
Challenge 3 
Measuring Performance and Monitoring 
SBA Programs 
Measuring Program Performance 
Monitoring Program Performance Results 
Ensuring Funds Are Used as Intended 
Challenge 4 
Financial Reporting and Managing Data 
Improving Internal Controls Through Financial Statements 
Audit Remediation 
Authorized Data Sharing 
2026 Top Management and Performance Challenges | iv 
U.S. Small Business Administration | Office of Inspector General 

Challenge 5 
Managing Risks in Information 
Technology Systems 
Improving Information Technology Systems Management 
Preparing for Artificial Intelligence Challenges 
Deploying and Monitoring New Third-Party Systems 
Cybersecurity and Modernization 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | v 

Challenge 1:Protecting the 
Integrity of SBA Programs 
The SBA provides loan guaranties, direct disaster assistance loans, government contracting 
certifications, and business development programs to qualifying small business owners, 
entrepreneurs, and those recovering from a declared disaster. SBA’s challenge is to fulfill its mission 
of quickly delivering services and capital while also protecting the integrity of its programs. A strong 
internal control environment will help mitigate this challenge. Agency leaders have implemented new 
verification measures to ensure only eligible Americans benefit from SBA programs.A We will 
continue to provide oversight as the agency moves forward with fraud protection efforts. 
Managing Fraud Risk 
SBA’s four pandemic relief programs delivered 22.1 million loans and grants to help eligible small 
business owners and entrepreneurs. SBA used limited front-end fraud detection internal controls 
when it initially distributed the $1.2 trillion.1 The agency was following legislative requirements 
intended to expedite aid to small business owners adversely affected by the pandemic. 
The challenge of managing fraud risk continues as SBA conducts post-payment automated and 
manual reviews of Paycheck Protection Program (PPP) loans. Post-payment reviews are when loans 
are examined for eligibility after the funds have already been paid to the borrower and forgiven. PPP 
borrowers can continue to apply for forgiveness for up to 5 years from the issuance of the loan, so 
through 2026. The statutes of limitations for fraud in the PPP and Coronavirus 2019 (COVID-19) 
Economic Injury Disaster Loan (EIDL) program were extended from 5 years to 10. In most cases, the 
U.S. government will have until 2032 to prosecute wrongdoers and return misused and fraudulently 
obtained funds to taxpayers. 
In a recent management advisory, we reported how SBA presumed that post-payment reviews of PPP 
loans would offset the risks of eliminating key up-front internal controls.2 SBA started flagging these 
loans for review in July 2021; however, as of May 2024, SBA had not completed reviewing 37,938 
loans totaling about $4.6 billion. According to the agency, these reviews are ongoing and will 
continue as resources allow. SBA is drafting a recovery plan for any loans deemed ineligible. For loans 
suspected of fraud, SBA did provide information to lenders on how to refer PPP loans, but the agency 
did not always keep record and review the referrals. 
A SBA, News Release 25-42, “SBA Highlights Range of New Measures to Stop Fraud” (April 10, 2025). 
2026 Top Management and Performance Challenges | 1 

The federal government does have a front-end fraud 
detection system in place. The U.S. Department of the 
Treasury’s Do Not Pay system is available to help verify 
applicant eligibility for loans or grants before they are 
issued. The Do Not Pay system is a series of databases 
designed to prevent and detect improper payments to 
those not eligible for government funds because of past 
fraudulent activity or other high-risk factors. SBA 
eventually started using the Do Not Pay system for its 
pandemic assistance programs. The agency is in the 
process of adding additional front-end verification checks 
that include Do Not Pay for disaster assistance, 7(a), and 
504 program loans. 
We also found SBA performed limited oversight of non-
bank lenders and lender service providers even though the 
agency had processes in place. After the non-bank lenders 
and service providers were approved to become PPP 
lenders, SBA could have better assessed the risk of 
allowing them to continue to operate in the program. We 
found that non-bank lenders made $14.2 billion in 
suspected fraudulent loans at a rate more than five times 
higher than loans made by traditional bank lenders. We 
also found the rate of suspected fraudulent loans made by 
lenders using service providers was more than three times 
the rate of loans processed by lenders that did not use a 
service provider. For more on this topic see our 
Overseeing Lenders section. 
In 2023, SBA adopted several new changes to its flagship 
7(a) loan program that dramatically reduced underwriting 
standards. Ultimately, these changes increased potential 
risk. Many of these changes were reversed in 2025; 
Example of a Massive 
Scheme to Defraud 
SBA Preferred 
Lenders 
Fourteen defendants were arrested 
in a global criminal network charged 
with conspiracy to defraud the 
government in obtaining over  
$25 million in taxpayer-funded 
federally guaranteed small business 
loans and pandemic relief funds over 
a period of 7 years. 
One ringleader allegedly defrauded 
numerous banks and the SBA 
Preferred Lender Program, a 
program designed to help small 
businesses that otherwise might not 
obtain financing. 
He allegedly directed sham 
corporations to open bank accounts, 
make false statements, and concoct 
documents to support loan 
applications. He also allegedly 
purchased phony tax returns that 
falsely reported millions in revenue. 
U.S. Attorney’s Office 
Central District of California 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 2 

however, the loans made during that time remain susceptible to increased risk and financial loss.B 
Our investigative work has revealed a pattern of fraud by loan packagers and other fee-based agents 
in the 7(a) loan guaranty program. We found SBA’s loan programs are susceptible to borrower fraud 
from false statements and documentation, misrepresentation of equity injections, and misuse of 
proceeds. These patterns of fraud continue to pose a risk to taxpayer resources due, in part, to SBA 
allowing applicants to attest to their own eligibility (see Improving Verification of Eligibility). 
This past year, the agency has expanded the chief financial officer’s role to include ensuring agency-
wide risk factors are monitored and mitigated. An effective risk management program is sustained by 
implementing corrective actions and strengthening internal controls, ultimately reducing fraud and 
enhancing program integrity for current and future programs. 
Improving Verification of Eligibility 
SBA should obtain evidence to verify an applicant’s compliance with program requirements before 
issuing loans, grants, or conferring certifications. The agency should be able to ensure only eligible 
applicants receive program benefits. One of the biggest challenges in this area is self-certification. 
Self-certification is when a person is allowed to make an official declaration that their business 
complies with standards set for that program without independent evidence. Requiring participants 
to provide supporting documentation could mitigate the risks associated with self-certification. 
We found that SBA allowed self-certification in the Small Business Innovation Research and Small 
Business Technology Transfer programs. Business owners were asked to submit and verify reports, 
sales, and investments documentation, but SBA then did not always review the material.3 
SBA also allowed applicants to the Restaurant Revitalization Fund (RRF) and Shuttered Venue 
Operators Grant (SVOG) pandemic relief grant programs to self-certify their eligibility.4 Applicants 
attested that they qualified by both industry and operational status during the eligibility period. We 
found this self-certification made the programs vulnerable to fraud or misuse. SBA has not made 
progress in resolving multiple audit recommendations for SBA to review billions in grant awards. 
Progress had been delayed as the agency contemplated recovery strategies. SBA plans to recover 
funds for any improper payments made to RRF recipients starting in FY 2026. However, it remains 
that agency managers will only review 10,050 awards, despite OIG identifying over 61,000 awards 
that lacked sufficient support to determine whether the payment was made to an eligible entity. This 
means the agency could miss the opportunity to recoup over $9.5 billion in potentially improper RRF 
payments. 
B SBA, News Release 25-41,“SBA Initiates Actions to Reverse Biden-Era Mismanagement of Core 7(a) Lending Program” 
(March 27, 2025). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 3 

Another area of concern is the verification of eligibility for 
SBA contracting certifications. The U.S. government is the 
largest single purchaser of goods and services in the world, 
awarding over $760 billion in prime contracts annually. 
Congress established SBA contracting certification programs 
to ensure that a fair proportion of federal awards and 
subcontracts are awarded to small businesses. Congress 
intended for these programs to assist small businesses with 
overcoming the complexities of the federal contracting 
system. The programs were intended to help build stronger 
businesses, expanding competition in the marketplace and 
strengthening the overall U.S. economy. 
SBA works to maximize opportunities for small businesses in 
government contracting, but because it relies on self-
certification for a key eligibility requirement, fraudsters can 
take advantage of the programs. 
SBA has seen unscrupulous business owners misrepresent 
themselves to compete for a contract set aside for a 
disadvantaged small business, capitalizing on the smaller pool 
of applicants and taking away the opportunity from an 
eligible and deserving small business. Fraud in these 
contracting certification programs contradicts the intent of 
the congressional mandate to support small business. 
OIG investigators currently have 27 cases involving 
allegations of firms not meeting contracting program 
requirements, including in the 8(a) Business Development, 
Women-Owned Small Business, Service-Disabled Veteran-
Owned Small Business, and Historically Underutilized 
Business Zone (HUBZone) programs. 
In our reviews of the HUBZone and Women-Owned Small 
Business programs, we recommended SBA check each 
business seeking these certifications to ensure they can be 
categorized as “small.”5 SBA decided instead to continue to 
rely on small business owners attesting that they meet these 
requirements. The agency has maintained its position that 
Example of 
Contracting 
Certification Fraud 
A Wisconsin woman who was the 
owner of a Milwaukee HUBZone-
certified construction company pled 
guilty to one count of false 
statements. She falsely certified her 
construction company met HUBZone 
eligibility requirements and complied 
with rules and procedures. She also 
falsely certified that she had no 
affiliate business. She solicited 15 
HUBZone set-aside contracts on 
behalf of her company and was 
awarded 7 HUBZone set-aside 
contracts worth  
$4.7 million. She did not comply with 
the subcontracting rules requiring 
her construction company to 
perform at least 15 percent of the 
cost of HUBZone contract 
performance. She did not disclose to 
SBA that employees of another 
construction company exercised 
control over the management and 
decision-making process of her 
business. 
We investigated this case with the 
assistance of the U.S. Department of 
Transportation OIG, FBI, General 
Services Administration OIG, Army 
Criminal Investigation Division, and 
Department of Defense OIG. 
DOT OIG 
Investigations 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 4 

self-certification is the most efficient method, but agreed to implement procedures to monitor 
contract volume and provide additional training to mitigate the risk of HUBZone firms outgrowing 
their size. 
Relying on self-certification without any verification perpetuates a system in which ineligible business 
owners can obtain benefits meant for disadvantaged businesses, depriving these business owners of 
the opportunities that should rightfully be theirs under the statute. Unscrupulous business owners 
can make unsupported claims to attest they are eligible for these certification programs in SAM.gov 
or SBA’s Small Business Search Database. Federal contracting officers check these databases when 
awarding a set-aside contract; however, the veracity of the information is not verified by any federal 
entity. 
Given these vulnerabilities across SBA’s loan, grant, and certification programs, it is vital the agency 
implement robust review procedures when conducting eligibility reviews. For certification programs, 
these reviews could include checking for indicators that a business still qualifies according to size 
standards. Such mitigating steps can protect program integrity and support SBA’s recent focus to 
comprehensively review 8(a) Business Development program participants and federal contracting 
officers who awarded contracts to these businesses over the last 15 years.C   
Mitigating Improper Payments 
An improper payment is one that should not have been made or was made in an incorrect amount, 
including overpayment or underpayment, under a statutory, contractual, administrative, or other 
legally applicable requirement.D 
Agencies are required to review and assess programs to identify those susceptible to significant 
improper payments and report estimates, corrective action plans, and reduction targets to Congress. 
However, SBA did not always have acceptable practices and processes to calculate accurate 
estimates of improper payment rates for some of its programs during the last fiscal year, raising 
concerns about whether there were problems and the extent of them.6 
Prior and ongoing OIG audit work has identified 7(a) and PPP loans given to borrowers who were 
ineligible, resulting in improper payments. OIG’s independent public accounting firm found SBA did 
not publish improper and unknown payment estimates for the SVOG program or for multiple 
C SBA, News Release 25-56, “Administrator Loeffler Orders Full-Scale Audit of 8(a) Contracting Program” (June 27, 2025). 
D Office of Management and Budget, M-21-19, “Transmittal of Appendix C to OMB Circular A-123, Requirements for 
Payment Integrity Improvement” (March 5, 2021). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 5 

programs under the debt relief 
program, according to our report 
on SBA’s FY 2024 compliance with 
the Payment Integrity Information 
Act. 
In FY 2024, SBA largely employed 
adequate and appropriate 
sampling and estimation 
methodology plans for each of its 
seven programs that reported an 
improper payment rate, a notable 
improvement from FY 2023. 
However, the independent public 
accountant noted SBA placed 
undue reliance on its statisticians 
executing the plans without the 
appropriate level of oversight and 
quality control. Further, SBA had 
data quality issues that affected 
the improper payment rates for 
multiple programs due to an 
inadequate review process. 
The independent public 
accountant also noted SBA 
published ineffective corrective 
action plans for the PPP loan 
forgiveness and the PPP loan 
guaranty purchase programs. In 
addition, they found SBA did not accurately disclose the improper payment reduction targets in the 
annual financial report for six programs. 
Payment integrity actions, such as accurately measuring and reporting an agency’s improper 
payment rate, will help to reduce fraud, waste, and abuse in government programs. These actions 
enhance program missions, efforts to advance equity, efficiency, and customer experience. 
Over the past several years, SBA has initiated several corrective actions to enhance and develop 
additional controls to address loan reviews, loan forgiveness, and fraud, including establishing 
Source: OIG figure adapted from Yellowbook-CPE.com, using GAO’s 
Standards for Internal Control in the Federal Government 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 6 

guidelines for loan and forgiveness reviews. Although many of SBA’s efforts to mitigate improper 
payments are for pandemic assistance programs, learning from past mistakes will help the agency 
mitigate improper payments in its traditional programs moving forward. 
SBA’s implementation of a robust framework and ensuring its effectiveness will help mitigate this 
challenge. SBA has also adopted several new verification measures within its loan application process 
that will strengthen protections against fraud to ensure its programs only benefit eligible Americans, 
including citizenship verification, date of birth verification, and automatic fraud alerts.E 
Seizure and Return of Funds 
SBA, SBA OIG, and our external law enforcement partners are continuing to work together to seize or 
return pandemic-related program funds that remain frozen at financial institutions. SBA is also 
working to claw back funds the agency has determined to be improper payments including loans 
flagged as potentially fraudulent. Recovery can be time consuming because it can involve 
coordination with other government entities and law enforcement agencies. This is a challenge given 
the volume of loans in SBA’s portfolio and the applicable statutory timeframes. SBA is working 
collaboratively with the Department of Justice, Treasury, and OIG officials to mitigate this challenge. 
In the FY 2024 financial statements audit, OIG’s independent public accountant identified significant 
issues in the agency’s accounting for the PPP, COVID-19 EIDL, RRF, and SVOG programs.7 Because 
these programs are either in the servicing or post-payment review phases, SBA needs to improve the 
process to recover funds or identify funds that need to be recovered. Further, the independent 
accountant found SBA managers did not adequately design and implement controls or develop 
accounting policies to account for the recovery of funds related to these programs (see Challenge 4 
for more discussion on this issue). 
Our audits of SBA’s oversight of RRF and SVOG recipients also found management did not establish a 
process to recover funds from these programs.8 Subsequently, SVOG program officials sent letters 
requesting a return of funds to recipients who were found to be ineligible for the award or who 
improperly used award funds.9 During FY 2025, SBA drafted a policy for recovering RRF funds and 
plans to implement a process in FY 2026. 
SBA’s challenge is to enforce its current guidance for returning loan funds and standardize 
procedures on clawing back funds. Recently, SBA established a process to recover SVOG awards that 
were either sent to an ineligible recipient or used for improper expenses. SBA has also recently 
drafted a plan to account for the recovery of improperly paid PPP and COVID-19 EIDLs. For RRF 
awards, SBA needs to finalize a process to recover funds. The agency is still working through finalizing 
E SBA, News Release 25-42, “SBA Highlights Range of New Measures to Stop Fraud” (April 10, 2025). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 7 

policies for clawing back PPP loans that were found to be ineligible after forgiveness. We will monitor 
SBA’s progress and actions to close this recommendation. Regarding seized and frozen pandemic-
related program funds, SBA developed a procedural notice to provide guidance to borrowers, 
lenders, and other financial intermediaries on how to return the PPP loan funds to SBA. OIG will 
continue to evaluate the effectiveness of the processes. 
OIG Highlighted Work 
1 COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Report 23-09) 
2 SBA’s Actions to Address Forgiven PPP Loans Subsequently Flagged as Potentially Ineligible  
(Report 25-12) 
3 SBA’s Implementation of the SBIR and STTR Extension Act of 2022 (Report 24-14) 
4 SBA’s Restaurant Revitalization Fund Program Award Practices (Report 24-09); SBA’s Oversight of 
Shuttered Venue Operators Grant Recipients (Report 25-21) 
5 SBA’s Implementation of the Women-Owned Small Business Certification Program (Report 22-20); 
SBA’s Oversight of HUBZone Program Participants’ Continuing Eligibility (Report 24-23) 
6 Independent Auditors’ Report on SBA’s FY 2024 Compliance with the Payment Integrity Information 
Act of 2019 (Report 25-15) 
7 Independent Auditors’ Report on SBA’s FY 2024 Financial Statements (Report 25-05) 
8 SBA’s Restaurant Revitalization Fund Program Award Practices (Report 24-09); SBA’s Oversight of 
Shuttered Venue Operators Grant Recipients (Report 25-21) 
9 Improvements Needed in SBA’s Shuttered Venue Operators Grant Post-Award Review Process 
(Report 24-21) 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 8 

Challenge 2: Managing SBA’s Loan 
Portfolio and Participating 
Lenders 
SBA provides entrepreneurs looking to start, grow, or 
expand their small businesses access to financial assistance 
through several business loan programs. The 7(a) loan 
program is SBA’s principal vehicle for providing small 
business owners and entrepreneurs with access to credit 
they cannot obtain elsewhere. This program relies on 
numerous outside parties (such as loan agents and lenders) 
to originate loans. By statute, the 7(a) loan guaranty 
offered through private lending institutions is required to 
operate at “zero-subsidy,” or zero cost to taxpayers, and is funded through the collection of lender 
fees. SBA has recently restored lender fees and increased underwriting standards for loan guaranties, 
which were eliminated or lowered in 2023.A To protect taxpayer dollars, SBA must maintain adequate 
oversight of financial institutions participating in its guaranteed loan programs. 
SBA also provides long-term, low-interest direct disaster assistance loans to businesses of all sizes, 
private nonprofits, homeowners, and renters following a declared disaster. The agency is tasked with 
handling the long-term loan servicing of the COVID-19 EIDL program, which is a loan portfolio of 
about 3.8 million loans — over 14 times what the agency was managing before the pandemic. SBA’s 
challenge is to effectively service this large volume of disaster loans and recover delinquent funds. 
Servicing Disaster Loans 
Prior to the pandemic, SBA typically serviced about 263,000 disaster loans totaling approximately 
$9.4 billion. Five years after the pandemic, SBA has the challenge of servicing approximately 
3.8 million outstanding disaster loans totaling approximately $336.4 billion — a fourteenfold increase 
in the amount of loans the agency was managing previously (see Figure 1). Note that the stated size 
of the portfolio includes about 1.1 million charged-off loans that normally would have been 
A SBA, News Release 25-41,“SBA Initiates Actions to Reverse Biden-Era Mismanagement of Core 7(a) Lending Program” 
(March 27, 2025). 
2026 Top Management and Performance Challenges | 9 

transferred to Treasury 
for cross servicing. SBA 
has been temporarily 
exempted from that 
requirement until March 
31, 2026. Upon transfer, 
the servicing portfolio 
will significantly 
decrease. 
SBA typically services a 
disaster loan until it is 
paid in full or, upon 
default, to 120 days 
delinquent. Treasury and 
the agency have agreed 
that SBA will service even 
defaulted loans and 
attempt recovery on 
these loans for up to 2 
years, or until the agency’s recovery efforts are exhausted. COVID-19 EIDL servicing is significantly 
different than traditional loan servicing because it includes a variety of complex action requests that 
are not common to private sector business loans. This further stresses SBA’s ability to fully and 
completely service current loans and perform full-spectrum collection efforts on past-due and 
defaulted loans.1 SBA’s challenge is to be responsive to recipients of these loans and perform its due 
diligence to mitigate loss to the taxpayer. 
In our May 2025 inspection report, we concluded that SBA would be able to service its COVID-19 loan 
portfolio with a staff of 1,492 at its Fort Worth, Texas, processing center.2 As of June 2025, SBA 
reduced its staff at the center to about 819 employees. Since these staff reductions occurred after 
our review, OIG has not assessed any potential impact on the agency’s servicing of the $336.4 billion 
COVID-19 EIDL disaster loan portfolio. 
Planning and Modeling for Future Disaster Responses 
To avoid funding lapses, SBA must improve its processes to forecast and request annual 
appropriations for future disaster responses. On October 15, 2024, the agency announced funds in its 
disaster assistance loans program account had been exhausted. This caused a delay in disbursements 
of loans between October 15 and December 21, 2024, when SBA received supplemental funding. This 
Figure 1: The Increased Burden of COVID-19 EIDL 
Servicing on SBA 
Source: OIG generated based on SBA data 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 10 

lapse in funding occurred, in part, because the agency had not adjusted its forecasted lending level or 
annual budget request for disaster assistance since 2009, even though the number and cost of 
billion-dollar disasters has generally increased over time (see red trendline on Figure 2).3 Our report 
25-24 shows the correlation between a large number of costly disasters and a larger number of 
disbursed loans and SBA loan amounts. SBA’s challenge is to ensure historical factors, such as 
changes in the subsidy rate, frequency of major disasters, and total dollar amount of loan approvals 
from prior years, are taken into account when developing the annual budget request for the disaster 
loan program. 
Figure 2: Total Dollar Amount of Approved Disaster Loans 
Source: National Centers for Environmental Information billion-dollar disaster database 
When requesting future funding, we found that SBA’s monthly reports to Congress did not include all 
the required components of 15 U.S. Code § 636k(a) and that the informal messages the agency 
initiated with Congress were insufficient to communicate the pending funding lapse.3 SBA’s challenge 
is to 1) ensure its monthly reports comply with the statute and can be clearly interpreted and 2) 
provide formal notification to Congress and the Office of Management and Budget (OMB) that clearly 
states whether sufficient funds are available or if there is a need for supplemental funds as soon as 
the agency anticipates a funding shortfall. 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 11 

Overseeing Lenders 
SBA’s Office of Credit Risk Management manages 
program credit risk on financial assistance portfolios of 
guaranteed loans that totaled about $163 billion as of 
June 2025. The office monitors lender performance and 
enforces lending program requirements. 
In 2023 and 2024, SBA made significant policy changes to 
its flagship 7(a) loan program to help expand access to 
capital for disadvantaged entrepreneurs. The agency 
lowered underwriting standards and granted mission-
driven financial institutions access to the 7(a) loan 
program as Community Advantage Small Business 
Lending Companies. In 2025, SBA reversed many of these 
changes.B The agency has recently issued a moratorium 
on the expansion of the program and will require existing 
lenders to meet prudent financial stability standards as a 
condition of further participation. SBA’s challenge is to 
serve entrepreneurs while also mitigating increased risk 
to its 7(a) loan program. Many non-bank lenders are not 
regulated by other federal entities, which means they are 
primarily regulated and examined by SBA. The agency 
considered these lenders to be higher risk than those 
with federal regulators, so they required more oversight 
by SBA’s Office of Credit Risk Management.4 
OIG has conducted prior audit work related to third-party 
service providers in the 7(a) loan program. In FY 2025, we 
assessed the risk associated with non-bank lenders in the 
PPP, including financial technology companies and service 
providers.5 We found opportunities for SBA to enhance 
its oversight of non-bank lenders to promote program 
integrity and reduce financial loss. Specifically, non-bank 
PPP lenders made $14.2 billion in suspected fraudulent 
loans at a rate more than five times higher than loans 
B SBA, News Release 25-51, “SBA Overhauls Reckless Biden-Era Lending Program” (May 19, 2025). 
Example of Lender 
Service Provider Fraud 
We helped prosecute a national 
criminal ring involving 1,300 PPP 
applications associated with  
$600 million in fraud, leading to the 
convictions of the founders of a lender 
service provider, which facilitated over 
$6 billion in PPP loans, itself benefitting 
from over $300 million in lender fees. 
To date, this is our largest prosecuted 
pandemic assistance fraud scheme. 
The investigation revealed two of the 
ringleaders co-founded a fintech in April 
2020 purportedly to assist applicants in 
obtaining PPP loans. To obtain larger 
loans for certain applicants, they and 
other co-conspirators fabricated 
documents, including tax 
documentation. They charged 
borrowers kickbacks based on a 
percentage of the funds received. To 
obtain a greater volume of kickbacks 
from borrowers and a percentage of 
lender fees from SBA, they submitted 
PPP loan applications they knew 
contained false information. 
U.S. Attorney’s Office  
Northern District of Texas, 
June 23, 2025 
August 11, 2025 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 12 

made by traditional bank lenders. Over $6.1 billion of the $14.2 billion in suspected fraudulent non-
bank PPP loans, or nearly 43 percent, were made by lenders categorized as fintechs and other state-
regulated finance companies. Additionally, loans involving service providers had a suspected fraud 
rate more than three times higher than loans made without a service provider. In addition, we have 
investigative cases that reflect some of the effects non-bank lenders have had on the PPP. 
SBA has taken steps to mitigate this challenge and significantly improved its tracking and monitoring 
of third-party providers in the traditional loan programs. We will continue to monitor compliance 
with SBA policies and procedures as well as corrective actions to address noncompliance. It is vital 
that the agency continues to: 
• Enhance its oversight of program lenders; 
• Enhance the oversight of third-party service providers, including loan agents who lenders 
place significant reliance on; and 
• Address emerging issues in a timely manner to reduce risks. 
Ensuring Retention of Loan and Award Records 
SBA guarantees 50 percent or more of a business loan made by a participating lender to the small 
business borrower. Lenders maintain the loan files and service the loan until either the loan is paid in 
full or SBA purchases the guaranty and charges off any uncollectible balance.6 This means that most 
loan documents and data reside only with the participating lender, which could be problematic if that 
lender dissolves or ceases to service the loan. 
If future programs were designed to capture and maintain applicant data, and if the data was shared 
with SBA, it would not be as difficult for the agency to conduct oversight of loans from lenders who 
ceased operating. In addition, if SBA were to acquire and maintain lender data, investigators would 
have access to the documentation needed to validate evidence of fraud. Retaining documentation 
and sufficient evidence to support loan decisions is consistent with federal standards for internal 
controls. These controls require managers to support their decisions and determinations with 
supporting documentation, which includes the rationale of how loan decisions were made. For this 
reason, it is important that all loan records are properly managed, maintained, and available.7 
This was most evident in the PPP because of the massive number of loans, the extent of the fraud, 
and the forgiveness process on the back end. In the PPP, SBA only required that lenders enter general 
applicant information, such as name, address, email, and telephone number, into the agency’s PPP 
systems. Applicants were not asked to provide their date of birth on the PPP application, which we 
found to be a critical element for Social Security number verification. In addition, SBA did not require 
lenders to submit borrower bank account details associated with the disbursement, Internet Protocol 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 13 

addresses, or web log data associated with the electronic signature on the applications. If a lender 
were to go out of business, SBA could not capitalize on the information it obtained in its PPP systems 
by using data analytics technology, such as artificial intelligence and machine learning, which help 
identify noncompliance with program requirements and likely fraud. 
Congress and the Administration took swift action to extend the statutes of limitations for 
prosecution of PPP and COVID-19 EIDLs from 5 to 10 years, but it will be difficult to prosecute bad 
actors if loan documents and data are not available. To correspond to the 10-year PPP fraud statute 
of limitations, SBA extended the records retention requirement for all PPP lenders to 10 years from 
the date of final disposition of each PPP loan.C SBA’s challenge is to continuously monitor and 
communicate with participating lenders to safeguard loan information and to share documents 
related to lending decisions, which is imperative in cases in which the lender dissolves or ceases to 
service the loan. 
The statute of limitations for the Restaurant Revitalization Fund and Shuttered Venue Operators 
Grant program is 5 years from application or the reporting date. SBA only requires Restaurant 
Revitalization Fund recipients to retain their award records for 3 years. If program officials do not 
conduct reviews in a timely manner, or extend the record retention period, SBA could miss the 
opportunity to prosecute wrongdoers and recover funds that were incorrectly or fraudulently 
obtained. 
OIG Highlighted Work 
1 Ending Active Collections on Delinquent COVID-19 Economic Injury Disaster Loans (Report 23-16) 
2 COVID-19 Economic Injury Disaster Loan Servicing Capability (Report 25-16) 
3 SBA’s Processes to Forecast and Request Appropriation Dollars for its Disaster Loans Program 
Account (Report 25-24) 
4 Audit of SBA’s Oversight of High-Risk Lenders (Report 20-03) 
5 SBA’s Oversight of Non-Bank Lenders and Third-Party Service Providers Associated With PPP Loans 
(Report 25-04) 
6 SBA’s Guaranty Purchases for Paycheck Protection Program Loans (Report 22-25) 
C 89 F.R. 68090 Business Loan Program Temporary Changes; PPP-Extension of Lender Records Retention Requirements, 
(August 2024). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 14 

SBA’s Eligibility and Forgiveness Review of PPP Loans Made to Borrowers with Treasury’s Do Not Pay 
Data Matches 
7 
(Report 24-06) 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 15 

Challenge 3: Measuring 
Performance and Monitoring SBA 
Programs 
SBA manages programs to help support American entrepreneurs access grant funds and business 
counseling. It aids existing and prospective small businesses through a variety of counseling and 
training services offered by partner organizations. Among these partners are Small Business 
Development Centers (SBDC), the SCORE mentoring network, Women’s Business Centers, and 
Veterans Business Outreach Centers. SBA’s challenge is to improve the measures it uses to assess the 
effects of its programs and improve grantee oversight, better serving entrepreneurs and ensuring 
that every dollar spent delivers results. 
Measuring Program Performance 
Federal guidance requires SBA managers establish meaningful performance goals and measure 
progress, which provides proof of success and helps improve future programs. With over 33 million 
small businesses supporting the economy, having clearly defined program goals and targets are 
essential to achieving program objectives. 
Our reviews of SBA’s counseling and contracting certification programs have consistently found 
opportunities for SBA to improve its measures used to assess program goal accomplishments. In a 
recent review of an SBDC, we found SBA established performance goals and measures to monitor 
progress toward the goals.1 However, improvements were needed to better align performance goals 
with the related funding and to track progress toward achieving those goals. 
Monitoring Program Performance Results 
Federal standards for internal controls require managers to use quality information to achieve their 
objectives. This requires that program officials ensure information is complete, accurate, accessible, 
and provided in a timely manner so that leaders can make informed decisions and evaluate 
performance. Without accurate and complete performance reporting and comprehensive reviews of 
performance reports, SBA grant programs may not achieve their intended results. 
The agency can improve tracking and monitoring performance goals by coordinating with resource 
partners. We found this lack of coordination in our recent inspection of one SBDC. We highlighted 
the need to demonstrate performance goals were met by associating the center’s financial data with 
2026 Top Management and Performance Challenges | 16 

the program activities conducted. If not properly associated, the SBDC spends additional money 
toward meeting goals already funded, thereby increasing the operational cost of fulfilling program 
goals and activities. We plan to take a broader look at these issues in an upcoming audit of SBA’s 
oversight of the SBDC program. 
We also found in SBA’s oversight of the Small Business Innovation Research (SBIR) and Small Business 
Technology Transfer (STTR) programs that there was limited assurance that small businesses met 
minimum performance standards.2 These programs help entrepreneurs explore their technological 
potential and provide an incentive to profit from commercialization. Small businesses must meet 
minimum performance standards to compete for SBIR and STTR awards. Changes to the Small 
Business Act are needed to improve SBA’s ability to monitor small businesses’ compliance with 
performance standards, reducing risks because they may not have the ability to achieve program 
goals for commercialization as intended by the Act. SBA’s challenge is to monitor grantee 
performance in the estimated number of new businesses started, tax revenue generated, and entity 
operational status. 
Ensuring Funds Are Used as Intended 
We identified systemic issues with SBA’s oversight of grant recipients’ use of federal funds. These 
issues included not enforcing financial reporting requirements, not detecting grant recipient budget 
reallocations, using weak financial review procedures, and missing supporting documentation. SBA’s 
challenge is to improve its grant management processes and procedures to ensure funds are used for 
allocable, allowable, and reasonable expenditures. 
In our recent review of an SBDC, we found opportunities for the center to improve its financial 
compliance when accounting for federal expenses, matching funds, and program income. SBA 
program officials are making changes to how it monitors use of funds to hold SBDCs accountable and 
ensure objectives are met. 
Federal funds can greatly assist struggling small businesses during an economic crisis. For example, 
the Restaurant Revitalization Fund (RRF) and Shuttered Venue Operators Grant (SVOG) were 
intended to help businesses in the restaurant and venues industries struggling to stay in business 
during the pandemic. 
In an audit of SBA’s oversight of RRF recipients, we found program officials needed to obtain 
sufficient information to monitor the recipients to ensure funds were used as intended.3 RRF 
recipients were required to submit their final use of funds report to SBA by April 30, 2023. As of July 
2025, 9.4 percent of all recipients, with awards totaling $1.5 billion, had not yet filed the required 
report. 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 17 

To oversee the RRF and SVOG programs, SBA selected samples of the award recipients to manually 
confirm eligibility, award calculation, and use of funds. We previously found the reviews for both 
programs were being conducted at a rate that would extend beyond the required timeframe for 
grantees to retain award records and the statute of limitations for prosecution of fraud or misuse.4 
SBA’s challenge is to prioritize the RRF and SVOG reviews to increase the opportunity to save 
taxpayer funds. Program managers stated they have increased the number of staff allocated to these 
reviews and are working to manage resources to complete the reviews within the timeframes. 
In addition, we found program officials did not review all awards made to potentially fraudulent or 
ineligible recipients, as the agency had originally planned to do.5 We also found SBA needed to 
implement procedures for recipients to return unused or improperly awarded funds to Treasury. SBA 
management recently implemented a process for the SVOG program and plans to implement a 
process to recover improper payments for the RRF program in FY 2026. 
SBA’s challenge is to effectively manage its resources to meet the demands of monitoring awardee 
compliance with award requirements. Improving awardee oversight will help the agency to 
effectively measure and accurately report performance results and assess whether the federal 
assistance programs were effective and funds were used appropriately. 
In our recent audit of SBA’s oversight of SVOG recipients, we found SBA could improve its process to 
close out SVOG awards. The SVOG award close out process consisted of various activities to include 
determining if 1) recipients were eligible; 2) the award amount was correct, used in accordance with 
requirements, or recovered if applicable; and 3) the agency completed its review of submitted audit 
packages. 
As of August 2025, SVOG officials closed out 1,515 of the 2,590 awards, with 1,075 awards totaling 
more than $1.5 billion still open. SBA program officials paused the close-out process to focus on 
recovery efforts. While finalizing the process to recover funds is important, SBA should consider both 
the close out and record retention requirements. By not doing so, they could miss the opportunity to 
collect misused or unused taxpayer funds. 
OIG Highlighted Work 
1 New Jersey Small Business Development Center’s Compliance With Cooperative Agreement 
Requirements (Report 25-17) 
2 SBA’s Implementation of the SBIR and STTR Extension Act of 2022 (Report 24-14) 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 18 

SBA’s Oversight of Restaurant Revitalization Fund Recipients 
3 
(Report 23-15) 
4 SBA’s Oversight of Shuttered Venue Operators Grant Recipients (Report 25-21); Improvements 
Needed in SBA’s Shuttered Venue Operators Grant Post-Award Review Process (Report 24-21) 
5 SBA’s Administrative Process to Address Potentially Fraudulent Restaurant Revitalization Fund 
Awards (Report 23-10) 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 19 

Challenge 4: Financial Reporting 
and Managing Data 
SBA is tasked with managing the 
data of small business owners through multiple interfaces 
and platforms while meeting government mandates for 
privacy and security. The agency has made it a priority to 
improve SBA technology, cybersecurity, and response time 
to customers, affirming that efficient data systems are 
integral to customer service.A Agency leaders also plan to 
further integrate AI into agency data systems, which may 
generate new cybersecurity concerns requiring OIG 
oversight. By implementing best practices in data management, the agency will have a stronger 
foundation for identifying and preventing fraud schemes. Data reliability is also essential for SBA to 
manage taxpayer funds and accurately communicate its financial position to Congress, the President, 
and the American public. The agency has made satisfactorily completing a financial audit a priority, 
according to an SBA February 2025 news release. By improving data sharing practices, SBA can 
leverage information from federal partners to make more informed decisions, ultimately benefiting 
all Americans. 
Improving Internal Controls Through Financial Statements 
Audit Remediation 
Our 2024 financial statements audit found a continuing challenge related to SBA’s internal controls, 
which are integral for financial data reliability and accuracy.1 Over the last 5 years, SBA has struggled 
with addressing long-standing internal control deficiencies due to challenges the agency faced with 
administering its pandemic relief programs. Starting in FY 2020, the agency received its first of five 
disclaimers of opinion, which means the auditors were unable to obtain sufficient audit evidence to 
support balances, so SBA has not obtained a clean audit opinion in 5 years. 
Since its first disclaimer, SBA’s financial statements audits have been limited to the balance sheet, 
one of four principal financial statements. The remaining three statements — net cost, statement of 
changes in net position, and budgetary resources — have not been audited due to the unresolved 
A SBA, News Release 25-32, “SBA Administrator Loeffler Issues Memo on Day One Priorities” (February 24, 2025). 
2026 Top Management and Performance Challenges | 20 

issues affecting the balance sheet. This is important because the other statements contain 
information about agency spending and how much funding was used during the fiscal year. 
In each of these 5 years, the auditors have identified as many as seven material weaknesses, three 
significant deficiencies, and three issues of non-compliance with laws and regulations (see Figure 3).2 
A material weakness is a serious concern that an organization’s financial reporting controls are not 
effective enough to detect major errors or fraud that could cause material misstatements in the 
financial statements. A significant deficiency is less severe but indicates control issues that could 
potentially lead to misstatements. 
Figure 3: SBA Audit Deficiencies From Pre-Pandemic Through Pandemic 
Recovery 
*Federal Managers’ Financial Integrity Act of 1982, Federal Financial Management Improvement Act of 1996, Debt 
Collection Improvement Act of 1996. 
Source: OIG analysis from SBA financial statements audit reports 
OMB guidance states that correcting internal control deficiencies is a fundamental part of 
management accountability and must be prioritized.B In this light, the agency developed a new and 
centralized Financial Statements Audit Remediation Strategy in January 2025 that set key targets to 
focus time and resources on, including: 
 
 
B OMB, M-16-17, “OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal 
Control,” at 37 (July 15, 2016). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 21 

• Enhancing governance for the audit process; 
• Developing accounting policies for the pandemic programs, such as COVID-19 EIDLs, the PPP, 
Restaurant Revitalization Fund, Shuttered Venue Operators Grants; and 
• Writing a position paper for the auditors, explaining that SBA has identified loans with 
potential eligibility concerns through its verification process.C 
Although these are positive steps, SBA has the challenge of remediating the seven material 
weaknesses and producing a clean audit opinion for all four financial statements. SBA should strive to 
improve program oversight provided to the taxpayer, Congress, and the President and accurately 
report how taxpayer money was used during the fiscal year. 
Beyond achieving a clean audit opinion, SBA must meet its statutory responsibility with the Federal 
Managers Financial Integrity Act of 1982, which requires annual assessments and certifications of 
internal controls to the Congress and President.D Although the material weaknesses identified are 
largely related to pandemic relief programs that have ended, SBA can learn lessons from the crisis to 
better its internal control environment moving forward. 
From FY 2020 to FY 2024, SBA did not substantially comply with the Federal Managers Financial 
Integrity Act of 1982. Building a more rigorous internal control environment will not only help SBA 
move toward compliance with the Act but will also help it to identify potential errors or fraud. SBA’s 
challenge will be to effectively design an internal controls assessment plan that meets requirements, 
while building a team with expertise and capacity to strengthen its internal controls. 
Authorized Data Sharing 
During the pandemic recovery, leaders in the offices of inspector general analytics community 
demonstrated that government data sharing can lead to successful criminal and administrative 
investigations into PPP, EIDL, and unemployment insurance program fraud.E 
C SBA, Office of Performance, Planning, and the Chief Financial Officer Financial Statement Audit Remediation Strategy, 
(January 8, 2025). 
D Federal Managers Financial Integrity Act of 1982. Pub. L. No. 97-255 (August 1982). 
E Pandemic Response Accountability Committee, Blueprint for Enhanced Program Integrity, Chapter 4: Whole-of-
Government Approach, at 11-12 (April 2025). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 22 

A collaboration between SBA OIG and the U.S. Department of 
Labor OIG identified $1.3 billion in potentially fraudulent 
unemployment insurance and EIDL payments were paid to the 
same likely fraudsters in both programs.3 We identified this issue 
through a data use agreement and a subsequent data sharing and 
matching project. Additionally, SBA OIG identified an additional 
$1.4 billion in EIDL disbursements from a larger dataset not 
previously identified by Labor OIG or SBA OIG as potentially 
fraudulent. 
Another example of effective data sharing between agencies 
would be if SBA pursues a legal framework to establish Social 
Security number verification data. The Pandemic Response 
Accountability Committee (PRAC) demonstrated how a 
memorandum of understanding with the Social Security 
Administration allowed its data scientists to verify Social Security 
numbers, names, and dates of birth from a random sampling of 
662,000 identity records across the COVID-19 EIDL, PPP, and 
Labor’s pandemic unemployment insurance program.F Using those 
results, PRAC estimated that up to 1.4 million stolen or invalid 
Social Security numbers were used to obtain benefits from these 
programs. PRAC estimated that verifying Social Security 
information could have saved taxpayers up to $79 billion in 
potentially fraudulent pandemic relief payments. 
Given the volume of identity theft associated with SBA pandemic 
loan programs, Social Security number verification could have 
helped mitigate fraud. If statutory limitations prevent SBA from 
accessing this or other critical data assets, there are other 
opportunities for responsible data sharing that could strengthen 
fraud detection efforts. 
The agency could undertake collaborative efforts to uncover fraud, 
waste, and abuse by implementing Do Not Pay data in all its 
F PRAC, Fraud Prevention Alert: Pre-Award Vetting Using Data Analytics Could Have Prevented Over $79 Billion in 
Potentially Fraudulent Pandemic Relief Payments, (June 2025). 
Example of Multi-
Agency Data 
Sharing 
Four Detroit residents pled 
guilty to conspiracy to commit 
wire fraud for their roles in a 
$6 million pandemic relief 
fraud scheme. Between 
February 2020 and May 2021, 
the co-conspirators stole 
identity information and 
created fictitious businesses 
to then file fraudulent claims 
in various states for PPP 
loans, EIDLs, and pandemic 
unemployment assistance. 
The unemployment benefits 
were often deposited onto 
debit cards that were sent to 
addresses controlled by the 
co-conspirators. 
This joint investigation was 
successful thanks to SBA OIG, 
Department of Labor OIG, 
and FBI data sharing and 
collaboration. 
Office of Inspector General 
U.S. Department of Labor 
Eastern District of Michigan 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 23 

programs. The agency could put agreements and systems in place to mitigate fraud, rather than 
chasing fraudsters after the funds have been disbursed. 
PRAC continues to advocate for expanding agency access to information, such as tax data.G We agree 
that expanding access to data using collaborative information sharing agreements will help identify 
fraud indicators so that federal agencies can better manage resources and protect taxpayer funds. 
SBA management stated they are currently making progress to secure sufficient and complete data 
sharing agreements with other federal agencies and ensure expired agreements are reestablished. As 
with Do Not Pay data sharing agreements with Treasury, the agency is undertaking additional 
collaborative efforts to uncover fraud, waste, and abuse during the application process for disaster 
assistance. These agreements can better help federal agencies verify applicant information and 
detect fraud. 
OIG Highlighted Work 
1 Independent Auditors’ Report on SBA’s FY 2024 Financial Statements (Report 25-05) 
2 SBA’s Controls to Address Financial Statements Audit Disclaimers and Material Weaknesses  
(Report 25-25) 
3 COVID-19: Data Sharing Project Finds Billions Paid to Same Likely Fraudsters Under Both the 
Unemployment Insurance and Economic Injury Disaster Loan Programs (Report 25-06) 
G PRAC, Blueprint for Enhanced Program Integrity, Chapter 4: Whole-of-Government Approach, at 11-12 (April 2025). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 24 

Challenge 5: Managing Risks in 
Information Technology Systems 
SBA continues to share our 
concerns about its information technology (IT) and 
cybersecurity issues, citing these as top priorities in 
2025.A A strong IT governance framework enables 
the agency to achieve mission goals and objectives 
while safeguarding taxpayer funds. A governance 
framework is an integrated strategy that identifies, 
measures, and controls risk in IT investments, 
fraud, and AI (see Figure 4). These processes will 
help the agency better deliver SBA programs and 
services, particularly in times of crisis. 
Improving Information 
Technology Systems 
Management 
In March 2024, OIG determined SBA did not enforce IT management policies and procedures, and a 
new IT systems framework was not scheduled to be implemented until the second quarter of 2024.1 
The agency has had issues related to IT software investment governance, including: 
• Lack of oversight from the governance board, 
• Not identifying the intended purpose of software investments and their expected benefits, 
• Lack of monitoring against performance measurement baselines. 
An IT system is essential to mission delivery and enhances organizational performance. IT system 
management is on the U.S. Government Accountability Office’s (GAO) high-risk list because IT 
purchases are often a large investment of taxpayer funds for mission critical functions.B The agency 
has made updates to its management processes, including updating its process for IT investment 
A SBA, News Release 25-32, “SBA Administrator Loeffler Issues Memo on Day One Priorities” (February 24, 2025). 
B GAO, GAO-25-107743, High-Risk Series: Heightened Attention Could Save Billions More and Improve Government 
Efficiency and Effectiveness, at 153 (February 2025). 
Figure 4: Risk Management Best 
Practices Strategy 
Source: OIG generated from National Institute of 
Standards and Technology data 
2026 Top Management and Performance Challenges | 25 

management to correspond with the requirements of the Clinger-Cohen Act, the Federal Acquisition 
Reform Act of 1995, OMB requirements, and OIG recommendations. 
Preparing for Artificial Intelligence Challenges 
A 2025 executive order on AI calls upon agencies to develop 
and submit to the President an action plan to achieve policy 
goals of sustaining and improving America’s AI use, promoting 
human advancement, economic competitiveness, and national 
security.C OMB also called upon agencies to develop and 
publicly release an AI strategy that includes all its current and 
possible future uses of machine-learning technology. OMB 
directed agencies to promote the use of AI while also 
considering security threats and risk, particularly taking care 
when the AI has a significant effect on decisions related to: 
• Civil rights, liberties, or privacy; 
• Critical government resources or services; and 
• Access to education, housing, insurance, credit, employment, and other programs.D 
This is relevant for SBA because it could employ AI to decide on loan guaranties, award grants, or 
detect potentially fraudulent applications, while accessing private financial information and affecting 
applicants’ credit records. 
SBA faces several challenges in implementing AI according to the new OMB memo. First, IT leaders 
must consistently identify and classify any AI uses, particularly if they plan to leverage existing data 
and AI assets across the agency. SBA management stated they have formed a new AI working group 
and a board to guide and oversee agency integration of AI to improve business processes. As of 
November 2025, SBA had no AI use cases reported. 
OMB also mandated SBA to: 
• Designate a Chief AI Officer to promote AI innovation and governance. (A new officer was 
assigned as of August 2025); 
C Executive Office of the President, Executive Order 14179, “Removing Barriers to American Leadership in Artificial 
Intelligence” (January 23, 2025). 
D OMB, M-25-21, “Accelerating Federal Use of AI Through Innovation, Governance, and Public Trust,” at 19 (April 3, 
2025). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 26 

• Update internal policies on IT infrastructure, data, cybersecurity, and privacy. (SBA published 
a 2-year Open Data Plan in June 2025 addressing open data security and privacy; however, 
more internal guidance is needed); and 
• Develop a generative AI policy. (Its last posted policy expired early 2025).E 
The agency must consider the budgetary costs and constraints of keeping AI systems and tools 
updated and protected from bad actors. Major tech players report skyrocketing costs to generative 
AI, leading to the cancellation or postponement of AI initiatives because of cost concerns.F Cutting-
edge tools can be costly to maintain, particularly with ever-evolving cyber threats. Some tech 
companies have recognized the need to address the cost and security concerns of AI use within 
government.G SBA’s risk management and need of transparency, in addition to the large amount of 
taxpayer resources at stake, is why this is a top management challenge for SBA in 2026. 
Both GAO and OIG have drawn attention to a past case of SBA not being fully transparent regarding 
its use of AI.H SBA had used a machine learning model, considered AI according to U.S. Code,I that it 
did not include in its AI inventory. An SBA loan reviewer contractor developed a random forest 
machine learning model, an ensemble algorithm using multiple decision trees, to determine if loans 
required further analysis before being approved. The model developed its internal rules for making 
loan assessments based on risk indicators created by a legal and business research platform, which 
are numerical measurements or scores to indicate risk level for businesses. The model used other 
factors deemed relevant by the contractor but not clearly explained to GAO or OIG. The model was 
trained on a dataset of 20,000 manually reviewed loans, of which 275 had been marked as requiring 
further analysis before approval. This model was then used by SBA to assess 129,000 loans. 
OIG plans to conduct audit oversight on the implementation of SBA’s AI plans and strategies in the 
future. We look forward to working with the agency to ensure AI objectives are met with minimum 
risk and optimum return on investment. 
E “Artificial Intelligence.” SBA Office of the Chief Information Officer. Internal SharePoint site. 
F Brodsky, Sascha. “The Hidden Costs of AI: How Generative Models are Reshaping Corporate Budgets.” IBM Think. 
Accessed July 18, 2025. (October 14, 2024). 
G Wakeman, Nick. “OpenAI to Give Federal Agencies ChatGPT Access at $1 Per year.” NextGov/FCW. Accessed August 6, 
2025. (August 6, 2025). 
H GAO, GAO-25-107267, COVID-19 Relief Improved Controls Needed for Referring Likely Fraud in SBA’s Pandemic Loan 
Programs, (March 2025). 
I 15 U.S. Code §9401(3). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 27 

Deploying and Monitoring New Third-Party Systems 
The agency relies on service providers for software and IT services. While these outside solutions are 
expedient, SBA’s challenge is to implement robust due diligence and continuous monitoring to 
ensure data integrity is maintained throughout the processing cycle. Shortfalls in these processes 
have contributed to SBA having material weaknesses and disclaimers of financial reporting reliability 
going back to FY 2020. 
Proper guidance on monitoring third-party systems can be found through System and Organization 
Controls 1 reviews. Our independent financial statements auditors identified material weaknesses 
related to insufficient technical support and inadequate system controls, possibly leading to 
operational inefficiencies and increased risk of errors. These reviews allow agencies to evaluate the 
effectiveness of their internal controls over financial reporting. In FY 2025, SBA revised its standard 
operating procedure to enhance oversight procedures of service providers.J 
SBA’s development guidance requires that systems are designed with adequate controls to prevent 
unauthorized access and data breaches. As new systems are developed, the importance of robust 
technical support and continuous system monitoring is integral to data quality. 
Cybersecurity and Modernization 
Our evaluations of SBA’s systems, policies, and procedures regarding the Federal Information 
Security Modernization Act (FISMA) show this area continues to be a challenge for the agency.2 The 
agency’s overall security program continues to be rated as “not effective” in accordance with federal 
guidance. Because of SBA’s mission and the personally identifiable information it is required to collect 
to carry out that mission, the agency is susceptible to privacy and data breaches. 
It is also critical that SBA plan for cybersecurity risks when modernizing its IT systems. This was an 
issue for SBA’s Unified Certification Platform, which was intended to help streamline the process for 
small business owners to apply for contracting certification programs. GAO reported that when SBA 
transitioned to this new “one-stop” certification system, meant to consolidate multiple systems into 
one, the agency did not implement leading practices for risk management, cybersecurity, and IT 
governance over the investment.K 
J SBA, SOP 20 33 1, Review and Assessment of System & Organization Controls Report(s), (July 10, 2025). 
K GAO, GAO-25-106963, It Modernization: SBA Urgently Needs to Address Risks on Newly Deployed System, (November 
2024). 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 28 

In addition to not developing a cybersecurity risk management plan, SBA also did not trace design 
elements of the new system to related cybersecurity requirements, which increases the risk of 
security vulnerabilities. 
This problem continued with personally owned electronic devices allowed to access sensitive SBA 
systems. In late 2024, we identified a significant security vulnerability.3 The agency unknowingly 
allowed personally owned devices, such as smartphones, laptops, or tablet computers, to access, 
store, and transmit agency data with only a username and password. Devices could also access the 
network from foreign locations, which is prohibited by SBA IT policy. Personally owned devices can 
expose the agency to IT security risks, such as unauthorized access and theft of personally identifiable 
information, which can be exploited by cyber criminals and other bad actors. Cyber threats include, 
but are not limited to, disclosure of sensitive data, unauthorized changes, or backdoor access to 
other network resources. 
SBA should have multifactor authentication enabled for users to access the agency’s secure network. 
Multifactor authentication is a high security control that requires a username, password, and an 
identity card, unique security code, or biometrics to access a system. Relying on usernames and 
passwords alone greatly increases the risk of SBA data being accessed and exploited by cyber 
criminals. 
SBA has taken corrective action by rolling out multifactor authentication for more than 6,000 users. 
The agency is also designing the Unified Certification Platform to improve processes for administering 
the contract certification programs. The challenge for SBA is to ensure cybersecurity risks are 
considered and mitigated as the agency continues to modernize and integrate AI technology, which 
will likely be a collaborative process with entities outside the agency. 
OIG Highlighted Work 
1 SBA’s IT Investment Governance Framework (Report 24-10) 
2 Fiscal year 2024 Federal Information Security Modernization Act (Report 25-13) 
3 Undetected Vulnerabilities From Personally Owned Devices (Report 25-11) 
U.S. Small Business Administration | Office of Inspector General 
2026 Top Management and Performance Challenges | 29 

2026 Top Management and Performance Challenges | 30 
Make a Difference 
To promote integrity, economy, and efficiency, we encourage you to report instances of fraud, waste, 
or mismanagement to the OIG Hotline.* 
Visit our OIG Hotline website. 
Write or visit: 
U.S. Small Business Administration 
Office of Inspector General 
Investigations Division 
409 Third Street SW (5th Floor) 
Washington, D.C. 20416 
*In accordance with the Inspector General Act of 1978, codified as amended at 5 USC 407 and 420(b)(2)(B), 
confidentiality of a complainant’s identity is mandatory absent their consent to release such information, or unless the 
Inspector General determines disclosure is unavoidable during the course of the investigation.

File and source

File

26-01-tmpc-fy2026.pdf

Size

2,386,863 bytes

SHA-256

9906479bd86e0c13a0e296e49d91c79a91d0155652bde3c975beafa98d1822e2

Our copy

26-01-tmpc-fy2026.pdf

Original

www.oversight.gov