GAO-21-498T, COVID-19 Loans: SBA Has Begun to Take Steps to Improve Oversight and Fraud Risk Management

Opinion — GAO-21-498T, COVID-19 Loans: SBA Has Begun to Take Steps to Improve Oversight and Fraud Risk Management, dated 2021-04-20, issued by Government Accountability Office.

Full text

COVID-19 LOANS
SBA Has Begun to Take
Steps to Improve
Oversight and Fraud Risk
Management
Statement of William B. Shear, Director, Financial
Markets and Community Investment

Testimony
Before the Committee on Small
Business, House of Representatives
For Release on Delivery
Expected at 10:00 a.m. ET
Tuesday, April 20, 2021
GAO-21-498T

United States Government Accountability Office

 United States Government Accountability Office

Highlights of GAO-21-498T, a testimony
before the Committee on Small Business,
House of Representatives

April 20, 2021
COVID-19 LOANS
SBA Has Begun to Take Steps to Improve Oversight
and Fraud Risk Management
What GAO Found
In April 2020, the Small Business Administration (SBA) quickly implemented the
Paycheck Protection Program (PPP) and expedited the processing of Economic
Injury Disaster Loans (EIDL) and a new EIDL advance program. These important
programs have helped businesses survive during the COVID-19 pandemic. In an
effort to move quickly on these programs, SBA initially put limited internal
controls in place, leaving both susceptible to program integrity issues, improper
payments, and fraud. Because of concerns about program integrity, GAO added
PPP and the EIDL program onto its High-Risk List in March 2021.

SBA has begun to take steps to address these initial deficiencies:
•
PPP oversight. Because ongoing oversight is crucial, GAO recommended in
June 2020 that SBA develop plans to respond to PPP risks to ensure
program integrity, achieve program effectiveness, and address potential
fraud. Since then, SBA has developed a loan review process and added up-
front verifications before it approves new loans.
•
Improper payments for PPP. GAO recommended in November 2020 that
SBA expeditiously estimate improper payments for PPP and report estimates
and error rates. SBA has now developed a plan for the testing needed to
estimate improper payments.
•
Analyzing EIDL data. Based on evidence of widespread potential fraud for
EIDL, GAO recommended in January 2021 that SBA conduct portfolio-level
analysis to detect potentially ineligible applications. SBA has not announced
plans to implement this recommendation.
•
EIDL oversight. GAO recommended in March 2021 that SBA implement a
comprehensive oversight plan for EIDL to ensure program integrity. SBA
agreed to implement such a plan.
•
Assessment of fraud risks. SBA has not conducted a formal fraud risk
assessment for PPP or the EIDL program. GAO made four recommendations
in March 2021, including that SBA conduct a formal assessment and develop
a strategy to manage fraud risks for each program. SBA said it would work to
complete fraud risk assessments for PPP and EIDL and continually monitor
fraud risks.
•
Financial statement audit. In December 2020, SBA’s independent financial
statement auditor issued a disclaimer of opinion on SBA’s fiscal year 2020
consolidated financial statements because SBA could not provide adequate
documentation to support a significant number of transactions and account
balances related to PPP and EIDL.
GAO continues to review information SBA recently provided, including data on
PPP loan forgiveness and details on the PPP and EIDL loan review processes.
In addition, GAO has obtained additional information from a survey of PPP
participating lenders, interviews with SBA’s PPP contractors, and written
responses to questions provided by SBA’s EIDL contractor and subcontractors.

View GAO-21-498T. For more information,
contact William B. Shear at (202) 512-8678 or
shearw@gao.gov.
Why GAO Did This Study
SBA has made or guaranteed about
18.7 million loans and grants through
PPP and the EIDL program, providing
about $968 billion to help small
businesses adversely affected by
COVID-19. PPP provides potentially
forgivable loans to small businesses,
and EIDL provides low-interest loans of
up to $2 million for operating and other
expenses, as well as advances
(grants).
This testimony discusses the lack of
controls in PPP and the EIDL program
and SBA’s efforts to improve its
oversight of these programs. It is
based largely on GAO’s June 2020–
March 2021 reports on the federal
response, including by SBA, to the
economic downturn caused by COVID-
19 (GAO-20-625, GAO-20-701, GAO-
21-191, GAO-21-265, GAO-21-387).
For those reports, GAO reviewed SBA
documentation and SBA Office of
Inspector General (OIG) reports;
analyzed SBA data; and interviewed
officials from SBA, the SBA OIG, and
the Department of the Treasury.
What GAO Recommends
GAO has previously made eight
recommendations to SBA to address
internal control and fraud risk
management deficiencies in PPP and
the EIDL program. SBA neither agreed
nor disagreed with three
recommendations, and agreed with the
five recommendations made in GAO’s
March 2021 report.

Page 1
GAO-21-498T
Chairwoman Velázquez, Ranking Member Luetkemeyer, and Members of
the Committee:
I am pleased to be here today to discuss our work on the Small Business
Administration’s (SBA) Paycheck Protection Program (PPP) and
Economic Injury Disaster Loan (EIDL) program. As of April 4, 2021, SBA
had made or guaranteed about 18.7 million loans and grants, providing
about $968 billion to help small businesses adversely affected by
Coronavirus Disease 2019 (COVID-19).
As we reported in June 2020, lenders and SBA moved quickly to make
and process PPP loans.1 Given the immediate need for these loans, SBA
worked to streamline PPP so that lenders could begin distributing funds
as quickly as possible. SBA’s initial interim final rule allowed lenders to
rely on borrower certifications to determine the borrower’s eligibility and
use of loan proceeds, and it required only limited lender review of
borrower documents to determine the qualifying loan amount and
eligibility for loan forgiveness.2 We also reported that as of June 2020,
SBA had already approved more EIDLs than for all previous disasters
combined, according to SBA officials.
While millions of small businesses have benefited from these programs,
the speed with which the programs were implemented left SBA with
limited safeguards to identify and respond to program risks, including
susceptibility to improper payments and fraud. Since June 2020, we have
reported on the potential for fraud in both PPP and EIDL and have made
eight recommendations to SBA to improve the programs (four for PPP
and four for EIDL). In addition, we included these programs as a new
area on our High-Risk List in March 2021 because of their potential for
fraud, significant program integrity risks, and need for much improved

1GAO, COVID-19: Opportunities to Improve Federal Response and Recovery Efforts,
GAO-20-625 (Washington, D.C.: June 25, 2020).
2See 85 Fed. Reg. 20,811 (Apr. 15, 2020). The interim final rule stated that lenders would
be held harmless for borrowers’ failure to comply with program criteria. Congress later
codified a PPP lender hold harmless provision, providing that lenders may rely on any
certification or documentation submitted by applicants that is submitted, and attests that it
is submitted, pursuant to all applicable statutory requirements. Pub. L. No. 116-260, div.
N, tit. III, § 305, 134 Stat. 1182, 1996-97 (2020). Congress made this provision retroactive,
as if it was included in the original CARES Act.
Letter

Page 2
GAO-21-498T
program management and better oversight.3 We also cited the results of
SBA’s most recent financial statement audit, in which the auditor issued a
disclaimer of opinion on SBA’s financial statements because SBA was
unable to provide adequate documentation to support a significant
number of transactions and account balances related to PPP and EIDL.4
Further, as we reported multiple times, SBA’s failure to provide us with
data and documentation on PPP and EIDL in a timely manner impeded
efforts to ensure transparency and accountability for the programs. This
included delays in our obtaining key information from SBA, such as
detailed oversight plans and documentation for estimating improper
payments. However, I am glad to report that we have received a
significant amount of information and data from SBA and its contractors
over the past 2 months.
In this statement, I will discuss the lack of adequately documented
controls in PPP and the EIDL program, as identified in prior work, and
SBA’s efforts to improve its oversight of these programs. I also will
characterize the information we have recently received and how we plan
to evaluate that information in our ongoing work. In preparing this
statement, we relied primarily on our body of work issued from June 2020
through March 2021 that reviewed, among other things, SBA’s
implementation of these programs in response to the economic downturn
caused by COVID-19.5
For those reports, we reviewed SBA documentation and analyzed
program data, and we interviewed officials from SBA and the Department
of the Treasury (Treasury). We also reviewed reports by SBA’s Office of
Inspector General (SBA OIG) and interviewed SBA OIG officials. In

3GAO, High-Risk Series: Dedicated Leadership Needed to Address Limited Progress in
Most High-Risk Areas, GAO-21-119SP (Washington, D.C.: Mar. 2, 2021).
4Small Business Administration, Office of Performance Management and the Chief
Financial Officer, Agency Financial Report Fiscal Year 2020 (Washington, D.C.: Dec. 18,
2020), 39–63.
5See GAO-20-625; COVID-19: Brief Update on Initial Federal Response to the Pandemic,
GAO-20-708 (Washington, D.C.: Aug. 31, 2020); COVID-19: Federal Efforts Could Be
Strengthened by Timely and Concerted Actions, GAO-20-701 (Washington, D.C.: Sept.
21, 2020); COVID-19: Urgent Actions Needed to Better Ensure an Effective Federal
Response, GAO-21-191 (Washington, D.C.: Nov. 30, 2020); COVID-19: Critical Vaccine
Distribution, Supply Chain, Program Integrity, and Other Challenges Require Focused
Federal Attention, GAO-21-265 (Washington, D.C.: Jan. 28, 2021); and COVID-19:
Sustained Federal Action is Crucial as Pandemic Enters Its Second Year, GAO-21-387
(Washington, D.C.: Mar. 31, 2021).

Page 3
GAO-21-498T
addition, we interviewed officials from the Federal Bureau of Investigation
(FBI). More detailed information on our scope and methodology can be
found in our June 2020, September 2020, November 2020, January
2021, and March 2021 reports.
We conducted the work on which this statement is based in accordance
with generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on
our audit objectives.

In response to the far-reaching public health and economic crises
resulting from COVID-19, in March 2020, Congress passed, and the
President signed into law, the CARES Act, which provides over $2 trillion
in emergency assistance and health care response for individuals,
families, and businesses affected by COVID-19.6
Among other things, Congress established PPP in the CARES Act to help
small businesses affected by COVID-19.7 To date, Congress has
provided commitment authority of about $814 billion for PPP.8
Through the CARES Act, Congress also temporarily expanded eligibility
for SBA’s EIDL program and appropriated $10 billion to create emergency
EIDL advances, a new component of the EIDL program under the

6Pub. L. No. 116-136, 134 Stat. 281 (2020). As of April 2021, six other relief laws were
also enacted in response to the COVID-19 pandemic: the Coronavirus Preparedness and
Response Supplemental Appropriations Act, 2020, Pub. L. No. 116-123, 134 Stat. 146;
the Families First Coronavirus Response Act, Pub. L. No. 116-127, 134 Stat. 178 (2020);
the Paycheck Protection Program and Health Care Enhancement Act, Pub. L. No. 116-
139, 134 Stat. 620 (2020); the Paycheck Protection Program Flexibility Act of 2020, Pub.
L. No. 116-142, 134 Stat. 641; Consolidated Appropriations Act, 2021, Pub. L. No. 116-
260, 134 Stat. 1182; and American Rescue Plan Act of 2021, Pub. L. No. 117-2, 135 Stat.
4.
7PPP was authorized under SBA’s 7(a) small business lending program.
8Pub. L. No. 116-136, §§ 1102(b)(1), 1107(a)(1), 134 Stat. at 293, 301; Pub. L. No. 116-
139, § 101(a), 134 Stat. at 620; Pub. L. No. 117-2, § 5001(d) 135 Stat. at 85.
Background
CARES Act and
Subsequent
Appropriations

Page 4
GAO-21-498T
CARES Act.9 Prior to the enactment of the CARES Act, SBA had begun
awarding EIDLs to small businesses affected by COVID-19 using existing
funds.10 In total, Congress has appropriated $50 billion in loan credit
subsidies for the cost of EIDL loans and $55 billion for advances to assist
businesses affected by COVID-19.11 The $50 billion in loan credit
subsidies would enable SBA to provide about $470 billion in EIDL loans.
We have previously reported that strong internal controls increase the
likelihood that an entity will achieve its objectives and help ensure that
emergency relief funds are appropriately safeguarded.12 While some level
of risk may be acceptable in an emergency, an effective internal control
system improves accountability and transparency, provides feedback on
how effectively an entity is operating, and helps reduce risks affecting the
achievement of the entity’s objectives. A major component of internal
control is identifying and responding to fraud risks. Recognizing fraud
risks, and thoughtfully and deliberately managing them in an emergency

9Pub. L. No. 116-136, §§ 1107(a)(6), 1110, 134 Stat. 281, 302, 306.
10The Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020,
deemed COVID-19 a disaster under the Small Business Act, which made businesses
experiencing economic injury caused by COVID-19 eligible for EIDLs. As a result, SBA
began using existing $1.1 billion in loan credit subsidy to provide EIDLs to these affected
businesses. The $1.1 billion in loan credit subsidy supported between $7 and $8 billion in
EIDL loans. Loan credit subsidy covers the government’s cost of extending or
guaranteeing credit and takes into consideration the estimated cash flows to and from the
government. The loan credit subsidy amount is estimated to be about one-seventh of the
cost of each disaster loan.
11SBA provided advances using the $10 billion Congress appropriated under the CARES
Act. On April 16, 2020, SBA announced that the lending authority for EIDL loans and the
funding for EIDL advances had been exhausted. Under the Paycheck Protection Program
and Health Care Enhancement Act, Congress appropriated another $10 billion for
advances and $50 billion in loan credit subsidy for EIDL loans. Additionally, Congress
made agricultural enterprises eligible for EIDL loans and advances. SBA began accepting
new applications from only agricultural enterprises on May 4, 2020. On June 15, 2020,
SBA reopened the application portal to all eligible applicants. Congress appropriated an
additional $20 billion for targeted EIDL advances to eligible entities located in low-income
communities with 300 or fewer employees that experienced an economic loss of greater
than 30 percent in the Consolidated Appropriations Act, 2021. Qualifying entities may
receive up to $10,000 in targeted advances. The American Rescue Plan Act of 2021
appropriated an additional $10 billion for the targeted EIDL advances; and $5 billion for a
newly created $5,000 targeted EIDL advance program for business entities that qualified
for the targeted EIDL advances but also meet smaller (employs less than 10 employees)
and more economically harmed (economic loss greater than 50 percent) criteria than the
original targeted EIDL advances. Pub. L. No. 117-2, § 5002, 135 Stat. 4, 85. The act also
appropriated $70 million for EIDL loans. Pub. L. No. 117-2, § 5006, 135 Stat. at 92.
12GAO-20-625.
Internal Controls and
Emergency Relief Funds

Page 5
GAO-21-498T
environment, can help federal managers safeguard public resources
while providing needed relief.
According to federal internal control standards and GAO’s Fraud Risk
Framework, managers in executive branch agencies are responsible for
managing fraud risks and implementing practices for mitigating those
risks.13 When fraud risks can be identified and mitigated, fraud may be
less likely to occur.14
Program overview. PPP loans, which are made by lenders but
guaranteed 100 percent by SBA, are low interest (1 percent) and fully
forgivable if certain conditions are met. Subsequent legislation has
modified the program, including the Paycheck Protection Program
Flexibility Act of 2020, the Consolidated Appropriations Act, 2021, and the
American Rescue Plan Act of 2021.15 As modified, at least 60 percent of
the loan forgiveness amount must be for payroll or other eligible
expenses to qualify for full loan forgiveness, and there is a simplified loan
forgiveness application process for loans of $150,000 or less.16 PPP
initially ended on August 8, 2020, but the Consolidated Appropriations

13GAO, Standards for Internal Control in the Federal Government, GAO-14-704G
(Washington, D.C.: Sept. 10, 2014); and A Framework for Managing Fraud Risks in
Federal Programs, GAO-15-593SP (Washington, D.C.: July 18, 2015).
14“Fraud” and “fraud risk” are distinct concepts. Fraud involves obtaining something of
value through willful misrepresentation. Fraud risk exists when individuals have an
opportunity to engage in fraudulent activity, have an incentive or are under pressure to
commit fraud, or are able to rationalize committing fraud. A fraud risk can exist even if
fraud has not yet been identified or occurred. When fraud risks can be identified and
mitigated, fraud may be less likely to occur. Determining if an act is fraud is beyond
management’s professional responsibility for assessing risk (such determinations are
made through judicial or adjudicative systems). See GAO, Medicare and Medicaid: CMS
Needs to Fully Align Its Antifraud Efforts with the Fraud Risk Framework, GAO-18-88
(Washington, D.C.: Dec. 5, 2017).
15For example, the Consolidated Appropriations Act, 2021, expanded the list of allowable
uses of proceeds and loan forgiveness to include certain operations, property damage,
supplier, and worker protection expenditures. Pub. L No. 116-260, div. N, tit. III, § 304,
134 Stat. at 1993-94 (2020).
16Under the Consolidated Appropriations Act, 2021, the loan forgiveness certification
should not be more than one page in length and should only require borrowers to provide
a description of the number of employees they were able to retain because of the loan, the
estimated amount of the loan amount spent on payroll costs, and the total loan value.
Borrowers must also attest that they complied with all PPP loan requirements. Borrowers
must retain relevant employment records for 4 years following submission of the form and
other relevant records for 3 years. SBA retains the right to review and audit these loans for
fraud.
SBA Has Made
Some Improvements
in Response to
Identified
Weaknesses in PPP

Page 6
GAO-21-498T
Act, 2021, authorized additional loans under the program, including
second PPP loans of up to $2 million for PPP borrowers provided they
meet certain criteria.17 SBA relaunched the program (Round 2) on
January 11, 2021, and small businesses can apply for a PPP loan
through May 31, 2021.18
Program usage. According to SBA, as of April 4, 2021, lenders had
made about 9.1 million PPP loans totaling about $746 billion. The majority
of these loans (5.3 million loans totaling more than $521 billion, according
to SBA) were made during Round 1 of PPP, which ended August 8,
2020.19
Implementing oversight plans. Given the immediate need for
emergency funding, SBA implemented PPP quickly with limited
safeguards for approving PPP loans.
In June 2020, we reported that SBA’s initial interim final rule for PPP
allows lenders to rely on borrowers’ certifying their eligibility and the use
of loan proceeds.20 It also requires a limited review by the lender of
documents provided by the borrower to determine the qualifying loan
amount and eligibility for loan forgiveness.21 We noted that reliance on
borrower self-certifications can leave a program vulnerable to exploitation
by those who wish to circumvent eligibility requirements or pursue
criminal activities.

17PPP borrowers are eligible to receive a second PPP loan of up to $2 million provided
that they meet certain criteria, such as having not more than 300 employees, having used
or intending to use the full amount of their initial PPP loan, and documenting quarterly
revenue losses of at least 25 percent in a quarter of 2020 when compared to the same
quarter in 2019. Pub. L No. 116-260, div. N, tit. III, § 311, 134 Stat. 1182, 2001 (2020);
see also 86 Fed. Reg. 3712 (Jan. 14, 2021).
18The PPP Extension Act of 2021 extended the PPP covered period until June 30, 2021,
but does not allow SBA to accept new applications starting June 1. Pub. L. No. 117-6, 135
Stat. 250.
19Totals exclude canceled loans. According to SBA, canceled loans may include, but are
not limited to, duplicative loans, loans not closed for any reason, and loans that were fully
paid off. In our September 2020 report, we provided information on the types of borrowers
that received PPP loans and the size of PPP loans.
20GAO-20-625.
21As previously noted, Congress later included a hold harmless provision in the
Consolidated Appropriations Act, 2021. Pub. L. No. 116-260, div. N, tit. III, § 305, 134
Stat. 1182, 1996-97 (2020).

Page 7
GAO-21-498T
We also reported that because SBA had limited time to implement
safeguards for the PPP loan approval process and assess program risks,
ongoing oversight would be crucial. At that time, SBA had announced that
it would review loans of more than $2 million to confirm borrower eligibility
after the borrower applied for loan forgiveness, and that it might review
any PPP loan it deemed appropriate. However, SBA provided few details
on these reviews at that time. Therefore, we recommended that SBA
develop and implement plans to identify and respond to risks in PPP to
ensure program integrity, achieve program effectiveness, and address
potential fraud, including in loans of $2 million or less. SBA neither agreed
nor disagreed with our recommendation at that time.
In December 2020, SBA officials said the agency had completed
oversight plans and provided a Loan Review Plan for the loan review
process. The plan references detailed policies and procedures for loan
reviews and loan forgiveness reviews. In February 2021, SBA provided
seven of the eight documents referenced in the plan and stated that the
last document covering reviews of loans of $2 million or greater was still
being finalized. The documents SBA provided include additional details
on how SBA and its contractors will conduct the various reviews,
including manual reviews conducted by contractor staff. We continue to
review these documents to determine the extent to which they address
our recommendation.
According to SBA documentation, there are three steps in the loan review
process for loans approved in 2020: automated screenings of all loans,
manual reviews of selected loans, and quality control reviews to ensure
the quality, completeness, and consistency of the review process.
•
Automated reviews. A contractor is to use a proprietary, automated
tool to screen every disbursed PPP loan by applying eligibility and
fraud detection rules to identify anomalies and attributes that may be
indicative of noncompliance, fraud, or abuse.
•
Manual reviews. A contractor is to manually review loans for issues
identified through the automated tool and provide SBA with an
analysis and recommendation for either (1) further action, if the loan
contains indications of noncompliance, fraud, or abuse (“unresolved”),
or (2) no further action, if the loan following review does not contain
indications of noncompliance, fraud, or abuse (“resolved”).
SBA is to manually review (1) all loans of $2 million or greater, (2) all
unresolved loans of less than $2 million, and (3) a statistically valid

Page 8
GAO-21-498T
sample of resolved loans of less than $2 million where the contractor
recommended no further action.
•
Quality control reviews. A separate contractor is to conduct quality
control reviews of a sample of loan review files after SBA has
conducted its review and made its determination.
In addition, SBA has added up-front controls to PPP as part of its
implementation of Round 2 of the program. In the initial round of PPP,
SBA did not conduct reviews of loan or borrower information before
issuing a loan number. However, before SBA approves a loan during
Round 2, the loan must pass front-end compliance checks of loan and
borrower information. These reviews compare loan applications against
Treasury’s Do Not Pay service and public records, according to SBA
officials and documentation.22 Among other things, these validation efforts
include determining whether the loan applicant business was in operation
as of February 15, 2020. According to SBA, these checks have added
time to the initial processing of the loans. However, according to SBA
officials, as of March 2021, SBA was approving more than 96 percent of
the applications within 48 hours after submission.
Estimating improper payments. The limited safeguards for approving
PPP loans may have increased SBA’s susceptibility to improper
payments and fraud. However, SBA has not estimated the magnitude of
potential improper payments.
As we reported in November 2020, it is especially important for agencies
with large appropriated amounts, like SBA, to quickly estimate their
improper payments, identify root causes, and develop corrective actions
when there are concerns about the possibility that improper payments,
including those resulting from fraudulent activity, could be widespread.23
Because SBA had not taken these measures for PPP, we recommended
that SBA expeditiously estimate improper payments and report estimates
and error rates for PPP because of concerns about the possibility that
improper payments, including those resulting from fraudulent activity,

22Treasury’s Do Not Pay service is an analytics tool that helps federal agencies detect and
prevent improper payments made to vendors, grantees, loan recipients, and beneficiaries.
Agencies can check multiple data sources to make payment eligibility decisions.
23GAO-21-191.

Page 9
GAO-21-498T
could be widespread. SBA neither agreed nor disagreed with our
recommendation at that time.
In response to our recommendation, SBA stated that it was planning to
conduct improper payment testing for PPP and that it took improper
payments seriously. In February 2021, SBA officials stated that SBA had
submitted the sampling plan for this testing to the Office of Management
and Budget and would use this sampling plan to estimate both improper
payments and error rates for PPP. We will continue to monitor the
agency’s actions to address this recommendation.
Identifying and mitigating fraud risk. In January 2021, we reported on
potentially suspicious activity in PPP.24 From April through October 2020,
financial institutions filed more than 21,000 suspicious activity reports
(SAR) related to PPP with the Financial Crimes Enforcement Network
(FinCEN). These reports identified multiple types of potentially suspicious
activity related to PPP, such as indicators of identity theft, the rapid
movement of funds, and forgeries. Although the filing of a SAR does not
necessarily mean that fraud has occurred, law enforcement agencies use
these reports to help support investigations, such as those related to PPP
fraud.25 Over 1,400 institutions had filed SARs related to PPP from April
through October 2020, and the number of SARs filed generally increased
during this period.26

24GAO-21-265. We analyzed aggregate SAR data across U.S. financial institutions from
April through October 2020. These data did not include identifying information on financial
institutions that filed SARs, such as PPP lender status.
25SARs are reports certain financial institutions are required to file if a transaction involves
or aggregates at least a certain dollar amount in funds or other assets (generally $5,000),
and the institution knows, suspects, or has reason to suspect that the transaction is
designed to evade any Bank Secrecy Act requirements or involves money laundering, tax
evasion, or other criminal activities. See, e.g. 31 C.F.R. § 1020.320. Under the Bank
Secrecy Act’s implementing regulations, banks are also required to file a SAR when a
transaction meets certain other criteria, such as for known or suspected criminal violations
involving insider abuse of any amount. 12 C.F.R. §§ 21.11(c), 163.180(d)(3); 12 C.F.R. §
208.62(c); 12 C.F.R. § 353.3(a). Law enforcement agencies query FinCEN systems as
part of their investigations of potential financial and other crimes.
26Banks and other financial institutions must file a SAR no later than 30 calendar days
after the date of initial detection of facts that may constitute a basis for filing a SAR. If no
suspect is identified on the date of detection of the incident requiring the filing, the
financial institution may delay filing a SAR for an additional 30 calendar days to identify a
suspect, but the report must be filed no more than 60 calendar days after the date of initial
detection of a reportable transaction.

Page 10
GAO-21-498T
DOJ and law enforcement agencies have reported ongoing efforts related
to potential fraud in PPP. From May 2020 through February 2021, DOJ
publicly announced charges in over 100 fraud-related cases associated
with PPP loans, charging at least 170 defendants. The charges—filed in
federal courts across the U.S. and investigated by a range of law
enforcement agencies—include allegations of making false statements
and engaging in identity theft, wire and bank fraud, and money
laundering. As of February 2021, over 30 defendants had pleaded guilty
to federal charges of defrauding PPP.
In addition to ongoing prosecutions, law enforcement officials we spoke
with noted a large number of ongoing investigations and hotline
complaints related to CARES Act loans, including PPP and the EIDL
program. A senior official with SBA OIG told us that, as of January 2021,
the OIG had opened over 260 investigations related to CARES Act loans,
at least three times the number of investigations the office would typically
open in a year. Similarly, SBA OIG reported receiving over 70,000 hotline
complaints related to CARES Act programs, compared to the 700 to 800
it would receive in a typical year.
Law enforcement officials also reported systemic patterns of fraud across
PPP and EIDL investigations. Officials at SBA OIG and the FBI told us
that they have identified systemic patterns of potential fraud, including
identity theft, false attestations on loan documents, fictitious and inflated
employee counts, falsified tax documentation, and misuse of proceeds.
Additionally, the FBI reported in June 2020 that early investigations of
PPP-related fraud involved bank insiders, previously convicted felons, the
use of dormant or cash businesses, and identity theft.
In March 2021, we found that SBA had taken some steps to mitigate
fraud risks to PPP.27 According to SBA officials, they conducted an
informal fraud risk assessment for PPP that resulted in reviews and the
addition of some upfront controls, as discussed above. For example, SBA
brought together subject matter experts from SBA and Treasury, as well
as contractors, to identify fraud risks and mitigating controls for the
program. To identify fraud risks, SBA used information on vulnerabilities
observed through existing loan reviews as well as information from
external sources, such as SBA OIG reports. In February 2021, SBA
officials told us the agency would complete a formal fraud risk

27GAO-21-387.

Page 11
GAO-21-498T
assessment but did not provide a firm date for when they would complete
such an assessment.
Because SBA had not conducted a formal fraud risk assessment for PPP,
we recommended in March 2021 that SBA (1) conduct and document a
fraud risk assessment for PPP and (2) develop a strategy that outlines
specific actions to monitor and manage fraud risks in PPP on a
continuous basis. SBA agreed with the recommendations, stating that it
would work to ensure that a fraud risk assessment for PPP is completed
and that fraud risks are monitored on a continuous basis.
Supporting PPP transactions and related controls. In December
2020, SBA’s independent financial statement auditor issued a disclaimer
of opinion on SBA’s fiscal year 2020 consolidated financial statements,
meaning the auditor was unable to express an opinion due to insufficient
evidence.28 As the basis for the disclaimer, the auditor reported that SBA
was unable to provide adequate documentation to support a significant
number of transactions and account balances related to PPP due to
inadequate processes and controls.
The auditor identified several material weaknesses in controls related to
SBA’s CARES Act programs, including PPP. In its discussion of material
weaknesses related to PPP, the auditor noted there were over 2 million
approved PPP loans (with an approximate total value of $189 billion)
flagged by management that were potentially not in conformance with the
CARES Act and related legislation. SBA management flagged the loans
for one or more of 35 reasons (such as borrowers with criminal record or
inactive businesses). In addition, the auditor found that SBA reported
approximately $6 billion of PPP loans approved but not disbursed
because of unsubmitted or unprocessed reports from lenders. In addition,
the auditor noted there were over 896,000 errors from lender reporting
that were identified but not reviewed or processed. The auditor
recommended that SBA review loans with incomplete or inaccurate
reporting and update records as appropriate, among other things.

28A disclaimer of opinion indicates that sufficient information was not available for the
auditors to determine whether the reported financial statements were fairly presented in
accordance with Generally Accepted Accounting Principles. Small Business
Administration, Office of Performance Management and the Chief Financial Officer,
Agency Financial Report Fiscal Year 2020.

Page 12
GAO-21-498T
We support the recommendations the auditor provided to address control
weaknesses related to PPP, and we encourage SBA to continue to work
to improve its controls over the program, as well as to improve its
documentation to support future financial statement audits. Our audit of
the U.S. government’s fiscal years 2020 and 2019 consolidated financial
statements noted that SBA’s internal control deficiencies significantly
increase the risk of misstatements, noncompliance, fraud and other
improper payments.29 These deficiencies also contribute to the federal
government’s inability to reasonably estimate the value of receivables and
liabilities associated with lending programs.
Program overview. The EIDL program provides low-interest loans of up
to $2 million for expenses—such as operating expenses—that cannot be
met because of a disaster. The CARES Act expanded EIDL program
eligibility to include additional small business entities and relaxed some
approval requirements, such as demonstrating that the business could
not obtain credit elsewhere.30 Congress also appropriated $10 billion
through the CARES Act to provide small businesses up to $10,000 in
advances toward payroll, sick leave, and other business obligations,
which borrowers do not have to repay, even if they are subsequently
denied the EIDL. Through the Paycheck Protection Program and Health
Care Enhancement Act, Congress appropriated $50 billion in loan credit
subsidies for the cost of EIDL loans and an additional $10 billion for
advances.31
On December 27, 2020, under the Consolidated Appropriations Act,
2021, Congress appropriated an additional $20 billion for targeted EIDL
advances. These targeted advances are restricted to certain eligible
entities located in low-income communities that experienced an economic
loss of greater than 30 percent and have no more than 300 employees.
Qualifying entities may receive up to $10,000 in targeted advances.
Previously, SBA calculated the advances provided under the CARES Act
based on the applicant’s number of employees, up to $10,000. On March

29GAO, Financial Audit: FY 2020 and FY 2019 Consolidated Financial Statements of the
U.S. Government, GAO-21-340R (Washington, D.C.: Mar. 25, 2021).
30Prior to CARES Act changes, eligible businesses included small businesses, most
private nonprofits of any size, small aquaculture enterprises, and small agricultural
cooperatives.
31The American Rescue Plan Act of 2021 appropriated an additional $70 million for EIDL
loans.
SBA Has Begun
Adding Controls to
Detect Fraud and
Determine Eligibility
in the Economic
Injury Disaster Loan
Program

Page 13
GAO-21-498T
11, 2021, under the American Rescue Plan Act of 2021, Congress
appropriated additional funding for entities that qualified for targeted EIDL
advances under the Consolidated Appropriations Act, 2021.32 Congress
appropriated an additional $10 billion for eligible entities that have not
received the full amount of $10,000 in targeted EIDL advances. Congress
also appropriated $5 billion to provide an additional $5,000 for eligible
entities in low-income communities that suffered economic loss of greater
than 50 percent and employ not more than 10 employees. The $5,000 is
available in addition to advances obtained under the CARES Act or
targeted advances under the Consolidated Appropriations Act, 2021.
Program usage. As of April 1, 2021, SBA had approved about 3.8 million
EIDL loans totaling about $202 billion (or an average of about $53,500
per loan). On July 11, 2020, SBA announced that it had fully allocated the
$20 billion in funding for EIDL advances and would stop making advances
to new applicants. Prior to then, SBA received about 10 million
applications for EIDL advances related to COVID-19, and it approved
about 5.8 million of these applications totaling $20 billion (or an average
of about $3,500 per advance). SBA began implementing the targeted
EIDL advances program on February 1, 2021.
Detecting potentially ineligible and fraudulent applicants. The
CARES Act relaxed some approval requirements for EIDL, such as
requiring the applicant to demonstrate that it could not obtain credit
elsewhere and restricting SBA from obtaining tax transcripts. In January
2021, we reported that as of July 14, 2020, SBA had provided about
5,000 advances totaling about $26 million to potentially ineligible
businesses in three types of industries—adult entertainment, casino
gambling, and marijuana retail.33 Additionally, we reported that as of
September 30, 2020, SBA approved at least 3,000 loans totaling about
$156 million to potentially ineligible businesses that SBA policies state
were ineligible for the EIDL program, such as real estate developers and
multilevel marketers.34

32Pub. L. No. 117-2, §§ 5002, 5006, 135 Stat. 4, 85, 92.
33GAO-21-265.
34Multilevel marketing is a business structure or practice in which an individual seller earns
income both from direct sales and from the sales of the seller’s recruits, or those recruited
by the seller’s recruits.

Page 14
GAO-21-498T
Therefore, we recommended in January 2021 that to improve SBA’s
oversight of its EIDL approval process, SBA should develop and
implement portfolio-level data analytics across EIDL loans and advances
made in response to COVID-19 as a means to detect potentially ineligible
and fraudulent applications.35
SBA neither agreed nor disagreed with our recommendation. SBA took
issue with our finding that potentially ineligible businesses received EIDL
advances and loans. SBA stated that CARES Act provisions permitted
businesses to self-certify their eligibility and that applicants could not
proceed until they certified that they were not engaged in any of the
prohibited activities. The agency also stated that a business being in one
of the categories we deemed ineligible did not automatically mean the
business was ineligible. However, we did not state that the businesses
were automatically ineligible.
SBA also referred to actions the agency takes to ensure ineligible
businesses do not receive EIDL loans, such as manual review of
applications from businesses in prohibited categories. But SBA did not
state it had any plans to conduct data analytics to identify potential
ineligible businesses. We maintain that portfolio-level data analytics could
help SBA improve its management of fraud risk.
SBA has begun adding additional verifications for the targeted EIDL
advance program. As part of the Consolidated Appropriations Act, 2021,
Congress requires SBA to perform eligibility verification for targeted
advances, and it permitted SBA to require additional information from
applicants, such as tax returns, for loans and advances as part of its
verification. According to SBA officials, SBA has procured a contractor to
map the primary business address to help ensure that the applicant
meets program requirements. In addition, they have begun to obtain and
review applicants’ IRS tax information and check for matches against the
Treasury Do Not Pay list. The CARES Act previously restricted SBA from

35GAO’s Fraud Risk Framework cites data analytics as a leading practice in developing
specific control activities to prevent and detect fraud—in particular, to mitigate the
likelihood and impact of fraud. Data analytics can be used to detect potential fraud and
can include a variety of techniques, such as data mining, data matching, and predictive
analytics, to identity particular types of behavior. Such efforts can be conducted across a
portfolio of all loans or activities to identify patterns or anomalies.

Page 15
GAO-21-498T
using this IRS tax information, including to verify eligibility for the EIDL
advances.
Identifying and mitigating fraud risk. Similar to PPP, we reported on
potentially suspicious activity in EIDL in January 2021.36 Between May
and October 2020, over 900 U.S. financial institutions filed more than
20,000 suspicious activity reports related to the EIDL program. These
reports identified multiple types of potentially suspicious activity related to
EIDL, such as indicators of identity theft, the rapid movement of funds,
and forgeries.
In October 2020, SBA OIG reported that its preliminary review revealed
strong indicators of widespread potential fraud in the EIDL program.
According to the report, OIG and other law enforcement agencies had
seized over $450 million from over 15,000 fraudulent EIDL loans.
DOJ and law enforcement agencies report ongoing efforts related to
potential fraud in the EIDL program. From May 2020 through February
2021, DOJ publicly announced charges in over 30 fraud-related cases
associated with EIDL loans and charged over 50 defendants. The
charges—filed in federal courts across the U.S. and investigated by a
range of law enforcement agencies—include allegations of making false
statements and engaging in identity theft, wire and bank fraud, and
money laundering. As of February 2021, at least five defendants had
pleaded guilty to federal charges of defrauding the EIDL program.
Law enforcement officials we spoke with also noted many ongoing
investigations and hotline complaints related to CARES Act loans,
including the EIDL program and PPP. Similar to PPP, they have also
reported systemic patterns of fraud across EIDL investigations.
In March 2021, we found that SBA had taken some steps to mitigate
fraud risks in the EIDL program.37 SBA conducted an informal fraud risk
assessment for EIDL that resulted in new and enhanced internal controls,
according to SBA officials. For example, SBA began conducting eligibility
checks through the Department of the Treasury’s Do Not Pay service and
plans to obtain 2019 tax information from IRS for the targeted advances.
The agency also considered fraud risks facing EIDL, the sources and

36GAO-21-265.
37GAO-21-387.

Page 16
GAO-21-498T
likelihood of those risks, and residual risks.38 Additionally, SBA officials
told us SBA increased staffing for its OIG liaison team that reviews
suspicious loans flagged by loan officers and forwards referrals to SBA
OIG. According to SBA OIG, as of January 2021, it had received nearly
750,000 of these referrals related to identity theft and over 585,000
referrals related to other potentially fraudulent activities associated with
the EIDL program.
Because SBA had not conducted a formal fraud risk assessment for
EIDL, we recommended in March 2021 that SBA (1) conduct and
document a fraud risk assessment for the EIDL program and (2) develop
a strategy that outlines specific actions to address assessed fraud risks in
the EIDL program on a continuous basis. SBA agreed with the
recommendations, stating that it would work to ensure that a fraud risk
assessment for EIDL is completed and that fraud risks are monitored on a
continuous basis.
Implementing oversight plans. As discussed above, we and others
have identified gaps in controls that may have led to fraud and the
provision of EIDL funding to ineligible entities. However, we reported in
March 2021 that SBA’s Office of Disaster Assistance, which administers
the EIDL program, had not proactively assessed risks to the program.39
SBA officials told us that SBA does not have documented risk
assessments and that SBA has identified problems primarily through loan
officer review of loan applications.
The lack of a comprehensive plan to proactively assess controls and
mitigate risks in the EIDL program may hinder SBA from achieving the
defined objectives of the program and identifying opportunities for
improving preventive controls in a timely manner. For example, SBA
officials told us that 4 months after SBA started using the service
organization’s automated validation system to approve loan applications
in batches, they realized that these applications contained alerts that
should have been further reviewed by loan officers.
Because SBA did not have a plan for responding to EIDL risks, we
recommended in March 2021 that SBA implement a comprehensive

38According to federal internal control standards, inherent risk is the risk to an entity prior
to considering management’s response to the risk. Residual risk is the risk that remains
after management’s response to inherent risk.
39GAO-21-387.

Page 17
GAO-21-498T
oversight plan to identify and respond to risks in the EIDL program to help
ensure program integrity, achieve program effectiveness, and address
potential fraud. SBA agreed with the recommendation, stating that it
would implement a comprehensive oversight plan for EIDL.
Ensuring adequate controls over EIDL approvals and contractors.
SBA’s independent financial statement auditor also found material
weaknesses related to SBA’s processing of EIDL loans and advances
and contractor oversight, and these weaknesses contributed to the
auditor’s disclaimer of opinion on SBA’s financial statements. To process
EIDL loans and advances, SBA used a contractor system to first
automatically validate applicants and then issue alerts, including fraud
alerts, which SBA loan officers were to review and mitigate. The auditor
determined that SBA did not adequately design and implement controls to
ensure that loan officers accurately recorded and approved EIDL loan
and advances for eligible borrowers. Further, SBA did not design and
implement controls to ensure loan officers addressed fraud alerts before
they approved applications. The auditor also determined that SBA did not
adequately design and implement internal controls for evaluating and
monitoring the contractor’s controls for the validation system.
We support the recommendations the auditor provided to address control
weaknesses related to EIDL, and we encourage SBA to continue to work
to improve its controls over the program, as well as to improve its
documentation to support future financial statement audits.
Our work on PPP and EIDL is ongoing. As mentioned above, we recently
received a significant amount of additional information and data from SBA
and its contractors, which we are beginning to analyze. For PPP, we
continue to examine the safeguards SBA implemented to help ensure that
lenders and borrowers complied with program requirements and the loan
forgiveness process. We have received additional information on PPP
loan reviews, including information provided during interviews with
contractors performing some of the reviews. SBA also recently provided
loan-level information for those borrowers who have applied for
forgiveness, which we are using to evaluate the forgiveness process. In
addition, we have surveyed a generalizable sample of PPP lenders to
obtain their perspectives on the program.
For EIDL, we have ongoing work to examine SBA actions to address
internal control weaknesses and the integrity of the EIDL program. We
recently received written answers from SBA’s contractor and
subcontractors for EIDL and are reviewing the information. In addition, we

Page 18
GAO-21-498T
remain concerned about fraud risks in the EIDL program and have
ongoing work related to fraud risk management.
For both programs, we also continue to monitor SBA’s progress toward
developing and implementing corrective actions to address the material
weaknesses identified by its financial statement auditor.
Chairwoman Velázquez, Ranking Member Luetkemeyer, and Members of
the Committee, this concludes my statement. I would be pleased to
respond to any questions you may have.
If you or your staff have any questions about this testimony, please
contact William B. Shear, Director, Financial Markets and Community
Investment, at (202) 512-8678 or shearw@gao.gov. Contact points for
our Offices of Congressional Relations and Public Affairs may be found
on the last page of this statement. GAO staff who made key contributions
to this testimony are Paige Smith (Assistant Director), Marshall Hamlett
(Assistant Director), Daniel Newman (Analyst in Charge), Marcia Carlsen,
Irina Carnevale, Jacob Fender, Dan Flavin, Jessica Sandler, Shenandoah
Sowash, Tyler Spunaugle, and Weifei Zheng.

GAO Contact and
Staff
Acknowledgments
(105078)

This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.

The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost is
through our website. Each weekday afternoon, GAO posts on its website newly
released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
Contact FraudNet:
Website: https://www.gao.gov/fraudnet/fraudnet.htm
Automated answering system: (800) 424-5454 or (202) 512-7700
Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400,
U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Washington, DC 20548
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Stephen J. Sanford, Acting Managing Director, spel@gao.gov, (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548

GAO’s Mission
Obtaining Copies of
GAO Reports and
Testimony
Order by Phone
Connect with GAO
To Report Fraud,
Waste, and Abuse in
Federal Programs
Congressional
Relations
Public Affairs
Strategic Planning and
External Liaison
Please Print on Recycled Paper.

File and source

File

21-498t-covid-19-loans-sba-has-begun-to.pdf

Size

345,733 bytes

SHA-256

77939e6bec3c880839845048c0ab72d8b7a11202614f40b446160f5b2fb5f780

Our copy

21-498t-covid-19-loans-sba-has-begun-to.pdf

Original

www.gao.gov