Independent Auditors' Report for the United States Small Business Administration

Source document: Independent Auditors' Report for the United States Small Business Administration; document type: OIG financial statement audit report.

Full text

U.S. Small Business Administration
                                        Office of Inspector General
                                          Washington, D.C. 20416

DATE:
November 15, 2021

TO:

Isabella Casillas Guzman

Administrator

FROM:
Hannibal “Mike” Ware
Inspector General

SUBJECT:
Independent Auditors’ Report on SBA’s FY 2021 Financial Statements
(Report 22-05)
I am pleased to present the attached independent auditors’ report on the U.S. Small Business
Administration’s (SBA’s) consolidated financial statements for fiscal years 2021 and 2020, as
required annually by the Chief Financial Officers Act of 1990, as amended.
We contracted with the independent certified public accounting firm KPMG LLP to conduct an
audit of SBA’s consolidated balance sheets as of September 30, 2021, and for 2020 and the related
notes to these statements.  KPMG was also engaged to audit the consolidated statements of net
cost and changes in net position and combined statement of budgetary resources for the year
ended September 30, 2020, as well as the related notes to those statements.
KPMG was engaged to conduct the audit in accordance with U.S. Generally Accepted Auditing
Standards. The audit also complied with the applicable standards for financial audits in
Government Auditing Standards issued by the Comptroller General of the United States and Office
of Management and Budget Bulletin No. 21-04, Audit Requirements for Federal Financial
Statements.
In the report, KPMG auditors found significant matters for which they were unable to obtain
sufficient, appropriate audit evidence to provide a basis for an audit opinion on SBA’s consolidated
financial statements for the year ended September 30, 2021. Accordingly, KPMG issued a
disclaimer of opinion on the consolidated financial statements as of and for the year ended
September 30, 2021, and for 2020.
The basis for the disclaimer was that, due to inadequate processes and controls, SBA was unable
to provide adequate evidential matter in support of a significant number of transactions and
account balances related to the expanded Paycheck Protection and Economic Injury Disaster Loan
programs and the newly implemented Restaurant Revitalization and Shuttered Venues Operators
Grant programs.
As a result, KPMG was unable to determine whether any adjustments might have been necessary
with respect to the following:
• Loans Receivable (net)
• Advances and Prepayments
• Downward Reestimate Payable to Treasury
• Liability for Loan Guaranties

For the year ended September 30, 2021, KPMG identified six material weaknesses and two
significant deficiencies in internal controls over financial reporting. Appendixes I and II of this
report describe details of KPMG’s conclusions about the material weaknesses and significant
deficiencies. Appendix III describes instances of noncompliance or other matters required to be
reported under Government Auditing Standards or OMB Bulletin No. 21-04.
We reviewed KPMG’s report and related documentation and inquired of its representatives. Our
review, as differentiated from an audit of the financial statements in accordance with U.S.
Generally Accepted Government Auditing Standards, was not intended to enable us to express—
and we do not express—opinions on SBA’s financial statements or internal control over financial
reporting or conclusions on SBA’s compliance with applicable laws and other matters.
KPMG is responsible for the attached auditors’ report dated November 15, 2021, and the
conclusions expressed. However, OIG provides negative assurance of this audit.
Our oversight protocols include evaluation of major work products, attendance at critical
meetings, review of significant findings and examination of related evidential matter. Our review
disclosed no instances where KPMG did not comply in all material respects with U.S. Generally
Accepted Government Auditing Standards.
We provided a draft of KPMG’s audit report to SBA’s Acting Chief Financial Officer, who did not
concur with the severity of five material weaknesses under “PPP Loan Guarantees,” “COVID-19
EIDLs and Grants,” “Subsidy Reestimate,” “Restaurant Revitalization and Shuttered Venues
Operators Grant program,” and “Entity Level Controls.” SBA partially agrees with the material
weakness under “Evaluation of Service Organizations.”

SBA’s responses, as communicated to KPMG during the audit, detail their concerns with the
analysis and conclusions drawn by the auditors. The Acting Chief Financial Officer’s response is
included in Appendix IV, and KPMG’s response to the Acting Chief Financial Officer’s response is
included in Appendix V of this report.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or
your staff have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.

cc:
Antwaun Griffin, Chief of Staff

Arthur Plews, Deputy Chief of Staff
Jason Bossie, Acting Associate Administrator, Office of Performance, Planning,
and the Chief Financial Officer
Patrick Kelly, Associate Administrator, Capital Access
John Miller, Deputy Associate Administrator, Capital Access
James Rivera, Associate Administrator, Disaster Assistance
Erica Gaddy, Deputy Chief Financial Officer
Peggy Delinois Hamilton, General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls
Rafaela Monchek, Director, Office of Continuous Operations and Risk Management

Attachment

KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
KPMG LLP, a Delaware limited liability partnership and a member firm of
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
Independent Auditors’ Report
Inspector General
U.S. Small Business Administration
Administrator
U.S. Small Business Administration
Report on the Financial Statements
We were engaged to audit the accompanying consolidated balance sheets of the United States (U.S.) Small
Business Administration (SBA) as of September 30, 2021 and 2020, and the related notes to these statements.
We were also engaged to audit the consolidated statements of net cost and changes in net position, and
combined statement of budgetary resources for the year ended September 30, 2020 and the related notes to
these statements. These are referred to as the consolidated financial statements.
Management’s Responsibility for the Financial Statements
Management is responsible for the preparation and fair presentation of these consolidated financial statements
in accordance with U.S. generally accepted accounting principles; this includes the design, implementation, and
maintenance of internal control relevant to the preparation and fair presentation of the consolidated financial
statements that are free from material misstatement, whether due to fraud or error.
Auditors’ Responsibility
Our responsibility is to express an opinion on these consolidated financial statements based on conducting the
audit in accordance with auditing standards generally accepted in the United States of America, in accordance
with the standards applicable to financial audits contained in Government Auditing Standards issued by the
Comptroller General of the United States, and in accordance with Office of Management and Budget (OMB)
Bulletin No. 21-04, Audit Requirements for Federal Financial Statements. Because of the matter described in
the Basis for Disclaimer of Opinion paragraph, however, we were not able to obtain sufficient appropriate audit
evidence to provide a basis for an audit opinion.
Basis for Disclaimer of Opinion
During fiscal years 2020 and 2021, the Coronavirus Aid, Relief, and Economic Security Act of 2020 and related
legislations authorized funding for SBA to expand or implement the Paycheck Protection Program, Economic
Injury Disaster Loan program, Restaurant Revitalization program, and Shuttered Venues Operators Grant
program. SBA was unable to provide adequate evidential matter in support of a significant number of
transactions and account balances related to these programs due to inadequate processes and controls. As a
result of these matters, we were unable to determine whether any adjustments might have been necessary
related to Loans Receivable, Net; Advances and Prepayments; Downward Reestimate Payable to Treasury;
and Loan Guarantee Liabilities.
Disclaimer of Opinion
Because of the significance of the matter described in the Basis for Disclaimer of Opinion paragraph, we have
not been able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion.
Accordingly, we do not express an opinion on these consolidated financial statements.

Other Matters
Report on Certain Fiscal Year 2021 Information
We were not engaged to audit the consolidated statements of net cost and changes in net position, and
combined statement of budgetary resources for the year ended September 30, 2021 and the related notes to
these statements and, accordingly we express no opinion on them.
Interactive Data
Management has elected to reference to information on websites or other forms of interactive data outside the
U.S. Small Business Administration’s Fiscal Year 2021 Agency Financial Report to provide additional
information for the users of its consolidated financial statements. Such information is not a required part of the
consolidated financial statements or supplementary information required by the Federal Accounting Standards
Advisory Board. The information on these websites or the other interactive data has not been subjected to any
of our auditing procedures, and accordingly we do not express an opinion or provide any assurance on it.
Required Supplementary Information
U.S. generally accepted accounting principles require that the information in the Management’s Discussion and
Analysis and Required Supplementary Information sections be presented to supplement the consolidated
financial statements. Such information, although not a part of the consolidated financial statements, is required
by the Federal Accounting Standards Advisory Board who considers it to be an essential part of financial
reporting for placing the consolidated financial statements in an appropriate operational, economic, or historical
context. We were unable to apply certain limited procedures to the required supplementary information in
accordance with auditing standards generally accepted in the United States of America because of the
significance of the matters described in the Basis for Disclaimer of Opinion paragraph. We do not express an
opinion or provide any assurance on the information.
Other Information
We were engaged to audit the consolidated financial statements as a whole. The Table of Contents, How this
Report is Organized, Message from the Administrator, Message from the Acting Chief Financial Officer, Other
Information, and the Appendices are presented for purposes of additional analysis and are not a required part
of the consolidated financial statements. Such information has not been subjected to the procedures applied in
our engagement to audit the consolidated financial statements, and accordingly, we do not express an opinion
or provide any assurance on it.
Other Reporting Required by Government Auditing Standards
Internal Control over Financial Reporting
In connection with our engagement to audit the consolidated financial statements, we considered SBA’s
internal control over financial reporting (internal control) as a basis for designing procedures that are
appropriate in the circumstances for the purpose of expressing an opinion on the consolidated financial
statements, but not for the purpose of expressing an opinion on the effectiveness of SBA’s internal control.
Accordingly, we do not express an opinion on the effectiveness of SBA’s internal control. We did not test all
internal controls relevant to operating objectives as broadly defined by the Federal Managers’ Financial
Integrity Act of 1982.
Our consideration of internal control was for the limited purpose described in the preceding paragraph and was
not designed to identify all deficiencies in internal control that might be material weaknesses or significant
deficiencies and therefore, material weaknesses or significant deficiencies may exist that have not been
identified. However, as described in the accompanying Appendices I and II, we did identify certain deficiencies
in internal control that we consider to be material weaknesses and significant deficiencies.
A deficiency in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or detect and correct,

misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in
internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies
described in Appendix I to be material weaknesses.
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe
than a material weakness, yet important enough to merit attention by those charged with governance. We
consider the deficiencies described in Appendix II to be significant deficiencies.
Compliance and Other Matters
In connection with our engagement to audit SBA’s consolidated financial statements, we performed tests of its
compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with
which could have a direct and material effect on the consolidated financial statements. However, providing an
opinion on compliance with those provisions was not an objective of our engagement to audit, and accordingly,
we do not express such an opinion. The results of our tests disclosed instances of noncompliance or other
matters that are required to be reported under Government Auditing Standards or OMB Bulletin No. 21-04, and
which are described in Appendix III.
We also performed tests of SBA’s compliance with certain provisions referred to in Section 803(a) of the
Federal Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with
FFMIA was not an objective of our engagement to audit, and accordingly, we do not express such an opinion.
The results of our tests disclosed instances in which SBA’s financial management systems did not substantially
comply with the (1) Federal financial management systems requirements, and (2) applicable Federal
accounting standards. The results of our tests disclosed no instances in which SBA’s financial management
systems did not substantially comply with the United States Standard General Ledger at the transaction level.
Additionally, if the scope of our work had been sufficient to enable us to express an opinion on the basic
consolidated financial statements, other instances of noncompliance or other matters may have been identified
and reported herein.
SBA’s Response to Findings
SBA’s response to the findings identified in our engagement is described in Appendix IV. SBA’s response was
not subjected to the procedures applied in the engagement to audit the consolidated financial statements and,
accordingly, we express no opinion on the response.
Our response to SBA’s response is included in Appendix V.
Purpose of the Other Reporting Required by Government Auditing Standards
The purpose of the communication described in the Other Reporting Required by Government Auditing
Standards section is solely to describe the scope of our testing of internal control and compliance and the
results of that testing, and not to provide an opinion on the effectiveness of SBA’s internal control or
compliance. Accordingly, this communication is not suitable for any other purpose.

Washington, DC
November 15, 2021

Appendix I
U.S. Small Business Administration
Material Weaknesses
The following deficiencies are considered to be material weaknesses in internal controls over financial
reporting.
1.
Controls over Paycheck Protection Program (PPP) Loan Guarantees Need Improvement
2.
Controls over COVID-19 Economic Injury Disaster Loans (EIDLs) and Grants Need Improvement
3.
Controls over the Subsidy Reestimate Need Improvement
4.
Controls over the Evaluation of Service Organizations Need Improvement
5.
Controls over Accounting and Monitoring of Restaurant Revitalization and Shuttered Venues
Operators Grant Programs Need Improvement
6.
Entity Level Controls Need Improvement
For purposes of presentation and as described below, material weaknesses (1) and (4) have multiple
components. Material weakness (1) Controls over PPP Loan Guarantees Need Improvement, is comprised of:
(A) Approval of PPP Loan Guarantees, (B) Reporting of PPP Loan Guarantees, (C) Review of PPP Loan
Guarantees, and (D) Forgiveness of PPP Loan Guarantees. Material weakness (4) Controls over the
Evaluation of Service Organizations Need Improvement, is comprised of: (A) Service Organization Used for
COVID-19 EIDLs and Grants; and (B) Service Organizations Used for Loan Guarantee Programs.
During fiscal year 2021, Congress passed the Economic Aid to Hard-Hit Small Businesses, Nonprofits,
and Venues Act and the American Rescue Plan Act to continue providing emergency assistance in
response to the extensive effects of the public health and economic crisis arising from the Coronavirus
Disease 2019 (COVID-19) pandemic. In addition to implementing the new and expanded provisions of the
fiscal year 2021 referenced legislations, SBA processed forgiveness payments for the 2020 and 2021 cohort
PPP loan guarantees and continued to issue additional COVID-19 EIDLs. The fiscal year 2021 funding
expanded on the programs authorized by the Coronavirus Aid, Relief, and Economic Security Act of 2020
(CARES Act) and the Paycheck Protection Program and Health Care Enhancement Act during fiscal year
2020 specifically with additional PPP and COVID-19 EIDL Grants funding, and the authorization of the
Restaurant Revitalization and Shuttered Venues Operators Grants (SVOG) programs. The referenced
fiscal year 2020 and 2021 laws from this point forward are collectively referred to as the CARES Act and
related legislation.
1. Controls over PPP Loan Guarantees Need Improvement
A. Approval of PPP Loan Guarantees
Management did not adequately design and implement controls to ensure PPP loan guarantees approved
in fiscal year 2021 were in existence, accurate, and in conformance with CARES Act and related
legislation. Specifically, management identified approved loans disbursed by its third-party lenders that, in
many cases, were potentially not accurate and not in conformance with the CARES Act and related
legislation. Additionally, we tested a sample of 383 PPP loan guarantees from the 2021 cohort and were
unable to verify the existence and accuracy of 32 sampled items because we did not receive a confirmation
response from the respective lenders.
Also, SBA’s process was not designed to identify and resolve a complete list of potential noncompliance
flags that should have been addressed prior to approving the loan guarantees. As of September 30, 2021,
over 27,000 approved PPP loan guarantees (with an approximate total value of $488 million) were flagged

by management in the loan repository system that potentially did not conform with the CARES Act and
related legislation.  More specifically, SBA did not ensure the 2021 cohort of PPP loan guarantee
applications met select program eligibility requirements by verifying with all validation checks available
within its case management system. Instead, only a limited number of checks were performed.
Furthermore, for the flags that SBA identified for an application, SBA did not perform a sufficient review of
the application to ensure that lenders followed established procedures and adequately addressed the
eligibility concerns raised from the case management system’s automated screening.
The deficiencies were caused by an inadequate entity wide control environment to implement processes to
account for new and expanded programs under the CARES Act and related legislation with sufficiently
designed, implemented, and effectively operating controls.
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
The Government Accountability Office’s (GAO’s) Standards for Internal Control in the Federal
Government (“Green Book”), Principle 10, Design Control Activities; and Principle 16, Perform
Monitoring Activities
•
Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for
Enterprise Risk Management and Internal Control
The deficiencies noted above may result in material misstatements to the Loan Guarantee Liabilities,
Downward Reestimate Payable to Treasury line items, and related elements in the consolidated financial
statements.
Recommendations – Approval of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
1. Perform a thorough review of PPP loan guarantee approvals in the 2021 cohort. Based on the
review, determine the impact on the outstanding loan guarantee and the eligibility for
forgiveness of loans that are determined to not be in conformance with the CARES Act and
related legislation and program requirements.
We also recommend the Administrator coordinate with the Acting Chief Financial Officer to:
2. Based on the results of the loan guarantee review process for the 2021 cohort of PPP loan
guarantees, assess the accounting considerations, including the impact on the consolidated
financial statements, and record any necessary adjustments for loans determined to not be in
conformance with the CARES Act and related legislation.
B. Reporting of PPP Loan Guarantees
Management did not adequately design and implement controls to determine that the status of PPP loan
guarantees was complete and accurate to enable the fair presentation of the Loan Guarantee Liabilities
and related elements in the consolidated financial statements. Specifically, management did not have
adequate processes and controls in place to review the status of PPP loan guarantees where lender loan
status reports had not been submitted, had been submitted incorrectly, or were not processed.
As of September 30, 2021, SBA reported approximately $2 billion of approved PPP loan guarantees, but
not disbursed due to unreported or unprocessed lender loan status reports. In addition, there were over 5
million errors during the fiscal year from lender loan status reports that were not reviewed or processed to
update the outstanding loan principal balance. The affected PPP loan guarantees comprised of 74 distinct
lender loan status report error codes (e.g., PPP loans must be fully disbursed, Lender not Reported, Loan
is in inactive status, Invalid Guarantee Service Status Code, Outstanding balance plus Total Amount
Undisbursed cannot exceed Loan Approval Amount, and Outstanding Balance must be less than or equal

to Current Loan Approval Amount).
The deficiencies were caused by an inadequate entity wide control environment to implement processes, and
procedures to account for new and expanded programs under the CARES Act and related legislation with
sufficiently designed, implemented, and effectively operating controls.
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above may result in material misstatements to the Loan Guarantee Liabilities,
Downward Reestimate Payable to Treasury line items and related elements in the consolidated financial
statements.
Recommendations – Reporting of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
3. Design and implement controls to identify and review PPP loan guarantees with incomplete or
inaccurate lender loan status reports.
4. Determine the correct PPP loan balances and ensure the loan repository system is updated
with the correct balance.
5. Develop and enforce a policy and controls that require the adequate training and monitoring of
lenders to execute their responsibilities in the PPP loan servicing process.
6. Develop and enforce a policy and controls to monitor incomplete or inaccurate PPP lender
loan status reports on an ongoing basis.
We also recommend the Administrator coordinate with the Acting Chief Financial Officer to:
7. Based on the results of the lender loan status reports review process for PPP loan
guarantees, design and implement controls to assess the accounting considerations, including
the impact on the consolidated financial statements, and record any necessary adjustments.
C. Review of PPP Loan Guarantees
Management did not adequately design and implement controls to ensure the 2020 cohort of PPP loan
guarantees were completely and accurately reviewed to address their respective eligibility flags and
ultimately determine their eligibility for forgiveness. Specifically, management did not demonstrate controls
over the review and validation of identified flags from the case management system. Additionally,
management did not demonstrate effective monitoring controls over the results from the key contractor
involved in the review process. The loan guarantees determined by the contractor as ‘No Further Action’
were not subsequently reviewed by SBA.
The deficiencies occurred because SBA did not have a policy in place to adequately review outputs of the case
management system and insufficient design and implementation of monitoring controls over the contractor’s
loan review process.
The following criteria were considered with respect to the matter described in the preceding paragraphs:

•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6,
Define Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks;
Principle 10, Design Control Activities; and Principle 16, Perform Monitoring Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above may result in a material misstatement to the Loan Guarantee Liabilities and
Downward Reestimate Payable to Treasury line items, and the related elements in the consolidated
financial statements.
Recommendations – Review of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
8. Develop and enforce a policy and controls that require the adequate review and validation of
the outputs of the case management system.
9. Develop and enforce a policy and controls to monitor the results of the contractor’s loan review
process including a review of loans with a ‘No Further Action’ determination.
D. Forgiveness of PPP Loan Guarantees
Management did not adequately design and implement controls to ensure that forgiveness payments
processed for PPP loan guarantees were accurate and proper in accordance with the CARES Act and
related legislation. The forgiveness review process was insufficiently designed as only a limited number of
PPP forgiveness applications were actually reviewed. Specifically, the review process was not sufficient to
ensure the accuracy and appropriateness of forgiveness payments in accordance with the program terms
for the loan guarantees that were not actually sampled and reviewed. In addition, the review process for
the sample of forgiveness loan applications was not completed prior to the processing of forgiveness
payments. As such, the results of the sample would not effectively prevent forgiveness payments to be
processed for loan guarantees that did not meet the program requirements.
Additionally, management did not design and implement adequate controls to ensure the completeness of
loans in one of the categories that forgiveness applications would be subjected to manual review. The
category of loans subjected to manual review is dependent on the PPP loan review process. Due to the
deficiencies noted in the review of PPP loan guarantees process specific to the case management
system, the PPP loan guarantees in this category that is subject to review may not be complete.
Furthermore, from an analysis performed over the results of the PPP loan review process and forgiveness
payments, $49 billion was paid to lenders for forgiveness of PPP loan guarantees that were still being
reviewed to address alerts and flags indicative of eligibility concerns.
The deficiencies were caused by an insufficient design and implementation of the loan forgiveness review
process prior to the processing of payments, a lack of sufficient and timely coordination between the contractor
involved in the loan review process and SBA, the lack of a policy to adequately review outputs of the case
management system, and insufficient design and implementation of monitoring controls over the contractor’s
loan review process.
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6,
Define Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks; and
Principle 10, Design Control Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

The deficiencies noted above may result in a material misstatement to the Loan Guarantee Liabilities and
Downward Reestimate Payable to Treasury line items, and the related elements in the consolidated
financial statements.
Recommendations – Forgiveness of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
10. Design adequate controls and processes to ensure forgiveness payments are not processed
for loan guarantees that have not been sufficiently reviewed.
2.
Controls over COVID-19 EIDLs and Grants Need Improvement
Management did not adequately design and implement controls to ensure that approved COVID-19 EIDLs and
grants were provided to eligible borrowers and accurately recorded. Specifically, SBA approved and disbursed
COVID-19 EIDLs and grants in the following instances:
•
More than one COVID-19 EIDL or grant was approved and disbursed to the same borrower;
•
According to law enforcement agencies, COVID-19 EIDLs and grants were issued to
borrowers with fraudulent tax identification numbers;
•
COVID-19 EIDLs were issued that management flagged to be potentially fraudulent, a victim
of identity theft, or where the borrower or the bank was involved in an Office of Inspector
General investigation; and
•
COVID-19 EIDLs and grants with eligibility concerns were issued to borrowers.
As of September 30, 2021, over 500,000 approved and disbursed COVID-19 EIDLs (with an approximate total
value of over $30 billion) were flagged in the loan repository system as issued to potentially ineligible
borrowers. The loans were flagged for one or more of 20 different reasons (e.g., Data Anomaly Issue; General
Eligibility; Potential Fraud; Borrower or Lender is Involved in Office of Inspector General Investigation; Lender
Referrals; Duplicate Tax Identification Number; Business Identification Theft Flag; Federal Bureau of
Investigation- Identified as Fraudulent Tax Identification Number; EIDL Criminal Record; EIDL Bankruptcy;
EIDL Office of Foreign Assets Control; EIDL Potential Descendent; EIDL Inactive Business; EIDL Mismatch of
Tax Identification Number; EIDL Mismatch of Entity Name; Confirmed Fraud; Fraud; Potential Identity Theft;
Confirmed Identity Theft; and Pandemic Response Accountability Committee Fraud Referral). According to
management, a review plan was implemented and ongoing to address the COVID-19 EIDLs identified with
eligibility concerns.
Also, management did not implement adequate procedures and controls to address certain alerts within the
system. Specifically, the system’s Reference Guide that is used by loan officers during the approval process did
not have adequate procedures to address the following alerts: Public records search did not find business;
Bank account or routing number could not be verified; Bank account could not be confirmed to be associated
with the business; Deferred student loans; Foreclosure; and Outstanding lawsuit.
The deficiencies were caused by an inadequate entity wide control environment to implement processes and
procedures to account for the new and expanded programs under the CARES Act and related legislation with
sufficiently designed, implemented, and effectively operating controls.
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities

•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above may result in a material misstatement of the Loan Receivables (net) and
Downward Reestimate Payable to Treasury line items, and related elements in the consolidated financial
statements.
Recommendations – Controls over COVID-19 EIDLs and Grants
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
11. Develop and execute a thorough, formal review plan of the COVID-19 EIDLs and grants
portfolios and determine which transactions were made to ineligible recipients and did not
conform with the CARES Act and related legislation.
12. Implement controls that prevent or detect COVID-19 EIDLs from being approved that are not
in conformance with the related legislation and program’s eligibility terms.
13. Update the Reference Guide to require a more thorough review to clear certain alerts and
enforce the actions recommended by the Reference Guide to adequately address and mitigate
the alerts prior to COVID-19 EIDLs approval.
14. Provide training for loan officers and team leads to reinforce their responsibilities in
accordance with established and updated guidance and standard operating procedures.
We also recommend the Administrator coordinate with the Acting Chief Financial Officer to:
15. Based on the results of the review process for COVID-19 EIDLs and grants, assess the
accounting considerations, including the impact on the consolidated financial statements, and
record any necessary adjustments for transactions determined not to be in conformance with
the CARES Act and related legislation.
3. Controls over the Subsidy Reestimate Need Improvement
Management did not adequately design and implement controls over the review of the data inputs used in
the PPP subsidy reestimate. Specifically, management did not consider and document the effects on the
reestimate methodology regarding:
•
PPP loan guarantees with lender loan status report errors that were not reviewed or
processed to update the outstanding loan principal balance. This includes lender loan status
reports that were not submitted, submitted incorrectly, or did not process due to an error. As
such, management did not have sufficient controls to ensure the unpaid principal balance of
loan guarantees within the portfolio, on which the reestimate is performed, is complete and
accurate.
•
The results from SBA’s loan review process that were used to develop a significant assumption
in the PPP reestimate model. However, there were not effective monitoring controls over the
performance of the loan review process. As such, management did not have sufficient controls
in place to ensure the completeness and accuracy of the data used to develop the significant
assumption.
•
The forgiveness transactions processed by SBA during the year that were also used to develop
another significant assumption. The forgiveness review process was not adequately designed to
assure that forgiveness transactions processed were appropriate and in accordance with the
program terms. As such, management did not have sufficient controls in place to ensure the

completeness and accuracy of the data used to develop forgiveness related significant
assumption.
In addition, management did not adequately design and implement controls to ensure the assumptions
used in the subsidy reestimate for the COVID-19 EIDLs were commensurate with their risks. Management
is in process of reviewing the COVID-19 EIDLs portfolio to address eligibility concerns on disbursed loans. This
review was not completed at the time of the year-end reestimate. As such, management does not have a
reasonable basis to determine whether the assumptions applied are appropriate to COVID-19 EIDLs in the
portfolio based on their specific risk characteristics.
Additionally, management did not design and implement sufficient review controls over the development
and application of the assumptions used in the subsidy reestimate for the COVID-19 EIDLs portfolio.
Specifically, management did not adequately address the relevancy of assumptions developed and
applied to the COVID-19 EIDLs portfolio. The risk profile of the COVID-19 EIDLs is different than that of
the traditional EIDLs where performance data was used to develop the assumptions. Therefore,
management is unable to sufficiently support the appropriateness of the assumptions applied to the
subsidy reestimate for the COVID-19 EIDLs.
The deficiencies were caused by an inadequate entity wide control environment related to the design,
implementation, and operating effectiveness of controls related to the review of the loan portfolio at a precision
level necessary to ensure the data inputs used for the reestimate models are complete and accurate. In
addition, the deficiencies were caused by the inherent challenges with the implementation and development of
subsidy reestimate models for new programs that do not have a significant volume of historical data or
precedence.
The following criteria were considered with respect to the matter described in the preceding paragraphs:
•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 10,
Design Control Activities; and Principle 13, Use Quality Information
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above may result in a material misstatement to the Loan Guarantee Liabilities, Loan
Receivables (net), and Downward Reestimate Payable to Treasury line items, and the related elements in
the consolidated financial statements.
Recommendations – Controls over the Subsidy Reestimate
We recommend the Administrator coordinate with the Acting Chief Financial Officer to:
16. Design and implement controls to continue accumulating relevant, complete, and accurate
data on which to base the subsidy reestimate models for the PPP and COVID-19 EIDLs
portfolios.
17. Ensure there are adequate review and approval controls over the reestimate models for the PPP
and COVID-19 EIDLs portfolios by appropriate levels of management, including review and
documentation of relevant data inputs, development of assumptions, and reasonableness for the
selected assumptions used and the resulting estimates.
4. Controls over the Evaluation of Service Organizations Need Improvement
A. Service Organization Used for COVID-19 EIDLs and Grants
Management did not obtain reasonable assurance on the operating effectiveness of internal controls in
the service organization’s control environment relevant to the processing of SBA’s COVID-19 EIDLs
transactions. The service organization control environment includes the operation of the system used for

COVID-19 EIDLs and grants processing and the application controls within the system. In addition, the
relevant control environment includes the data transmissions over the internet between the system and
various third-party organizations.
In addition, management did not provide evidence of adequate monitoring activities performed over the
relevant internal control environment at the service organization, such as obtaining and reviewing an
attestation report on the design, implementation, and operating effectiveness of controls at the service
organization. Management also did not provide evidence whether adequate user entity controls were
designed, implemented, and operated effectively to complement the service organization’s controls.
Management’s assessment of internal controls over financial reporting is not complete without the sufficient
consideration of existing and non-existing controls at relevant service organizations and the effectiveness of
those controls.
Management did not hold the service organization accountable for the assigned internal control responsibilities
by obtaining reasonable assurance on the operating effectiveness of internal controls in the service
organization’s control environment (e.g., requiring a service organization control (SOC) 1 Type 2 report for the
control environment relevant to the processing of SBA’s COVID-19 EIDLs transactions).
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
GAO’s Green Book, Section 4, Additional Considerations: Service Organizations; Principle 5,
Enforce Accountability; Principle 10, Design Control Activities; and Principle 16, Perform Monitoring
Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above prevented SBA from obtaining an understanding of relevant service organization
controls and any weaknesses that increase risks of misstatements in the Loans Receivable (net) and
Downward Reestimate Payable to Treasury line items, and related elements in the consolidated financial
statements.
Recommendations – Service Organization Used for COVID-19 EIDLs and Grants
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
18. Continually evaluate the established policy for SOC 1 reports that requires new service
organizations to provide a SOC 1 report over the control environment that is relevant and
significant to the processing and recording of SBA’s transactions. If a SOC 1 report cannot be
obtained, identify, and evaluate relevant controls at the service organizations that have an
impact on SBA’s internal controls over financial reporting.
19. Assess the risk posed by the service organization’s control environment and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine
the integrity of transactions processed on behalf of and recorded by SBA. If a SOC 1 report is
obtained for the relevant control environment at the service organization, determine and
document the following:
•
SOC 1 report is sufficiently scoped to cover transaction processing and related control
activities performed by the service organization on behalf of SBA (e.g., that services, business
applications and other information technology, service organization departments and locations,
control objectives and activities, and other aspects of scope that are relevant to SBA’s internal
controls over financial reporting are included in the scope of SOC 1 reports).
•
All exceptions noted in the SOC 1 report – not just those described in the independent service

auditor’s report – are evaluated to determine applicability to SBA’s internal controls over
financial reporting, the potential impact to SBA’s financial statements, and mitigating controls
other considerations made during their risk assessment.
•
All complementary user entity controls described in the SOC 1 reports are evaluated using
current information and with consideration to their applicability to SBA’s internal controls over
financial reporting.
•
Evaluation procedures performed to assess whether complementary user entity controls and
other SBA-performed controls were tested and found effective and, if they are not, the impact
of such deficiencies on SBA’s internal controls over financial reporting.
•
All complementary subservice organization controls described in SOC 1 reports are evaluated
to determine whether they provided services and performed controls considered relevant to
SBA’s internal controls over financial reporting and, if relevant subservice organizations were
identified, an evaluation is performed to obtain an understanding of the subservice
organization(s) and their controls.
•
SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.
B. Service Organizations Used for Loan Guarantee Programs
Management did not obtain reasonable assurance on the operating effectiveness of internal controls in
multiple service organizations’ control environments relevant to the financial service providers for the 7(a)
and 504 loan guarantee programs, and the PPP and Restaurant Revitalization program application intake
platform. With regards to the financial service providers for the 7(a) and 504 loan guarantee programs, the
relevant control environments include the facilitation, maintenance, and reporting of the account balances
for the respective secondary market programs. With regards to the application intake platform, the
relevant control environment includes the operation of the PPP loan forgiveness, PPP loan approval, and
Restaurant Revitalization program modules, the data transmissions over the internet between the relevant
modules and SBA systems used in the configured checks, the cloud-based infrastructure hosting provider,
and the application controls within the application intake platform.
In addition, management did not provide evidence of adequate monitoring activities performed over the
relevant internal control environments at the respective service organizations, such as obtaining and
reviewing an attestation report on the design, implementation, and operating effectiveness of controls at
the service organization. Management also did not provide evidence whether adequate user entity
controls were designed, implemented, and operated effectively to complement the service organization’s
controls. Management’s assessment of internal controls over financial reporting is not complete without the
sufficient consideration of existing and non-existing controls at relevant service organizations and the
effectiveness of those controls.
Also, management’s evaluation of SOC 1 reports for another 7(a) program financial service provider was not
sufficient or properly documented to aid in management’s assessment of internal controls over financial
reporting. Specifically, management did not provide documentation of the review performed over the SOC 1
reports. In addition, management did not obtain bridge letters for a relevant subservice organization mentioned
in the SOC 1 report that covered the appropriate gap period.
Management did not hold the service organizations accountable for the assigned internal control
responsibilities by obtaining reasonable assurance on the operating effectiveness of internal controls in the
service organizations’ control environments (e.g., by requiring a SOC 1 Type 2 report for the control
environment relevant to the processing of SBA’s transactions).
The following criteria were considered with respect to the matters described in the preceding paragraphs:

•
GAO’s Green Book, Section 4, Additional Considerations: Service Organizations; Principle 5,
Enforce Accountability; Principle 10, Design Control Activities; and Principle 16, Perform Monitoring
Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above prevented SBA from obtaining an understanding of relevant service organization
controls and any weaknesses that increase risks of misstatements in the Loan Guarantee Liabilities line item
and related elements in the consolidated financial statements.
Recommendations – Service Organizations Used for Loan Guarantee Programs
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
20. Continually evaluate the established policy for SOC 1 reports that requires new service
organizations to provide a SOC 1 report over the control environment that is relevant and
significant to the processing and recording of SBA’s transactions. If a SOC 1 report cannot be
obtained, identify, and evaluate relevant controls at the service organizations that have an
impact on SBA’s internal controls over financial reporting.
21. Assess the risk posed by the service organizations’ control environments and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine
the integrity of transactions processed on behalf of and recorded by SBA. If a SOC 1 report is
obtained for the relevant control environment at the service organization, determine and
document the following:
•
SOC 1 report is sufficiently scoped to cover transaction processing and related control
activities performed by the service organization on behalf of SBA (e.g., that services, business
applications and other information technology, service organization departments and locations,
control objectives and activities, and other aspects of scope that are relevant to SBA’s internal
controls over financial reporting are included in the scope of SOC 1 reports).
•
All exceptions noted in the SOC 1 report – not just those described in the independent service
auditor’s report – are evaluated to determine applicability to SBA’s internal controls over
financial reporting, the potential impact to SBA’s financial statements, and mitigating controls
considerations made during their risk assessment.
•
All complementary user entity controls described in the SOC 1 reports are evaluated using
current information and with consideration to their applicability to SBA’s internal controls over
financial reporting.
•
Evaluation procedures performed to assess whether complementary user entity controls and
other SBA-performed controls were tested and found effective and, if they are not, the impact
of such deficiencies on SBA’s internal controls over financial reporting.
•
All complementary subservice organization controls described in SOC 1 reports are evaluated
to determine whether they provided services and performed controls considered relevant to
SBA’s internal controls over financial reporting and, if relevant subservice organizations were
identified, an evaluation is performed to obtain an understanding of the subservice
organization(s) and their controls.
•
SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.

5. Controls over Accounting and Monitoring of Restaurant Revitalization and Shuttered Venues
Operators Grant Programs Need Improvement
Management did not adequately design and implement monitoring controls over Restaurant Revitalization
and SVOG awards to ensure accurate financial reporting as of the fiscal year-end, and the funds were
used in accordance with the CARES Act and related legislation. Specifically, we noted that management
was unable to provide evidence that the accounting treatment and financial reporting for the Restaurant
Revitalization and SVOG awards were in accordance with U.S. generally accepted accounting principles. The
full amount of the awards was expensed immediately upon disbursement without evidence supporting the
existence, accuracy, and timely recognition of expenses, instead of advances, as they were incurred by the
recipients during the fiscal year.
In addition, management did not adequately design and implement controls to ensure the Restaurant
Revitalization program awards were approved and disbursed to eligible recipients in conformance with the
related legislation. Management approved and disbursed Restaurant Revitalization awards to recipients
that also had PPP loan guarantees that were flagged in SBA’s loan repository system. SBA placed flags
on PPP loan guarantees if the loans were indicative of potential noncompliance with select eligibility
requirements. As of September 30, 2021, we noted that numerous Restaurant Revitalization award
recipients also had a PPP loan guarantee with an alert or flag that were not cleared prior to the approval
of the Restaurant Revitalization award.
The deficiencies were caused by an inadequate entity wide control environment to identify and respond to risks,
and design and implement sufficient controls related to the Restaurant Revitalization and SVOG programs. In
addition, there was a lack of a sufficient analysis performed to determine the appropriate accounting treatment
for the newly established programs.
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
GAO’s Green Book, Principle 10, Design Control Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
The deficiencies noted above may result in a material misstatement to the Advances and Prepayments
line item and the related elements in the consolidated financial statements.
Recommendations – Controls over Accounting and Monitoring of Restaurant Revitalization and Shuttered
Venues Operators Grant Programs
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
22. Perform a thorough review of Restaurant Revitalization awards issued and identify recipients
that may not have been eligible to receive awards in accordance with the program’s terms,
especially for recipients with flagged PPP loan guarantees.
23. Design and implement effective monitoring controls, to ensure that Restaurant Revitalization
award recipients are complying with the program’s terms and to ensure complete, accurate, and
timely reporting for the use of the award.
We recommend the Administrator coordinate with the Associate Administrator for Office of Disaster
Assistance to:
24. Design and implement effective monitoring controls, to ensure that SVOG award recipients are
complying with the program’s terms and to ensure complete, accurate, and timely reporting for the
use of the award.

We recommend the Administrator coordinate with the Acting Chief Financial Officer to:
25. Design and implement controls to ensure the accounting treatment established to record the
Restaurant Revitalization and the SVOG program related balances is in accordance with U.S.
generally accepted accounting principles and the basis for the appropriate treatment is
sufficiently documented.
6. Entity Level Controls Need Improvement
Due to the implementation of the new and expanded programs, management faced challenges in maintaining
an adequate entity level controls system that produces reliable and accurate financial reporting. The
significance of the internal control matters indicated several entity level control categories. We noted the
following conditions.
Control Environment: Management did not fully design and implement an effective control environment. For
example, the following matters were noted:
1. There was not a clear organizational structure which established the designated responsibilities as it
relates to the management and oversight of the COVID-19 EIDLs program including the timely
development of corrective actions to remediate recommendations related to review of the COVID-19
EIDLs portfolio.
2. Management did not adequately document the internal control system and processes related to the
implementation of significant new programs impacting SBA, including the Restaurant Revitalization and
SVOG programs.
Risk Assessment: Management did not design and implement an effective risk assessment process. For
example, the following matters were noted:
3. The materiality threshold developed and documented was not adequately considered and applied by
program offices when key decisions regarding controls and review processes were implemented. The
controls within the relevant offices were not designed, implemented, and operating effectively to a
sufficient precision level to ensure the reporting objective of preparing the financial statements free of
material misstatement could be achieved. For example, the 2021 cohort of PPP loan guarantees were
subject to a limited set of validation checks as compared to the 2020 cohort of PPP loan guarantees
without a documented risk assessment determining the rationale for why a lower response was
appropriate. Additionally, the PPP loan guarantee review and forgiveness review processes were not
designed to ensure the reviews performed were to a sufficient level of precision to ensure the related
balances were free of material misstatement.
4. New risks brought about by the CARES Act and related legislation that could significantly impact SBA’s
internal control system and the ability to achieve financial reporting objectives were not identified. For
example, evidence of adequate risk assessments related to the Restaurant Revitalization and SVOG
programs were not provided as processes were still being implemented and finalized.
Monitoring: Management did not design and implement effective monitoring processes. Specifically, the
following matters were noted:
5. There was not an adequate monitoring plan developed and implemented for lenders participating in the
PPP program.
6. There was not adequate monitoring of the effectiveness of internal control over processes performed
by service organizations.
7. There was not adequate monitoring performed for the Restaurant Revitalization and SVOG program
award recipients.

8. There was not effective monitoring and evaluation performed of SBA’s entity level controls, manual
controls, general information technology controls, and system application controls for key financial
statement line items and risks. Specifically, evidence was not provided to substantiate that the testing
of controls was complete for significant new and expanded programs authorized from the CARES Act
and related legislation.
The deficiencies were primarily caused by the prioritization and the urgent need to implement the provisions of
the CARES Act and related legislation as quickly and efficiently as possible over internal control processes. In
addition, these deficiencies were primarily caused by the inherent challenges with the implementation of new
and expanded programs that do not have any historical precedence. The challenges included implementing
programs with evolving and complex guidance, inadequate systems to implement such large-scale programs,
and an insufficient number of personnel to assist in the implementation of the CARES Act and related
legislation. Finally, these deficiencies were primarily caused by the lack of established responsibilities for the
various offices and their duties for each program and the effective risk assessment and communication
processes to ensure financial statement reporting objectives were achieved.
The following criteria were considered with respect to the matters described in the preceding paragraphs:
•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6,
Define Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks;
Principle 9, Identify, Analyze, and Respond to Change; Principle 10, Design Control Activities;
Principle 12, Implement Control Activities; and Principle 16, Perform Monitoring Activities
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
As a result of the deficiencies noted above, transactions for new and expanded programs were approved and
in certain cases disbursed to potentially ineligible entities and not in conformance with the CARES Act and related
legislation, and the Office of Chief Financial Officer placed reliance on controls not designed, implemented, and
operating effectively to ensure the financial statements are free from potential material misstatements. Without
the proper level of entity level controls in place and operating effectively, there is an increased risk that a
material misstatement exists in the consolidated financial statements, and noncompliance with the relevant
laws and regulations would not be prevented or detected and timely corrected.
Recommendations – Entity Level Controls
We recommend that the Administrator coordinate with the Associate Administrators for Offices of Capital
Access and Disaster Assistance to:
26. Document the internal control system and processes related to the implementation of new or
expanded programs from new legislation.
27. Develop and implement monitoring controls to ensure implementation of an effective internal
control environment.
We recommend that the Administrator coordinate with the Acting Chief Financial Officer to:
28. Perform and document a thorough risk assessment at the financial statement assertion level
to identify process level risks and communicate the results to relevant program offices.
29. In conjunction with relevant program offices, assess the effectiveness of key process level
controls to respond to the identified risks.
30. Develop and implement a sufficient plan to test and monitor the design, implementation, and
operating effectiveness of key, relevant controls that affect financial reporting and compliance
with relevant laws and regulations.

Appendix II
U.S. Small Business Administration
Significant Deficiencies
The following deficiencies are considered to be significant deficiencies in internal controls over financial
reporting.
1. Controls over Payments for Covered Loans under the Debt Relief Program Need Improvement
2. Controls over General Information Technology Need Improvement
1. Controls over Payments for Covered Loans under the Debt Relief Program Need Improvement
Management did not adequately design and implement controls to determine that payments made to lenders
for covered loans under the Debt Relief Program were accurate, reviewed, and approved prior to payment
to enable the fair presentation of the Loan Guarantee Liabilities. Specifically, management did not have a
documented process and sufficient controls in place to substantiate the accuracy of the payments made to
lenders.
The deficiency was caused by an inadequate entity wide control environment to implement processes, and
procedures to account for new and expanded programs under the CARES Act and related legislation with
sufficiently designed, implemented, and effectively operating controls.
The following criteria were considered with respect to the matter described in the preceding paragraphs:
•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities
The deficiency noted above may result in misstatements of the Loan Guarantee Liabilities line item and
related elements in the consolidated financial statements.
Recommendations – Payments for Covered Loans under the Debt Relief Program
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access
to:
31. Perform a review of the payments made by SBA for covered loans under the Debt Relief
Program to identify, review, and remediate any potential over or under payments made on the
related loans.
2. Controls over General Information Technology Need Improvement
Management had several control deficiencies that limited SBA’s ability to effectively manage its information
system risks. Collectively, these conditions increase the risk of unauthorized use, modification, or destruction of
financial data, which may impact the integrity of information used to prepare the financial statements. In the
sections below, we have omitted some technical details from the conditions and recommendations due to the
sensitivity of the information. These details were communicated to management in notices of findings and
recommendations.
The deficiencies were primarily caused by the prioritization and the urgent need to implement the provisions of
the CARES Act and related legislation as quickly and efficiently as possible over adherence to internal control
processes and requirements.
The following criteria were considered with respect to the matters described in the following paragraphs:

•
GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority
•
National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and
Privacy Controls for Federal Information Systems and Organizations
We have summarized the information technology control deficiencies by the following general information
technology control objectives: logical access controls and system configuration management.
Logical Access Controls
Management did not consistently follow established policy and procedure requirements for the timely removal
of access to SBA systems for separated employees and contractors.
The deficiency noted above increases the risk that unauthorized users may retain access to the system
resulting in unauthorized modification, destruction, or exposure to SBA systems and data.
Recommendations – Logical Access Controls
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access to:
32. Consider allocating resources to implement enforcement processes that ensure the accounts
of separated users are removed timely from SBA systems.
33. Validate that the identified accounts of separated users were not utilized after separation had
occurred.
34. Ensure individuals responsible for removing accounts of separated users are aware of the
process and periodically sent reminders of their responsibilities.
System Configuration Management
Management did not maintain supporting evidence to consistently demonstrate that database and operating
system patches were tested and approved prior to migration into the production environment. In addition,
management migrated application changes into the production environment without supporting evidence of
appropriate testing and approval.
The deficiencies noted above increase the risk that known vulnerabilities can be exploited and unauthorized
changes can be applied to the system, resulting in possible disclosure, modification, or destruction of SBA
system programs and data.
Recommendations – System Configuration Management
We recommend the Administrator coordinate with the Associate Administrator for Office of Capital Access to:
35. Implement controls and a monitoring process to ensure that patches applied to the database
and operating system and application changes are appropriately tested prior to being moved
into the production environment.
36. Update the system configuration management plan to require internal control documentation
for patch management and application changes as required by the Government Accountability
Office’s Standards for Internal Control in the Federal Government.
37. Periodically train personnel involved with the implementation of database and operating
system patches, and the review and approval of application changes, to follow the respective
controls and requirements of the patch management and application change management
processes in accordance with existing policies.

Appendix III
U.S. Small Business Administration
Compliance and Other Matters
A. Federal Managers’ Financial Integrity Act of 1982 (FMFIA)
Management performed an internal control assessment as required under FMFIA; however, management’s
assessment did not substantially comply with FMFIA and the related OMB Circular No. A-123 requirements.
Specifically, management did not:
1. Sufficiently identify or define risks related to new or expanded programs established by the CARES Act
and related legislation.
2. Perform, document, and demonstrate that they completed an internal control over financial reporting
evaluation regarding the new or expanded programs, including the evaluation and consideration of the
risks and controls of significant service organizations.
3. For the risks significant to financial reporting, consistently document financial statement risks and
assertions covered, testing procedures performed, extent of sampling performed, testing results,
corrective action plans to respond to deficiencies identified, and provide evidence of management
review. Additionally, management did not complete testing over significant areas and did not plan for
and test information technology controls as part of the internal control evaluation program.
4. Ensure there was an adequate review performed over the statement of assurances prepared by the
program offices as certain statements did not provide accurate or updated statuses of internal controls
as of the end of the fiscal year.
Management did not substantially meet FMFIA requirements due to the urgent need to implement the
provisions of the CARES Act and related legislation as quickly and efficiently as possible, the lack of historical
precedence, and other inherent challenges faced in implementing and expanding programs. In addition,
management did not consider all FMFIA and OMB Circular No. A-123 requirements when performing their
evaluation over internal controls.
The following criteria were considered with respect to the matter described in the preceding paragraphs:
•
Section 2 of FMFIA
•
OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control
Management did not substantially comply with FMFIA and the related OMB Circular No. A-123
requirements, which may lead to not identifying the appropriate risks and key controls, and not detecting internal
control or compliance deficiencies. The risk of not detecting and correcting control deficiencies could result in
misstatements to the consolidated financial statements.
Recommendations – FMFIA
We recommend the Administrator coordinate with the Acting Chief Financial Officer to:
38. Update the risk assessment regarding the evaluation of internal controls to ensure it includes all
significant programs, key processes, and other material line items on the consolidated financial
statements.
39. In conjunction with relevant program offices, perform and document the internal control evaluation
over all programs. This should include entity level controls, manual controls, general information

technology controls, and system application controls covering key financial statement line items
and risks.
40. Update the existing policy and implement adequate controls to ensure that the statement of
assurances provided by the program offices are adequately documented and reviewed for
completeness and accuracy to provide a sufficient basis to support the Administrator’s statement of
assurance.
B. Federal Financial Management Improvement Act of 1996 (FFMIA)
Management did not establish and maintain financial management systems that substantially comply with the
following FFMIA requirements:
1. Federal Financial Management Systems Requirements. As discussed in Appendix I – Material
Weaknesses, control deficiencies over transactions arising from the implementation of the CARES Act
and related legislation do not enable reliable and accurate financial reporting and do not ensure
budgetary resources are safeguarded against waste, loss, and misuse. In addition, the deficiencies
may not support compliance objectives related to ensuring financial transactions are in conformance
with the CARES Act and related legislation are achieved.
2. Federal Accounting Standards. The deficiencies identified and reported in Appendix I – Material
Weaknesses, provide an indication that SBA’s financial management systems were substantially non-
compliant with applicable federal accounting standards. Specifically, management was unable to
provide evidence that the accounting treatment and financial reporting for the Restaurant Revitalization
and SVOG awards were in accordance with U.S. generally accepted accounting principles. The full
amount of the awards was expensed immediately upon disbursement without evidence supporting the
existence, accuracy, and timely recognition of expenses, instead of advances, as they were incurred by
the recipients during the fiscal year.
Management did not substantially meet FFMIA requirements because of the reasons discussed in Appendix I –
Material Weaknesses and due to an inadequate entity wide control environment to implement the provisions of
the CARES Act and related legislation with sufficiently designed and implemented controls.
The following criteria were considered with respect to the matter described in the preceding paragraphs:
•
Section 803(a) of FFMIA
•
GAO’s Green Book, Section 2, Establishing an Effective Internal Control System
•
Appendix D to OMB Circular No. A-123, Compliance with the Federal Financial Management
Improvement Act of 1996
Management did not substantially comply with FFMIA increasing the risk that transactions are incorrectly
recorded to the general ledger, impacting the completeness, existence, and accuracy of the balances in the
consolidated financial statements.
Recommendations – FFMIA
We recommend the Administrator coordinate with the Acting Chief Financial Officer to:
41. Address the control deficiencies over transactions arising from the implementation of the
CARES Act and related legislation by working with the Office of Capital Access and the Office
of Disaster Assistance to implement the recommendations in Appendix I – Material
Weaknesses.

Appendix IV
CFO Response to Audit Report
on FY 2021 Financial Statements

DATE:
November 15, 2021
TO:
Hannibal M. Ware, Inspector General
FROM:
Jason Bossie, Acting Associate Administrator for Performance, Planning and the Chief
Financial Officer
SUBJECT:
FY 2021 Financial Statement Audit
The Small Business Administration has reviewed the Independent Auditors’ Report from KPMG that includes
the auditors’ disclaimer of opinion on the Agency’s FY 2021 Consolidated Balance Sheet and the Report of the
Agency’s internal control over financial reporting and compliance with laws and regulations. The independent
audit of the Agency’s financial statements and related processes is a core component of SBA’s financial
management program, and we are concerned by this outcome.
The FY 2021 Agency Financial Report includes the programs implemented under the American Rescue Plan
Act, in addition to those programs funded under the CARES Act and subsequent legislation.  The expansion of
these programs, to include the Restaurant Revitalization program and Shuttered Venues Operators Grant
program, added to the unprecedented significance of serving small businesses under unprecedented times.
Most of SBA’s programs are governed by the Federal Credit Reform Act (FCRA), which requires estimation of
lifetime expected subsidy costs at program implementation and does provide for annual adjustment to original
subsidy cost estimates in future periods. The SBA believes the FY 2021 presentation of financial information is
materially correct.
The SBA has made substantial progress strengthening internal controls for pandemic-focused programs
although there are improvements that need to be made.  The Agency continues its efforts to address material
weaknesses, strengthen processes, develop fraud risk assessments, and support requirements for auditability of
its financial statements.  The SBA understands its obligations for providing accountability and transparency to
the American public and is working diligently to correct shortcomings for future audits.
The auditors identified material weaknesses related to the internal controls over six areas.  The SBA has
reviewed the identified material weaknesses and does not concur with the severity of the five weaknesses
included in the report under PPP Loan Guarantees, COVID-19 EIDLs and Grants, Subsidy Reestimate,
Restaurant Revitalization and Shuttered Venues Operators Grant Program, and Entity Level Controls. The SBA
partially agrees with the weakness under Evaluation of Service Organizations. Our responses, as
communicated to KPMG during the audit, detail our concerns with the analysis and conclusions drawn by the
auditors.  SBA has worked to establish internal controls, policies, and procedures to address the new legislative
programs as result of the pandemic and will take corrective actions to remediate weaknesses and strengthen
internal controls where necessary.
We appreciate your efforts and those of your colleagues in the Office of the Inspector General, as well as those
of KPMG. The independent audit process continues to provide us with new insights and valuable
recommendations that directly support our efforts to further enhance the SBA's financial management
practices. We remain committed to excellence in financial management and look forward to making more
progress in the coming year.

Appendix V
Auditors’ Response to Management’s Response
We acknowledge SBA management’s response to our Independent Auditors’ Report, presented in Appendix IV,
and commend their commitment to financial management and the accountability for and transparency of their
programs. SBA management partially agreed with the material weakness area entitled Controls over the
Evaluation of Service Organizations Need Improvement and did not agree with the severity of the remaining
material weakness areas included in our report in Appendix I. We evaluated the validity of management’s
responses communicated to us during the engagement and have determined that the material weaknesses in
internal control over financial reporting are appropriate.

File and source

File

22-05-fy2021-financial-statements-audit.pdf

Size

713,121 bytes

SHA-256

1e4da4e9c7e96b022e3d3a4e85cc18bb3864e0528965621e0699409b7f4dbec6

Our copy

22-05-fy2021-financial-statements-audit.pdf

Original

www.oversight.gov