Full text
U.S. SMALL BUSINESS ADMINISTRATION
OFFICE OF INSPECTOR GENERAL
SBA’s Eligibility and Forgiveness
Review of PPP Loans Made to
Borrowers with Treasury’s Do Not
Pay Data Matches
Evaluation Report
Report 24-06
February 22, 2024
Make a Difference
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s
Office of Inspector General Hotline at https://www.sba.gov/oig/hotline. You can also write to the
U.S. Small Business Administration, Office of Inspector General, 409 Third Street, SW (5th Floor),
Washington, DC 20416 or call 800-767-0385. In accordance with the Inspector General Act of
1978, codified as amended 5 U.S.C. §§ 407(b) and 420(b)(2)(B), confidentiality of a complainant’s
personally identifying information is mandatory, absent express consent by the complainant
authorizing the release of such information.
NOTICE:
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023,
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities
identified in this report have the opportunity to submit a written response for the purpose of
clarifying or providing additional context as it relates to any specific reference contained herein.
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date.
We request that any comments be no longer than two pages, Section 508 compliant, and free
from any proprietary or otherwise sensitive information The comments will be appended to this
report and posted on our public website.
U.S. Small Business Administration
Office of Inspector General
EXECUTIVE SUMMARY
SBA’s Eligibility and Forgiveness Reviews of PPP Loans Made to
Borrowers with Treasury’s Do Not Pay Data Matches
What OIG Reviewed
This report is a follow up to U.S. Small Business
Administration Office of Inspector General (SBA
OIG) Report Number 21-06, Paycheck Protection
Program (PPP) Loan Recipients on the
Department of Treasury’s (Treasury) Do Not Pay
(DNP) List, which reported SBA did not use
Treasury’s DNP data to screen borrowers for
eligibility prior to approving loans originated
before August 8, 2020, PPP round one. In this
report, we assessed SBA actions to address
potentially ineligible loans identified in report
21-06 and its implementation of controls to
review DNP data for PPP loans originated after
August 8, 2020, PPP round two.
What OIG Found
SBA implemented a review plan to address the
25,634 potentially ineligible PPP loans originated
prior to August 8, 2020, and review DNP data
sources pre-award for loans originated after
August 8, 2020. However, inadequate policies
and procedures exposed the program to
avoidable risks. We found SBA’s review plan only
included reviewing loans with submitted
forgiveness applications where all funds had
been disbursed and used. As a result, during PPP
round one, lenders approved and disbursed
1,799 loans totaling over $89 million with known
DNP matches that were not subject to manual
review. We also found SBA’s manual loan
reviews did not always sufficiently ensure
borrowers’ eligibility. We sampled 176 of
25,634 DNP-matched loans and found SBA
cleared 92 by using pre-decisional memos that
did not address DNP hold codes or had
insufficient evidence to support SBA’s review
decision. We projected our sample results onto
the DNP-matched loans to estimate lenders
disbursed, and SBA forgave, 12,234 of 25,634
loans (or 48 percent) totaling over $1.4 billion
without verifying borrower eligibility, exposing
the program to financial losses and improper
payments. In addition, SBA did not use all
Treasury’s DNP restricted data sources for
reviewing applicants during the first 2 months of
pre-award reviews of DNP data for second
round PPP loans. SBA identified 2,777 potentially
ineligible applicants, totaling approximately
$22.4 million. By comparison, our reassessment
of applications using all Treasury’s minimally
required DNP data sources identified 59,893
additional potentially ineligible loans, totaling
about $1.9 billion.
What OIG Recommended
We recommend SBA implement or enhance
policies and procedures to ensure compliance
with program requirements and federal
standards for identifying/preventing improper
payments and seek remedy or repayment of
ineligible loans.
Agency Response
SBA partially agreed with recommendations 1-3
and 5-7; and disagreed with recommendation 4.
Management’s planned actions satisfy the intent
of recommendations 1, 6 and 7 and are
considered resolved. Management’s planned
actions for recommendations 2-5 are
unresolved. In accordance with our audit follow-
up policy, we will attempt to reach agreement
with SBA management on the unresolved
recommendations. If we do not reach
agreement, OIG will notify the audit follow-up
official of the disputed issues.
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
Date:
February 22, 2024
To:
Isabella Casillas Guzman
Administrator
From:
Hannibal “Mike” Ware
Inspector General
Subject:
Evaluation of SBA’s Eligibility and Forgiveness Reviews of Paycheck Protection
Program Loans Made to Borrowers with Treasury’s Do Not Pay Data Matches
(Report 24-06)
This report presents the results of our Evaluation of the U.S. Small Business Agency’s (SBA)
Eligibility and Forgiveness Reviews of Paycheck Protection Program Loans Made to Borrowers
with Treasury’s Do Not Pay Data Matches. We considered management’s comments on the draft
of this report when preparing the final report. SBA management partially agreed with six of our
seven recommendations and disagreed with one recommendation.
We appreciate the cooperation and courtesies provided by your staff. If you have any questions
or need additional information, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.
cc:
Dilawar Syed, Deputy Administrator
Arthur Plews, Chief of Staff
Kathryn Frost, Associate Administrator, Office of Capital Access
Therese Meers, General Counsel, Office of General Counsel
John Miller, Deputy Associate Administrator, Office of Capital Access
Michael Simmons, Attorney Advisor, Office of General Counsel
Anna Maria Calcagno, Director of Performance, Analysis, and Evaluation
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and Chief
Financial Officer
Tonia Butler, Director, Office of Internal Controls
Peter Meyers, Senior Advisor, Office of Capital Access
Rachel Wilson, Program Analyst, Office of Capital Access
i
CONTENTS
Introduction ........................................................................................................................................ 1
Background ......................................................................................................................................... 1
Objective ............................................................................................................................................ 3
Results ................................................................................................................................................ 3
Finding 1: SBA’s Review Plan Was Not adequate to Ensure Loans with Known DNP Data Matches
Were Cleared before Disbursement .................................................................................................. 4
Recommendations ............................................................................................................................. 6
Finding 2: SBA Loan Reviews Were Not Always Adequate to Ensure Borrowers’ Met Eligibility
Requirements ..................................................................................................................................... 6
Recommendations ........................................................................................................................... 10
Finding 3: SBA’s Loan Review Procedures Were Not Always Sufficient to Assess Eligibility .......... 11
Recommendations ........................................................................................................................... 12
Other Matter: Update to Treasury’s Initial Analysis of Borrowers Who Were Delinquent or
Defaulted on Federal Debt ...................................................................................................... 13
Recommendations ........................................................................................................................... 14
Evaluation of Agency Response ....................................................................................................... 14
Summary of Actions Necessary to Close the Recommendations ................................................... 14
Tables
1
Comparison of Treasury’s TOP Data Source Original and Revised Matched PPP Round
One Loans .............................................................................................................................. 13
Figures
1
Do Not Pay Initiative Timeline ..................................................................................................... 1
ii
Appendices
Appendix 1: Additional Information ........................................................................................................ 1-1
Appendix 2: Data Sources Mandated by Law and Used in Treasury’s PPP Analysis ........................ 2-1
Appendix 3: Treasury’s DNP Analytic Explanations ............................................................................... 3-1
Appendix 4: Monetary Impact .................................................................................................................. 4-1
Appendix 5. Agency Response .................................................................................................................. 5-1
1
Introduction
This report presents the results of our evaluation of the U.S. Small Business Administration’s
(SBA) eligibility and forgiveness reviews of Paycheck Protection Program (PPP) loans made to
borrowers with U.S. Department of Treasury’s (Treasury) Do Not Pay (DNP) data matches. This
report is a follow up to SBA OIG Paycheck Protection Program Loan Recipients on the Department
of Treasury’s Do Not Pay List (Report Number 21-06), which reported that SBA did not use
Treasury’s DNP data to screen PPP borrowers for eligibility prior to approving PPP loans
originated before August 2020.
Background
On June 18, 2010, the White House released the Presidential Memorandum Enhancing Payment
Accuracy Through a "Do Not Pay List." The memo directed heads of executive departments and
federal agencies to review pre-payment and pre-award procedures and ensure that a thorough
review of available databases with relevant information on eligibility occurs before the release of
any federal funds, to the extent permitted by law. Figure 1 provides the milestones in the Do Not
Pay initiative.
Figure 1: Do Not Pay Initiative Timeline
Source: OIG generated from Office of Management and Budget and PIIA guidance.
2
The President signed the Coronavirus, Aid, Relief, and Economic Security (CARES) Act into law on
March 27, 2020. Section 1102 of the CARES Act provided $349 billion to create the PPP under
Section 7(a) of the Small Business Act. Subsequent acts provided additional funding for the PPP,
increasing total program funding to $813.7 billion. The PPP provided fully guaranteed loans for
certain eligible businesses, individuals, and nonprofit organizations that could be forgiven if loan
proceeds were used as required by law. Eligible expenses include payroll, rent, utility payments,
and other limited uses.
Borrowers were not eligible for PPP loans if they were suspended or debarred from participating
in federal programs; were delinquent or defaulted on federal debt, including student loans, that
caused a loss to the federal government within 7 years of applying; or had non-financial fraud
felony conviction. However, effective March 4, 2021, PPP eligibility revisions removed the
restriction prohibiting business owners with delinquent or defaulted federal student loans from
obtaining PPP loans.1
Together, Treasury’s Working System — databases used to assist in preventing improper
payments — and DNP create one element of the larger multi-agency, government-wide DNP
initiative and centrally provide a variety of data matching and data analytics services to help
agencies in their efforts to prevent and detect improper payments. An improper payment is any
federal government payment made to an ineligible recipient or for an ineligible good or service,
duplicate payment, or payment for goods or services not received (except for such payment
authorized by law). Treasury’s DNP system — designated by the Office of Management and
Budget and mandated by the Payment Integrity Information Act of 2019, dated March 2, 2020 —
gives agencies a higher degree of certainty that a payee is legitimate and eligible before making
an award or payment.
The Payment Integrity Information Act of 2019 requires agencies to evaluate fraud risks and use
a risk-based approach to design and implement financial and administrative controls to counter
identified fraud risks. The Act reinforces the requirement for agencies to review prepayment and
pre-award procedures. Agencies are also required to thoroughly review available databases with
relevant information to determine program or award eligibility and prevent improper payments
before the release of any federal funds. At a minimum and before issuing any awards or
payments, agencies must review certain databases to verify eligibility of the payment and award
(see Appendix 2 for a list of databases).
In our prior report titled OIG Paycheck Protection Program Loan Recipients on the Department of
Treasury’s Do Not Pay List (Report Number 21-06), we found that SBA did not use Treasury’s DNP
data to screen PPP borrowers for eligibility before approving loans. As of the end of PPP round
one funding (August 8, 2020), after cancellations, lenders approved 5.2 million PPP loans,
1 Interim Final Rule, Business Loan Program Temporary Changes; Paycheck Protection Program-Revisions to Loan
Amount Calculation and Eligibility, Federal Register, Vol. 86, No. 43, dated March 8, 2021.
3
totaling approximately $525 billion. Of the 5.2 million approved PPP loans, we found 57,473 (or
1.1 percent) matched a DNP data source, indicating the borrowers were potentially ineligible.
The 57,473 loans with DNP matches totaled about $3.6 billion and 9,013 of the 57,473 loans
totaling about $280 million were undisbursed.
In February 2021, at the request of the Department of Education, Treasury waived the restriction
in 31 U.S.C. § 3720B, barring federal debtors from obtaining federal financial assistance to the
extent that it applies to delinquent or defaulted federal student loan debt. Subsequently, on
March 4, 2021, SBA updated its Interim Final Rule to reflect this change. Accordingly, the 57,473
PPP loans with DNP data matches were reduced by 31,115, leaving 26,358 loans totaling
approximately $2.7 billion. In addition, as of March 7, 2023, SBA cancelled 723 of these loans
and 1 was voluntarily terminated, for a total of over $32 million. We also removed these from
the 57,473 loans. This report covers the remaining 25,634 loans totaling approximately $2.7
billion with DNP matches that required SBA’s review to assess eligibility.
It also covers SBA’s implementation of controls to review Treasury’s DNP data before approving
and disbursing the 7.37 million approved PPP loans, totaling approximately $270 billion that
originated after August 8, 2020 (PPP round two).
Objective
Our objective was to assess SBA’s actions to address PPP loans identified as potentially ineligible
due to DNP data matches, and its implementation of controls to review DNP data prior to loan
approval and disbursement of loans originated after August 8,2020.
Results
SBA implemented a review plan to address the 25,634 potentially ineligible loans due to DNP
data matches that originated prior to August 8, 2020 (PPP round one), and to review DNP data
sources pre-award for loans originated after August 8, 2020 (PPP round two). However,
inadequate policies and procedures that prioritized rapid loan processing exposed the program
to avoidable risks.
We found SBA’s review plan only included reviewing loans with submitted forgiveness
applications where all funds had been disbursed and used. As a result, during PPP round one,
lenders disbursed 1,799 loans totaling over $89 million with known DNP data matches before
the DNP eligibility issues were resolved.
We also found that SBA’s manual loan reviews were not always sufficient to ensure borrowers’
eligibility. We statistically sampled 176 of 25,634 loans with DNP matches and concluded that
4
SBA appropriately resolved 84. SBA inappropriately cleared the remaining 92 loans by either
using pre-decisional memos that did not address the DNP hold codes, or the loan files did not
contain sufficient documentation to support SBA’s review decisions. By projection, we estimate
that lenders disbursed, and SBA forgave 12,234 of 25,634 loans (or 48 percent) totaling over
$1.4 billion without verifying the borrowers’ eligibility, which further exposed the program to
financial losses and improper payments.
In addition, SBA did not screen applicants against all the minimally required DNP databases for
the first 2 months of conducting pre-award reviews of DNP data for loans originated during PPP
round two. Specifically, SBA did not screen applicants for delinquent or defaulted debt data
sources or debarment. Using only Treasury’s public DNP data sources, SBA identified 2,777
potentially ineligible applicants with loans totaling approximately $22.4 million. By comparison,
our reassessment of PPP loan applications originated after August 8, 2020, using the restricted
DNP data sources, including delinquent or defaulted debt or debarment identified 59,893
additional potentially ineligible loans, totaling about $1.9 billion.
Finding 1: SBA’s Review Plan Was Not adequate to Ensure Loans
with Known DNP Data Matches Were Cleared before
Disbursement
In our prior report (Report Number 21-06), we identified 9,013 undisbursed PPP loans totaling
over $280 million that matched a DNP data source, indicating the loans were potentially
ineligible. We recommended that SBA promptly identify the PPP loans that had not been fully
disbursed and follow-up with the lenders to stop the $280 million in potential improper
payments.
On March 4, 2021, SBA removed eligibility restrictions deeming borrowers with delinquent or
defaulted federal student loan debt ineligible for PPP loans to be consistent with the
Departments of Treasury waiver decision involving federal student loan debt. This impacted
6,513 loans totaling over $159 million as of March 7, 2023. SBA also cancelled another 701 loans
totaling over $31 million. However, 1,799 loans totaling over $89 million remained with DNP
data matches unrelated to delinquent or defaulted student loan debt or cancellations that SBA
should have reviewed before disbursement.
These are loans OIG referred to SBA in our prior report, and SBA’s PPP Loan Review Plan requires
a manual review of loans referred by OIG.2 However, when SBA began reviewing loans, it only
reviewed loans with submitted forgiveness applications and in order to apply for forgiveness,
loans had to be fully disbursed, and all funds used.
2 SBA’s Paycheck Protection Program Loan Review Plan, dated October 2, 2020.
5
As a result, SBA lenders disbursed funds for the 1,799 loans totaling over $89 million to
potentially ineligible borrowers who should not have received loan funds until the DNP hold
codes were cleared. The review plan prioritized rapid loan processing, which continued to fuel
the pay-and-chase environment created with the handling of PPP round one loans.
The Payment Integrity Information Act of 2019 states that for agencies to be effective, programs
should not operate in a “pay-and-chase” environment but, instead, should prioritize efforts to
prevent improper payments and under payments from occurring.3
In June 2021, SBA modified its loan review procedures to be risk-based, rather than contingent
on a forgiveness request. However, this change did not ensure these high-risk loans with known
DNP matches were reviewed before disbursement.
In its new approach, SBA designated loans that did not pass the automated screening process as
high-risk. SBA’s policy asserted that identifying loans with a higher risk of fraud can be achieved
by using machine learning prioritization and leveraging the results of past manual and aggregate
reviews. However, SBA did not assign loan review priority to the loans that we determined had
DNP data matches and on which they subsequently placed hold codes. As such, the automated
screening process was unable to capture critical risk areas designated by DNP data matches.
Consequently, these high-risk loans were reviewed using the same process as low-risk loans.
According to an internal memo, SBA knew that in many cases loan reviews would occur after
borrowers received funds and the loan was forgiven.4 SBA indicated the new approach would
allow it to identify high-risk loans and make quicker referrals to SBA OIG. Program officials said
they did not think eliminating the requirement for high-risk loans to be reviewed before
borrowers were paid would increase SBA’s financial exposure due to the 100 percent guaranty
on PPP loans and lender hold harmless provisions, introduced by the CARES Act and
strengthened by the Economic Aid Act.
We identified and informed SBA that these undisbursed loans were potentially ineligible due to
DNP data matches; therefore, SBA was aware that these loans presented an increased risk for
improper payments and could have reduced the risk by ensuring the loans were reviewed before
they were disbursed and forgiven.
3 Payment Integrity Information Act of 2019, dated March 2, 2020.
4 SBA Memorandum Transition to Review of Remaining Loans in the Manual Review Population Based on Risk
Priority, dated June 7, 2021.
6
Recommendations
To address the potentially ineligible loans, we recommend the Administrator direct the Acting
Associate Administrator for the Office of Capital Access:
Recommendation 1: Review the 1,799 PPP loans totaling over $89 million, that matched a DNP
data source, to ensure eligibility requirements were met and seek remedy or repayment of all
loans deemed ineligible.
Finding 2: SBA Loan Reviews Were Not Always Adequate to
Ensure Borrowers’ Met Eligibility Requirements
Of 25,634 loans totaling about $2.6 billion, we statistically sampled 176 with DNP matches
totaling about $19.7 million and found that SBA did not always appropriately resolve DNP hold
codes to ensure borrowers’ eligibility. Specifically, SBA appropriately reviewed 84 of the 176
loans totaling about $9 million. For the remaining 92 loans, SBA used three different pre-
decisional memos that did not address DNP hold codes to clear 49 of the loans, totaling
approximately $3.5 million, in lieu of conducting manual reviews, as required. SBA also did not
have sufficient evidence to support its decision to resolve the hold codes and deem the
borrowers eligible for the remaining 43 loans, totaling approximately $7.2 million.
Pre-Decisional Memos
The pre-decisional memos that SBA inappropriately used to clear DNP hold codes for 49 loans,
totaling approximately $3.5 million included:
• Transition to Review of Remaining Loans in the Manual Review Population Based on Risk
Priority: This June 7, 2021, memo explains SBA’s transition from prioritizing manual loan
review based on when borrowers applied for forgiveness to prioritization based on risk.
• Expedited Batch Dispositioning of Certain Alerted Loans and Machine Learning Proposal:
This November 19, 2020, memo allowed SBA to batch-disposition loans as needing “No
Further Actions” based on automated screening results and specific hold codes that SBA
deemed were low risk.
• Horizontal Network Analysis for PPP Loans of $150,000 or less: This December 30, 2020,
memo allowed SBA to approve PPP loans valued at $150,000 or less without a manual
review based on whether aggregate loan analysis generated alerts during the automated
screening process.
None of the pre-decisional memos addressed the DNP hold codes and should not have been
used to resolve the issues. Also, according to SBA’s PPP Loan Review Plan, SBA and its
contractors were required to conduct manual reviews of loans identified as having signs of
noncompliance with eligibility requirements. One of those attributes included loans of any size
7
separately flagged for manual review. According to the plan, this includes loans identified
through OIG or Department of Justice referrals, fraud tips, credible media reports, or
whistleblowers. This was the case for all 25,634 of the DNP-matched loans that we brought to
SBA’s attention.
However, SBA inappropriately cleared DNP hold codes for 49 of 176 loans, totaling
approximately $3.5 million, using these pre-decisional memos without conducting manual
reviews, as required. For example, DNP hold codes for the 49 loans included:5
• thirty-three with DNP delinquent or defaulted federal debt matches;
• eight with DNP debarment matches; and
• eight with DNP death data source matches.
The SBA memos were intended to address low-risk loans that did not generate alerts during the
automated screening process.
SBA stated that it could manually review the loans at any time, at its discretion; however, there
were no formal plans to review these loans and this approach further fueled a pay-and-chase
environment. Additionally, SBA did not have effective controls, such as supervisory reviews, to
ensure the manual reviews were conducted as required.
Consequently, there is increased risk that potentially ineligible borrowers received loans and
loan forgiveness. By projection, we estimate that 6,516 of 25,634, or 25 percent of the PPP loans
cleared using pre-decisional memos, totaling over $465 million went to potentially ineligible
borrowers, resulting in a high risk of financial loss and improper payments.
SBA stated they cleared the hold codes for 12 of 33 exceptions that we deemed potentially
noncompliant due to DNP matches regarding delinquent or defaulted federal debt because the
borrower’s debt was not a direct or guaranteed loan from SBA or any other federal agency, and
did not fall under any of the examples of ineligibility cited in its Interim Final Rule.6 However, for
the 12 DNP hold codes that SBA cleared, the borrowers had delinquent or defaulted debt related
to Department of Justice claims, Department of State, Army and Air Force Exchange Service, or
the Social Security Administration.
5 One loan fit into both "delinquent or defaulted federal debt matches" and "debarment matches" categories.
6 Interim Final Rule, Business Loan Program Temporary Changes; Paycheck Protection Program, Federal Register,
Vol. 85, No. 73, dated April 15, 2020.
8
In accordance with 31 U.S.C. §3720B, Barring Delinquent Federal Debtors from Obtaining Federal
Loans or Loan Insurance Guarantees, unless this subsection is waived by the head of a federal
agency, a person may not obtain any federal financial assistance in the form of a loan other than
a disaster loan, or a marketing assistance loan, or loan deficiency payment if the person has an
outstanding debt other than a debt under the Internal Revenue Code of 1986. SBA did not have
a waiver to exempt debts owed to the Department of Justice, Department of State, Army and Air
Force Exchange Service, or the Social Security Administration from this statutory requirement.
The applicable waiver related to this statute was specific to federal student loan debt only.
Further, SBA’s Procedural Notice recognizes delinquent federal debt as a potential eligibility
issue and stipulates that lenders are required to obtain proof that the borrower is not delinquent
or defaulted on any federal debt.
Insufficient Support for Loan Reviews
SBA did not have sufficient supporting documentation to substantiate its review decisions to
clear DNP hold codes for 43 of 176 (or 24 percent) statistically sampled DNP-matched loans,
totaling approximately $7.2 million.
SBA’s guidance for conducting manual reviews to resolve hold codes noted that the reviews
entailed reviewing loan data, conducting research, and requesting documents from borrowers.
The DNP hold codes for the 43 loans included:
• thirty-eight with DNP delinquent or defaulted federal debt matches;
• four with DNP debarment matches; and
• one with DNP death data source match.
However, the loan files we reviewed did not contain sufficient supporting documentation to
substantiate SBA’s decision to clear the hold code and deem the borrower eligible for the PPP
loan.
Examples of acceptable documents and information needed to clear DNP hold codes specific to
delinquent or defaulted federal debt, SAM debarments, or death matches include:7
7 Paycheck Protection Program Loan Review Plan, dated October 22, 2020.
9
• loan transcripts showing payment disbursement dates for federal debt;
• documents validating that a business is not debarred or was released from debarment; or
• identity affidavits for borrowers that appear to be deceased, current proof of identity
including social security cards or IDs, or ownership transfer paperwork.
Retaining documentation and sufficient evidence to support loan decisions in loan files is
consistent with federal standards for internal controls, which require management to support
their decisions and determinations with supporting documentation that includes the rationale of
how decisions were made and underscores the importance of documentation and records being
properly managed, maintained, and available.8 While guidance in the PPP Loan Review Plan
references documentation that can be used to resolve hold codes and requires reviewers to
support their decisions, it is not always obvious that the supporting documentation must be
retained. For example, in SBA’s review plan, reviewers are required to support their conclusions
with documentation but are not explicitly required to include copies of the supporting
documents in the loan files. While 84 of the 176 files examined had sufficient documentation to
support SBA’s review decisions, the remaining 43 did not.
Consequently, SBA did not ensure the quality, completeness, and consistency of its loan reviews
and there is no reasonable assurance that SBA’s loan review decisions were appropriate or that
borrowers met eligibility requirements. By projection, we estimate 5,718 of 25,634 (or 22
percent) DNP-matched loans totaling approximately $1 billion, were disbursed and forgiven
without sufficient support to substantiate SBA’s loan decisions.
8 Standards for Internal Control in the Federal Government, dated September 2014.
10
Recommendations
To ensure borrowers met PPP eligibility requirements and to reduce the risk of fraud, waste, and
abuse, we recommend the Administrator direct the Acting Associate Administrator for the Office
of Capital Access:
Recommendation 2: Review the 49 PPP loans totaling approximately $3.5 million and the 43
loans totaling approximately $7.2 million to ensure borrowers met eligibility requirements and
seek remedy or repayment of loans deemed ineligible.
Recommendation 3: Conduct a review of PPP loans, in which the DNP hold codes were cleared to
1) identify those cleared using pre-decisional memos and 2) those cleared without sufficient
evidence to support the reviewer’s loan decision and seek remedy or repayment of loans
deemed ineligible.
Recommendation 4: Develop and implement controls, such as supervisory reviews, to ensure
PPP loans and loans for future stimulus programs with DNP matches receive manual reviews, as
required. The reviews should ensure that pre-decisional memos are not used to clear DNP hold
codes and that the loan files contain relevant and appropriate documentary evidence to support
the loan review decisions.
Recommendation 5: Develop and implement clear guidance requiring responsible officials to
maintain documentary evidence used to support loan decisions in the loan files.
11
Finding 3: SBA’s Loan Review Procedures Were Not Always
Sufficient to Assess Eligibility
SBA developed and implemented review procedures to screen PPP applicants against Treasury’s
DNP databases before approving and disbursing PPP round two loans.9 However, SBA’s review
for the first 2 months, impacting about 2.65 of 7.37 million (or 36 percent of loan applications)
totaling approximately $172 billion, was not sufficient to assess eligibility and prevent improper
payments. SBA did not screen applicants against all the minimally required DNP databases,
specifically, it did not screen applicants for delinquent or defaulted debt data sources or
debarment. This occurred because SBA had not completed the administrative requirements to
comply with the Improper Payment Elimination and Recovery Act of 2012, thus it did not have
access to Treasury’s restricted DNP databases.
Analysis using all required sources found an additional 59,893 loans, totaling about $1.9 billion
that matched either a Treasury Offset Program (TOP), Credit Alert Interactive Verification
Response System (CAIVRS), or SAM.gov restricted DNP data source over the first 2 months that
were not identified originally. These data sources are required to be used in enhancing payment
accuracy.10
In January 2021, SBA revised its PPP loan review procedures to address DNP compliance checks
and subsequently completed the administrative requirements necessary to screen PPP
applicants against Treasury’s public and restricted DNP databases. However, SBA did not
implement these updates until March 9, 2021, almost 2 months after it began accepting PPP
round two loan applications.
From January 11 through March 9, 2021, SBA received about 2.7 million loan applications. Using
only Treasury’s public data sources to identify potentially ineligible applicants, SBA identified
2,777 (or 0.1 percent) totaling approximately $22.4 million matching a public DNP data source.
By comparison, our reassessment using all required sources found an additional 59,893 loans
totaling about $1.9 billion that matched either a TOP, CAIVRS, or SAM.gov restricted DNP data
source over the first two months that were not originally identified.
TOP, CAIVRS, and SAM.gov restricted data sources are not available to the public and consist of
databases with information that is protected by the Privacy Act and characterized by those
records under the control of an agency. 11 Since sources are protected by the Privacy Act, federal
agencies are required to enter into an agreement with Treasury prior to using it (with some
exceptions). The purpose of the agreement is to establish or verify the eligibility of compliance
with statutory and regulatory requirements for an agency, such as SBA, to use the data.
9 Loans originating from January 2021 until the PPP expired in June 2021.
10 Presidential Memorandum, Enhancing Payment Accuracy Through a "Do Not Pay List, June 18, 2010.
11 Treasury has both public and restricted data for SAM.gov.
12
SBA had not finalized its agreement or its exception before PPP round two began. In SBA’s
response to our November 30, 2020, management alert on Paycheck Protection Program Loan
Recipients on the Department of Treasury’s Do Not Pay List, SBA stated that efforts were
underway to screen potential borrowers against Treasury’s Do Not Pay List.
Only screening applicants against Treasury’s publicly available databases limited the depth of
SBA’s analysis and the likelihood of finding all DNP matches. Public databases can contain self-
reported information and generally have a narrow focus. For example, Treasury’s publicly
available Automatic Revocation of Exemption List (ARL) debarment database only provides
information on entities that have a tax-exempt status that has been automatically revoked under
the law because they have not filed IRS Form 990 series tax returns annually for three
consecutive years. Similarly, the Office of Foreign Assets Control debarment database only
contains records of individuals and entities that are under sanction by the federal government
and, therefore, ineligible for payment. This generally applies to foreign companies or
governments.
In contrast, Treasury’s restricted databases for screening applicants for debarment, such as
SAM.gov Exclusion Records, has unique identifiers needed for identifying conclusive matches and
more agencies report to the database.
The additional 59,893 loans totaling about $1.9 billion that had a DNP data match indicate the
borrowers were potentially ineligible.
Recommendations
To address the potentially ineligible loans, we recommend the Administrator direct the Acting
Administrator for the Office of Capital Access:
Recommendation 6: Review the 59,893 PPP applications that matched a DNP data source to ensure
borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.
13
Other Matter: Update to Treasury’s Initial Analysis
of Borrowers Who Were Delinquent or Defaulted
on Federal Debt
Our prior report (Report Number 21-06) found 57,473 potentially ineligible DNP matched loans
totaling about $3.6 billion for PPP round one (April 4 through August 8, 2020).12 The TOP
delinquent debt DNP data matches were 37,316, totaling about $1.6 billion. This TOP DNP data
match search should have covered active debt from date of application, up to seven years prior
to applying; however, it did not. Treasury’s TOP DNP data match search mistakenly only covered
active debt on the date of application, which was limited to 12 months. Treasury acknowledged
the error and provided an updated analysis of PPP round one TOP matches for April 4 through
August 8, 2020, which considered debt on the date of application through the prior 7 years.
Treasury’s revised analysis identified 101,564 DNP data matches totaling $5.1 billion, of which
85,256 loans totaling $3.3 billion matched a TOP data source. This represented an increase of
47,940 DNP TOP matches totaling over $1.7 billion.
Table 1: Comparison of Treasury’s TOP Data Source Original and Revised Matched
PPP Round One Loans
Match Source
Number of Loans
Dollar Amount
Original Matched TOP Debt
Check
37,316
$1,554,269,548
Revised Matched TOP Debt
Check
85,256
$3,306,131,643
Increase from Original to
Revised
47,940
$1,751,862,095
Source: Treasury DNP Business Group, January 25, 2023.
12 Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do Not Pay List, Report Number
21-06.
14
Recommendations
To address the potentially ineligible loans, we recommend the Administrator direct the Acting
Associate Administrator for the Office of Capital Access:
Recommendation 7: Review the additional 47,940 PPP loans totaling over $1.7 billion, identified
through the DNP data match, to ensure borrowers met the eligibility requirements and seek
remedy or repayment of loans deemed ineligible.
Evaluation of Agency Response
SBA management provided formal comments to the draft report, which are included in their
entirety in Appendix 5. We considered management’s comments when preparing this final
report. Management partially agreed with recommendations 1-3 and 5-7; and disagreed with
recommendation 4. Management indicated in their responses to recommendations 1, 6, and 7
that they requested specific loan data from OIG to assist in analyzing the findings and determining
which loans had already been manually reviewed but did not receive that data in time for their
response. As of December 19, 2023, OIG provided all requested data to SBA management.
Management’s proposed corrective actions for recommendations 2-5 do not satisfy the intent of
those recommendations and, as a result, are unresolved. In accordance with our audit follow-up
policy, we will attempt to reach agreement with SBA management on these recommendations
within 60 days of the date of this report. If we do not reach agreement, OIG will notify the audit
follow-up official of the disputed issues.
Summary of Actions Necessary to Close the Recommendations
The following section summarizes the status of our recommendations and the actions necessary
to close them.
Recommendation 1
Review the 1,799 PPP loans totaling over $89 million that matched a DNP data source to ensure
eligibility requirements were met and seek remedy or repayment of all loans deemed ineligible.
Status: Resolved
Management partially agreed with this recommendation, stating they requested specific loan
data from OIG to assist in analyzing the findings and determining which loans had already been
manually reviewed, but they did not receive the data in time for their response. Management
further stated once they receive and analyze the data, they will discuss with OIG and determine
15
the appropriate next steps towards remediation. In subsequent correspondence, management
stated they plan to complete final action on this recommendation by January 31, 2025.
Management’s planned actions satisfy the intent of this recommendation. We consider this
recommendation resolved and will close it when management provides evidence that they
reviewed the 1,799 PPP loans totaling over $89 million, that matched a DNP data source, to
ensure eligibility requirements were met and it took actions to seek remedy or repayment of all
loans deemed ineligible.
Recommendation 2
Review the 49 PPP loans totaling approximately $3.5 million and the 43 loans totaling
approximately $7.2 million to ensure borrowers met eligibility requirements and seek remedy or
repayment of loans deemed ineligible.
Status: Unresolved
Management partially agreed with this recommendation, stating they reviewed and
appropriately cleared 40 of 49 loans we determined were cleared using pre-decisional memos;
and 41 of 43 loans with insufficient support for loan reviews. Management stated they need
additional documentation for the remaining 11 loans to determine if borrowers met eligibility
requirements. They will request the necessary documentation from lenders and make an
eligibility determination. In addition, management stated they placed hold codes on the 11 loans
to prevent borrowers from receiving additional SBA financing until they resolve the hold codes.
After fieldwork was complete, management provided their rationale for removing hold codes for
40 of the 49 loans that were cleared using pre-decisional memos. The 40 loans included 18 DNP
matches regarding delinquent debt, 15 DNP matches related to borrowers defaulting on federal
debt within 7 years of applying for the PPP loan, 6 matches related to DNP death data sources,
and 1 DNP match for SAM debarment.
In our analysis of management’s actions to remove the hold codes, we found that they
inappropriately cleared them. As indicated in the report, management cleared hold codes
related to delinquent or defaulted debt by stating the borrower’s debt was not a direct or
guaranteed loan from SBA or any other federal agency and did not fall under any of the
examples of ineligibility cited in its Interim Final Rule.
For the 18 loans with delinquent debt matches that SBA cleared, we found the borrowers had
federal debts such as Department of Justice (DOJ) claims, or debts to the Social Security
Administration (SSA). In accordance with 31 U.S.C. §3720B, Barring Delinquent Federal Debtors
from Obtaining Federal Loans or Loan Insurance Guarantees, unless a federal agency head
waives this subsection, a person may not obtain any federal financial assistance in the form of a
16
loan other than a disaster loan or a marketing assistance loan, or loan deficiency payment if the
person has an outstanding debt other than a debt under the Internal Revenue Code of 1986. SBA
did not have a waiver to exempt debts owed to the DOJ, the SSA, or any other federal entity to
which we identified potentially ineligible borrowers owed a debt, from this statutory
requirement. Additionally, SBA did not provide, nor did we find support in its applicable
databases to substantiate, that SBA appropriately resolved the remaining hold codes related to
defaulting federal debt, death data sources, and SAM debarment. Therefore, we maintain our
analysis as indicated in the report, management inappropriately cleared the hold codes for the
49 loans.
Management similarly provided us their rationale or screenshots of notations to loan files for
removing DNP hold codes for 41 of the 43 loans with insufficient support for loan reviews. These
included 39 DNP matches related to delinquent or defaulted federal debt, 1 DNP debarment
match, and 1 match to a DNP death data source.
We reviewed the information management provided and the applicable loan files. As indicated in
the report, we concluded that neither the information management provided nor the loan files
contained sufficient supporting documentation to substantiate SBA’s decision to clear the hold
codes and deem the borrowers eligible for the PPP loan.
In conclusion, although management provided additional information, the agency’s actions were
not sufficient to resolve the hold codes for any of the 92 loans identified and thus does not meet
the intent of this recommendation. We will attempt to resolve this recommendation with
management in accordance with our audit follow-up policy.
Recommendation 3
Review PPP loans in which the DNP hold codes were cleared to 1) identify those cleared using
pre-decisional memos and 2) those cleared without sufficient evidence to support the reviewer’s
loan decision and seek remedy or repayment of loans deemed ineligible.
Status: Unresolved
Management partially agreed with this recommendation, stating that the agency acknowledges
it may have inadvertently closed DNP hold codes for a population of loans due to a pre-
decisional memo. SBA estimated that this error impacted 0.0001 percent of the PPP portfolio
and believes that the manually reviewed DNP hold codes were reviewed correctly and previously
supplied that information to OIG.
As shown in the report, in our analysis of the 176 loans, SBA cleared hold codes for 49 of 176
loans (or 28 percent), using pre-decisional memos, or did not have sufficient supporting
17
documentation to substantiate its review decisions to clear the DNP hold codes for 43 of 176 (or
24 percent). We projected our sample results onto the DNP-matched loans to estimate that
lenders disbursed, and SBA forgave, 12,234 of 25,634 loans (or 48 percent) totaling over $1.4
billion without verifying borrower eligibility, exposing the program to financial losses and
improper payments.
As indicated in the report, using pre-decisional memos that do not address hold codes and
clearing hold codes without sufficient evidence to support the reviewer’s decisions did not
provide reasonable assurance that SBA’s loan review decisions were appropriate or that
borrowers met eligibility requirements.
Management did not express plans to review these loans, therefore management’s actions were
not sufficient to resolve this recommendation. We will attempt to reach resolution in accordance
with our audit follow-up policy.
Recommendation 4
Develop and implement controls, such as supervisory reviews, to ensure PPP loans and loans for
future stimulus programs with DNP matches receive manual reviews, as required. The reviews
should ensure that pre-decisional memos are not used to clear DNP hold codes and that loan
files contain relevant and appropriate documentary evidence to support the loan review
decisions.
Status: Unresolved
Management disagreed with this recommendation, stating they reserve the right to allocate
program resources and appropriately define risk tolerances, as recommended in GAO Standards
for Internal Control in the Federal Government (Green Book), and will continue using data
analytics to identify loan categories that present minimal risk as candidates for disposition
without manual reviews, especially for emergency programs.
OIG agrees that SBA has the program responsibility to establish an internal control environment
consistent with the Green Book. The Green Book emphasizes the importance of continuous
monitoring and supervisory control activities, such as transaction-level supervisory reviews.
However, we found that management did not adhere to the controls outlined in SBA’s PPP Loan
Review Plan, dated June 10, 2021, which called for these loans to be manually reviewed.
Incorporating such controls into loan review processes could support SBA’s achievement of
programmatic objectives and management of risks associated with fraud and improper
payments.
18
The agency does not plan to develop and implement controls to ensure PPP loans and loans for
future stimulus programs with DNP matches receive manual reviews, as required by SBA’s PPP
Loan Review Plan. However, we will attempt to reach resolution in accordance with our audit
follow-up policy.
Recommendation 5
Develop and implement clear guidance requiring responsible officials to maintain documentary
evidence used to support loan decisions in the loan files.
Status: Unresolved
Management partially agreed with this recommendation, stating that the agency has
consistently developed and implemented clear guidance since initiating PPP loan reviews. SBA
agrees that clear guidance is essential to maintaining documentary evidence used to support
loan decisions in loan files. However, management did not indicate plans to revise loan review
guidance to require responsible officials to maintain documentary evidence used to support loan
decisions, therefore, we will attempt to reach agreement on management’s proposed actions to
sufficiently resolve the recommendation in accordance with our audit follow-up policy.
Recommendation 6
Review the 59,893 PPP applications that matched a DNP data source to ensure borrowers met
eligibility requirements and seek remedy or repayment of loans deemed ineligible.
Status: Resolved
Management partially agreed with this recommendation, stating that the agency requested loan
data from OIG to assist in analyzing the applications and determining which loans have already
been manually reviewed, but did not receive the data in time for their response. Management
stated they will analyze the data and discuss the findings with OIG and determine the
appropriate next steps towards remediation. As of December 19, 2023, OIG provided all
requested data to SBA management. In subsequent correspondence, management stated they
plan to complete final action on this recommendation by January 31, 2025.
Management’s planned actions satisfy the intent of this recommendation. We consider this
recommendation resolved and will close it when management provides evidence that they
reviewed the 59,893 PPP applications that matched a DNP data source to ensure borrowers met
eligibility requirements and that they took action to seek remedy or repayment of all loans
deemed ineligible.
Recommendation 7
19
Review the additional 47,940 PPP loans totaling over $1.7 billion, identified through the DNP
data match, to ensure borrowers met the eligibility requirements and seek remedy or repayment
of loans deemed ineligible.
Status: Resolved
Management partially agreed with this recommendation, stating that they flagged all loans OIG
identified when Report Number 21-06 was issued January 2021. Management further stated
that after almost 2 years, OIG is stating there was a mistake in their methodology and is issuing a
recommendation for SBA to review an additional 47,490 loans. Management also stated they
requested loan data from OIG to assist in analyzing these findings and determining which loans
have been manually reviewed but did not receive the data in time for their response. They stated
once they receive and analyze the data, they will discuss their findings with OIG and determine
appropriate next steps towards remediation. In subsequent correspondence, management
stated they plan to complete final action on this recommendation by January 31, 2025.
As indicated in the report, the 37,316 Treasury Offset Program (TOP) delinquent debt DNP data
matches, totaling about $1.6 billion shown in Report Number 21-06, mistakenly only covered
active debt on the date of application, which was limited to 12 months. However, the data match
search should have covered active debt from date of application, up to 7 years prior to applying.
Treasury acknowledged its error and provided an updated analysis of PPP round one TOP
matches for April 4 through August 8, 2020, which considered debt on the date of application
through the prior 7 years. Treasury’s revised analysis identified 101,564 DNP data matches
totaling $5.1 billion, of which 85,256 loans totaling $3.3 billion matched a TOP data source. This
represented an increase of 47,940 DNP TOP matches totaling over $1.7 billion that SBA should
review.
As of December 19, 2023, OIG provided all requested data to SBA management. Management’s
planned actions satisfy the intent of this recommendation. We consider this recommendation
resolved and will close it when SBA provides evidence that it reviewed the additional 47,940 PPP
loans totaling over $1.7 billion, identified through the DNP data match, to ensure borrowers met
the eligibility requirements and took action to seek remedy or repayment of all loans deemed
ineligible.
1-1
Appendix 1: Additional Information
Objective, Scope, and Methodology
Our objective was to assess the U.S. Small Business Administration’s (SBA) actions to address
Paycheck Protection Program (PPP) loans identified as potentially ineligible due to DNP data
matches and its implementation of controls to review Do Not Pay (DNP) data prior to loan
approval and disbursement of loans originated after August 2020.
To answer our objective, we reviewed applicable laws, regulations, and requirements governing
PPP loan eligibility and forgiveness; SBA’s guidance in its PPP Interim Final Rules; PPP Frequently
Asked Questions; and policies and procedures for addressing hold codes. We also reviewed SBA’s
processes and procedures implemented to review DNP data sources prior to loan approval and
disbursement for loan applications submitted after PPP round two funding. In addition, we
analyzed PPP loan data and interviewed staff responsible for performing loan reviews.
Specifically, we interviewed officials from the Office of Capital Access.
We obtained and reviewed pertinent federal, departmental, and SBA-specific regulations,
policies, procedures, and guidance, including the Coronavirus, Aid, Relief, and Economic Security
Act, Paycheck Protection Program and Health Care Enhancement Act, Paycheck Protection
Program Flexibility Act of 2020, Economic Aid Act, Interim Final Rules, Frequently Asked
Questions, Procedural Notices, program forms, and policies and procedures for conducting loan
reviews that pertained to the PPP.
We also met with SBA management and personnel at the U.S. Department of Treasury’s DNP
Business Center to discuss the matching parameters to ensure that the DNP data matching
results were consistent with PPP eligibility requirements.
We statistically sampled 176 of 25,634 loans with DNP matches with a 95 percent confidence
level. We treated each of the following three types of DNP hold codes, (1) delinquent or
defaulted federal debt (TOP and CAIVRS), (2) loans with DNP debarment matches (SAM), and (3)
loans with DNP death data source matches as a separate population. We conducted a sample
size analysis for each DNP hold type, and the results from these three analyses were summed to
determine the total overall sample size.
1-2
We conducted this evaluation in accordance with the Council of the Inspectors General on
Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. Those standards
require that we adequately plan and perform the evaluation to obtain sufficient and appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our objective.
We believe that the evidence we obtained provides a reasonable basis for our conclusions based
on our objective.
Use of Computer-Processed Data
We relied on information from SBA’s electronic loan servicing system (E-Tran), Forgiveness
Platform, and data from the Office of Capital Access to conduct our analysis. Our scope of work
covered loans originated from April 2020 through June 2021. We interviewed data scientists
from Department of Treasury’s DNP team and recalculated their analysis to determine if SBA’s
reported data was reliable. We believe the data elements used in this report are sufficiently
reliable to support our report conclusions (see Appendix 3).
Assessment of Internal Controls
We identified the following internal control components and underlying internal control
principles significant to the audit objective.
Table 1-1: Internal Controls Assessed
Internal Control Component
Internal Control Principle
Control Environment
Management should establish an organizational
structure, assign responsibility, and delegate
authority to achieve the entity’s objectives
Risk Assessment
Management should:
•
Define objectives clearly to enable the
identification of risks and define risk
tolerances.
•
Identify, analyze, and respond to risks related
to achieving the defined objectives.
•
Consider the potential for fraud when
identifying, analyzing, and responding to risks.
•
Identify, analyze, and respond to significant
changes that could impact the internal control
system.
Control Activities
Management should design control activities to
achieve objectives and respond to risks.
Info/Communication
Management should internally communicate the
necessary quality information to achieve the
entity’s objectives.
1-3
Monitoring
Management should establish and operate
monitoring activities to monitor the internal
control system and evaluate the results.
Management should remediate identified internal
control deficiencies on a timely basis.
We assessed the operating effectiveness of internal controls implemented to address PPP loans
identified as potentially ineligible due to DNP data matches and controls to review DNP data
prior to loan approval and disbursement and identified deficiencies we believe could affect SBA’s
ability to determine if borrowers met eligibility requirements.
The internal control deficiencies we found are discussed in the Results section of this report.
However, because our review was limited to aspects of these internal control components and
underlying principles, it may not identify all internal control deficiencies that may have existed
when this audit took place.
Prior Audit Coverage
The following lists OIG’s previous audit coverage related to the objective of this report:
Report Number
Report Title
Final Report Date
SBA OIG (21-06)
Paycheck Protection Program Loan
Recipients on the Department of Treasury’s
Do Not Pay List
January 11, 2021
SBA OIG (21-07)
SBA’s Implementation of the Paycheck
Protection Program
January 14, 2021
SBA OIG (21-19)
The Small Business Administration’s
Implementation of Recommended Controls
and the Economic Aid Act
August 12, 2021
SBA OIG (22-09)
SBA’s Paycheck Protection Program Loan
Review Processes
February 28, 2022
2-1
Appendix 2: Data Sources Mandated by Law and
Used in Treasury’s PPP Analysis
The Do Not Pay (DNP) portal accesses multiple federal data sources required by law and
includes:
Treasury Debt Check (Treasury Offset Program (TOP) Debt Check)
• TOP Debt Check is a data extract or subset of data contained in the TOP delinquent
debtor database. It was created for the U.S. Department of Treasury’s (Treasury) DNP
system to help agencies fulfill the obligation to deny federal loans, loan insurance, and
loan guarantees to people who are delinquent on federal nontax debts and child support
obligations (if allowed by agency statute and regulations).
• DNP receives weekly TOP Debt Check updates.
Credit Alert Interactive Verification Reporting System (CAIVRS)
• A shared database of defaulted federal debtors, CAIVRS enables processors of
applications for federal credit benefits to identify individuals who are in default or have
had claims paid on direct or guaranteed federal loans or are delinquent on other debts
owed to federal agencies. Treasury DNP receives CAIVRS data from the following
agencies:
o U.S. Department of Justice o U.S. Department of Agriculture
o U.S. Department of Veterans Affairs
o U.S. Department of Housing and Urban Development
o U.S. Small Business Administration
• The entire CAIVRS database is refreshed each time any agency source forwards an
update; agency sources update data at various times throughout the month.
System for Award Management (SAM Exclusion)
• SAM Exclusion records contain the data for all active exclusion records entered by the
federal government identifying those parties excluded from receiving federal contracts,
certain subcontracts, and federal financial and nonfinancial assistance and benefits.
• Treasury DNP receives daily SAM updates.
2-2
Social Security Administration Death Records
• The DMF from the Social Security Administration (SSA) is a data source that contains
more than 94 million records. The file is built from internal SSA records of deceased
persons possessing SSNs and whose deaths were reported to the SSA.
• DNP uses the public DMF but does not have access to the full DMF. Legislation such as
the Social Security Act precludes the sharing of the full DMF with agencies that do not
pay benefits.
• DNP receives a weekly update to the public DMF.
3-1
Appendix 3: Treasury’s DNP Analytic Explanations
2020 Re-Run Paycheck Protection Program (PPP) Loan Universe
The U.S. Small Business Administration’s Office of the Inspector General (SBA OIG) requested the
Do Not Pay (DNP) Business Center perform a re-run data analytics project of loans originated in
the PPP first round, April 4-August 8, 2020, as identified in SBA OIG Report Number 21-06. DNP’s
original assessment of the PPP was completed on August 24, 2020, and used PPP loan data with
an extraction date of August 8, 2020. For the original assessment, DNP evaluated 5.2 million PPP
loans with a total value of $525 billion.
2020 Re-Run Project Scope
SBA OIG collaborated with the U.S. Department of Treasury’s DNP for an analytics project to
conduct eligibility checks of applicants who received PPP loans.
DNP revisited the analysis with the original parameters to identify applicants omitted in the
original project results. This revised analysis used the same data, data sources, and filters used in
the original analytics project. PPP eligibility requirements included verifying the eligibility of
applicants who:
• may have had delinquent federal loans or defaulted on federal loans the seven years
prior to the PPP loan application date;
• appear to be on the System for Award debarment list; and
• matches any of the death sources used by DNP.
2020 Re-Run Results
The subsequent review of project results revealed an error. DNP omitted results that included
applicants who may have defaulted on loan payments within the seven years prior to the PPP
application date. Consequently, the total number of potential improper payments was
understated.
The original analysis identified 57,473 loans as potentially ineligible, while the revised analysis
identified 101,564 loans as potentially ineligible — an increase of 44,091 loans.
3-2
We found that:
• most of the increase comes from the TOP and CAIVRS debt check data source. The original
ineligibility analysis identified 37,316 loans that matched to TOP, while the revised analysis
identified 85,256 loans, an increase of 47,940 loans.
• the total value of the matched loans was $5.1 billion, representing 0.97 percent of the total
value of loans screened.
• of the loans screened, 101,564 (or 1.95 percent) contained a match to a DNP data source,
indicating potential fraud.
Table 3-1: Treasury’s Matched PPP Round One Loans by DNP Data Sources(s)
Match Source
Matched Loans
Approved
Amount ($)
Current Amount ($)
Undisbursed Amount
($)
TOP Debt
Check
37,316
1,565,193,095
1,554,269,548
196,605,444
CAIVRS
16,043
1,145,296,385
1,136,997,092
74,077,133
SAM Exclusion
958
73,627,495
73,684,412
5,478,728
AIS Obituary
4,258
826,654,548
825,395,032
12,609,669
DMF
938
178,314,957
179,104,890
2,771,773
AIS Probate
228
49,916,171
49,588,488
32,500
Dept. of State
20
2,720,320
2,720,320
Total
59,761
$3,841,722,971
$3,821,759,782
$291,575,247
Source: SBA OIG Report Number 21-06, January 11, 2021.
*Note: The matched loan count does not equal the 57,473 loan total because some loans matched
multiple DNP data sources. If the same loan matched multiple sources, we included its amount in the
totals for each matched source.
3-3
Table 3-2: Summarizes Treasury’s re-run of matched PPP round one loans by the
DNP data sources(s)
Match Source
Matched Loans
Approved Amount ($)
Current Amount ($)
Undisbursed
Amount ($)
TOP Debt
Check
85,256
3,332,024,321
3,306,131,643 430,705,310
CAIVRS
17,696
1,310,036,279
1,301,730,319
89,300,886
SAM
Exclusion
958
73,627,495
73,684,412
5,478,728
AIS Obituary
3,079
634,155,096
633,806,773
5,135,713
DMF
635
140,854,239
141,871,309
1,482,717
AIS Probate
222
48,597,610
48,271,927
21,500
Dept. of State
16
2,556,216
2,556,216
Total
107,862
$5,541,851,256
$5,508,052,599
$532,124,854
Source: Treasury DNP Business Group, December 12, 2022.
*Note: The count of matched loans will not equal the 101,564 total due to loans that had matches to
multiple data sources. If the same loan matched to multiple sources, we included its amount in the totals
for each matched source.
2021 PPP Loan Universe
SBA OIG requested that Treasury’s DNP Business Center analyze the data matches of PPP second
round funding, December 27, 2020 – June 30, 2021.
2021 Project Scope
The DNP Business Center collaborated with SBA OIG to identify potential improper payments
disbursed through the PPP. SBA OIG requested the DNP Business Center perform eligibility
checks for those who applied for loans as part of the PPP. To be eligible to receive funds from
the PPP, a business must not have any current federal debarments or suspensions and the
applicant must not have delinquent federal loans or have defaulted on any federal loans in the
last seven years.
3-4
The purpose of this project was to screen Tax Identification Numbers (TIN)/Name data provided
in the SBA data files against DNP debt, exclusion, and death data sources. The SBA data files used
in this project included TIN/Name data for the borrower, borrower’s business, and principals
recorded on the PPP loan application.
2021 Results
Of the loans screened, 319,493 (or 5.05 percent) contained a match to a DNP data source record
indicating potential loan ineligibility. We found that:
• the total current loan value of the matched loans was $6.73 billion; and
• loans that provided a match and were classified as “Undisbursed” at the time of the
analysis totaled $283,000.
Of the 319,493 matched loans, 305,186 matched with a TOP debt check source. The current loan
value of the matched loans is $6.06 billion.
Table 3-3: Summarizes Treasury’s matched PPP round two loans by the DNP sources
Match Source
Matched
Loans
Approved Amount
($)
Current Amount ($)
Undisbursed Amount
($)
TOP Debt
Check
305,186
6,074,082,616
6,057,099,571
282,816
CAIVRS
27,066
874,379,634
872,001,527
SAM
Exclusion
1,116
35,644,441
36,135,545
AIS Obituary
670
86,150,982
86,381,191
EVVE
305
46,803,180
46,762,548
DMF
221
24,659,213
24,642,572
AIS Probate
74
16,464,902
16,699,507
Dept. of State
8
706,969
706,969
Total
334,646
$7,158,891,937
$7,140,429,430
$282,816
Source: Treasury DNP Business Group, December 12, 2022.
*Note: The count of Matched Loans will not equal the 319,493 total due to loans that had matches to
multiple data sources. If the same loan matched to multiple sources, its amount is included in the totals
for each matched source.
4-1
Appendix 4: Monetary Impact
Monetary Impact identified in this report is categorized as questioned costs. Questioned costs
are expenses not supported by adequate documentation at the time of the audit, or which
otherwise do not comply with legal, regulatory, or contractual requirements.
Table 4-1: OIG Schedule of Monetary Impact (Questioned Cost) for Borrowers
Matching a Do-Not-Pay Data Source
Description
Amount (Dollars)
Explanation
Unsupported Costs
$465,060,351
By projection, we statistically estimate SBA
dispositioned and disbursed 6,516 of 25,634,
or 25 percent, using pre-decisional memos
that did not address the DNP issue.
Unsupported Costs
$963,338,720
By projection, we statistically estimate SBA
dispositioned and disbursed 5,718 of 25,634,
or 22 percent, without sufficient support for
loan decisions.
Total Overall
Questioned Cost
$1,428,399,071
Source: OIG analysis of loan data.
5-1
Appendix 5. Agency Response
1
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
To:
Hannibal “Mike” Ware
Inspector General
U.S. Small Business Administration
From:
Jihoon Kim
Director
Office of Financial Program Operations
Office of Capital Access
Date:
December 20, 2023
Subject:
Response to OIG Draft Report - SBA's Eligibility and Forgiveness Reviews of Paycheck
Protection Program Loans Made to Borrowers with Treasury's Do Not Pay Data
Matches - Project 22011
We appreciate the role the Office of Inspector General (OIG) plays in working with management in
ensuring that our programs are effectively managed, and for the feedback provided in this draft report.
The SBA team reviewed the OIG Discussion Memo. SBA acknowledges the importance of
implementing the Do Not Pay (DNP) system to reduce improper payments. To that end, SBA employed
DNP checks of the entire PPP portfolio in its forgiveness process and the Paycheck Protection Program
(PPP) loan origination process in 2021.
The implementation of PPP was expedited to quickly provide timely relief to mitigate the economic
impact of the COVID-19 pandemic. During 2020, the desire for the rapid deployment of relief funds
resulted in fewer fraud and eligibility controls up-front and at disbursement than what normally
occurred in SBA program operations. After the 2020 cohort of loans was approved, SBA performed
data analytics, including reviewing information from the Department of Treasury DNP lists (initially
provided by the OIG), and other analyses of the 2020 First Draw PPP Loan portfolio. Loans identified
through data analytics as having potential eligibility issues were marked with Hold Codes to be
manually reviewed when the borrower applied for a second draw, applied for forgiveness, when a lender
requests guaranty purchase or when a PPP borrower with a potential eligibility issue applies for
additional SBA financing. If the potential eligibility issue was confirmed after the manual review, SBA
denied forgiveness in full.
For PPP loans that originated in 2021, SBA implemented upfront controls to identify potential eligibility
issues or potential fraud before loan approval. The upfront controls included Compliance Checks using
information from the Department of Treasury DNP lists and public record sources. If the Compliance
Check for a 2021 First Draw PPP loan or a Second Draw PPP loan identified an issue, the Lender was
provided an opportunity to work with the applicant to resolve the outstanding Compliance Check. If the
lender was unable or unwilling to resolve the Compliance Check, the application was not approved.
SBA designed its loan review process to maximize program integrity and optimize use of SBA’s limited
resources, considering the challenges posed by the volume of PPP loans and the statutory timeframe for
reviews. As of December 2023, SBA has manually reviewed 405,000 PPP loans at forgiveness, guaranty
purchase and when a PPP borrower with a potential eligibility issue applies for additional SBA
financing.
Recommendation 1 - Review the 1,799 PPP loans totaling over $89 million, that matched a DNP data
source, to ensure eligibility requirements were met and seek remedy or repayment of all loans deemed
ineligible.
SBA Response: SBA partially agrees. SBA requested specific loan data from OIG to assist us in
analyzing these findings and determining which loans have already been manually reviewed but were
unable to receive that data in time for this response. Once we receive and analyze the data, we will
discuss our findings with OIG and determine the appropriate next steps towards remediation.
Recommendation 2 - Review the 49 PPP loans totaling approximately $3.5 million and the 43 loans
totaling approximately $7.2 million to ensure borrowers met eligibility requirements and seek remedy or
repayment of loans deemed ineligible.
SBA Response: SBA partially agrees. SBA reviewed the loans referenced in the recommendation and
determined that DNP matches were appropriately cleared for 40 of the 49 loans and 41 of the 43 loans.
Additional documentation is required for the remaining 11 loans to determine if borrowers met
eligibility requirements. SBA will request necessary documentation from the lender and make an
eligibility determination. In addition, SBA placed Hold Codes on the 11 loans to prevent borrowers from
receiving additional SBA financing until the hold codes are resolved.
Recommendation 3 - Conduct a review of PPP loans, in which the DNP Hold Codes were cleared to 1)
identify those cleared using pre-decisional memos and 2) those cleared without sufficient evidence to
support the reviewer’s loan decision and seek remedy or repayment of loans deemed ineligible.
SBA Response: SBA partially agrees. SBA acknowledges a population of loans may have had their
DNP Hold Codes inadvertently closed due to a pre-decisional memo. SBA estimated that this error
impacted 0.0001% of the PPP portfolio. SBA believes that DNP hold codes that were manually
reviewed were reviewed correctly and has supplied that information previously to OIG.
Recommendation 4 - Develop and implement controls, such as supervisory reviews, to ensure PPP
loans and loans for future stimulus programs with DNP matches receive manual reviews, as required.
The reviews should ensure that pre-decisional memos are not used to clear DNP Hold Codes and that the
loan files contain relevant and appropriate documentary evidence to support the loan review decisions.
SBA Response: SBA disagrees. Management reserves the right to allocate program resources and
appropriately define risk tolerances, as recommended in the GAO Standards for Internal Control in the
Federal Government (the Green Book). SBA will continue using data analytics to identify categories of
loans that present minimal risk as candidates for disposition without manual reviews, especially for
emergency programs.
Recommendation 5 - Develop and implement clear guidance requiring responsible officials to maintain
documentary evidence used to support loan decisions in the loan files.
SBA Response: SBA partially agrees. SBA has consistently developed and implemented clear guidance
since PPP loan reviews were initiated. SBA agrees that clear guidance is essential to maintaining
documentary evidence used to support loan decisions in loan files.
Recommendation 6 - Review the 59,893 PPP applications that matched a DNP data source to ensure
borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.
SBA Response: SBA partially agrees. SBA requested specific loan data from OIG to assist us in
analyzing these findings and determining which loans have already been manually reviewed but were
unable to receive that data in time for this response. Once we receive and analyze the data, we will
discuss our findings with OIG and determine the appropriate next steps towards remediation.
Recommendation 7 - Review the additional 47,940 PPP loans totaling over $1.7 billion, identified
through the DNP data match, to ensure borrowers met the eligibility requirements and seek remedy or
repayment of loans deemed ineligible.
SBA Response: SBA partially agrees. SBA flagged all loans identified by OIG when Report Number
21-06 was issued January 2021. After almost 2 years, OIG is stating there was a mistake in their
methodology and is issuing a recommendation for SBA to review an additional 47,490 loans. SBA
requested specific loan data from OIG to assist us in analyzing these findings and determining which
loans have already been manually reviewed but were unable to receive that data in time for this
response. Once we receive and analyze the data, we will discuss our findings with OIG and determine
the appropriate next steps towards remediation.