Full text
U.S. SMALL BUSINESS ADMINISTRATION
OFFICE OF INSPECTOR GENERAL
Automated Controls Should Ensure
Compliance with Criteria
Management Advisory
Report 25-18
June 4, 2025
Make a Difference
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s
Office of Inspector General Hotline at https://www.sba.gov/oig/hotline. You can also write to the
U.S. Small Business Administration, Office of Inspector General, 409 Third Street, SW (5th Floor),
Washington, DC 20416. In accordance with the Inspector General Act of 1978, codified as
amended at 5 U.S.C. §§ 407(b) and 420(b)(2)(B), confidentiality of a complainant’s personally
identifying information is mandatory, absent express consent by the complainant authorizing the
release of such information.
NOTICE:
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023,
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities
identified in this report have the opportunity to submit a written response for the purpose of
clarifying or providing additional context as it relates to any specific reference contained herein.
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date.
We request that any comments be no longer than two pages, Section 508 compliant, and free
from any proprietary or otherwise sensitive information. The comments may be appended to
this report and posted on our public website.
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
Date:
June 4, 2025
To:
Kelly Loeffler
Administrator
From:
Sheldon Shoemaker
Deputy Inspector General
Subject:
Automated Controls Should Ensure Compliance with Criteria (Report 25-18)
This management advisory presents the results of our review of the U.S. Small Business
Administration’s (SBA) incomplete reviews of Coronavirus Disease 2019 Economic Injury Disaster
Loans and grants disbursed to borrowers who self-disclosed their business establishment dates
after January 31, 2020.
We considered SBA management’s comments on the draft of this report when preparing the
final report. Management’s planned action to resolve Recommendation 1 does not fully satisfy
the intent of the recommendation; therefore, it will remain unresolved, and we will seek
resolution in accordance with our audit resolution policy. Management’s planned action to
resolve Recommendation 2 satisfies the intent of the recommendation; therefore, it will be
closed upon issuance of this report.
We appreciate the cooperation and courtesies provided by your staff. If you have any
questions, please contact me or Andrea Deadwyler, Assistant Inspector General for Audits,
at (202) 205-6586.
cc: Wesley Coopersmith, Chief of Staff, Office of the Administrator
Ben Grayson, Deputy Chief of Staff, Office of the Administrator
Robin Wright, Chief Operating Officer, Office of the Administrator
Nathan Davis, Chief Financial Officer and Chief Risk Officer, Office of Performance, Planning,
and the Chief Financial Officer
Deborah Chen, Deputy Chief Financial Officer, Office of Performance, Planning, and the
Chief Financial Officer
Sharon Kirkley, Accountant, Office of Performance, Planning, and the Chief Financial Officer
2
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
Alex H. Wilson, Senior Policy Advisor, Enterprise Risk Management
Wendell Davis, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Anna M. Calcagno, Director, Office of Strategic Management and Enterprise Integrity
Thomas Kimsey, Associate Administrator, Office of Capital Access
Peter Meyers, Senior Advisor, Office of Capital Access
Aaron Wright, Program Analyst, Office of Capital Access
Michelle Blank, Supervisory Criminal Investigator, Investigations Division
Malcolm Johnson, Jr., Supervisory Criminal Investigator, Investigations Division
i
Contents
Background ..................................................................................................................................... 1
Automated Controls Not Tied to Criteria ........................................................................................ 2
Importance of Aligning Automated Controls to Criteria ........................................................... 3
Recommendations .......................................................................................................................... 5
Evaluation of Agency Response ....................................................................................................... 6
Summary of Actions Necessary to Close the Recommendation(s) ............................................ 6
Scope and Methodology ................................................................................................................. 7
Tables
1 COVID-19 EIDL Applications with Self-Disclosed Business Establishment Dates
After January 31, 2020 .................................................................................................... 4
Appendices
1 Monetary Impact .............................................................................................................. 1-1
2 Agency Response .............................................................................................................. 2-1
1
Background
In response to the Coronavirus Disease 2019 (COVID-19) pandemic, the Coronavirus
Preparedness and Response Supplemental Appropriations Act of 2020 authorized the
U.S. Small Business Administration (SBA) to issue COVID-19 Economic Injury Disaster Loans
(EIDL) to affected businesses. The Coronavirus Aid, Relief, and Economic Security (CARES) Act
subsequently authorized the agency to also provide affected businesses with Emergency EIDL
Advances. Emergency EIDL Advances were intended to be a stopgap for applicants to quickly
receive an advance payment within 3 days of applying for a COVID-19 EIDL, in the amount of
$1,000 per employee, up to the statutory cap of $10,000. To qualify for a COVID-19 EIDL or
Emergency EIDL Advance, an applicant’s business had to be an eligible entity in operation on
January 31, 2020. The CARES Act directed the agency to verify that the applicant was an eligible
entity by accepting self-certification from the applicant under penalty of perjury.1
We conducted two previous reviews related to applicants for COVID-19 EIDLs and
Emergency EIDL Advances whose businesses were not in operation on or before January 31,
2020:
• Report 21-02, Inspection of Small Business Administration's Initial Disaster Assistance
Response to the Coronavirus Pandemic, found nearly $1.1 billion in potentially ineligible
COVID-19 EIDLs and Emergency EIDL Advances identified by Employer Identification
Number registrations made after January 31, 2020.
• Report 22-22, Follow-up Inspection of SBA’s Internal Controls to Prevent COVID-19 EIDLS
to Ineligible Applicants, identified more than $92 million in COVID-19 EIDLs to applicants
with suspect tax ID numbers issued after January 31, 2020.
For those reviews, we primarily focused on COVID-EIDLs and Emergency EIDL Advances we
suspected were ineligible based on other program criteria; we did not examine automated
controls SBA had in place to evaluate applicant self-assertions of eligibility. The objective of this
review was to determine if SBA’s internal controls were sufficient to prevent both COVID-19
EIDLs and Emergency EIDL Advances from being paid to applicants who self-disclosed business
establishment dates after January 31, 2020.
1 Pub. L. No. 116-136, CARES Act, Sec. 1110(e)(2), March 2020. A declaration under penalty of perjury is a signed
statement in which the signer swears that the information contained in the document is true and correct. If the
statement is later found to be false in any material respect, the signer can be criminally charged.
2
Automated Controls Not Tied to Criteria
CARES Act criteria required a business to be “in operation” on or before January 31, 2020, to
receive a COVID-19 EIDL and Emergency EIDL Advance.2 Specifically, the Act waived “the
requirement that an applicant needs to be in business for the 1-year period before the disaster,
except that no waiver may be made for a business that was not in operation on January 31,
2020.” The CARES Act further directed the agency to verify that the applicant was an eligible
entity by accepting a self-certification from the applicant under penalty of perjury.3 Therefore,
the agency was to accept the self-certification unless the applicant stated on their application
that they were not in operation on or before January 31, 2020, which would have rendered them
ineligible.
During our review, SBA asserted that the CARES Act requirement for a business to be in
operation on or before January 31, 2020, applied only to COVID-19 EIDLs. For Emergency EIDL
Advances, the agency stated that they were required to rely only on self-certification, under the
penalty of perjury, to determine eligibility. The Office of Inspector General (OIG) disagreed and
reiterated the CARES Act requirement that there be no waiver of eligibility for a business that
was not in operation on or before January 31, 2020, which included Emergency EIDL Advances.
Further, SBA used one loan application for both COVID-19 EIDLs and Emergency EIDL Advances,
which implied the eligibility criteria applied to both.
The application required applicants to self-disclose details about their business, including the
business’s establishment date and ownership date. To help process the enormous volume of
applications received, SBA used its underwriting system and established automated controls to
ensure applicant eligibility. Namely, the system flagged applications with potential eligibility
issues such as the business ownership date reflected on the application being after the statutory
date, January 31, 2020. SBA loan officers were then to review the flagged applications and
mitigate eligibility issues prior to approving this federal assistance. Without a proper risk analysis,
a costly pay and chase environment could emerge.4
Although SBA implemented automated controls to assess applicant eligibility, these controls
were not fully utilized or properly aligned with CARES Act criteria. First, SBA did not directly ask
applicants if they were in operation on January 31, 2020. Instead, applicants were required to
self-disclose their business establishment date and current ownership date, two dates that could
2 Pub. L. No. 116-136, CARES Act, Sec. 1110(c)(2), March 2020.
3 Pub. L. No. 116-136, CARES Act, Sec. 1110(e)(2), March 2020.
4 Pay and chase refers to the practice of detecting fraudulent transactions and attempting to recover funds after
payments have been made.
3
differ. While the business establishment date is generally fixed, the ownership date could be
different if the business was subsequently sold or acquired by another individual. Neither of
these dates clearly indicated whether the business was in operation on or before January 31,
2020, as required by the CARES Act. For instance, a business could have been created
(establishment date) prior to January 31, 2020; however, it had yet to open and start operations
on that date. Similarly, an individual could have acquired a business (ownership date) prior to
January 31, 2020, but that does not necessarily mean the business was in operation on that date,
as the owner could have purchased a shuttered business to reopen.
Second, although SBA established an automated control to flag applications as potentially
ineligible based on the business ownership date, the agency did not fully utilize the control. For
COVID-19 EIDLs, an SBA loan officer reviewed and addressed flags for potential ineligibility.
However, the agency relied solely on the automated process for approving Emergency EIDL
Advances; therefore, loan officers did not review flagged applications prior to disbursement.
SBA stated the statute required disbursement of the Emergency EIDL Advance within 3 days
of the application, which would not have been feasible without automation (i.e., automatic
disbursement without a loan officer review). The agency further stated there were no
underwriting requirements for grants, and loan officer reviews would have greatly slowed
down the process. Although OIG acknowledges these statements, we assert that disbursements
would have only taken longer for those applicants flagged as potentially ineligible as only those
applications would have required an additional review.
Additionally, unlike the automated control or flag in place for the ownership date, SBA had not
implemented a control based on the establishment date even though that date was also
provided on the application.
Importance of Aligning Automated Controls to Criteria
GAO’s Fraud Risk Management Framework provides a structure for SBA to follow to ensure
the agency is committed to preventing fraud, assessing the needs of their programs, designing
and implementing controls to mitigate assessed fraud risk, and evaluating and adapting
when needed. However, the agency’s control design did not fully consider the statutory
language in the CARES Act requiring that a business be in operation on or before January 31,
2020.
Had SBA used the CARES Act requirement to develop the COVID-19 EIDL application and
included a specific question as to whether the applicant’s business was in operation on or before
4
January 31, 2020, the agency could have, based on this information, created an automated
process to flag potentially ineligible applications for review. Absent this control, we believe
SBA should have at a minimum 1) established a flag for both the business ownership and
establishment dates and 2) declined any applicant who self-disclosed their business ownership
and/or establishment date was after January 31, 2020, if the applicant could not cure the
discrepancy.
Technology is important to execute a program, and automated processes can facilitate
robust internal controls. However, the technology and automated control environment must
be properly calibrated and designed to align with specific program criteria to not only be
effective but also to avoid a pay and chase environment. As a result of SBA not aligning its
automated control environment to program criteria, we identified 17,568 COVID EIDLs and
Emergency EIDL Advances totaling over $93 million (see Table 1) that were given to individuals
who self-disclosed on their applications that their business entities were established after
January 31, 2020.
Table 1: COVID-19 EIDL Applications with Self-Disclosed Business Establishment
Dates After January 31, 2020
Number of Days after
January 31, 2020
Number of
Awards
Amounts
Disbursed in Loans
Amounts Disbursed
in Emergency EIDL
Advances
Total
30 days
8,897
$19,859,700
$21,811,000
$41,670,700
60 days
4,096
16,418,068
8,255,000
24,673,068
90 days
1,982
8,508,100
3,952,000
12,460,100
120 days
1,397
3,402,300
2,396,000
5,798,300
150 days
1,106
3,890,700
2,316,000
6,206,700
180 days or more
90
2,382,800
54,000
2,436,800
Total
17,568
$54,461,668
$38,784,000
$93,263,236
Note: This universe excluded previously reported Emergency EIDL Advances in Reports 21-02 and 22-22.
The Payment Integrity Information Act of 2019 defines payments to ineligible entities as
improper payments.5 This Act includes a new, broader requirement for agencies to conduct
5 An improper payment is defined as any payment that should not have been made or that was made in an incorrect
amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally
applicable requirements. It includes any payment to an ineligible recipient, any payment for an ineligible service,
any duplicate payment, payment for services not received, and any payment that does not account for credit for
applicable discounts. OMB guidance also instructs agencies to report payments for which insufficient or no
documentation was found as improper payments.
5
recovery audits when cost effective.6 The Office of Management and Budget (OMB) also has
issued a policy stating that agencies should attempt recovery of improper payments resulting in
monetary loss.7 Therefore, SBA should review the loans and grants included in Table 1 and
recover those determined to be ineligible if not cost prohibitive.
Further, most Emergency EIDL Advances, 11,411 of the 15,612 awards (or 73 percent),
were for only $1,000 each, totaling over $11.4 million. The potential cost of recovery for the
small amounts of these Emergency EIDL Advances may not be cost effective and thus highlights
the importance of preventative activities and properly aligning automated controls with criteria
at the onset of a program.
We have previously reported on internal control weaknesses within the COVID-19 EIDL program
and made recommendations to strengthen controls and mitigate the impact of a pay and chase
environment. Although the COVID-19 EIDL program is over, the opportunity still exists for SBA
to calibrate its technology to align with current and future program criteria and help ensure
reliable data is used to establish robust internal controls and create automated verification and
validation processes.
Recommendations
To recover funds disbursed to ineligible applicants, and to ensure automated controls are aligned
with clearly defined disaster assistance criteria, we recommend the Administrator direct the
Associate Administrator for the Office of Capital Access to:
Recommendation 1: Review the 17,568 COVID-19 EIDLs and Emergency EIDL Advances identified
with business establishment dates after January 31, 2020, to determine eligibility and to seek
recovery of funds from ineligible recipients.
Recommendation 2: Assess the automated controls within the agency’s new lending platform,
the Unified Lending Platform (ULP), to ensure they align with clearly defined disaster assistance
criteria.
6 Recovery audits are conducted to identify and reclaim overpayment, also referred to as improper payments.
7 OMB Memorandum M-21-19, “Transmittal of OMG Circular No. A-123, App. C, Requirements for Payment
Integrity,” March 5, 2021.
6
Evaluation of Agency Response
SBA management provided formal written comments on the draft report that are included in
their entirety in Appendix 2. Management partially agreed with Recommendation 1 and agreed
with Recommendation 2. Management’s planned action for Recommendation 1 does not fully
satisfy the intent of the recommendation and it is unresolved. Management’s planned action for
Recommendation 2 satisfies the intent of the recommendation; therefore, it is resolved and will
be closed upon issuance of this report.
Summary of Actions Necessary to Close the Recommendation(s)
The following section summarizes the status of our recommendations and the actions necessary
to close them.
Recommendation 1
To recover funds disbursed to ineligible applicants, we recommend the Administrator direct the
Associate Administrator for the Office of Capital Access to review the 17,568 COVID-19 EIDLs and
Emergency EIDL Advances identified with business establishment dates after January 31, 2020,
to determine eligibility and to seek recovery of funds from ineligible recipients.
Status: Unresolved
SBA management partially agreed with this recommendation, stating that the agency will flag the
1,956 COVID EIDLs of the 17,568 COVID EIDLs and Emergency EIDL Advances identified by OIG
with business establishment dates after January 31, 2020, with hold code 36 (general eligibility).
Management further stated that when a borrower requests a servicing action or seeks a new
loan (Disaster, 7a, or 504), SBA will review the loan to determine eligibility. Also, if a business is
determined to be ineligible, SBA will maximize recovery through standard collections.
Although management’s proposed action addresses the 1,956 COVID EIDLs, the agency did not
indicate how they will address the remaining 15,612 grants that went to applicants who self-
reported a business start date after January 31, 2020, which represents the majority of ineligible
applicants. The Payment Integrity Information Act of 2019 and the OMB requires agencies to
conduct recovery audits when cost effective and attempt to recover improper payments
resulting in monetary loss, respectively.
Therefore, this recommendation is unresolved. We will attempt to reach resolution with SBA
management in accordance with our audit follow-up policy.
7
Recommendation 2
To ensure automated controls are aligned with clearly defined disaster assistance criteria, we
recommend the Administrator direct the Associate Administrator for the Office of Capital Access
to assess the automated controls within the agency’s new lending platform, the Unified Lending
Platform (ULP), to ensure they align with clearly defined disaster assistance criteria.
Status: Closed
SBA management agreed with this recommendation, stating that in late 2023, the agency
launched the ULP that operationalizes standard operating procedure requirements within the
disaster lending programs. This automation allows SBA to enforce the required rules via the
system and is coupled with a multi-level review process if required. Management also stated
that the ULP rules engine allows for both systemic enforcement and visualization of rules to the
reviewer. Further, the rules can be maintained by the system owners and policy owners of the
respective loan platforms. SBA’s implementation of the ULP sufficiently meets the intent of our
recommendation; therefore, this recommendation will be closed upon issuance of this report.
Scope and Methodology
This management advisory presents the results of our review of COVID-19 EIDLs and Emergency
EIDL Advances awarded to individuals who self-disclosed their business was not in operation on
or before January 31, 2020. We reviewed federal laws, regulations, policies, procedures, and
internal memos pertaining to SBA COVID-19 EIDLs. We met with officials from the SBA Office of
Capital Access to discuss internal controls for applicant self-disclosed potential ineligibility. We
also obtained and analyzed COVID-19 EIDL data to evaluate the impact of COVID-19 EIDLs and
Emergency EIDL Advances disbursed to applicants who self-disclosed their business was not in
operation on or before January 31, 2020.
We obtained a list of applications with business establishment dates after January 31, 2020, and
excluded applications that were previously reported on in Reports 21-02 and 22-22.
This management advisory was prepared in alignment with OIG’s quality control standards and
the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Federal
Offices of Inspector General, which requires that we conduct our work with integrity, objectivity,
and independence.
1-1
Appendix 1: Monetary Impact
The monetary impact identified in this report is categorized as “questioned costs.” Questioned
costs are expenditures that do not comply with legal, regulatory, or contractual requirements;
are not supported by adequate documentation at the time of the audit; or are unnecessary or
unreasonable.1 Questioned costs may be remedied by offset, waiver, recovery of funds, the
provision of supporting documentation, or contract ratification, where appropriate.
Recommendation
Category
Amount
1
Ineligible costs
$93,263,236
Total questioned costs
$93,263,236
Source: Office of Inspector General analysis
The $93,263,236 shown above represents costs the Office of Inspector General calls into
question, as the disbursements include payments the U.S. Small Business Administration (SBA)
made to individuals whose businesses were not in operation on or before January 31, 2020. If
these costs are determined to be ineligible, this would be a violation of federal statutes,
regulations, and SBA standard operating procedures.
1 Inspector General Act of 1978 codified as amended at 5 U.S.C. § 405(a)(4).
2-1
Appendix 2: Agency Response
U.S. Small Business Administration
Response to Draft Report
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
To:
Sheldon Shoemaker
Deputy Inspector General
U.S. Small Business Administration
Office of Financial Program Operations, Director
Office of Capital Access
Date:
May 5, 2025
Subject:
Response to OIG Draft Report – Automated Controls Should Ensure Compliance
with Criteria (Project 24801)
The Office of Inspector General (OIG) reviewed COVID-related EIDL loans and grants to assess
whether SBA’s internal controls effectively prevented disbursement to ineligible applicants,
specifically those with business start dates after January 31, 2020. The audit identified 1,956
COVID EIDL loans (0.05%) and 15,612 grants (0.27%) that went to applicants who self-
reported starting after this date.
The OIG concluded that SBA’s internal controls were either not fully utilized or not properly
aligned with CARES Act eligibility requirements. As a result, the OIG recommended that SBA
review all 17,568 disbursements to determine eligibility and attempt collection of ineligible
funds and to assess the automated controls within the Unified Lending Platform to ensure they
align with clearly defined disaster assistance criteria.
Recommendation 1 – Review the 17,568 loans and advances identified with business
establishment dates after January 31, 2020, to determine eligibility and seek recovery of funds
from ineligible recipients.
SBA Response: SBA partially agrees with this recommendation. SBA will flag the 1,956 loans
identified by OIG with business establishment dates after January 31, 2020, with hold code 36
(general eligibility). When the borrower requests a servicing action or seeks a new loan
(Disaster, 7a or 504), SBA will review the loan to determine eligibility. If the business is
From:
Jihoon Kim
determined to be ineligible, SBA will maximize recovery through standard collections. If the
loan is not performing, SBA will have already issued a demand.
Recommendation 2 – Assess the automated controls within the agency’s new lending platform,
the Unified Lending Platform, to ensure they align with clearly defined disaster assistance
criteria.
SBA Response: SBA agrees with this recommendation. With the launch of the ULP platform in
late 2023, the platform includes a full rules engine that operationalizes the SOP requirements
within the Disaster Lending programs. This platform orchestration allows SBA to enforce the
required rules via the system and is coupled with a multi-level review process if required. The
ULP rules engine allows both the systemic enforcement and the visualization of the rules to the
reviewer. These rules can be maintained by the system owners as required by the SOP and policy
owners of the respective loan platforms.