Lafountain Testimony

Issuer: Congressional materials
Document type: Lafountain Testimony
Date: 2025-12-10
Case: Lafountain Testimony

Summary

Testimony GAO-26-108820 of the U.S. Government Accountability Office before the Senate Committee on Small Business and Entrepreneurship on December 10, 2025, by Courtney LaFountain, Acting Director, Financial Markets and Community Investment. It discusses the Small Business Administration's efforts to address 42 GAO recommendations, of which SBA has implemented 17, on fraud risks, improper payments and contracting programs. The testimony states that GAO estimated SBA's additional pandemic-relief controls had saved more than $30 billion as of the end of fiscal year 2025, and that SBA has not addressed 14 recommendations on its small business certification platform. It also notes the auditor's disclaimer of opinion on SBA's fiscal year 2024 financial statements. Background sections describe PPP, COVID-19 EIDL, the Restaurant Revitalization Fund and Shuttered Venue Operators Grants.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

United States Government Accountability Office
Testimony
Before the Committee on Small
Business & Entrepreneurship, U.S.
Senate

SMALL BUSINESS
For Release on Delivery
Expected at 2:30 p.m. ET
Wednesday, December 10,

ADMINISTRATION
2025

Opportunities to Improve
Management of Fraud
Risks, Improper
Payments, and
Contracting Programs
Statement of Courtney LaFountain, Acting Director,
Financial Markets and Community Investment

GAO-26-108820
SMALL BUSINESS ADMINISTRATION

Highlights Opportunities to Better Manage Fraud Risks, Improper
Payments, and Contracting Programs
GAO-26-108820 December 10, 2025

A testimony before the Committee on Small Business and Entrepreneurship, U.S. Senate
For more information, contact: Courtney LaFountain, lafountainc@gao.gov

What GAO Found Why GAO Did This Study
Since June 2020, GAO has made dozens of recommendations to help the Small Since spring 2020, SBA has made or
Business Administration (SBA) better manage fraud risks, improve its estimates guaranteed more than $1 trillion in
of improper payments, and oversee its contracting programs. This testimony loans and grants and assisted more
discusses SBA’s efforts to address 42 of these, of which SBA has implemented than 10 million small businesses
17. adversely affected by the COVID-19
pandemic, primarily through PPP and
• Fraud risks. GAO has found that some SBA programs—particularly its the COVID-19 Economic Injury Disaster
COVID-19 pandemic relief programs—have been susceptible to fraud. SBA Loan program. SBA also continued to
established these programs quickly to respond to the adverse economic support small businesses through its
conditions small businesses faced, but the speed of implementation came at contracting assistance and small
the expense of appropriate safeguards. SBA has implemented most GAO business research programs.
recommendations in this area—for example, by implementing oversight plans, This testimony discusses the status of
conducting fraud risk assessments, and developing a fraud strategy. GAO has selected GAO recommendations to
estimated that the additional controls SBA put in place for its pandemic-relief SBA related to fraud risks, improper
programs collectively had saved the government more than $30 billion as of payments, and contracting assistance
the end of fiscal year 2025. programs, as well as issues related to
SBA’s financial statements.
However, it is imperative for SBA to advance its fraud prevention and
detection efforts, such as by expanding use of data analytics and improving its This testimony is based on prior GAO
process for referring potential fraud to SBA’s Office of Inspector General. reports issued from June 2020 through
Furthermore, examining fraudsters and fraud schemes that emerged during March 2025 that assessed SBA’s
the pandemic can help agencies identify fraud mitigation controls that can be implementation of four pandemic relief
implemented both in emergency environments and during normal operations. programs, SBA improper payments,
financial statements, and contracting
• Improper payments. GAO has also previously identified problems related to assistance programs. Details on GAO’s
SBA’s estimates of improper payments, particularly for its pandemic relief methodology can be found in the
programs. An improper payment occurs when a payment should not have individual reports cited.
been made or was made in the incorrect amount. SBA has implemented one
GAO recommendation in this area but has not implemented three others.
These include expanding and documenting its overpayment review
procedures and expanding its overpayment tracking process. Developing
reliable improper payment estimates is essential for understanding and
addressing financial vulnerabilities in SBA’s programs in a timely manner.
• Contracting assistance programs. SBA has addressed several GAO
recommendations related to oversight of its contracting programs, including
the 8(a) Business Development Program. For example, the agency has
improved its documentation of compliance reviews of small business
subcontracting plans. However, SBA has not addressed 14 recommendations
intended to address critical risk management and cybersecurity issues
associated with its small business certification platform.
In addition, SBA’s independent financial statement auditor issued a disclaimer of
opinion on SBA’s fiscal year 2024 financial statements. The auditor reported
material weaknesses in SBA’s controls over pandemic relief programs for the fifth
consecutive year. For example, the auditor found that SBA did not sufficiently
design the review process for Paycheck Protection Program (PPP) loan
forgiveness. GAO supports the auditor’s recommendations to address these
weaknesses and urges SBA to work toward obtaining a clean financial statement
audit opinion.

United States Government Accountability Office
Letter Letter

Chair Ernst, Ranking Member Markey, and Members of the Committee:

Thank you for the opportunity to discuss the status of selected
recommendations we have made to the Small Business Administration
(SBA) and issues related to its financial accounting.

Since spring 2020, SBA has done much to help small businesses
adversely affected by the COVID-19 pandemic. SBA made or guaranteed
more than $1 trillion in loans and grants and assisted more than 10 million
small businesses, primarily through the Paycheck Protection Program
(PPP) and COVID-19 Economic Injury Disaster Loan (COVID-19 EIDL)
program. SBA also continued to operate programs supporting federal
contracting opportunities for small businesses and overseeing agencies’
small business research programs.

Although these efforts helped millions of small businesses, we have
identified significant program integrity risks, potential for fraud, and the
need for improved management and oversight of SBA’s pandemic relief
programs. Our concerns about SBA’s implementation of PPP and
COVID-19 EIDL led us to include emergency loans for small businesses
on our High-Risk List in March 2021. 1

Beyond financial impacts, fraud erodes public trust in government and
hinders agencies’ efforts to execute their missions and program
objectives effectively and efficiently. Investigations, prosecutions, and
efforts to recover fraudulently disbursed funds are ongoing. Congress has
passed legislation to extend the statute of limitations for fraud for some
pandemic-relief programs, which will give law enforcement, investigators,
and prosecutors more time to uncover potential fraud and to develop
cases.

Furthermore, by examining fraudsters and fraud schemes that emerged
during the pandemic, agencies can identify fraud mitigation controls that
can be implemented both in emergency environments and during normal
operations.

1GAO, High-Risk Series: Dedicated Leadership Needed to Address Limited Progress in
Most High-Risk Areas, GAO-21-119SP (Washington, D.C.: Mar. 2, 2021). We provided
updates on this high-risk area in April 2023 and February 2025. See GAO, High-Risk
Series: Efforts Made to Achieve Progress Need to Be Maintained and Expanded to Fully
Address All Areas, GAO-23-106203 (Washington, D.C.: Apr. 20, 2023), and High-Risk
Series: Heightened Attention Could Save Billions More and Improve Government
Efficiency and Effectiveness, GAO-25-107743 (Washington, D.C.: Feb. 25, 2025).

Page 2 GAO-26-108820
We have also issued reports citing concerns about improper payments
and weaknesses in the management of some SBA contracting programs,
such as the 8(a) Business Development Program.

In this statement, I will discuss (1) the status of selected fraud-related
recommendations for SBA programs, including pandemic relief programs;
(2) concerns identified by SBA’s independent financial statement auditor;
(3) SBA’s actions to address improper payments; and (4) SBA’s
management of its contracting programs.

For this statement, we relied primarily on our body of work issued from
June 2020 through March 2025 on SBA’s implementation of four
pandemic relief programs. 2 For those reports, we reviewed SBA
documentation and analyzed program data. We interviewed officials from
SBA and other federal agencies, such as the Department of the Treasury.
We also reviewed our recent work on SBA’s improper payments and the
opinions of SBA’s independent financial statement auditor. 3 More detailed
information on our scope and methodology can be found in the individual
reports we cite.

We conducted the work on which this statement is based in accordance
with generally accepted government auditing standards. Those standards

2These programs are PPP, COVID-19 EIDL, the Restaurant Revitalization Fund, and
Shuttered Venue Operators Grants. For more information, see GAO, COVID-19:
Opportunities to Improve Federal Response and Recovery Efforts, GAO-20-625
(Washington, D.C.: June 25, 2020); COVID-19: Urgent Actions Needed to Better Ensure
an Effective Federal Response, GAO-21-191 (Washington, D.C.: Nov. 30, 2020); COVID-
19: Critical Vaccine Distribution, Supply Chain, Program Integrity, and Other Challenges
Require Focused Federal Attention, GAO-21-265 (Washington, D.C.: Jan. 28, 2021);
COVID-19: Sustained Federal Action Is Crucial as Pandemic Enters Its Second Year,
GAO-21-387 (Washington, D.C.: Mar. 31, 2021); Economic Injury Disaster Loan Program:
Additional Actions Needed to Improve Communication with Applicants and Address Fraud
Risks, GAO-21-589 (Washington, D.C.: July 30, 2021); COVID-19: Current and Future
Federal Preparedness Requires Fixes to Improve Health Data and Address Improper
Payments, GAO-22-105397 (Washington, D.C.: Apr. 27, 2022); Restaurant Revitalization
Fund: Opportunities Exist to Improve Oversight, GAO-22-105442 (Washington, D.C.: July
14, 2022); COVID Relief: SBA Could Improve Communications and Fraud Risk Monitoring
for Its Arts and Entertainment Venues Grant Program, GAO-23-105199 (Washington,
D.C.: Oct. 11, 2022); COVID Relief: Fraud Schemes and Indicators in SBA Pandemic
Programs, GAO-23-105331 (Washington, D.C.: May 18, 2023); COVID-19 Relief: SBA
and DOL Should Improve Processes to Identify and Recover Overpayments, GAO-25-
106199 (Washington, D.C.: Nov. 13, 2024); and COVID-19 Relief: Improved Controls
Needed for Referring Likely Fraud in SBA's Pandemic Loan Programs, GAO-25-107267
(Washington, D.C.: Mar. 24, 2025).
3GAO, Improper Payments: Information on Agencies’ Fiscal Year 2024 Estimates,
GAO-25-107753 (Washington, D.C.: Mar. 11, 2025).

Page 3 GAO-26-108820
require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on
our audit objectives.

Background
SBA’s Pandemic Relief Paycheck Protection Program. Congress established PPP in the
Programs CARES Act to help small businesses affected by the COVID-19
pandemic. 4 In total, Congress provided approximately $814 billion in
commitment authority. 5 PPP loans were made by lenders and guaranteed
100 percent by SBA. The loans carried a 1 percent interest rate and were
fully forgivable if certain conditions were met—for example, at least 60
percent of the loan forgiveness amount had to be for payroll expenses to
qualify for full loan forgiveness.

According to SBA, as of May 31, 2021 (when SBA stopped accepting new
applications), lenders had made about 11.8 million PPP loans totaling
about $800 billion. 6

COVID-19 Economic Injury Disaster Loan Program. Congress
temporarily expanded eligibility for SBA’s EIDL program, which provides
low-interest loans of up to $2 million for expenses that cannot be met
because of a disaster. Congress also created emergency EIDL advances,
a new program component. 7 In total, Congress appropriated $50 billion in
loan credit subsidies for the cost of COVID-19 EIDL loans and $55 billion

4The CARES Act established PPP as part of SBA’s 7(a) lending program.

5American Rescue Plan Act of 2021, Pub. L. No. 117-2, § 5001(d), 135 Stat. 4, 85.

6Totals exclude canceled loans. According to SBA, canceled loans may include, but are
not limited to, duplicative loans, loans not closed for any reason, and loans fully paid off.
7CARES Act, Pub. L. No. 116-136, §§ 1107(a)(6), 1110, 134 Stat. 281, 302, 306. The
advances could be used toward payroll, sick leave, and other business obligations.
Borrowers did not have to repay them, even if they were subsequently denied the COVID-
19 EIDL loan.

Page 4 GAO-26-108820
for advances. 8 The $50 billion in credit subsidies would enable SBA to
provide about $470 billion in COVID-19 EIDL loans. 9

As of April 2022, SBA had approved about 3.9 million loans totaling about
$378 billion. SBA also approved about 6.8 million advances totaling about
$27.5 billion.

Restaurant Revitalization Fund. The Restaurant Revitalization Fund
provided awards (which did not need to be repaid) to assist small
businesses in the food service industry affected by the pandemic. 10
Recipients could use the awards for eligible expenses such as payroll,
business debt, maintenance, or construction of outdoor seating. The
program accepted applications from May 3, 2021, through June 30, 2021.

As of June 30, 2021, the Restaurant Revitalization Fund had provided
$28.6 billion in awards to assist about 101,000 small businesses.

Shuttered Venue Operators Grants. The Shuttered Venue Operators
Grant program provided grants to small businesses in the live performing

8SBA provided advances using the $10 billion that Congress appropriated under the
CARES Act. On April 16, 2020, SBA announced that the lending authority for COVID-19
EIDL loans and the funding for EIDL advances had been exhausted. Under the Paycheck
Protection Program and Health Care Enhancement Act, Congress appropriated another
$10 billion for advances and $50 billion in loan credit subsidy for COVID-19 EIDL loans.
Additionally, Congress made agricultural enterprises eligible for COVID-19 EIDL loans and
advances. SBA began accepting new applications from only agricultural enterprises on
May 4, 2020. On June 15, 2020, SBA reopened the application portal to all eligible
applicants. In the Consolidated Appropriations Act, 2021, Congress appropriated an
additional $20 billion for targeted EIDL advances to eligible entities located in low-income
communities with 300 or fewer employees that experienced an economic loss of greater
than 30 percent. Qualifying entities could receive up to $10,000 in targeted advances. The
American Rescue Plan Act of 2021 appropriated an additional $10 billion for the targeted
EIDL advances. It also appropriated $5 billion for a newly created EIDL advance program
that provided up to $5,000 to business entities that qualified for the targeted EIDL
advances but also met criteria for being smaller (employs less than 10 employees) and
more economically harmed (economic loss greater than 50 percent) than the original
targeted EIDL advances. The act also appropriated $70 million for COVID-19 EIDL loans.
9The distributed amount for COVID-19 EIDL exceeded the net appropriated funding due to
the COVID-19 EIDL loan credit subsidy. The subsidy covers the government’s cost of
extending or guaranteeing credit and represents the estimated long-term cost of providing
loans, taking into account expected future performance, including loan repayments,
prepayments, and defaults. The subsidy amount was roughly 14 percent of the cost of
each disaster loan in fiscal year 2020 and roughly 9 percent in fiscal year 2021.
10Pub. L. No. 117-2, § 5003, 135 Stat. 4, 85.

Page 5 GAO-26-108820
arts and entertainment sectors affected by the pandemic. 11 Recipients
could use the funds for eligible expenses such as payroll, rent or
mortgage payments, and utilities. This program accepted applications
from April 26, 2021, through August 20, 2021. 12

As of July 5, 2022, Shuttered Venue Operators Grants had provided
about $14.6 billion in grants to about 23,000 small businesses.

Fraud Risk Management The objective of fraud risk management is to ensure program integrity by
continuously and strategically mitigating both the likelihood and effects of
fraud, while also facilitating a program’s mission. The Fraud Risk
Framework provides a comprehensive set of leading practices that serve
as a guide for agency managers to use when developing efforts to
combat fraud in a strategic, risk-based manner. 13 The framework
organizes the leading practices within four components: (1) Commit, (2)
Assess, (3) Design and Implement, and (4) Evaluate and Adapt.

In June 2016, the Fraud Reduction and Data Analytics Act of 2015
required the Office of Management and Budget (OMB) to establish
guidelines for federal agencies to create controls to identify and assess
fraud risks to design and implement antifraud control activities. The act
further required OMB to incorporate the leading practices from the Fraud
Risk Framework in the guidelines. 14 The Payment Integrity Information
Act of 2019 repealed the Fraud Reduction and Data Analytics Act but
maintained the requirement for OMB to provide guidelines to agencies in
implementing the Fraud Risk Framework. 15

11Consolidated Appropriations Act, 2021, Pub. L. No. 116-260, § 324, 134 Stat. 1182,
2022.
12The application portal initially opened on April 8, 2021, but shut down the same day
because of a software problem, reopening on April 26, 2021.
13GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP
(Washington, D.C.: July 28, 2015).
14Pub. L. No. 114-86, 130 Stat. 546 (2016).

15Pub. L. No. 116-17, § 2(a), Stat. 113, 131 – 132 (2020), codified at 31 U.S.C. § 3357.
The act requires these guidelines to remain in effect, subject to modification by OMB as
necessary and in consultation with GAO.

Page 6 GAO-26-108820
In its 2016 Circular No. A-123 guidelines, OMB directed agencies to
adhere to the Fraud Risk Framework’s leading practices. 16 In October
2022, OMB issued a Controller Alert reminding agencies that they must
establish financial and administrative controls to identify and assess fraud
risks. 17 In addition, the alert reminded agencies that they should adhere to
the leading practices in the Fraud Risk Framework as part of their efforts
to effectively design, implement, and operate an internal control system
that addresses fraud risks.

Small Business Innovation The Small Business Innovation Research (SBIR) and Small Business
Research and Small Technology Transfer (STTR) programs were established to enable
federal agencies to support research and development (R&D) projects
Business Technology carried out by small businesses. 18 Under the Small Business Act, federal
Transfer Programs agencies with an extramural budget for R&D exceeding $100 million are
required to participate in the SBIR program. Those with such obligations
of $1 billion or more are required to participate in the STTR program. 19
According to SBA, which oversees the programs, 11 federal agencies and
their components participate in SBIR or in both programs.

Since the inception of the programs, federal agencies have invested over
$68 billion in SBIR/STTR awards for R&D and to commercialize
technologies. 20

Payment Integrity The Payment Integrity Information Act of 2019 requires agencies to
Information Act of 2019 manage improper payments by identifying risks, taking corrective actions,
and estimating and reporting on improper payments in programs they
administer. The act also requires each agency’s inspector general to
issue an annual report on compliance with applicable criteria from the act.

16Office of Management and Budget, Management’s Responsibility for Enterprise Risk
Management and Internal Control, OMB Circular No. A-123 (Washington, D.C.: July 15,
2016).
17Office of Management and Budget, Establishing Financial and Administrative Controls to
Identify and Assess Fraud Risk, CA-23-03 (Washington, D.C.: Oct. 17, 2022).
1815 U.S.C. § 638.

1915 U.S.C. § 638(f)(1), (n)(1)(A). Agencies’ R&D programs generally include funding for
two types of R&D: intramural and extramural. Intramural R&D is conducted by employees
of a federal agency in or through government-owned, government-operated facilities.
Extramural R&D is generally conducted by nonfederal employees outside of federal
facilities.
20SBIR and STTR started in 1982 and 1992, respectively.

Page 7 GAO-26-108820
8(a) Business The 8(a) Business Development Program supports small businesses
Development Program owned and controlled by socially and economically disadvantaged
individuals and entities. It is SBA’s largest program to support contracting.
The program generally provides up to 9 years of developmental support,
such as business counseling and mentoring, contracting guidance, and
access to capital and surety bond guarantees. 21 The program also sets
aside federal contracting opportunities for participants.

We have previously found that some SBA programs—particularly its
SBA Has Taken Steps pandemic relief programs—have been susceptible to fraud risks. 22 SBA
to Address Fraud established PPP and COVID-19 EIDL quickly to respond to the adverse
economic conditions small businesses faced. However, the speed of
Risk in Some implementation came at the expense of appropriate financial and other
Programs, but safeguards, which left the programs susceptible to fraud. 23
Additional Work As the programs matured and SBA implemented our recommendations,
Remains SBA improved its oversight and incorporated lessons learned from PPP
and COVID-19 EIDL into its other relief programs, the Restaurant
Revitalization Fund and Shuttered Venue Operators Grants.

SBA still has opportunities to advance its fraud prevention and detection
efforts, such as by expanding use of data analytics and providing
guidance to agencies participating in certain programs. Addressing
material weaknesses in internal controls reported by its financial
statement auditor could also help prevent fraud in SBA’s programs.

SBA Has Implemented We have made a number of recommendations to SBA to improve
Most of Our Pandemic- oversight and fraud risk management of its pandemic programs, including
13 detailed below. 24 SBA has implemented nine of these
Related Fraud Risk
recommendations. However, it is still in the process of implementing four
Recommendations others, which are related to responding to potentially fraudulent or
ineligible awards, enhancing the use of data analytics to prevent and

21To assist small businesses adversely affected by the COVID-19 pandemic, Congress

allowed businesses in the 8(a) program on or before September 9, 2020, the option to
extend their participation in the program for 1 year.
22Fraud involves obtaining something of value through willful misrepresentation.

23For example, see GAO, Small Business Administration: COVID-19 Loans Lack Controls
and Are Susceptible to Fraud, GAO-21-117T (Washington, D.C.: Oct. 1, 2020).
24GAO has made additional recommendations to SBA that could help prevent or identify
fraud in its programs.

Page 8 GAO-26-108820
detect fraud, and improving its process for referring potential fraud cases
to SBA’s Office of the Inspector General (OIG).

Incorporating oversight plans—implemented. SBA officials said they
initially put limited safeguards in place when launching PPP to expedite
the loan approval process. This was consistent with a mandate from
Congress, reinforced by Treasury, to provide rapid support for small
businesses. In June 2020, we found that SBA had not provided details on
how it would review loans of more than $2 million and did not have plans
for reviewing loans of less than $2 million. 25 We therefore recommended
that SBA develop and implement plans to identify and respond to PPP
risks to help ensure program integrity, achieve program effectiveness,
and address potential fraud.

Consistent with our recommendation, in December 2020, SBA
implemented an oversight plan with multiple layers of review. It also hired
a contractor with expertise in fraud detection to help conduct these
reviews. SBA incorporated controls from this plan when it launched the
Restaurant Revitalization Fund and Shuttered Venue Operators Grant
programs.

Similarly, because SBA did not have a plan for responding to COVID-19
EIDL risks, we recommended in March 2021 that SBA implement a
comprehensive oversight plan for that program to help ensure program
integrity, achieve program effectiveness, and address potential fraud. 26 In
August 2022, SBA provided an oversight plan describing controls it had
implemented or planned to implement for COVID-19 EIDL loans.

We estimated that SBA’s additional controls it put in place for its
pandemic-relief programs collectively had saved the government more
than $30 billion as of the end of fiscal year 2025.

Assessing fraud risks—implemented. Conducting a fraud risk
assessment is a leading practice in strategically managing fraud risks. 27
Such assessments can, for example, help program officials determine
whether certain controls are effectively designed and implemented to
reduce the likelihood or impact of a fraud risk to a tolerable level. They

25GAO-20-625.

26GAO-21-387.

27GAO-15-593SP.

Page 9 GAO-26-108820
also can help agencies prioritize risks and allocate resources. Because
SBA moved quickly to establish PPP and COVID-19 EIDL, it did not
conduct formal risk assessments for either program. Accordingly, in
March 2021, we made two recommendations that SBA conduct a
comprehensive fraud risk assessment for each program. 28

In response, SBA hired a contractor in October 2021 to conduct these
assessments. The contractor found that SBA had implemented additional
fraud prevention controls since the start of the programs. These controls
included cross-referencing applicant information with Treasury’s Do Not
Pay list and introducing a set of automated screening rules. 29 However,
the assessment also noted that the programs remained susceptible to
fraud risks that required further enhancements to the current mitigation
strategies. The contractor identified 25 active fraud risks in PPP and 21 in
COVID-19 EIDL. It made four recommendations to help SBA establish a
fraud governance process and inform its fraud tolerance approach.

In addition, we reported in March 2021 that SBA had not designated a
dedicated entity to lead fraud risk management activities, which
contributed to the lack of a timely fraud risk assessment of the
programs. 30 In February 2022, SBA designated such an entity, which is
responsible for the oversight and coordination of SBA’s fraud risk
prevention, detection, and response activities.

SBA has since made some changes to its fraud governance structure.
According to SBA, the agency created an Office of Enterprise Integrity in
January 2024, led by its Chief Risk Officer, that is responsible for
overseeing SBA’s enterprise risk management and fraud risk
management functions. The Chief Risk Officer is responsible for ensuring
that risk management activities across SBA are coordinated, internal
controls are designed and implemented to ensure accuracy in SBA’s
financial reporting, and SBA is complying with laws and regulations.

Developing a strategy for managing fraud risks—implemented. In
March 2021, we recommended that, once SBA had completed a

28GAO-21-387.

29Treasury’s Do Not Pay service is an analytics tool that helps federal agencies detect and
prevent improper payments.
30As discussed in our Fraud Risk Framework, designating an entity to design and oversee
fraud risk management activities is a leading practice. In carrying out its role, the antifraud
entity, among other things, manages the fraud risk-assessment process.

Page 10 GAO-26-108820
comprehensive fraud risk assessment for PPP and COVID-19 EIDL, it
should also document an antifraud strategy for each program. 31

As discussed in our Fraud Risk Framework, an antifraud strategy
describes the agency’s approach for addressing the prioritized fraud risks
identified during a fraud risk assessment. 32 The antifraud strategy
describes how the agency will prevent, detect, and respond to fraud, as
well as monitor risks. Without an antifraud strategy based on the results
of a fraud risk assessment, SBA was not positioned to ensure that it was
strategically addressing the most significant fraud risks in either program.

In August 2023, SBA finalized a fraud risk management strategy that
identified approaches to prevent, detect, and respond to instances of
active and potential fraud in PPP and COVID-19 EIDL. For example, the
strategy described data analytic methods for reviewing the PPP loan
portfolio to manage fraud risks by reducing false positives, prioritizing
identified fraud typologies and behaviors, and uncovering areas of fraud
risk not previously identified. For COVID-19 EIDL, the strategy described
SBA’s efforts to use advanced data analytics, machine learning
technologies, and cross-program data analytics to screen for potential
fraud and ineligibility.

Analyzing portfolio-level data—implemented. We recommended in
January 2021 that SBA develop and implement portfolio-level data
analytics across COVID-19 EIDL program loans and advances to detect
potentially ineligible and fraudulent applications. 33 SBA fully implemented
this recommendation by developing and implementing data analytics. For
example, SBA identified applications submitted with foreign telephone
area codes, which is an indicator of ineligibility.

In addition, in July 2022, we found that SBA had not proactively used data
analytics or information from enforcement entities to identify potentially
fraudulent Restaurant Revitalization Fund award recipients. 34 Therefore,
we recommended that SBA develop and implement data analytics across
these awards. SBA has fully addressed this recommendation.
Specifically, it conducted data analytics for the program that included

31GAO-21-387.

32GAO-15-593SP.

33GAO-21-265.

34GAO-22-105442.

Page 11 GAO-26-108820
cross-checking recipient identifiers (such as address and tax identification
number) against recipients flagged for fraud or identity theft.

Using enforcement data—implemented. We recommended in July
2022 that SBA develop, document, and implement procedures to use
enforcement data on suspected fraud in other SBA programs, such as
PPP, to identify potential fraud by Restaurant Revitalization Fund
recipients. 35 SBA has fully addressed this recommendation. In April 2024,
SBA provided us with documentation demonstrating that it uses
enforcement data from a variety of sources—including the Department of
Justice and SBA’s OIG—to flag potentially fraudulent awards. In addition,
SBA ran monthly cross-program analysis to identify all Restaurant
Revitalization Fund awards associated with PPP loans that had been
flagged because of enforcement activity.

Developing a plan to respond to improper awards—not
implemented. In July 2022, we recommended that SBA develop and
implement a plan to respond to potentially fraudulent and ineligible
Restaurant Revitalization Fund awards in a prompt and consistent
manner. 36 SBA disagreed with this recommendation, stating that its
planned efforts were sufficient. However, in April 2024, SBA officials said
they had prioritized reviewing flagged Restaurant Revitalization Fund
awards and had conducted initial reviews of all flagged awards for which
recipients had submitted post-award reports. This recommendation will
remain unaddressed until SBA provides us with documentation of its
procedures for prioritizing flagged awards and evidence of implementing
these procedures.

Identifying fraud across multiple programs—not implemented. We
found in May 2023 that SBA had used data analytics to facilitate fraud
detection for PPP and COVID-19 EIDL. 37 However, it had not fully
leveraged information to help prevent fraud and identify applicants who
tried to defraud multiple programs. We therefore recommended that SBA
(1) develop and use mechanisms to facilitate cross-program data
analytics and (2) identify external data sources that can facilitate the

35GAO-22-105442.

36GAO-22-105442.

37GAO-23-105331.

Page 12 GAO-26-108820
verification of applicant information and the detection of potential fraud
across its programs. SBA agreed with these two recommendations.

As of November 2024, SBA’s Fraud Risk Management Board—which
oversees and coordinates SBA’s fraud risk prevention, detection, and
response activities—continued to work on policies related to program
office actions for cross-program analysis results, management of
inventory, and parameters of operation. One SBA office began performing
cross-program data analytics using taxpayer identification numbers for
new loan approvals. In addition, SBA reported that it has engaged with
other federal agencies regarding data sharing to improve its fraud risk
management capabilities. We will continue to monitor SBA's progress in
this area, and we have ongoing work examining data sharing efforts
between the Internal Revenue Service and SBA.

Improving fraud referrals to SBA’s OIG—not implemented. SBA
developed and implemented oversight plans for PPP and COVID-19 EIDL
that include automated and manual reviews to help identify and refer
potentially fraudulent loans and advances to the SBA OIG. This four-step
approach involves (1) initial automated screening that compares each file
with several public- and private-sector databases, (2) data analytics to
examine anomalies, (3) human-led review of files not cleared through
data analytics, and (4) referral of files identified as likely fraudulent to the
OIG.

Our March 2025 review found a weakness in step four—SBA’s process
for referring cases of likely fraud to its OIG. 38 We recommended that SBA
develop a plan for referring potential or likely fraud for the COVID-19
EIDL program. SBA agreed with the recommendation and noted that it
has worked with the OIG to put an effective process in place. We will
review the evidence of this process once SBA provides it and will
continue to monitor SBA's efforts in this area.

SBA Can Take Steps to We reported on fraud risks for the SBIR/STTR programs in September
Manage Fraud Risks in 2024 and found control vulnerabilities and fraud risks with a range of
Small Business Research
Programs

38GAO-25-107267.

Page 13 GAO-26-108820
financial and other impacts. 39 We consequently made four
recommendations to SBA to address these concerns, none of which have
yet been implemented.

Identifying, sharing, and reporting fraud-related convictions—not
implemented. SBA uses several tools—including its monthly program
manager meetings, annual survey to participating agencies, and listing of
fraud convictions and civil liabilities on SBIR.gov—to monitor and support
agencies’ fraud, waste, and abuse prevention efforts. 40 However, we
identified opportunities for SBA to better leverage these tools. We made
two recommendations that SBA expand it methods and sources to
identify, share, and report fraud-related convictions and its findings on
SBIR.gov. SBA agreed with the recommendations. In March 2025, SBA
officials told us that SBA would continue to report final adjudicated fraud-
related settlements, convictions, and findings of civil liability on SBIR.gov.
SBA also planned to add related information to its program guidance. We
will continue to monitor the status of SBA’s updates to its guidance.

Providing guidance on risk assessments—not implemented. Most of
the agencies that participate in SBIR/STTR had not conducted fraud risk
assessments in alignment with our leading practices. Some of those
agencies identified lack of guidance, training, and resources as related
challenges with respect to conducting program-specific fraud
assessments. We therefore made two recommendations in September
2024 that SBA provide guidance to participating agencies to conduct
comprehensive SBIR/STTR program fraud risk assessments that include
all key elements. 41 SBA agreed and said it would provide training to
program managers and reinforce the information in its program guidance.
SBA told us in August 2025 that it had provided the training to program
managers. We will continue to monitor the status of SBA’s updates to its
guidance.

39GAO, Small Business Research Programs: Opportunities Exist for SBA and Agencies to
Reduce Vulnerabilities to Fraud, Waste, and Abuse, GAO-24-105470 (Washington, D.C.:
Sept. 9, 2024).
40SBIR.gov is SBA’s primary government-wide website for the SBIR/STTR programs.

41GAO-24-105470.

Page 14 GAO-26-108820
In November 2024, SBA’s independent financial statement auditor issued
SBA’s Financial a disclaimer of opinion on SBA’s fiscal year 2024 financial statements. 42
Statement Auditor The financial statement auditor reported that material weaknesses existed
in SBA’s controls over its pandemic relief programs that contributed to
Has Raised Concerns SBA’s inability to support a significant number of transactions and
account balances related to these programs. For example, the auditor
found that SBA had not sufficiently designed the review process for PPP
loan forgiveness. SBA also had not adequately designed and
implemented controls to ensure that COVID-19 EIDL loans were issued to
eligible borrowers and were accurately recorded.

The auditor also identified concerns about SBA’s controls beyond its
pandemic relief programs. For example, the auditor found weaknesses
that limited SBA’s ability to effectively manage its information system
risks. Collectively, these deficiencies increased the risk of unauthorized
use, modification, or destruction of financial data.

According to SBA, it has made efforts to strengthen internal controls. In
January 2025, SBA finalized a remediation strategy for its financial
statement audit. Among other things, the strategy identifies the highest
priority target areas, remediation steps, and target dates to complete
those steps.

In September 2025, the SBA OIG reviewed SBA’s new strategy. 43 It found
that some elements would substantially address related audit
recommendations but that the strategy did not fully prioritize other
material weaknesses, such as those related to certain pandemic relief
programs. For example, SBA’s OIG reported that SBA had not developed
a plan to perform a comprehensive review of all COVID-19 EIDL
transactions flagged for eligibility concern. SBA also had not prioritized
addressing the auditor’s recommendations related to the material
weaknesses for the other pandemic-relief programs. According to SBA’s
OIG, although SBA acknowledged the importance of its pandemic relief
programs, SBA’s strategy instead concentrated resources on other areas.

42Small Business Administration, Office of Inspector General, Independent Auditors’
Report on SBA’s Fiscal Year 2024 Financial Statements, 25-05 (Washington, D.C.: Nov.
15, 2024). SBA’s auditor also had issued a disclaimer of opinion on SBA’s financial
statements for fiscal years 2020 through 2023.
43Small Business Administration, Office of Inspector General, SBA’s Controls to Address

Financial Statements Audit Disclaimers and Material Weaknesses, 25-25 (Washington,
D.C.: Sept. 29, 2025).

Page 15 GAO-26-108820
The OIG made four recommendations to enhance the strategy’s
implementation.

We support the recommendations the financial statement auditor
provided to address control weaknesses related to SBA’s pandemic relief
programs, as well as the OIG’s recommendations to enhance SBA’s
financial audit remediation strategy. We encourage SBA to address these
recommendations and continue to work toward obtaining a clean financial
statement audit opinion.

An improper payment occurs when a payment should not have been
SBA Has Taken Some made or was made in the incorrect amount. 44 These payments can stem
Steps to Manage from various causes, including fraud. Developing reliable improper
payment estimates is essential for understanding and addressing
Improper Payments, financial vulnerabilities.
but Additional Work
Remains
SBA Reported Improper We have previously identified problems related to SBA’s estimates of
Payment Estimates, but improper payments, particularly for its pandemic relief programs.
Accordingly, we made four recommendations to address these concerns,
Work Remains on
one of which has been implemented and three of which have not.
Overpayments
Estimating improper payments in pandemic relief programs—
implemented. In November 2020, we reported that the lack of initial
safeguards for PPP contributed to the increased risk of improper
payments. 45 Because of concerns about the timely reporting of improper
payments, we recommended that SBA expeditiously estimate improper
payments and report estimates and error rates for PPP. In response to
our recommendation, SBA began reporting an estimated improper

44An improper payment is defined by law as any payment that should not have been made
or that was made in an incorrect amount (including overpayments and underpayments)
under statutory, contractual, administrative, or other legally applicable requirements. It
includes any payment to an ineligible recipient, any payment for an ineligible good or
service, any duplicate payment, any payment for a good or service not received (except
for such payments where authorized by law), and any payment that does not account for
credit for applicable discounts. 31 U.S.C. § 3351(4). When an executive agency’s review
is unable to discern whether a payment was proper because of insufficient or lack of
documentation, that payment must also be included in the improper payment estimate. 31
U.S.C. § 3352(c)(2)(A).
45GAO-21-191.

Page 16 GAO-26-108820
payment rate and amount for PPP in its fiscal year 2022 agency financial
report.

SBA has continued reporting these estimates, but some of the estimates
remain high. For example, in March 2025, we reported that SBA’s
estimated improper payment rates in fiscal year 2024 for three pandemic
relief programs—the Restaurant Revitalization Fund, PPP Loan
Forgiveness, and PPP Loan Guaranty Purchases—were at least 24
percent. 46

Documenting and tracking overpayment reviews—not implemented.
In November 2024, we reported on SBA’s efforts to identify and recover
overpayments in PPP and COVID-19 EIDL. 47 We found that SBA’s loan
review processes for these programs were not effectively identifying
overpayments, and that SBA did not have sufficient processes to track
identified overpayments and subsequent recoveries. We made three
recommendations to SBA, including that it expand and document
overpayment review procedures and expand its tracking process. SBA
partially agreed with these recommendations, and we will continue to
monitor its progress in addressing them.

SBA’s OIG Has Raised SBA’s OIG reported in May 2025 that SBA was not in compliance with the
Concerns About SBA’s Payment Integrity Information Act of 2019 and related OMB
requirements. 48
Improper Payment
Reporting The OIG found that SBA did not comply with eight of the act’s 10 criteria
for fiscal year 2024. For example, it found that SBA did not report an
improper payment estimate for the Shuttered Venue Operators Grant
program as required, and did not design and implement adequate review
procedures to produce reliable sample results used to develop improper
payment estimates for several programs, including PPP Loan
Forgiveness and PPP Loan Guaranty Purchases.

46The estimated improper payment rate for the Restaurant Revitalization Fund was 30.3
percent (about $8.7 billion of the $28.6 billion in awards), the second-largest estimated
improper payment rate reported for a federal program in fiscal year 2024.
GAO-25-107753.

47GAO-25-106199.

48Small Business Administration, Office of Inspector General, Independent Auditors’
Report on SBA’s Fiscal Year 2024 Compliance with the Payment Integrity Information Act
of 2019, 25-15 (Washington, D.C.: May 15, 2025).

Page 17 GAO-26-108820
We have ongoing work for this committee examining SBA’s improper
payment estimation methods and recovery audits for its pandemic relief
and standard programs. We will continue to monitor SBA’s actions to
address these issues.

We have reported on challenges related to SBA’s oversight of its
SBA Has Taken Steps contracting programs, including the 8(a) program. 49 SBA has addressed
to Improve seven of the 21 recommendations we have made to address these
challenges.
Administration of
Contracting Programs Reporting on procurement center representatives—implemented.
SBA’s procurement center representatives advocate for small businesses
when agencies are procuring goods and services. In a June 2020 report,
we found that SBA did not maintain complete documentation to support
data on the activities of these representative; these data are used to
oversee the representatives and assess their performance. 50 Storing the
complete documentation would help SBA verify the accuracy of the
reports. SBA also did not submit required reports to Congress on the
agency’s rationale for assigning the representatives to cover buying
activities. We made two recommendations that SBA address these
issues. In early 2021, SBA began using a central repository to store its
data and submitted the required report to Congress.

Documenting reviews of small business subcontracting plans—
implemented. Contractors that receive certain federal contracts are
required to have small business subcontracting plans. Under these plans,
contractors must make a good-faith effort to offer subcontracting
opportunities to small businesses. Contracting officers are required to
provide SBA staff with an opportunity to review the proposed contract.
However, in a May 2020 report, we found that SBA could not provide
documentation or information on almost all compliance reviews
conducted by SBA in fiscal years 2016 through 2018. 51 We recommended

49In June 2025, the SBA Administrator announced a review of fraud in the 8(a) program.
According to SBA, the audit would be led by its Office of General Contracting and
Business Development, beginning with high-dollar and limited-competition contracts and
going back over a period of 15 years, in collaboration with various federal agencies that
award contracts to 8(a) participants.
50GAO, Small Business Contracting: Better Documentation and Reporting Needed on
Procurement Center Representatives, GAO-20-462 (Washington, D.C.: June 30, 2020).
51GAO, Small Business Subcontracting: Oversight of Contractor Compliance with
Subcontracting Plans Needs Improvement, GAO-20-464 (Washington, D.C.: May 28,
2020).

Page 18 GAO-26-108820
that SBA address these issues. In response, SBA issued two guidance
memos in November 2020. These memos instructed SBA staff to use a
single electronic repository to store compliance review information and to
conduct performance reviews.

Submitting 8(a) Business Development Program annual reports—
implemented. In a 2022 report, we found that SBA had not submitted
any of its required annual 8(a) program reports to Congress on time for
2016 to 2021. 52 We made two recommendations to SBA related to
documenting its report process and developing a plan to address report
delays. In response to our recommendations, SBA updated its standard
operating procedures for the program to include a chapter on submitting
the annual report, including a timeline for completing the report on time.
SBA also developed a process map to help streamline report
development.

Accurately documenting nonmanufacturer rule waiver reviews—
implemented. In December 2023, we reported on issues related to
SBA’s oversight of waivers to the nonmanufacturer rule. 53 We found that
SBA data on these waivers included inaccurate or incomplete information,
and that SBA did not have policies on how management should review
analysts’ decisions. We made two recommendations that SBA address
these issues. In response to our recommendations, SBA updated its
program guidelines in July 2025 to address these concerns.

Identifying and addressing risks associated with the small business
certification platform—not implemented. In a November 2024 report,
we found problems with SBA’s management of the Unified Certification
Platform project, which is intended to allow small businesses to more
efficiently apply for and maintain certifications to SBA’s contracting

52GAO, Small Business Administration: Recent Changes to the 8(a) Program’s Financial
Thresholds Need Evaluation, GAO-22-104512 (Washington, D.C.: Aug. 30, 2022).
53The nonmanufacturer rule allows federal agencies to award contracts to small business
contractors to supply products manufactured by another small business if the contractors
do not manufacture those products themselves. If no small business manufacturers exist,
federal agencies can request a waiver from SBA, allowing a small business to supply the
product of any sized manufacturer. 15 U.S.C. § 637(a)(17), 15 U.S.C. § 637(a)(17)(B)(iv).
GAO, Small Business Contracting: SBA Could Improve Oversight of Individual Waiver
Requests to the Nonmanufacturer Rule, GAO-24-106196 (Washington, D.C.: Dec. 14,
2023).

Page 19 GAO-26-108820
assistance programs, including the 8(a) program. 54 We identified critical
management gaps in the project. For example, SBA did not have a
project-level risk management strategy or a risk mitigation plan, and did
not fully identify and document risks. These issues increased the
likelihood of a successful cyberattack. Consequently, we made 14
recommendations, including that SBA expeditiously address critical risk
management and cybersecurity issues. SBA agreed with three, partially
agreed with three, and disagreed with the other eight recommendations.
We are monitoring SBA’s efforts to address our recommendations.

Chair Ernst, Ranking Member Markey, and Members of the Committee,
this concludes my statement. I would be pleased to respond to any
questions you may have.

If you or your staff have any questions about this testimony, please
GAO Contact and contact Courtney LaFountain, Acting Director, Financial Markets and
Staff Community Investment, at lafountainc@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
Acknowledgments the last page of this statement. GAO staff who made key contributions to
this testimony are Marshall Hamlett (Assistant Director), Daniel Newman
(Analyst in Charge), Seto Bagdoyan, Marcia Carlsen, Dan Flavin, Hannah
Padilla, Jennifer Schwartz, and Jessica Sandler. Key contributors to the
previous work discussed in this statement are listed in each of the cited
reports.

54GAO, IT Modernization: SBA Urgently Needs to Address Risks on Newly Deployed
System, GAO-25-106963 (Washington, D.C.: Nov. 6, 2024).

Page 20 GAO-26-108820
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Connect with GAO Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

Contact FraudNet:
To Report Fraud,
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
Automated answering system: (800) 424-5454
Federal Programs
Sarah Kaczmarek, Managing Director, Media@gao.gov
Media Relations

A. Nicole Clowers, Managing Director, CongRel@gao.gov
Congressional
Relations
https://www.gao.gov/about/contact-us
General Inquiries

Please Print on Recycled Paper.

File and source

File: LaFountain_Testimony.pdf
Size: 275,877 bytes
SHA-256: 47ae8e22cb3c6f22052b90341ace99152aa87b568bc0e2d0c4d0972ecabcb58e
Our copy: LaFountain_Testimony.pdf
Original: No public link identified.

Lafountain Testimony

Summary

Full text

File and source

Related records