Kirk Testimony

Summary

Testimony of William W. Kirk, Inspector General of the U.S. Small Business Administration, before the U.S. Senate Committee on Small Business and Entrepreneurship on February 25, 2026. It addresses eligibility oversight in the 8(a) Business Development Program, post-award monitoring and recovery in the Restaurant Revitalization Fund (RRF) and Shuttered Venue Operators Grant (SVOG), and extending the statute of limitations for RRF and SVOG fraud to 10 years to match PPP and COVID-19 EIDL. The testimony states that SBA disbursed approximately $1.2 trillion in pandemic assistance and that OIG estimated in 2023 that more than $200 billion in potentially fraudulent EIDL and PPP funds were disbursed. It reports OIG findings on RRF and SVOG awards, including 526 SVOG awards totaling approximately $716 million with unreviewed risk indicators, and hotline and investigation counts.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

                   WILLIAM W. KIRK
                INSPECTOR GENERAL
        U.S. SMALL BUSINESS ADMINISTRATION

                   BEFORE THE


COMMITTEE ON SMALL BUSINESS AND ENTREPRENEURSHIP

                   U.S. SENATE


          APPEARING ON FEBRUARY 25, 2026
                                  Introduction
Chair Ernst, Ranking Member Markey, and distinguished members of the
Committee. Thank you for the opportunity to appear before you today. It is an honor
to represent the Office of Inspector General (OIG) at the U.S. Small Business
Administration (SBA) and the dedicated auditors, law enforcement, analysts, and
support professionals who work every day to protect taxpayer dollars and promote
integrity across SBA’s programs.
SBA OIG operates independently under the Inspector General Act of 1978, as
amended. Our mandate is straightforward but consequential: conduct objective
oversight, grounded in evidence, to detect and deter fraud, waste, and abuse, and to
strengthen SBA program integrity through actionable recommendations and
transparent reporting.
While the acute economic phase of the COVID-19 pandemic has passed, oversight
has not. The scale and speed of SBA’s pandemic response was unprecedented. To
avert an economic crisis caused by lockdowns, business closures, and other
impediments, SBA disbursed approximately $1.2 trillion in pandemic economic
assistance. The response delivered critical relief to millions of legitimate small
businesses. It also created opportunities for fraudsters to exploit internal control
vulnerabilities. Fraudsters stole identity information, created synthetic identities,
and duplicated information to exploit programs meant to help those in need.
Today, I will focus on three areas central to the Committee’s oversight
responsibilities:
   •   First, the systemic risks within the 8(a) Business Development Program and
       the importance of eligibility oversight.
   •   Second, the underperformance in post-award monitoring within the
       Restaurant Revitalization Fund (RRF) and Shuttered Venue Operators Grant
       (SVOG) awards and the recovery of funds that were improperly or
       fraudulently disbursed.
   •   Third, the necessity of extending the statute of limitations to 10 years for
       RRF and SVOG fraud, which would match the statute enacted for the
       Paycheck Protection Program (PPP) and COVID-19 Economic Injury Disaster
       Loan (EIDL) fraud.
These issues are interconnected. They all reflect the same underlying principle:
when program eligibility is not rigorously verified, when red flags are not fully
resolved, or when enforcement timelines are misaligned with investigative realities,
the American taxpayer bears the risk.
Our office has continued to identify indicators of potential ineligibility, unresolved
fraud flags, and delayed recovery actions in certain pandemic programs. At the
same time, we have seen the benefits of strengthened controls, improved


                                           1
interagency data sharing, and enhanced investigative coordination through
partnerships, such as with the Pandemic Response Accountability Committee
(PRAC).

Oversight is not about revisiting the urgency of 2020. It is about ensuring that the
structural lessons from that period translate into stronger controls today and in the
future.
Under my leadership, SBA OIG will continue to exercise independent judgment,
pursue complex fraud investigations wherever the evidence leads, issue
recommendations to strengthen internal controls, and keep this Committee fully
informed of risks, corrective actions, and measurable outcomes.
The work ahead requires persistence, the time to investigate potential fraud, and a
sustained commitment to integrity. I appreciate the Committee’s engagement on
these matters and look forward to discussing them in greater detail.

        Risk in the 8(a) Business Development Program
The 8(a) Business Development Program was designed to help disadvantaged small
business owners gain business skills and access to federal contracting opportunities
so they can better compete in the open marketplace. The federal government sets
aside contracting opportunities to help small, disadvantaged businesses participate
in the federal marketplace, grow and develop expertise, and ultimately strengthen
the American economy. As mandated by the Small Business Act, the government-
wide goal is to award at least 23 percent of contract dollars to small businesses. The
government seeks to award small, disadvantaged businesses, of which
8(a)businesses are included, at least 5 percent of the value of prime and
subcontracting awards each year.

The 8(a) program also allows for contracts to be awarded directly to one business
with no competitive bidding, a process called sole-sourcing contracts. Alaska Native
Corporations, Tribal-owned firms, Native Hawaiian Organizations, and Community
Development Corporations that are 8(a) businesses can benefit from unlimited sole-
sourced authority.1 Other 8(a) firms are limited to certain contracting award
amounts. Fraudsters can seek to take advantage of these benefits meant to help
eligible small businesses owners, which is one of the reasons this program should
have strong eligibility controls and ongoing monitoring to ensure benefits are
delivered consistent with established criteria.
In prior audit work, OIG identified weaknesses in how the agency tracked and
resolved credible eligibility complaints. Where red flags are not consistently
addressed, the risk of ineligible participation increases.
SBA has recently initiated its own administrative review of 8(a) participants and

1 15 U.S. Code § 637(a) and Federal Acquisition Regulation (FAR) 19.805-1.




                                                 2
required documentation to validate continued eligibility. OIG has independent
oversight authority over the program. OIG conducts its work consistent with
Government Auditing Standards and reports findings and recommendations to the
Administrator and Congress upon completion. In our 2026 Oversight Plan, we have
planned audit work examining:
   •   SBA’s process for certifying firms’ initial 8(a) Program eligibility
   •   SBA’s oversight of entity-owned 8(a) firms and their community benefits
       reporting

These reviews are focused on whether internal controls and verification procedures
are operating effectively and in accordance with applicable requirements. Effective
oversight protects legitimate small businesses. When ineligible entities gain access
to set-aside contracting opportunities, they do so at the expense of qualified
participants.

Pandemic Fraud Landscape and Ongoing Oversight Exposure
The COVID-19 pandemic required an unprecedented federal response. In a
compressed timeframe, Congress appropriated and SBA administered
approximately $1.2 trillion in economic assistance through multiple relief programs,
including the PPP, COVID-19 EIDL, the RRF, and the SVOG.
The urgency of the moment was real. Millions of legitimate small businesses
depended on rapid access to relief. At the same time, the scale and speed of
deployment created significant fraud and improper payments.
In 2023, SBA OIG estimated that more than $200 billion in potentially fraudulent
COVID-19 EIDL and PPP funds were disbursed out of the approximately $1.2
trillion administered by SBA. This represents at least 17 percent of total
disbursements in those programs. The fraud was not incidental. It was organized,
opportunistic, and in many cases coordinated by fraudsters across multiple
programs.

Investigations uncovered:
   •   Identity theft schemes using stolen Social Security numbers,
   •   Synthetic business entities created solely to obtain relief funds,
   •   Organized international fraud rings,
   •   Layered financial transfers designed to conceal misuse, and
   •   Cross-program exploitation of eligibility gaps.
Fraudsters exploited weakened front-end verification controls, reliance on self-
certification, and limited cross-program data validation during the early phases of
implementation.
Congress recognized the magnitude of the potential fraud and extended the statute



                                           3
of limitations to 10 years for PPP and COVID-19 EIDL fraud in 2022. This action
acknowledged the reality of complex financial fraud and extended the time available
to prosecute individuals who committed fraud.

However, two large pandemic assistance programs remain under shorter statutory
limitations: the RRF and the SVOG.
Those programs must be evaluated within the broader fraud landscape.

   Restaurant Revitalization Fund and Shuttered Venue
                    Operators Grant
SBA has progressed to reviewing the pandemic assistance grants, which includes
the RRF and the SVOG programs. Both programs involved large-scale grant
disbursements executed in compressed timeframes, with limited front-end
verification controls. As a result, post-award monitoring and recovery efforts are
critical to protecting taxpayer funds.

Restaurant Revitalization Fund
The American Rescue Plan Act of 2021 authorized approximately $28.6 billion for
the RRF. SBA approved over 100,000 applications during an application window
that lasted roughly 10 weeks.
Applications submitted totaled more than $72 billion in requested funding, nearly
three times the available appropriation.

The program’s design prioritized rapid disbursement to stabilize food service
businesses during economic shutdowns. However, the speed of implementation
increased vulnerability where verification controls were not consistently applied.

Eligibility Verification Weaknesses
OIG identified significant control deficiencies in SBA’s administration of the RRF
program. In one limited-scope review, OIG found that 3,790 applications submitted
through a point-of-sale vendor partner were processed without validating gross
sales, a key control designed to confirm eligibility. The vendor notified SBA that
these applications lacked verifiable sales documentation and that 1,056 of the
applications showed strong indications of fraud.
SBA took action to prevent approximately $278.4 million from being disbursed to
certain applicants. However, $278.6 million had already been disbursed to 2,172
recipients associated with unsupported gross sales. This issue had not been resolved
at the time of our review. Until these awards are reviewed and resolved, SBA lacks
assurance that those funds were awarded based on verified eligibility.

Cross-Program Fraud Indicators



                                          4
In another review, OIG identified 33,168 RRF award recipients who also received
PPP loans that had been marked as potentially fraudulent or ineligible. These
recipients received nearly $10.9 billion in RRF funds. Of these, 656 awards had
active indicators requiring review. We found that 210 high-risk awards totaling
approximately $160 million were not selected for review after they were awarded.
Our recommendations called for review of more than 61,000 RRF awards totaling
over $9.5 billion. We also recommended the development of a recovery plan that
identified improper payments. SBA has agreed to review a small number of these
awards. The agency recently established a policy to recover funds that were deemed
an improper payment.
Investigative Activity and Criminal Enforcement
We continue to pursue potential fraud in the RRF program. Some of our recent
activities include:
   •   680 RRF-related Hotline complaints,
   •   23 open investigations involving RRF-related matters,
   •   32 individuals charged, and
   •   14 individuals convicted.

RRF Investigations involve complex fraud schemes such as:
   •   False revenue reporting,
   •   Fabricated tax documentation,
   •   Identity theft,
   •   Misuse of grant funds for personal investments, and
   •   Multi-program fraud spanning the PPP and EIDL programs.
These schemes frequently involve concealment and layered financial transactions
that require significant forensic review and coordination with federal prosecutors.

Recently OIG helped investigate a fraudster running an elaborate kickback scheme
involving losses of over $700,000 in RRF, PPP, and COVID-19 EIDL funds. The
Alabama resident obtained an RRF grant for a purported catering business, used
taxpayer funds to purchase a car, and then charged others a fee for submitting false
applications on their behalf. The Alabama resident was sentenced to nearly 10
years after pleading guilty to wire fraud and money laundering charges in a scheme
that would have stolen over $14 million in SBA pandemic assistance funds if her
false applications had been funded.

We have another case of a former Oregon dentist sentenced to nearly 6 years for
attempting to steal over $170 million in pandemic aid funds and illegally
distributing doses of prescription drugs. He submitted more than 100 fraudulent
pandemic relief program applications, including the RRF, using the stolen identities
of more than 40 victims. He received and caused SBA to pay out over $11.5 million
that he then used to speculate in stocks and cryptocurrency, continuing even after


                                          5
his arrest. One of the identity theft victims reported the crime because she found
herself listed in a federal database as having received a $3.4 million RRF grant for a
catering business she had never heard of, using her name and an outdated address

Shuttered Venue Operators Grant
The Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act
authorized $16.25 billion for the SVOG program. SBA ultimately disbursed
approximately $14.6 billion to 13,011 awardees, including supplemental awards.
Most SVOG recipients had no prior experience with federal grant programs. The
eligibility requirements were complex and required careful documentation of
revenue loss and venue operations.

Post-Award Monitoring and Eligibility Risks
OIG identified weaknesses in SBA’s post-award review process for SVOG awards.
We found that:
   •   526 SVOG awards, totaling approximately $716 million, had eligibility risk
       indicators but were not selected for review.
   •   47 awards, totaling approximately $22.9 million, were made to ineligible
       applicants, including recipients who did not meet venue-specific eligibility
       requirements.

Oversight gaps in the review stage have delayed recovery efforts and increased the
risk that improper payments remain unresolved. In fiscal year 2025, SBA issued
309 demand letters to SVOG recipients in an attempt to recoup $540 million in
improperly paid funds.

Investigative Activity and Criminal Enforcement
We continue to pursue potential fraud in the SVOG program. Some of our recent
activities include:
   •   439 SVOG-related Hotline complaints,
   •   6 open investigations involving SVOG,
   •   4 individuals charged, and
   •   2 individuals convicted.

Fraudsters dipped into multiple SBA pandemic assistance programs, so these
investigations involve complex financial tracing. One example of this cross-program
fraud is a Florida couple who stole over $4.8 million from the SVOG, PPP, and
COVID-19 EIDL. This couple submitted 166 false EIDL applications, 20 false PPP
loan applications, and 3 false SVOG applications using false tax forms and monthly
payroll and expenses in their names and in the names of co-conspirators. The couple
pled guilty and were sentenced to 40 months and 24 months in federal prison,
respectively.



                                          6
Structural Lessons from the RRF and SVOG
The high demand and then the large amounts disbursed on a quick timeline created
structural vulnerabilities that should be considered in future emergency economic
aid assistance programs.
Fraud indicators frequently emerge years after disbursement. Whistleblowers may
come forward late. Cross-program data analysis can identify linkages only after
sufficient time and aggregation.

Effective oversight depends on:
   •   Complete review of flagged awards,
   •   Timely issuance of recovery actions where warranted,
   •   Strong interagency coordination, and
   •   Adequate statutory timeframes for enforcement.
The oversight phase of pandemic grant programs remains ongoing. Identification of
improper payments is only the first step. Resolutions and recovery must follow.

Extension of the Statue of Limitations for RRF and SVOG
                          Fraud
In 2022, Congress acted on a bipartisan basis to extend the statute of limitations to
10 years for fraud related to the PPP and COVID-19 EIDL. That extension reflected
a recognition that pandemic-era fraud schemes were frequently complex, concealed,
and time-intensive to investigate. Financial trading, forensic accounting, data
aggregation, and interagency coordination require substantial time. In many cases,
fraud indicators do not surface until years after funds have been disbursed.

The same realities apply to the RRF and the SVOG programs, which account for
about $43 billion in total funding. We have leveraged technology to identify billions
of dollars of RRF and SVOG funds that are in need of further scrutiny to confirm
indicators of fraud. Our criminal investigators have dashboards available to assist
in their investigative efforts.
Both RRF and SVOG were large-scale grant programs disbursed rapidly during an
emergency period. Both involved eligibility determinations that relied in part on
applicants attesting to or certifying their own eligibility. We have investigated and
continue to detect leads on identity theft, falsified documentation, misuse of funds,
and cross-program fraud.
The complexity of these cases mirrors the PPP and EIDL. Fraudsters frequently:

   •   Layer transactions across multiple financial institutions,
   •   Use nominee accounts or shell entities,
   •   Co-mingle funds from multiple pandemic programs,
   •   Delay detection through concealment tactics, and


                                          7
   •   Exploit timing gaps in enforcement windows.
Investigations often involve extensive coordination with the U.S. Department of
Justice, the Internal Revenue Service Criminal Investigation division, the
Department of Homeland Security, the Financial Crimes Enforcement Network,
and the PRAC. When concealment and money laundering are involved,
investigative timelines extend significantly beyond the initial disbursement date.
Statutes of limitations exist for important reasons. They promote fairness and
ensure that prosecutions occur within a reasonable period after alleged misconduct.
However, Congress has already recognized that pandemic-era fraud warrants
extended timelines due to the scale and complexity of the schemes involved.
Extending the statute of limitations for RRF and SVOG fraud would promote
consistency across pandemic programs. It would help ensure the government’s
ability to pursue recovery of taxpayer funds and reduce the risk that fraudsters
evade accountability. Congress can continue to ensure that enforcement tools match
the operational realities of these cases.
From a taxpayer protection perspective, alignment promotes fairness across
programs of comparable scale and exposure. RRF disbursed approximately $28.6
billion. SVOG disbursed approximately $14.6 billion. The combined exposure
exceeds $43 billion in grant funding.

Where significant improper payment risk has been identified, and where
investigative caseloads remain active, statutory alignment strengthens the
government’s position to pursue accountability. Fraud recovery is not immediate. It
is iterative, evidence-driven, and often dependent on extended financial analysis.
The oversight of pandemic programs continues. Enforcement tools should reflect
that reality.

Strengthening Controls, Leveraging Data, and Protecting
                Taxpayer Investment
The pandemic exposed vulnerabilities in eligibility verification, front-end screening,
and post-award monitoring. It also accelerated innovation in fraud detection,
interagency data sharing, and analytics-driven oversight. The responsibility now is
to institutionalize those lessons.

Internal Control Improvements and Risk Management
Recently, SBA has indicated that it has implemented additional fraud detection
frameworks at various stages of loan and grant processing, including account
registration screening, post-submission review routines, and pre-disbursement
verification. SBA also has stated that it has expanded data-sharing agreements
across federal databases, including:



                                          8
   •   The Department of Homeland Security’s SAVE Program,
   •   The Social Security Administration’s Enterprise Data Exchange Network,
       and
   •   The Department of the Treasury’s Do Not Pay system.
These tools, when effectively implemented, can reduce improper payments and
improve front-end eligibility validation.
However, as an oversight body operating under Government Auditing Standards,
OIG must independently verify the design and effectiveness of such controls before
concluding that risks have been mitigated. Control design alone is not sufficient.
Implementation and monitoring determine effectiveness.
We continue to assess internal controls through risk-based audits and compliance
reviews, including oversight of SBA’s improper payment assessments as required by
the Payment Integrity Information Act.
Data Analytics and Technology-Driven Oversight
One of the most significant advancements during pandemic oversight was the
integration of data analytics into investigative and audit workflows. OIG’s
Technology Solutions Division supports:
   •   Cross-program anomaly detection,
   •   Identity validation analysis,
   •   Pattern recognition across loan and grant portfolios,
   •   Transaction tracing and clustering analysis,
   •   Integration of external data sources, and
   •   Interagency collaboration and data matching.
These tools allow us to identify relationships that would not be visible through
manual review alone. For example, cross-referencing PPP, EIDL, RRF, and SVOG
data sets have revealed overlapping applicant identifiers, shared bank accounts,
application inconsistencies across programs, and patterns of coordinated
submissions. Data-driven oversight enhances our investigative and auditing work.
It reduces false positives and allows for a larger scope and surveys. We can focus
our limited investigative and auditing resources on the highest risk cases.

PRAC and Interagency Coordination
Collaboration with the PRAC has strengthened oversight across federal programs.
Through shared analytics platforms and coordinated case development, OIG and
partner agencies have improved:
   •   Deconfliction of investigations,
   •   Financial tracing across jurisdictions,
   •   Identification of multi-program fraud networks, and



                                          9
   •   Referral efficiency to federal prosecutors.
Pandemic fraud frequently crosses agency boundaries. Oversight coordination must
do the same.

Return on Investment and Resource Stewardship
Oversight is not only about identifying vulnerabilities. It is about measurable impact.
With an annual budget of approximately $37 million in FY 2025, SBA OIG achieved
nearly $3.7 billion in monetary accomplishments in that fiscal year. Since the
beginning of SBA’s pandemic response, OIG has secured more than $17.7 billion in
monetary accomplishments through investigative recoveries, forfeitures, fines, and
questioned costs. These results reflect a substantial return on investment for
taxpayers.

At the same time, our office continues to manage an active caseload of
approximately 500 investigations nationwide. Many of these cases involve complex,
multi-million-dollar schemes that require sustained forensic analysis and
prosecutorial coordination.

Preserving Integrity Going Forward
The vulnerabilities exposed during the pandemic were not isolated to a single
program. They revealed structural weaknesses that can emerge whenever speed,
scale, and urgency converge. Key lessons to carry forward include:

   •   Eligibility verification must be documented and validated,
   •   Self-certification requires cross-check mechanisms to verify eligibility,
   •   Post-award monitoring and recovery of improper payments must be done in a
       timely manner,
   •   Data analytics must be used to promote program integrity during
       implementation and for reviews, and
   •   Enforcement timelines must reflect investigative complexity.

Our goal is structural improvement. We will continue to:
   •   Conduct independent audits and investigations;
   •   Verify corrective actions before closing recommendations;
   •   Identify emerging risks across SBA’s capital, contracting, and disaster
       programs;
   •   Report transparently to the public, Administrator, and the Congress.
Protecting the integrity of SBA programs protects legitimate small businesses and
taxpayer interests.

                Commitment to Continued Oversight
The scale of SBA’s pandemic response was unprecedented. The speed of


                                           10
disbursement was often necessary. The exposure to fraud was significant. Oversight
must be equally sustained. Oversight is not episodic. It is continuous.
The vulnerabilities identified during the pandemic were not isolated events. They
reflected structural weaknesses in eligibility verification, internal control
implementation, and post-award monitoring. We will continue to recommend that
SBA address these weaknesses moving forward.
The 8(a) Business Development Program must operate with integrity so that
opportunities reach qualified disadvantaged businesses. Pandemic grant programs
must be fully reviewed so that unresolved risk indicators are addressed.
Enforcement tools must align with investigative realities so that fraudsters do not
evade accountability. Extending the statute of limitations for RRF and SVOG would
promote consistency, preserve recovery opportunities, and strengthen taxpayer
protection.
Under my leadership, this office will remain focused on helping ensure that SBA
programs operate with less risk of fraud, waste, and abuse, remaining accountable
to the American people.
I welcome the Committee’s questions.




                                        11


File and source

File

Kirk_Testimony.pdf

Size

229,804 bytes

SHA-256

3bc3846d20401342a8f5472617cd9e41a39628fbf6b7d9ef23960b9318f8505f

Our copy

Kirk_Testimony.pdf

Original

www.sbc.senate.gov