SBA's Fiscal Year 2023 Compliance with the Payment Integrity Information Act of 2019 (Report 24-16)
Summary
A memorandum dated May 15, 2024 from SBA Inspector General Hannibal "Mike" Ware to Administrator Isabella Casillas Guzman transmitting the Independent Auditors' Report on SBA's Fiscal Year 2023 Compliance with the Payment Integrity Information Act of 2019 (Report 24-16), prepared by KPMG LLP. KPMG found SBA was not compliant with 8 of the 10 reporting requirements under the Act and OMB guidance. The findings include that SBA did not publish improper and unknown payment estimates for the Restaurant Revitalization Fund and Shuttered Venue Operators Grant, unreliable estimates for COVID-19 EIDLs and PPP loan forgiveness, and missing effective corrective action plans. The memorandum states that the Inspector General's review found no instances where KPMG did not comply with Government Auditing Standards.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“SBA's Fiscal Year 2023 Compliance with the Payment Integrity Information Act of 2019 (Report 24-16).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/24-16-fy2023-piia-compliance-0170556226/
, SHA-256 c99eba18bd2eb1f00b2d4322557fd3c630bd2a27203eb8eb495a415729a842be.Full text
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
DATE: May 15, 2024
TO: Isabella Casillas Guzman
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Fiscal Year 2023 Compliance with the
Payment Integrity Information Act of 2019 (Report 24-16)
This independent auditors’ report on the U.S. Small Business Administration’s (SBA) improper
payment reporting is required by the Payment Integrity Information Act of 2019. We contracted
with the independent certified public accounting firm KPMG LLP to conduct a performance audit
of SBA’s fiscal year (FY) 2023 compliance with the Act. The auditor was engaged to review the
payment integrity section of SBA’s Agency Financial Report Fiscal Year 2023 (AFR) and
accompanying materials to determine whether the agency complied with the reporting
requirements under the Act.
KPMG was engaged to conduct the audit in accordance with consulting services standards
established by the American Institute of Certified Public Accountants. The audit also complied
with standards applicable to government performance audits issued by the Comptroller General
of the United States and the Council of the Inspectors General on Integrity and Efficiency
Guidance for Payment Integrity Information Act Compliance Reviews.
In the report, KPMG auditors found SBA was not compliant with 8 of the 10 reporting
requirements under the Act and Office of Management and Budget (OMB) guidance. Specifically,
SBA is not compliant with the Act because it did not:
409 3rd Street SW, Washington, DC 20416 • phone (202) 205-6586 • fax (202) 205-7382
• Publish improper and unknown payment estimates in the FY 2023 agency AFR and
accompanying materials for the Restaurant Revitalization Fund, Shuttered Venue
Operators Grant, and payments for covered loans in the 7(a) and 504 loan guaranty
programs under the Debt Relief Program. These programs and activities did not comply
with the requirement to report improper and unknown payment rate estimates of less
than 10 percent. Further, SBA did not publish corrective action plans and reduction
targets for payments for covered loans in the 7(a) and 504 loan guaranty programs under
the Debt Relief Program.
• Use appropriate sampling and estimation methodology plans for disaster assistance
loans, Coronavirus Disease 2019 (COVID-19) Economic Injury Disaster Loans (EIDL), and
EIDL Targeted Advance programs and activities. In addition, the population of outlays SBA
used for sampling and reporting were not complete and accurate for disaster assistance
loans, COVID-19 EIDLs, Paycheck Protection Program (PPP) loan forgiveness, and PPP loan
guaranty purchases. Further, SBA did not design and implement adequate sample review
procedures to produce reliable sample results that it could use to develop accurate
improper and unknown payment estimates for the COVID-19 EIDL, EIDL advance, PPP
loan forgiveness, and PPP loan guaranty purchases programs. Consequently, SBA’s
improper payment and unknown payment rate estimates were not accurate or reliable
for disaster assistance loans, COVID-19 EIDLs, EIDL advances, PPP loan forgiveness, and
PPP loan guaranty purchases. These programs and activities did not comply with the
requirement to report improper and unknown payment rate estimates of less than 10
percent because of unreliable estimates.
• Did not publish effective corrective action plans for the disaster assistance loans, PPP
loan forgiveness, and PPP loan guaranty purchases programs and activities.
• Demonstrate improvements to payment integrity for 7(a) loan guaranty approvals, 7(a)
loan guaranty purchases, 504 Certified Development Company loan approvals, disaster
assistance loans, and COVID-19 EIDL programs and activities as the improper payment
estimates increased between FYs 2022 and 2023.
2
We reviewed KPMG’s report and related documentation and inquired of its representatives. Our
review, as differentiated from an audit in accordance with the Government Auditing Standards,
was not intended to enable us to express, and we do not express, opinions on SBA’s compliance
with the Act or internal controls over improper payment reporting. KPMG is responsible for the
attached auditors’ report dated May 15, 2024 and the conclusions expressed.
Our oversight protocols include evaluation of major work products, attendance at critical
meetings, review of significant findings, and examination of related evidential matter. Our review
disclosed no instances where KPMG did not comply in all material respects with Government
Auditing Standards.
SBA indicates that it is committed to reducing the dollar amount of improper payments, ensuring
program integrity, and continuing to implement effective risk management procedures in
accordance with improper payment legislation, as well as guidance prescribed in OMB
Memorandum M-21-19, Appendix C to OMB Circular A-123, Requirements for Payment Integrity
Improvement.
SBA concurs with the recommendations made in this audit report and has provided comments in
response to those recommendations. The agency’s response is included in Appendix 1 of this
report. We provided a draft of KPMG’s report to SBA’s Chief Financial Officer and the Associate
Administrator for the Office of Capital Access.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or
your staff have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.
cc: Dilawar Syed, Deputy Administrator, Office of the Administrator
Arthur Plews, Chief of Staff, Office of the Administrator
Katherine Aaby, Associate Administrator and Chief Financial Officer, Office of
Performance, Planning, and the Chief Financial Officer
Walter B. Hill Jr., Chief Risk Officer, Office of Performance, Planning, and the Chief
Financial Officer
Katie Frost, Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Francisco Sanchez Jr., Associate Administrator, Office of Disaster Recovery and Resilience
Therese Meers, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls
Attachment
3
Performance Audit of the U.S. Small Business Administration’s Fiscal Year
2023 Compliance with the Payment Integrity Information Act of 2019
Prepared for: U.S. Small Business Administration, Office of Inspector General
Date: May 15, 2024
KPMG LLP
1801 K Street NW, Suite 12000
Washington DC 20006
Table of Contents
Auditor’s Report .......................................................................................................................... 3
I. Background ........................................................................................................................... 7
II. Objective, Scope, and Methodology ...................................................................................... 8
III. Results and Conclusions ....................................................................................................... 9
IV. Findings ...............................................................................................................................12
A. Deficiencies in Internal Control ........................................................................................12
B. Recommendations ...........................................................................................................16
V. Appendix I: Management’s Response to Report ...................................................................17
Page | 2
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
Administrator
Inspector General
U.S. Small Business Administration
This report presents the results of our performance audit related to the U.S. Small Business
Administration’s (SBA’s) compliance with the requirements contained in the Payment Integrity
Information Act of 2019 (PIIA), section 3351(2). We performed our work between December 5,
2023, and May 15, 2024, and our results are as of May 15, 2024.
We conducted this performance audit in accordance with the standards applicable to
performance audits contained in the Government Auditing Standards (GAS) issued by the
Comptroller General of the United States. Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings
and conclusions based on our audit objective. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objective.
In addition to GAS, we conducted this performance audit in accordance with the Statements on
Standards for Consulting Services established by the American Institute of Certified Public
Accountants (AICPA). This performance audit did not constitute an audit of SBA’s financial
statements, or an attestation level report as defined under generally accepted government
auditing standards (GAGAS) and AICPA standards for attestation engagements.
We used the Council of the Inspectors General on Integrity and Efficiency Guidance (CIGIE) for
Payment Integrity Information Act Compliance Reviews dated October 19, 2023, which provides
guidance regarding the fieldwork and reporting related to the performance audit objective. The
objective of our performance audit was to determine whether SBA complied with the PIIA for
fiscal year (FY) 2023.
Based on the results of our performance audit procedures, we have met our audit objective.
We determined that SBA was not compliant with PIIA due to the following:
• SBA did not publish improper and unknown payment estimates within the FY 2023
Agency Financial Report (AFR) and accompanying materials for the Restaurant
Revitalization Fund (RRF), Shuttered Venues Operator Grant (SVOG), and the
payments for covered loans in the 7(a) and 504 loan guaranty programs under the Debt
Relief Program. As a result, these programs and activities did not comply with the
requirement to report improper and unknown payment rate estimates of less than 10
percent. Further, SBA did not publish corrective action plans and reduction targets for
the payments for covered loans in the 7(a) and 504 loan guaranty programs under the
Debt Relief Program.
• The sampling and estimation methodology plans (S&EMP) were not appropriate for the
Disaster Assistance Loans, COVID-Economic Injury Disaster Loans (COVID-EIDL), and
Economic Injury Disaster Loan Emergency Assistance Advance (EIDL Advance)
KPMG LLP, a Delaware limited liability partnership and a member firm of Page | 3
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
programs and activities. Also, the population of outlays used for sampling and reporting
were not complete and accurate for the Disaster Assistance Loans, COVID-EIDL,
Paycheck Protection Program (PPP) loan forgiveness, and PPP loan guaranty
purchases. Further, SBA did not design and implement adequate sample review
procedures to produce reliable sample results that could be used to develop accurate
improper and unknown payment estimates for the COVID-EIDL, EIDL Advance, PPP
loan forgiveness, and PPP loan guaranty purchases programs. Consequently, SBA’s
improper payment and unknown payment rate estimates were not accurate or reliable
for the Disaster Assistance Loans, COVID-EIDL, EIDL Advance, PPP loan forgiveness,
and PPP loan guaranty purchases. These programs and activities did not comply with
the requirement to report improper and unknown payment rate estimates of less than 10
percent because of unreliable estimates.
• SBA did not publish effective corrective action plans for the Disaster Assistance Loans,
PPP loan forgiveness, and PPP loan guaranty purchases programs and activities.
• SBA did not demonstrate improvements to payment integrity for the 7(a) loan guaranty
approvals, 7(a) loan guaranty purchases, 504 Certified Development loan approvals,
Disaster Assistance Loans, and COVID-EIDL programs and activities as the improper
payment estimates increased between FYs 2022 and 2023.
See Table 1 for a summary of SBA’s compliance with the PIIA for FY 2023 for programs and
activities reported by SBA in the FY 2023 AFR or accompanying materials. As the payments for
covered loans in the 7(a) and 504 loan guaranty programs under the Debt Relief Program were
not reported by SBA in the FY 2023 AFR or accompanying materials, this program was not
included in Table 1.
Table 1. Summary of SBA’s PIIA Compliance
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
5a) Published
Payment and Unknown
Integrity Information
and Accompanying
to Meet the Reduction
Program or
Concluded from Risk
Improvements to
Activity1
Corrective Action Payment Estimate of
Payment Estimates
Materials on the
within the AFR Agency Website Assessment Assessment Plans Reduction Target Payment Integrity Target Less Than 10 Percent
7(a) Loan
Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant
Approvals
7(a) Loan
Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant
Purchases
504 Certified
Development Not Not Not
Compliant Compliant Compliant Compliant Compliant Compliant Compliant
Loan Applicable Applicable Compliant
Approvals
Disaster
Not Not Not Not Not Not
Assistance Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Compliant Compliant
Loans
COVID- Not Not Not Not Not Not Not Not
Compliant Compliant
Economic Applicable Applicable Compliant Applicable Applicable Compliant Applicable Compliant
1 Based on our evaluation of SBA’s reporting, we concluded the Congressional Grants Program was compliant with requirements
2a and 2b during Phase 1 of review.
Page | 4
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
5a) Published
Payment and Unknown
Integrity Information
and Accompanying
to Meet the Reduction
Program or
Concluded from Risk
Improvements to
Activity1
Corrective Action Payment Estimate of
Payment Estimates
Materials on the
within the AFR Agency Website Assessment Assessment Plans Reduction Target Payment Integrity Target Less Than 10 Percent
Injury Disaster
Loan (COVID-
EIDL)
Economic
Injury Disaster
Loan
Not Not Not Not Not Not Not Not
Emergency Compliant Compliant
Applicable Applicable Compliant Applicable Applicable Compliant Applicable Compliant
Assistance
(EIDL
Advance)
Paycheck
Protection
Not Not Not Not Not Not
Program (PPP) Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Applicable Compliant
Loan
Forgiveness
Paycheck
Protection
Not Not Not Not Not Not
Program (PPP) Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Applicable Compliant
Loan Guaranty
Purchases
Restaurant
Not Not Not Not Not Not Not Not Not Not
Revitalization
Compliant Compliant Applicable Applicable Compliant Applicable Applicable Applicable Applicable Compliant
Fund (RRF)2
Shuttered
Venues Not Not Not Not Not Not Not Not Not Not
Operator Compliant Compliant Applicable Applicable Compliant Applicable Applicable Applicable Applicable Compliant
Grant (SVOG)2
The compliance requirements 2a and 2b are not applicable for programs and activities in the
second of two review phases for improper and unknown payments reporting (i.e., Phase 2) as
defined by the Office of Management and Budget (OMB) Memorandum M-21-19, Transmittal of
Appendix C to OMB Circular No. A-123, Requirements for Payment Integrity Improvement
(OMB Memorandum M-21-19). We found that the programs and activities included in Table 1
were in Phase 2 of review. Therefore, the compliance requirements 2a and 2b are not
applicable for these programs and activities. However, SBA was compliant with requirements 2a
and 2b as a risk assessment was conducted and adequately concluded on for the
Congressional Grants program.
The compliance requirement 5b is not applicable for the PPP loan forgiveness, PPP loan
guaranty purchases, RRF, and SVOG programs and activities because the improper and
unknown payment rate estimates were not reported in the prior fiscal year for these programs
and activities.
The compliance requirements 4, 5a, and 5c are not applicable for the COVID-EIDL, EIDL
Advance, RRF, and SVOG programs and activities because payments for these programs
ended as of the FY 2023 reporting period.
2 Based on our evaluation of SBA’s reporting, we concluded these programs were not appropriately assessed by SBA during Phase
2 of review.
Page | 5
Our findings, identified internal control deficiencies, and related recommendations are detailed
in Section IV.
We caution that projecting the results of our performance audit, as described above, to future
periods is subject to the risks that controls may become inadequate due to changes in
conditions or compliance with controls may deteriorate.
SBA’s response to the findings identified in our performance audit is presented in Appendix I.
SBA’s response was not subjected to the auditing procedures applied in this performance audit
and, accordingly, we are unable to determine if management’s response provides a reasonable
basis for our findings and conclusions based on our audit objective.
This report is intended solely for the use of the U.S. Small Business Administration and
Inspector General, Comptroller General, the Office of Management and Budget, and relevant
congressional committees; and is not intended to be and should not be relied upon by anyone
other than these specified parties.
May 15, 2024
Page | 6
I. BACKGROUND
The Payment Integrity Information Act of 2019 (PIIA) Public Law (P.L.) 116-117 repealed the
Improper Payments Elimination and Recovery Act of 2010 (IPERA) P.L. 111-204 (and other
laws) but set forth similar improper payment reporting requirements, including an annual
compliance report by Inspectors General.
PIIA requires an annual compliance report by an agency’s Inspector General and defines what
constitutes compliance with the requirements. An agency has met the PIIA compliance
requirements if they:
• published improper payments information within an agency financial report (AFR) or
performance and accountability report (PAR) for the fiscal year ended September 30,
2023, and posted that report and any accompanying materials required by OMB on the
agency website;
• conducted a program specific risk assessment for each program that conforms with
section 3352(a) of PIIA (if required);
• published improper payment estimates for all programs identified as susceptible to
significant improper payments under its risk assessment under section 3352(a) of PIIA
(if required);
• published programmatic corrective action plans under section 3352(d) of PIIA in the
AFR or PAR or the accompanying materials (if required);
• published reduction targets under section 3352(d) of PIIA, developed a plan to meet
the reduction targets, and demonstrated improvements for each program assessed to
be at risk and estimated for improper payments (if required and applicable); and
• reported a gross improper payment rate of less than 10 percent for each program and
activity for which an improper payment estimate was published under section 3352(c)
of PIIA.
If an agency does not meet one or more of the six requirements above, then it is not compliant
under PIIA.
On March 5, 2021, OMB issued Memorandum M-21-19, Transmittal of Appendix C to OMB
Circular No. A-123, Requirements for Payment Integrity Improvement (OMB Memorandum M-
21-19), as updated implementation guidance to federal agencies. OMB Memorandum M-21-19
requires agencies to identify susceptible programs with an improper payment risk assessment,
report improper payment estimates, identify root causes of the improper payments, develop,
implement, and monitor corrective actions, and recapture improper payments identified.
We performed our fiscal year (FY) 2023 compliance review using the requirements set forth in
OMB Memorandum M-21-19, OMB Circular No. A-136, Financial Reporting Requirements dated
May 19, 2023, OMB Annual Data Call Instructions, OMB Payment Integrity Question and
Answer Platform, and the Council of the Inspectors General on Integrity and Efficiency (CIGIE)
Guidance for Payment Integrity Information Act Compliance Reviews.
Page | 7
II. OBJECTIVE, SCOPE, AND METHODOLOGY
Objective
We conducted this performance audit to determine whether SBA complied with the PIIA for FY
2023.
Scope
The scope of our performance audit was SBA’s FY 2023 improper payments and reporting data
in the payment integrity section of the agency’s FY 2023 AFR and any accompanying materials.
The accompanying materials to the AFR are the payment integrity information published on
paymentaccuracy.gov.
Methodology
During our planning and testing phases, we performed the following to achieve our objective:
• interviewed staff from SBA’s Offices of Performance, Planning, and the Chief Financial
Officer and Capital Access that performed the improper payment reviews;
• collected and inspected SBA provided documentation and evidence, and
• participated in process and control walkthroughs with SBA staff responsible for the
programs identified as susceptible to significant improper payments.
Our detailed procedures consisted of, but were not limited to, the following:
• obtained an understanding of SBA’s improper payments reporting process and relevant
controls through inquiries with management;
• reviewed SBA’s policies and procedures over the improper payments reporting process;
• reviewed management’s risk assessment for agency programs identified as susceptible
to significant improper payments;
• reviewed related legislation for significant changes or increases in funding levels for
each program;
• reviewed and evaluated the statistically determined improper payment and unknown
payment estimates for each program deemed susceptible to improper payments in
consultation with a statistician;
• reviewed and evaluated the population of outlays for each program for completeness
and accuracy;
• reviewed and evaluated SBA’s payment integrity section in the AFR and accompanying
materials for completeness and accuracy;
• evaluated the corrective actions published and determined whether they focus on the
true root cause, and were implemented;
• evaluated the root cause category classifications and determined whether SBA
accurately classified the true root causes of improper payments, and
• obtained OMB waivers/exemptions for improper payments reporting (if applicable).
We used the CIGIE Guidance for Payment Integrity Information Act Compliance Reviews, as it
provides guidance regarding the fieldwork and reporting related to the performance audit
objective.
Page | 8
We obtained sufficient and appropriate evidence to provide a reasonable basis for our
conclusions related to the audit objective.
III. RESULTS AND CONCLUSIONS
We determined SBA was not compliant under PIIA based on our audit procedures performed.
See below for additional details of our results.
Requirement 1a – Determine if SBA published payment integrity information within the AFR for
the fiscal year ended September 30, 2023.
• Not Compliant. SBA did not publish payment integrity information in its FY 2023 AFR for
the Restaurant Revitalization Fund (RRF), Shuttered Venues Operator Grant (SVOG),
and the payments for covered loans in the 7(a) and 504 loan guaranty programs under
the Debt Relief Program.
Requirement 1b – Determine if SBA posted the AFR and any accompanying materials required
by OMB on the agency website.
• Not Compliant. SBA did not publish payment integrity information in the AFR or any
accompanying materials for the RRF, SVOG, and the payments for covered loans in the
7(a) and 504 loan guaranty programs under the Debt Relief Program on the agency’s
website.
Requirement 2a – Determine if SBA conducted a program specific risk assessment for each
program with annual outlays greater than $10 million at least once in the last three years.
• Compliant. SBA performed a risk assessment for the Congressional Grants program in
FY 2023. In accordance with OMB Memorandum M-21-19, during FY 2022, SBA
conducted risk assessments for all other programs with annual outlays greater than
$10 million at least once every three years, or earlier if a program experiences a
significant change in legislation or a significant increase in funding level.
Requirement 2b – Determine if SBA adequately concluded whether the program is likely to
make improper payments and unknown payments above or below the statutory threshold.
• Compliant. SBA adequately concluded the Congressional Grants program was not likely
to make improper payments and unknown payments above or below the statutory
threshold.
Requirement 3 – Determine if SBA published improper payment and unknown payment
estimates for all programs identified as susceptible to significant improper payments and
unknown payments in the accompanying materials to the AFR.
• Not Compliant. SBA did not implement adequate sampling and estimation methodology
plans that are statistically acceptable to produce accurate improper and unknown
payment estimates that are representative of the Disaster Assistance Loans, COVID-
Economic Injury Disaster Loans (COVID-EIDL), and Economic Injury Disaster Loan
Emergency Assistance Advance (EIDL Advance) programs.
Page | 9
In addition, SBA did not design and implement adequate review procedures over the
documentation of the sample results used to produce the programs’ improper and
unknown payment estimates to ensure that the procedures could be reperformed and
the results independently validated for the COVID-EIDL, EIDL Advance, PPP loan
forgiveness, and PPP loan guaranty purchases programs and activities. The review of
key eligibility requirements for these programs and activities was not adequately
documented and maintained. The review procedures did not consistently verify whether
the original PPP loan amount that was approved, paid, and ultimately purchased, was
accurate for the PPP loan guaranty purchases activity. Also, the interest portion for each
PPP loan forgiveness and PPP loan guaranty purchases sample payment was not
tested for accuracy as part of the review procedures for the activities.
The population of outlays reported in the AFR and accompanying materials and
subjected to sampling were not reconciled to the general ledger for the Disaster
Assistance Loans and COVID-EIDL to support completeness. Consequently, certain
transactions were improperly omitted from the population and excluded from SBA’s
review procedures. The unreconciled populations resulted in incomplete sample
selection which ultimately increases the risk of inaccurate and unreliable improper
payment estimates.
The populations of outlays subjected to sampling, testing, and reporting were not
complete for the PPP loan forgiveness and PPP loan guaranty purchases activities. The
populations excluded significant amounts of outlays that occurred prior to FY 2023 for
these activities. In prior years, SBA did not report improper and unknown payment
estimates for these activities to ensure compliance with PIIA and excluded these
payments in the FY 2023 populations. As such, improper payments related to significant
amounts of outlays for the PPP loan forgiveness and PPP loan guaranty purchases
activities remain untested and unreported.
SBA did not report improper and unknown payment estimates for the RRF, SVOG, and
the payments for covered loans in the 7(a) and 504 loan guaranty programs under the
Debt Relief Program. In prior years, SBA did not adequately perform risk assessments
for these programs to ensure PIIA compliance. Also, SBA did not adequately perform
their responsibility to review the criteria for reporting to ensure compliance for these
programs in FY 2023. Although SBA determined the RRF and SVOG programs were
susceptible to significant improper payments, SBA did not publish improper payment
information for these programs in its FY 2023 reporting. In October 2023, OMB
requested SBA to conduct further analysis on the estimation and methodology related to
the RRF and SVOG programs to ensure compliance with PIIA which resulted in the
exclusion of RRF and SVOG improper payment information as part of SBA’s FY 2023
reporting.
Requirement 4 – Determine if SBA published corrective action plans for each program for which
an estimate above the statutory threshold was published in the accompanying materials to the
AFR.
• Not Compliant. SBA did not publish corrective actions for the payments for covered
loans in the 7(a) and 504 loan guaranty programs under the Debt Relief Program.
Page | 10
The published corrective action plans for the PPP loan forgiveness and PPP loan
guaranty purchases activities were not effective as they did not adequately address the
true root causes of unknown payments. Specifically, the unknown payment rates were a
result of lenders not providing complete documentation to enable SBA to determine
whether the sample of payments were proper or improper for PPP loan forgiveness and
PPP loan guaranty purchases activities. However, SBA did not provide a corrective
action plan that would be effective in reducing the improper and unknown payment rates.
Also, the published corrective action plans for the Disaster Assistance Loans program
were not effective as they did not adequately address the true root causes of improper
payments. SBA did not provide the specific root causes for each Disaster Assistance
Loans improper payment sample. As a result, the corrective action plans published were
not focused on the true causes of improper payments.
Requirement 5a – Determine if SBA published improper payment and unknown payment
reduction targets for each program for which an estimate above the statutory threshold was
published in the accompanying materials to the AFR.
• Not Compliant. SBA did not publish reduction targets for the payments for covered loans
in the 7(a) and 504 loan guaranty programs under the Debt Relief Program.
Requirement 5b – Determine if SBA demonstrated improvements to payment integrity or
reached a tolerable improper payment and unknown payment rate.
• Not Compliant. SBA did not demonstrate improvements to payment integrity for 7(a) loan
guaranty approvals, 7(a) loan guaranty purchases, 504 Certified Development loan
approvals, Disaster Assistance Loans, and COVID-EIDL as the improper payment
estimates increased between FYs 2022 and 2023.
Requirement 5c – Determine if SBA developed a plan to meet the improper payment and
unknown payment reduction target.
• Not Compliant. SBA did not develop improper payment and unknown payment reduction
targets and a plan to meet reduction targets for the payments for covered loans in the
7(a) and 504 loan guaranty programs under the Debt Relief Program.
Requirement 6 – Determine if SBA reported an improper payment and unknown payment rate
estimate of less than 10 percent for each program for which an improper payment estimate was
published in the accompanying materials to the AFR.
• Not Compliant. The improper and unknown payment rate estimates were not reliable or
accurate for the Disaster Assistance Loans, COVID-EIDL, EIDL Advance, PPP loan
forgiveness, and PPP loan guaranty purchases programs and activities. SBA also
published improper payment and unknown payment rate estimates greater than 10
percent for the PPP loan forgiveness and PPP loan guaranty purchases activities.
Moreover, SBA did not report improper and unknown payment rate estimates for the
RRF, SVOG, and the payments for covered loans in the 7(a) and 504 loan guaranty
programs under the Debt Relief Program.
Page | 11
Our findings identified internal control deficiencies, and related recommendations for each
requirement are detailed in Section IV below.
IV. FINDINGS
See Section III. RESULTS AND CONCLUSIONS (above). Refer to Section IV.A and IV.B for
details on the identified internal control deficiencies, and related recommendations.
A. DEFICIENCIES IN INTERNAL CONTROL
In planning and performing our performance audit of SBA’s FY 2023 compliance with PIIA
reporting, we considered internal controls that were relevant to our audit objective by obtaining
an understanding of those controls and assessing control risk for the purposes of achieving our
objective.
The objective of our audit was not to provide assurance on internal controls; therefore, we did
not express an opinion on internal controls. Our consideration of SBA’s internal controls relevant
to our audit objective would not necessarily disclose all deficiencies that might be significant
within the context of the audit objective.
As a result of our assessment over internal controls relevant to the audit objective and our
compliance test work, we identified the following deficiencies in internal control:
Program or Activity Control Deficiencies
PPP Loan Forgiveness 1. The procedures implemented to obtain sufficient documentation from
lenders to determine whether a significant number of samples selected
PPP Loan Guaranty were proper or improper as the improper and unknown payment rate
Purchases estimates exceed the statutory compliance threshold of 10% were not
effective.
7(a) Loan Guaranty 2. The preventative controls implemented to reduce improper payments
Approvals were not effective as the gross improper payment and unknown payment
rate increased from FY 2022 to FY 2023.
7(a) Loan Guaranty
Purchases
504 Certified
Development Loan
Approvals
Disaster Assistance
Loans
COVID-EIDL
Disaster Assistance 3. The population of outlays reported in the AFR and accompanying
Loans materials and subjected to sampling, were not reconciled to the general
ledger and were not complete.
COVID-EIDL
Page | 12
Program or Activity Control Deficiencies
Disaster Assistance 4. The sampling and estimation methodology plans did not provide a
Loans statistically acceptable and accurate estimate of improper and unknown
payments.
COVID-EIDL
EIDL Advance
7(a) Loan Guaranty 5. The sampling and estimation methodology plan, as implemented by the
Approvals statisticians, had errors for the improper payment amounts and related
statistical measures of precision and a management review was not
7(a) Loan Guaranty performed to ensure the results were appropriate.
Purchases
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
PPP Loan Forgiveness 6. The population of outlays subjected to sampling, testing, and reporting
were not complete and accurate as management did not consistently
PPP Loan Guaranty determine and review a significant number of outlays prior to the FY 2023
Purchases reporting period.
COVID-EIDL 7. The management review process over sample testing was not adequate
to ensure that key eligibility requirements and the relevant transaction-
EIDL Advance specific risks of each sample were addressed and documented to
determine whether the payments were improper.
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
Payments for Covered 8. The risk assessment was not reperformed and documented under the
Loans in the 7(a) and significantly revised risk assessment methodology.
504 Loan Guaranty
Programs under the
Debt Relief Program
Restaurant 9. Management did not effectively review the criteria established for PIIA
Revitalization Fund reporting and excluded the improper and unknown payment estimates for
(RRF) the RRF, SVOG, and payments for covered loans in the 7(a) and 504
loan guaranty programs under the Debt Relief Program programs and
Shuttered Venue activities.
Operators Grant
Program (SVOG)
Payments for Covered
Loans in the 7(a) and
504 Loan Guaranty
Programs under the
Debt Relief Program
Page | 13
Program or Activity Control Deficiencies
PPP Loan Guaranty 10. The process used by management to test samples in accordance with
Purchases PIIA requirements was not appropriate. Specifically, the review
procedures did not consistently verify whether the original PPP loan
amount that was approved, paid, and ultimately purchased, was accurate.
PPP Loan Forgiveness 11. The process used by management to test samples in accordance with
PIIA requirements was not appropriate. Specifically, the interest portion of
PPP Loan Guaranty each sample payment was not tested for accuracy as part of the review
Purchases procedures.
PPP Loan Forgiveness 12. There were not adequate review controls designed and implemented to
ensure the proper and unknown payment amounts and rates presented in
the AFR and in the accompanying materials were accurate.
7(a) Loan Guaranty 13. There were not adequate review controls designed and implemented to
Approvals ensure the margins of error reported in the accompanying materials were
accurate.
7(a) Loan Guaranty
Purchases
504 Certified
Development Loan
Approvals
Disaster Assistance
Loans
COVID-EIDL
EIDL Advance
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
Various Programs 14. The review controls designed and implemented to ensure the disclosures
within the AFR and accompanying materials were complete regarding the
risk assessments reperformed and their results due to the updated risk
assessment methodology were not adequate. Specifically, the disclosures
were not updated for the results of the risk assessments for the RRF and
SVOG programs.
Disaster Assistance 15. The review controls designed and implemented to ensure the root causes
Loans of the sample of improper payments published in the AFR were accurate
were not adequate.
COVID-EIDL
EIDL Advance
Page | 14
Program or Activity Control Deficiencies
Disaster Assistance 16. The process designed and implemented to ensure that corrective action
Loans plans developed, published, and addressed the true root causes of the
improper and unknown payments identified was not adequate.
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
Page | 15
B. RECOMMENDATIONS
We recommend the Administrator coordinate with the Chief Financial Officer to:
1. Continue to provide training and collaborate with program office staff to ensure the timely
and complete reconciliation of the population of transactions used for estimating
improper payments to the general ledger is performed, as needed. (Deficiency 3)
2. Proactively seek and obtain guidance from OMB in the first year of a new program’s
implementation and develop a plan to ensure compliance with PIIA reporting
requirements, as needed. (Deficiency 6 and 9)
3. Enhance existing procedures using the framework in the Government Accountability
Office’s Green Book to design and implement robust internal and quality control
processes to ensure complete and accurate reporting of annual improper payment
results and formalized risk assessment processes to ensure all programs and activities
are considered sufficiently to meet PIIA reporting objectives. (Deficiency 8, 9 ,12, 13,
14, and 15)
We recommend the Administrator coordinate with the Associate Administrator of the Office of
Capital Access to:
4. Design and implement enforceable actions and controls to hold lenders accountable for
not providing all documentation requested for loan samples in a timely manner.
(Deficiency 1)
5. Formally document and implement additional preventative and monitoring controls to
determine the eligibility of loans prior to loan approval and payments and loan guaranty
purchases. (Deficiency 2)
6. Collaborate with the responsible staff involved in the payment integrity reporting process
to ensure timely and complete reconciliations are performed on the populations subject
to sampling for improper payment reviews. (Deficiency 3)
7. Exercise effective management review controls over the statistician’s work product by
verifying that the documentation of the sampling and estimation methodology plans
comprehensively outlines the details of the implemented sampling and extrapolation
methodology, while maintaining statistical validity. (Deficiency 4 and 5)
8. Design and implement effective communication and review processes with responsible
staff involved in the payment integrity reporting process to ensure compliance for the
reporting of new programs and activities. (Deficiency 6)
9. Design and document adequate review procedures to ensure that the results of the
sample meet the PIIA objectives. (Deficiency 7, 10, and 11)
10. Design and implement a formal review process to ensure corrective actions plans
developed, implemented, and published are adequately addressing the true root causes
of improper and unknown payments. (Deficiency 16)
Page | 16
V. APPENDIX I: MANAGEMENT’S RESPONSE TO REPORT
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, D.C. 20416
DATE: May 10, 2024
TO: Hannibal M. Ware, Inspector General
FROM: Katherine Aaby, Associate Administrator for Performance, Planning, and Chief
Financial Officer, Office of Performance, Planning, & the Chief Financial Officer
Kathryn Frost, Associate Administrator, Office of Capital Access
SUBJECT: Response to Audit: Performance Audit of the U.S. Small Business
Administration’s Fiscal Year 2023 Compliance with the Payment Integrity
Information Act of 2019
The Small Business Administration (SBA) appreciates the opportunity to review and respond to
the draft Performance Audit of the U.S. Small Business Administration’s Fiscal Year 2023
Compliance with the Payment Integrity Information Act of 2019 (PIIA).
SBA is committed to reducing the dollar amount of improper payments, ensuring program
integrity, and continuing to implement effective risk management procedures in accordance with
improper payment legislation3, as well as guidance prescribed in Office of Management and
Budget Memorandum M-21-19, Appendix C to Circular A-123, Requirements for Payment
Integrity Improvement.
SBA concurs with the Recommendations made in this audit report and is providing the following
comments in response to those recommendations.
Recommendation 1. We recommend the Administrator coordinate with the Chief Financial
Officer to continue to provide training and collaborate with program office staff to ensure the
timely and complete reconciliation of the population of transactions used for estimating improper
payments to the general ledger is performed, as needed.
Agency Response. OPPCFO will continue to provide training and collaborate with program
office staff to ensure timely and complete reconciliation of the population of transactions used
for estimating improper payments to the general ledger. Additionally, OPPCFO will be
conducting population reconciliation quality control reviews for select programs.
3
Payment Integrity Information Act (2019)
Page | 17
Recommendation 2. We recommend the Administrator coordinate with the Chief Financial
Officer to proactively seek and obtain guidance from OMB in the first year of a new program’s
implementation and develop a plan to ensure compliance with PIIA reporting requirements, as
needed.
Agency Response. OPPCFO will continue to work with OMB to obtain guidance on the
application of OMB Circular A-123, Appendix C for first year programs to ensure conformance
and compliance with PIIA reporting requirements.
Recommendation 3. We recommend the Administrator coordinate with the Chief Financial
Officer to enhance existing procedures using the framework in GAO’s Green Book to design and
implement robust internal and quality control processes to ensure complete and accurate
reporting of annual improper payment results and formalized risk assessment processes to ensure
all programs and activities are considered sufficiently to meet PIIA reporting objectives.
Agency Response. OPPCFO will continue enhancing existing procedures using the framework
in GAO’s Green Book to design and implement robust internal and quality control processes to
ensure complete and accurate reporting of annual improper payment results and formalized risk
assessment processes to ensure all programs and activities are considered sufficiently to meet
PIIA reporting objectives. Specifically, OPPCFO will review and report improper payment data
for total programmatic outlays related to the Restaurant Revitalization Fund (RRF) program and
the Shuttered Venue Operators Grant (SVOG) program, and will continue oversight and review
efforts over improper payment data reported in the Agency Financial Report and the annual
OMB improper payment data-call.
Recommendation 4. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to design and implement enforceable actions and
controls to hold lenders accountable for not providing all documentation requested for loan
samples in a timely manner.
Agency Response. The Office of Capital Access (OCA) already has enforceable actions it can
employ to hold lenders accountable for not providing all documentation requested for loan
samples in a timely manner. OCA will improve its controls to ensure these actions are exercised
to ensure lenders provide all necessary documentation in a timely manner.
Recommendation 5. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to formally document and implement additional
preventative and monitoring controls to determine the eligibility of loans prior to loan approval
and payments and loan guaranty purchases.
Agency Response. OCA designed and implemented state-of-the-art controls to determine
eligibility for all 7(a) and 504 loans prior to loan approval in August 2023. SBA also has very
good controls prior to guaranty purchase. For PPP loans, SBA will continue to formally
document and implement additional preventative and monitoring controls to determine the
eligibility of loans prior to loan approval and payments and loan guaranty purchases.
Page | 18
Recommendation 6. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to collaborate with the responsible staff involved
in the payment integrity reporting process to ensure timely and complete reconciliations are
performed on the populations subject to sampling for improper payment reviews.
Agency Response. OCA will collaborate with responsible staff involved in the payment
integrity process to ensure timely and complete reconciliations are performed on the populations
subject to sampling for improper payment reviews.
Recommendation 7. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to exercise effective management review controls
over the statistician’s work product by verifying that the documentation of the sampling and
estimation methodology plans comprehensively outlines the details of the implemented sampling
and extrapolation methodology, while maintaining statistical validity.
Agency Response. OCA will exercise effective management review controls over the
statistician’s work product by verifying that the documentation of the sampling and estimation
methodology plans comprehensively outlines the details of the implemented sampling and
extrapolation methodology, while maintaining statistical validity.
Recommendation 8. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to design and implement effective communication
and review processes with responsible staff involved in the payment integrity reporting process
to ensure compliance for the reporting of new programs and activities.
Agency Response. OCA will design and implement effective communication and review
processes with responsible staff involved in the payment integrity reporting process to ensure
compliance for the reporting of new programs and activities.
Recommendation 9. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to design and document adequate review
procedures to ensure that the results of the sample meet the PIIA objectives.
Agency Response. OCA will design and document adequate review procedures to ensure that
the results of the sample meet the PIIA objectives.
Recommendation 10. We recommend the Administrator coordinate with the Associate
Administrator of the Office of Capital Access to design and implement a formal review process
to ensure corrective actions plans developed, implemented, and published are adequately
addressing the true root causes of improper and unknown payments.
Agency Response. OCA will design and implement a formal review process to ensure
corrective actions plans developed, implemented, and published are adequately addressing the
true root causes of improper and unknown payments.
Page | 19
File and source
- File
- 24-16-fy2023-piia-compliance.pdf
- Size
- 533,335 bytes
- SHA-256
- c99eba18bd2eb1f00b2d4322557fd3c630bd2a27203eb8eb495a415729a842be
- Our copy
- 24-16-fy2023-piia-compliance.pdf
- Original
- No public link identified.