Independent Auditors’ Report on SBA’s Fiscal Year 2025 Compliance With the Payment Integrity Information Act of 2019 (Report 26-09)
Summary
A memorandum dated May 15, 2026 from William W. Kirk, Inspector General of the U.S. Small Business Administration, to Administrator Kelly Loeffler, transmitting the Independent Auditors' Report on SBA's Fiscal Year 2025 compliance with the Payment Integrity Information Act of 2019 (Report 26-09). The audit, performed by KPMG LLP, found SBA not compliant with the Act and OMB guidance. Among the listed failures, SBA did not publish complete and accurate root causes and tolerable rates for all programs, did not perform updated risk assessments, and did not publish improper and unknown payment rate estimates less than 10 percent for PPP loan forgiveness, PPP loan guaranty purchases and the Shuttered Venue Operators Grant program. The memorandum states that SBA concurred with the recommendations, and the report sets out each recommendation with SBA's response.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Independent Auditors’ Report on SBA’s Fiscal Year 2025 Compliance With the Payment Integrity Information Act of 2019 (Report 26-09).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/26-09-fy2025-piia-compliance-33c161ba3e/
, SHA-256 01a7751ec2003cbbc64519390bb21d87b6246471e2f87cfdebcb9e0c0795df71.Full text
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
DATE: May 15, 2026
TO: Kelly Loeffler
Administrator
FROM: William W. Kirk
Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Fiscal Year 2025 Compliance With the
Payment Integrity Information Act of 2019 (Report 26-09)
This independent auditors’ report on the U.S. Small Business Administration’s (SBA) improper
payment reporting is required by the Payment Integrity Information Act of 2019. We contracted
with the independent certified public accounting firm KPMG LLP to conduct a performance audit
of SBA’s fiscal year (FY) 2025 compliance with the Act. The auditor was engaged to review the
payment integrity section of SBA’s Agency Financial Report Fiscal Year 2025 and accompanying
materials to determine whether the agency complied with the reporting requirements under the
Act.
KPMG was engaged to conduct the audit in accordance with Government Auditing Standards
issued by the Comptroller General of the United States and applicable American Institute of
Certified Public Accountants standards. The audit also complied with the Council of the
Inspectors General on Integrity and Efficiency Guidance for Payment Integrity Information Act
Compliance Reviews.
In the report, KPMG auditors found SBA was not compliant with reporting requirements under
the Act and Office of Management and Budget (OMB) guidance. Specifically, SBA is not
compliant with the Act because it did not:
• Publish complete and accurate root causes and tolerable rates for all applicable
programs, including Section 1112 payments and disaster assistance loans, and ensure
they agreed with accompanying materials and supporting documentation for FY 2025.
• Perform or document updated required risk assessments for all applicable programs in
FY 2025.
• Design and implement adequate review procedures to produce reliable sample results
that supported accurate improper and unknown payment estimates for Paycheck
Protection Program (PPP) loan guaranty purchases.
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
• Provide sufficient documentation to support corrective action plans or ensure those
plans aligned with root causes for PPP loan guaranty purchases.
• Ensure published root causes and reduction targets were accurately disclosed, published,
and consistent with accompanying materials for all applicable programs, including 7(a)
loan guaranty approvals, 7(a) loan guaranty purchases, 504 Certified Development
Company loan approvals, disaster assistance loans, PPP loan forgiveness, and PPP loan
guaranty purchases, and Section 1112 payments.
• Improve improper and unknown payment rates or meet established reduction targets for
7(a) loan guaranty approvals, 504 Certified Development Company loan approvals,
disaster assistance loans, PPP loan forgiveness, and PPP loan guaranty purchases.
• Submit all required quarterly information to OMB for PPP loan forgiveness and PPP loan
guaranty purchases.
• Publish improper payment and unknown payment rate estimates less than 10 percent for
the PPP loan forgiveness, PPP loan guaranty purchases, and Shuttered Venue Operators
Grant programs and include the required program integrity proposals in the
congressional budget justification for the PPP loan forgiveness and PPP loan guaranty
purchases programs.
SBA concurred with the recommendations and indicated that it is committed to reducing the
dollar amount of improper payments, ensuring program integrity, and continuing to implement
effective risk management procedures in accordance with improper payment legislation, as well
as guidance prescribed in OMB Memorandum M-21-19, Appendix C to OMB Circular A-123,
Requirements for Payment Integrity Improvement.
In connection with the contract, we reviewed KPMG’s report and related audit documentation
and spoke with KPMG staff. Our review, as differentiated from an audit in accordance with the
Government Auditing Standards, was not intended to enable us to express, and we do not
express, opinions on SBA’s compliance with the Act or internal controls over improper payment
reporting. KPMG is responsible for the attached auditors’ report dated May 15, 2026 and the
conclusions expressed.
Our oversight protocols include evaluation of major work products, attendance at critical
meetings, review of significant findings, and examination of related evidential matter. Our review
disclosed no instances where KPMG did not comply in all material respects with Government
Auditing Standards.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or
your staff have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586
2
cc: Bill Briggs, Deputy Administrator, Office of the Administrator
Wesley Coopersmith, Chief of Staff, Office of the Administrator
Nathan Davis, Chief Financial Officer and Chief Risk Officer, Office of Performance, Planning,
and the Chief Financial Officer
Alex H. Wilson, Acting Deputy Chief Financial Officer, Office of Performance, Planning, and
the Chief Financial Officer
Anna Maria Calcagno, Director, Office of Strategic Management and Enterprise Integrity
Thomas Kimsey, Associate Administrator, Office of Capital Access
Chris Stallings, Associate Administrator, Office of Disaster Recovery and Resilience
Wendell Davis, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Attachment
3
Performance Audit of the U.S. Small Business Administration’s
Fiscal Year 2025 Compliance with the Payment Integrity
Information Act of 2019
Prepared for: U.S. Small Business Administration, Office of Inspector General
Date: May 15, 2026
KPMG LLP
1801 K Street NW, Suite 12000
Washington DC 20006
Table of Contents
Auditor’s Report.....................................................................................................................................3
I. Background ..................................................................................................................................6
II. Objective, Scope, and Methodology .............................................................................................7
III. Results and Conclusions ..............................................................................................................9
IV. Findings ......................................................................................................................................11
A. Deficiencies in Internal Control .............................................................................................11
B. Recommendations ................................................................................................................14
V. Appendix I: Management’s Response to Report ........................................................................ 15
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
Administrator
Inspector General
U.S. Small Business Administration
This report presents the results of our performance audit related to the U.S. Small Business
Administration’s (SBA’s) compliance with the requirements contained in the Payment Integrity
Information Act of 2019 (PIIA), section 3351(2). We performed our work between November 20,
2025, and May 15, 2026, and our results are as of May 15, 2026.
We conducted this performance audit in accordance with the standards applicable to performance
audits contained in the Generally Accepted Government Auditing Standards (GAGAS) issued by the
Comptroller General of the United States. Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objective. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objective.
In addition to GAGAS, we conducted this performance audit in accordance with the Statements on
Standards for Consulting Services established by the American Institute of Certified Public
Accountants (AICPA). This performance audit did not constitute an audit of SBA’s financial
statements, or an attestation level report as defined under GAGAS and AICPA standards for
attestation engagements.
We used the Council of the Inspectors General on Integrity and Efficiency Guidance (CIGIE) for
Payment Integrity Information Act Compliance Reviews dated October 19, 2023, which provides
guidance regarding the fieldwork and reporting related to the performance audit objective. The
objective of our performance audit was to determine whether SBA complied with the PIIA for fiscal
year (FY) 2025.
Based on the results of our performance audit procedures, we have met our audit objective.
We determined that SBA was not compliant with PIIA. See Table 1 for a summary of SBA’s
compliance with the PIIA for FY 2025 for programs and activities reported by SBA in the FY 2025
AFR and accompanying materials. See Section III. Results and Conclusions for our detailed findings.
KPMG LLP, a Delaware limited liability partnership, and its subsidiaries are part of
the KPMG global organization of independent member firms affiliated with KPMG
International Limited, a private English company limited by guarantee.
3
Table 1. Summary of SBA’s PIIA Compliance
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
and Accompanying 5a) Published Payment and Unknown
Integrity Information Concluded from Risk Corrective Action Improvements to to Meet the Reduction
Program or
Assessment Payment Estimates
Reduction Target
Materials on the Payment Estimate of
Activity
Plans Payment Integrity
within the AFR Agency Website Assessment Target Less Than 10 Percent
7(a) Loan
Not Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant
Approvals
7(a) Loan
Not Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant
Purchases
504 Certified
Development Not Not Not Not
Compliant Compliant Compliant Compliant Compliant Compliant
Loan Applicable Applicable Compliant Compliant
Approvals
Disaster
Not Not Not Not Not Not
Assistance Compliant Compliant Compliant Compliant
Compliant Applicable Applicable Compliant Compliant Compliant
Loans
Paycheck
Protection
Not Not Not Not Not Not
Program (PPP) Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Compliant Compliant
Loan
Forgiveness
Paycheck
Protection
Not Not Not Not Not Not Not Not
Program (PPP) Compliant Compliant
Applicable Applicable Compliant Compliant Compliant Compliant Compliant Compliant
Loan Guaranty
Purchases
Section 1112
Not Not Not Not Not Not Not
Payments Compliant Compliant Compliant
Compliant Applicable Applicable Applicable Applicable Applicable Applicable
Shuttered Venue
Not Not Not Not Not Not Not
Operators Grant Compliant Compliant Compliant
Applicable Applicable Applicable Applicable Applicable Applicable Compliant
(SVOG)
As presented in Table 1, we determined the following requirements to be Not Applicable for certain
programs:
• Compliance requirements 2a and 2b are not applicable for programs and activities in the
second of two review phases for improper and unknown payments reporting (i.e., Phase 2)
because the risk assessments performed indicated the programs were likely to make IPs and
UPs above the statutory threshold, as defined by the Office of Management and Budget
(OMB) Memorandum M-21-19, Transmittal of Appendix C to OMB Circular No. A-123,
Requirements for Payment Integrity Improvement (OMB Memorandum M-21-19). During our
testing, we found that the programs and activities included in Table 1 were in Phase 2 of
review. Additionally, we found that SBA did not perform and document updated risk
assessments for all applicable programs in FY2025. As a result, we could not determine
whether additional programs and activities should have been included in Table 1. We have
determined SBA to be non-compliant with this requirement. See Section III for further details.
• Compliance requirements for 4, 5a and 5c are not applicable for the Section 1112 payments
and SVOG program since payments for these programs ended prior to the FY 2025 reporting
period.
4
• Compliance requirement 5b is not applicable for the Section 1112 payments and SVOG
program because the improper and unknown payment rate estimates were not reported in the
prior fiscal year for these programs and activities.
Our results and conclusions are described in Section III. Further, our identified internal control
deficiencies and related recommendations are described in Section IV.
We caution that projecting the results of our performance audit, as described above, to future periods
is subject to the risks that controls may become inadequate due to changes in conditions or
compliance with controls may deteriorate.
SBA’s response to the findings identified in our performance audit is presented in Appendix I. SBA’s
response was not subjected to the auditing procedures applied in this performance audit and,
accordingly, we are unable to determine if management’s response provides a reasonable basis for
our findings and conclusions based on our audit objective.
This report is intended solely for the use of the U.S. Small Business Administration and Inspector
General, Comptroller General, the Office of Management and Budget, and relevant congressional
committees; and is not intended to be and should not be relied upon by anyone other than these
specified parties.
May 15, 2026
5
I. BACKGROUND
The Payment Integrity Information Act of 2019 (PIIA) Public Law (P.L.) 116-117 repealed the
Improper Payments Elimination and Recovery Act of 2010 (IPERA) P.L. 111-204 (and other laws) but
set forth similar improper payment reporting requirements, including an annual compliance report by
Inspectors General.
PIIA requires an annual compliance report by an agency’s Inspector General and defines what
constitutes compliance with the requirements. An agency has met the PIIA compliance requirements
if they:
• published improper payments information within an agency financial report (AFR) or
performance and accountability report (PAR) for the fiscal year ended September 30, 2025,
and posted that report and any accompanying materials required by OMB on the agency
website;
• conducted a program specific risk assessment for each program that conforms with section
3352(a) of PIIA (if required);
• published improper payment estimates for all programs identified as susceptible to
significant improper payments under its risk assessment under section 3352(a) of PIIA (if
required);
• published programmatic corrective action plans under section 3352(d) of PIIA in the AFR or
PAR or the accompanying materials (if required);
• published reduction targets under section 3352(d) of PIIA, developed a plan to meet the
reduction targets, and demonstrated improvements for each program assessed to be at risk
and estimated for improper payments (if required and applicable); and
• reported a gross improper payment rate of less than 10 percent for each program and
activity for which an improper payment estimate was published under section 3352(c) of
PIIA.
If an agency does not meet one or more of the six requirements above, then it is not compliant under
PIIA.
On March 5, 2021, OMB issued Memorandum M-21-19, Transmittal of Appendix C to OMB Circular
No. A-123, Requirements for Payment Integrity Improvement (OMB Memorandum M- 21-19), as
updated implementation guidance to federal agencies. OMB Memorandum M-21-19 requires
agencies to identify susceptible programs with an improper payment risk assessment, report
improper payment estimates, identify root causes of the improper payments, develop, implement,
and monitor corrective actions, and recapture improper payments identified.
We performed our fiscal year (FY) 2025 compliance review using the requirements set forth in OMB
Memorandum M-21-19, OMB Circular No. A-136, Financial Reporting Requirements dated May 19,
2023, OMB Annual Data Call Instructions, OMB Payment Integrity Question and Answer Platform,
and the Council of the Inspectors General on Integrity and Efficiency (CIGIE) Guidance for Payment
Integrity Information Act Compliance Reviews.
6
II. OBJECTIVE, SCOPE, AND METHODOLOGY
Objective
We conducted this performance audit to determine whether SBA complied with the PIIA for FY 2025.
Scope
The scope of our performance audit was SBA’s FY 2025 improper payments and reporting data in
the payment integrity section of the agency’s FY 2025 AFR and any accompanying materials. The
accompanying materials to the AFR are the payment integrity information published on
paymentaccuracy.gov.
Methodology
During our planning and testing phases, we performed the following to achieve our objective:
• interviewed agency staff from SBA’s Offices of Performance, Planning, and the Chief
Financial Officer, Capital Access, and Disaster Recovery and Resilience that performed the
improper payment reviews;
• collected and inspected documentation and evidence provided by SBA, and
• participated in the improper payments reporting process and internal control walkthroughs
with SBA staff responsible for the programs identified as susceptible to significant improper
payments.
Our detailed procedures consisted of, but were not limited to, the following:
• obtained an understanding of SBA’s improper payments reporting process and relevant
internal controls through inquiries with management;
• reviewed SBA’s policies and procedures over the improper payments reporting process;
• reviewed management’s risk assessment for agency programs identified as susceptible to
significant improper payments;
• reviewed related legislation for significant changes or increases in funding levels for each
program;
• reviewed and evaluated the statistically determined improper payment and unknown
payment estimates for each program deemed susceptible to improper payments in
consultation with a statistician;
• reviewed and evaluated the population of outlays for each program for completeness and
accuracy;
• reviewed and evaluated SBA’s payment integrity section in the AFR and accompanying
materials for completeness and accuracy;
• evaluated the corrective actions published and determined whether they focus on the true
root cause, and were implemented;
• evaluated the root cause category classifications and determined whether SBA accurately
classified the true root causes of improper payments, and
• obtained OMB waivers/exemptions for improper payments reporting (if applicable).
7
We used the CIGIE Guidance for Payment Integrity Information Act Compliance Reviews, which
provides guidance regarding the fieldwork and reporting related to the performance audit objective.
We obtained sufficient and appropriate evidence to provide a reasonable basis for our conclusions
related to the audit objective.
8
III. RESULTS AND CONCLUSIONS
We determined that the SBA was not compliant under PIIA based on our audit procedures
performed. See below for additional details of our results.
Requirement 1a – Determine if SBA published payment integrity information within the AFR for the
fiscal year ended September 30, 2025.
• Not Compliant. SBA did not appropriately disclose payment integrity information.
Specifically, for Section 1112 payments, the improper payment breakdown (i.e.
overpayments outside the agency control) disclosed within the FY 2025 AFR did not agree
to the accompanying materials and no root cause(s) were reported within the AFR. Further,
for the Disaster Assistance Loan program, the tolerable rates disclosed were not correct
because the AFR reflected FY 2026 tolerable rates and did not reflect the FY 2025 tolerable
rates and the corresponding supporting documentation.
Requirement 1b – Determine if SBA posted the AFR and any accompanying materials required by
OMB on the agency website.
• Compliant. SBA posted the AFR and accompanying materials on the agency’s website.
Requirement 2a – Determine if SBA conducted a program specific risk assessment for each program
with annual outlays greater than $10 million at least once in the last three years.
• Not Compliant. SBA did not perform and document updated risk assessments for all
applicable programs for FY2025.
Requirement 2b – Determine if SBA adequately concluded whether the program is likely to make
improper payments and unknown payments above or below the statutory threshold.
• Not Compliant. SBA did not perform and document updated risk assessments for all
applicable programs for FY2025.
Requirement 3 – Determine if SBA published improper payment and unknown payment estimates for
all programs identified as susceptible to significant improper payments and unknown payments in the
accompanying materials to the AFR.
• Not Compliant. SBA did not design and implement adequate review procedures over the
documentation of the sample results used to produce the programs’ improper and unknown
payment estimates to ensure that the procedures could be reperformed and the results
independently validated for the PPP Loan Guaranty Purchases program. Specifically, the
interest portion for each PPP Loan Guaranty Purchases sample payment was not tested for
accuracy as part of the review procedures for the activities.
Requirement 4 – Determine if SBA published corrective action plans for each program for which an
estimate above the statutory threshold was published in the accompanying materials to the AFR.
• Not Compliant. Management did not provide sufficient documentation to support the
execution of corrective actions reported in the AFR for the PPP Loan Guaranty Purchases
program.
9
Furthermore, for the 7(a) Loan Guaranty Purchases, Disaster Assistance Loans, and PPP
Loan Guaranty Purchases programs, the root causes disclosed in the AFR did not agree to
the root causes disclosed in the accompanying materials. Because the root causes were
not properly disclosed, the resulting corrective action plans did not fully align to the root
causes and address the program deficiencies.
Requirement 5a – Determine if SBA published improper payment and unknown payment reduction
targets for each program for which an estimate above the statutory threshold was published in the
accompanying materials to the AFR.
• Not Compliant. SBA did not accurately disclose the reduction targets in Table 1 of the AFR
for all applicable programs for FY 2026.
Requirement 5b – Determine if SBA demonstrated improvements to payment integrity or reached a
tolerable improper payment and unknown payment rate.
• Not Compliant. SBA did not improve the payment integrity for 7(a) Loan Guaranty
Approvals, 504 Certified Development Loan Approvals, and Disaster Assistance Loan
programs as evidenced by the increase in the improper and unknown payment estimates
between FYs 2024 and 2025. In addition, SBA did not meet the reduction targets
established for 7(a) Loan Guaranty Approvals, 504 Certified Development Loan Approvals,
Disaster Assistance Loans, PPP Loan Forgiveness, and PPP Loan Guaranty Purchases
activities.
Requirement 5c – Determine if SBA developed a plan to meet the improper payment and unknown
payment reduction target.
• Not Compliant. SBA did not submit the required quarterly scorecard information to the
Office of Management and Budget (OMB) for the PPP Loan Forgiveness and PPP Loan
Guaranty Purchases programs (designated as High Priority Programs). These submissions
are mandatory under PIIA reporting requirements because the scorecards contain the
corrective actions necessary to achieve established improper payment and unknown
payment reduction targets.
Requirement 6 – Determine if SBA reported an improper payment and unknown payment rate
estimate of less than 10 percent for each program for which an improper payment estimate was
published in the accompanying materials to the AFR.
• Not Compliant. SBA published improper payment and unknown payment rate estimates
greater than 10 percent for the PPP Loan Forgiveness, PPP Loan Guaranty Purchases and
Shuttered Venue Operators Grant (SVOG) programs and activities. Further, the PPP Loan
Forgiveness and PPP Loan Guaranty Purchases programs entered their second
consecutive year of non-compliance. We found that SBA did not include the required
program integrity proposals in their Congressional Budget Justification, which resulted in
non-compliance.
10
Our findings identified internal control deficiencies, and related recommendations for each
requirement are detailed in Section IV below.
IV. FINDINGS
See Section III. RESULTS AND CONCLUSIONS (above). Refer to Section IV.A and IV.B for details
on the identified internal control deficiencies, and related recommendations.
A. DEFICIENCIES IN INTERNAL CONTROL
In planning and performing our performance audit of SBA’s FY 2025 compliance with PIIA reporting,
we considered internal controls that were relevant to our audit objective by obtaining an
understanding of those controls and assessing control risk for the purposes of achieving our
objective.
The objective of our audit was not to provide assurance on internal controls; therefore, we did not
express an opinion on internal controls. Our consideration of SBA’s internal controls relevant to our
audit objective would not necessarily disclose all deficiencies that might be significant within the
context of the audit objective.
As a result of our assessment of internal controls relevant to the audit objective and our compliance
test work, we identified the following deficiencies in internal control:
Program or Activity Control Deficiencies
PPP Loan Forgiveness 1. The preventive controls implemented to reduce improper payments and
obtain sufficient documentation for PPP Loan Forgiveness, PPP Loan
PPP Loan Guaranty Guaranty Purchases, and SVOG programs and activities were not effective
Purchases because the improper and unknown payment rates reported exceed the
statutory compliance threshold of 10%. (NFR Condition 1)
SVOG
7(a) Loan Guaranty 2. The preventive controls implemented to reduce improper payments were not
Approvals effective because the gross improper payment and unknown payment rate
increased from FY 2024 to FY 2025. (NFR Condition 2)
504 Certified
Development Loan
Approvals
Disaster Assistance
Loans
11
Program or Activity Control Deficiencies
7(a) Loan Guaranty 3. The preventive controls to reduce improper payments were not effective
Approvals because the reduction targets established for FY 2025 were not met. (NFR
Condition 3)
504 Certified
Development Loan
Approvals
Disaster Assistance
Loans
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
Various programs 4. Updated program specific risk assessments were not performed and
documented in FY2025. (NFR Condition 4)
SVOG 5. The sampling and estimation methodology plan, as implemented by the
statisticians, had errors in the statistical measures of precision and a
management review was not performed to ensure the results were
appropriate. (NFR Condition 5)
PPP Loan Forgiveness 6. There were not adequate review controls designed and implemented to
ensure the margins of error reported in the accompanying materials were
SVOG accurate.(NFR Condition 6)
PPP Loan Guaranty 7. Management did not provide sufficient documentation to support the
Purchases monitoring of corrective actions reported in the AFR. (NFR Condition 7)
7(a) Loan Guaranty 8. The review controls designed and implemented to ensure the improper and
Approvals unknown payment root causes, reduction targets within Table 1, overpayment
categorization and tolerable rates presented in the AFR and in the
7(a) Loan Guaranty accompanying materials were accurate were not adequate. Further, there
Purchases
was a lack of communication with oversight bodies to ensure proper
504 Certified classification and transmission of data in the accompanying materials for the
Development Loan Disaster Assistance Loan program. (NFR Conditions 8, 9, 10 & 11)
Approvals
Disaster Assistance
Loans
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
Section 1112 Payments
PPP Loan Guaranty 9. The procedures used by management to test samples in accordance with PIIA
Purchases requirements were not appropriate. Specifically, the interest portion of each
sample payment was not tested for accuracy. (NFR Condition 12)
12
Program or Activity Control Deficiencies
PPP Loan Forgiveness 10. High Priority program scorecards which contain the corrective actions
necessary to achieve established improper payment and unknown payment
PPP Loan Guaranty reduction targets were not published for all required quarters. (NFR
Purchases Condition 13)
PPP Loan Forgiveness 11. Integrity proposals were not published within the Congressional Budget
Justification for programs that are in their second year of non-compliance.
PPP Loan Guaranty (NFR Condition 14)
Purchases
13
B. RECOMMENDATIONS
Where noted, these recommendations are carried forward from the prior year.
We recommend the Administrator coordinate with the Chief Financial Officer to:
• Design and implement formalized risk assessment processes to ensure all programs are
assessed to meet PIIA reporting objectives. (Deficiency 4; Modified FY2023
Recommendation 3)
• Design and implement a formalized review and validation process over the accuracy of the
AFR and accompanying materials to meet PIIA reporting objectives. (Deficiency 8;
Modified FY2023 Recommendation 3)
• Design and implement formalized policies and procedures to effectively support and provide
information for the required publication of High-Priority Program scorecards. (Deficiency
10; Modified FY2023 Recommendation 3)
• Perform effective oversight over the statistician’s work by strengthening communication in
order to obtain sufficient understanding of the work performed and to verify that the
documentation (i.e. statistical measures of precision and margins of error) supports the
results of their work in alignment with internal control and/or PIIA requirements. (Deficiency
5 & 6; FY2023 Recommendation 7)
• Improve monitoring procedures to ensure PIIA compliance and reporting requirements are
considered when a program is non-compliant for multiple consecutive years. (Deficiency
11; new recommendation)
We recommend the Administrator coordinate with the Associate Administrator of the Office of Capital
Access to:
• Design and implement the appropriate preventive and monitoring controls to determine the
eligibility of loans prior to 7(a) and 504 loan approvals and payments, Disaster
disbursements, PPP loan forgiveness, and PPP loan guaranty purchases. (Deficiency 2 &
3; FY2023 Recommendation 5)
• Design and implement adequate review procedures to ensure that the sample is supported
by underlying documentation and the results meet the PIIA objectives. (Deficiency 9;
FY2023 Recommendation 9)
• Design and implement formal monitoring procedures to establish an audit trail that verifies
the successful implementation of corrective actions for improper and unknown payments.
(Deficiency 7; modified FY2023 Recommendation 10)
• Design and implement monitoring controls that strengthen SBA’s ability to obtain required
documentation from lenders and recipients to satisfy agency requirements and achieve PIIA
reporting objectives. (Deficiency 1; FY2023 Recommendation 4)
14
V. APPENDIX I: MANAGEMENT’S RESPONSE TO REPORT
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
DATE: May 13, 2026
TO: William Kirk, Inspector General
FROM: Nathan Davis, Associate Administrator, Chief Financial Officer and Chief Risk Officer
Thomas Kimsey, Associate Administrator, Office of Capital Access
SUBJECT: Response to Audit: Performance Audit of the U.S. Small Business Administration’s
Fiscal Year (FY) 2025 Compliance with the Payment Integrity Information Act of 2019
The Small Business Administration (SBA) appreciates the opportunity to review and respond to the
Performance Audit of the U.S. Small Business Administration’s Fiscal Year 2025 Compliance with the
Payment Integrity Information Act of 2019 (PIIA).
SBA is committed to reducing the dollar amount of improper payments, ensuring program integrity, and
continuing to implement effective risk management procedures in accordance with improper payment
legislation1, as well as guidance prescribed in Office of Management and Budget Memorandum M-21-19,
Appendix C to Circular A-123, Requirements for Payment Integrity Improvement.
SBA concurs with the Recommendations made in this audit report and is providing the following
comments in response to those recommendations.
Recommendation 1: We recommend the Administrator coordinate with the Chief Financial Officer to
design and implement formalized risk assessment processes to ensure all programs are assessed to meet
PIIA reporting objectives.
SBA Response: The Office of Chief Financial Officer (OCFO) concurs with this recommendation.
OCFO has already redesigned the risk assessment process to ensure all PIIA risk factors are adequately
assessed and that programs are assessed at the required frequencies in accordance with PIIA reporting
requirements.
Recommendation 2: We recommend the Administrator coordinate with the Chief Financial Officer to
design and implement a formalized review and validation process over the accuracy of the AFR and
accompanying materials to meet PIIA reporting objectives.
1
Payment Integrity Information Act (2019)
15
SBA Response: OCFO concurs with this recommendation. OCFO will design a formalized review and
validation process to strengthen oversight over the accuracy and completeness of the AFR and
accompanying materials supporting PIIA. The process will contain review procedures and defined roles
and responsibilities for review.
Recommendation 3: We recommend the Administrator coordinate with the Chief Financial Officer to
design and implement formalized policies and procedures to effectively support and provide information
for the required publication of High-Priority Program scorecards.
SBA Response: OCFO concurs with this recommendation. SBA is actively coordinating with OMB to
discuss the potential for submitting the omitted information through an off-cycle reporting process to
ensure a complete and accurate representation of Payment Accuracy results. Additionally, SBA will
design a formalized monitoring process to strengthen oversight over the High-Priority Program
scorecards.
Recommendation 4: We recommend the Administrator coordinate with the Chief Financial Officer to
perform effective oversight over the statistician’s work by strengthening communication in order to
obtain sufficient understanding of the work performed and to verify that the documentation (i.e. statistical
measures of precision and margins of error) supports the results of their work in alignment with internal
control and/or PIIA requirements.
SBA Response: OCFO concurs with this recommendation. OCFO will institute standardized processes,
maintained under change control and subject to validation and back testing, for the extrapolation of error
rates and the calculation of other relevant statistical measures including estimated variance, standard
deviation, confidence interval lower & upper bounds, recalculation of the margin of error, and the
calculation of reduction targets and tolerable rates. OCFO will institute a final review process of all
statistical calculations to ensure accuracy.
Recommendation 5: We recommend the Administrator coordinate with the Chief Financial Officer to
improve monitoring procedures to ensure PIIA compliance and reporting requirements are considered
when a program is non-compliant for multiple consecutive years.
SBA Response: OCFO concurs with this recommendation. OCFO will design a formalized monitoring
process to ensure that all PIIA non-compliance reporting requirements are met as required.
Recommendation 6: We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement the appropriate preventive and monitoring controls
to determine the eligibility of loans prior to 7(a) and 504 loan approvals and payments, Disaster
disbursements, PPP loan forgiveness, and PPP loan guaranty purchases.
SBA Response: OCA concurs with this recommendation. SBA will continue to implement preventive
and monitoring controls to reduce improper payments for all programs.
Recommendation 7: We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement adequate review procedures to ensure that the
sample is supported by underlying documentation and the results meet the PIIA objectives.
16
SBA Response: OCA concurs with this recommendation. To date, SBA has not encountered an issue
with the current review procedures. However, in order to better address the concerns raised by KPMG,
SBA will expand its review procedures to ensure that the sample is supported by underlying
documentation, and the results meet the PIIA objectives.
Recommendation 8: We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement formal monitoring procedures to establish an audit
trail that verifies the successful implementation of corrective actions for improper and unknown
payments.
SBA Response: OCA concurs with this recommendation. SBA has operationalized corrective actions
from prior years through the functioning of relevant processes identified in the corrective actions. In order
to better evidence the implementation of corrective actions going forward, SBA will design and
implement formal monitoring procedures to establish an audit trail that verifies the successful
implementation of corrective actions for improper and unknown payments.
Recommendation 9: We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement monitoring controls that strengthen SBA’s ability to
obtain required documentation from lenders and recipients to satisfy agency requirements and achieve
PIIA reporting objectives.
SBA Response: OCA concurs with this recommendation. SBA will design and implement controls to
strengthen SBA’s ability to obtain required documentation from lenders and recipients to satisfy agency
requirements and achieve PIIA reporting objectives.
17
File and source
- File
- 26-09-fy2025-piia-compliance.pdf
- Size
- 1,295,483 bytes
- SHA-256
- 01a7751ec2003cbbc64519390bb21d87b6246471e2f87cfdebcb9e0c0795df71
- Our copy
- 26-09-fy2025-piia-compliance.pdf
- Original
- No public link identified.