Improved Controls Needed for Referring Likely Fraud in SBA's Pandemic Loan Programs

Summary

GAO report GAO-25-107267, published March 24, 2025, on SBA's four-step process for managing fraud risks in the PPP and COVID-19 EIDL programs: screening, data analytics, human-led reviews and OIG referrals. It states SBA did not implement the process until over $210 billion of an eventual $385 billion in COVID-EIDL and over $525 billion of an eventual $800 billion in the PPP had been disbursed or approved. SBA submitted almost 3 million COVID-EIDL referrals to its OIG, and OIG officials said about 2 million were not actionable. GAO recommends that SBA work with its OIG on an effective referral plan; the status update states SBA reported reaching an agreement with the OIG in February 2026 and the recommendation remains open.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

COVID-19 Relief: Improved Controls Needed for Referring Likely Fraud in SBA's Pandemic Loan Programs

GAO-25-107267 Published: Mar 24, 2025. Publicly Released: Mar 24, 2025.

Jump To:

Fast Facts

The Small Business Administration made or guaranteed more than $1 trillion in loans and grants to over 10 million small businesses during the pandemic.

SBA used a four-step process for managing fraud risks in the COVID-19 Economic Injury Disaster Loan program. One step was to refer likely fraudulent applications to its inspector general for investigation. But the IG was unable to fully investigate nearly 2 million of the 3 million referrals because SBA did not provide enough information, or correct information, in its referrals.

We recommended SBA and its IG develop a plan to address this issue.

Skip to Highlights

Highlights

html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"

What GAO Found

According to Small Business Administration (SBA) officials, the four-step process for managing fraud risks in its pandemic loan programs generally consisted of the following components for both the Paycheck Protection Plan (PPP) and COVID-19 Economic Injury Disaster Loan (COVID-19 EIDL) programs:

- Screening : automated review, sometimes with additional manual components, that compared each application with several public and private databases and checked for internal inconsistencies that indicated data anomalies.
- Data analytics: various data analytic tools to examine data anomalies, sometimes using a type of artificial intelligence called machine learning for the PPP to help identify files with data anomalies in need of review.
- Human-led reviews : manual reviews of files with data anomalies to determine if the file was ineligible or likely fraudulent.
- OIG referrals: referrals of likely fraudulent applications to SBA's Office of Inspector General (OIG).

This process and its various steps were introduced at different times for COVID-19 EIDL and the PPP and were implemented iteratively over the course of the pandemic. However, SBA did not implement the process until more than half of the programs' funding had been approved, thus limiting its impact in preventing fraud. Specifically, for COVID-EIDL, over $210 billion of an eventual $385 billion (or about 55 percent) had already been disbursed before the full process was implemented. For the PPP, over $525 billion of an eventual $800 billion (or about 66 percent) had already been approved.

The four-step process as applied to COVID-19 EIDL and the PPP had weaknesses, as several audit entities, including GAO, SBA's OIG, and SBA's independent financial statement auditor, have previously reported. For example, as part of its screening step, SBA compared loan applications against the Treasury's various Do Not Pay (DNP) databases and public records. A June 2024 SBA OIG report found, however, that SBA awarded and disbursed funds to potentially ineligible entities listed in DNP without sufficient evidence to support the loan decision. In response to this report, SBA agreed, among other things, to review and address those loans and grants with an alert in the file that was not previously addressed. According to SBA's OIG, the proposed action did not fully meet OIG's recommendation to review all loans identified as potentially ineligible.

In its work, GAO identified a weakness in SBA's process for referring cases of likely fraud to its OIG—that is, step four of its four-step process. As part of its referral step for COVID-EIDL, SBA submitted almost 3 million referrals to its OIG. SBA OIG officials told GAO that of these referrals, about 2 million were not actionable because they did not contain enough data elements to allow for further investigation or had quality issues, such as duplicates or incorrect information. Without an effective referral process, the SBA OIG is not able to fully investigate instances of likely fraud and make follow-on referrals to, for example, the Department of Justice for prosecution, as necessary.

Why GAO Did This Study

SBA distributed over $1 trillion in loans and grants to over 10 million small businesses in 2020-2022 during the COVID-19 pandemic. Through the CARES Act and other laws, Congress provided funding for PPP and COVID-19 EIDL to support small businesses. In June 2020, GAO found that SBA had not yet developed and implemented plans to identify and respond to risks for the PPP to ensure program integrity. GAO reported in May 2023 that SBA moved quickly under challenging circumstances to develop and launch its pandemic relief programs but that some of the relief funds went to those who sought to defraud the government.

The CARES Act includes a provision for GAO to monitor COVID-19 pandemic relief funds. In this report, GAO examines SBA's four-step antifraud process by describing (1) how the process for detecting and referring likely fraud cases was designed and implemented for COVID-19 EIDL and the PPP and identifying (2) any control weaknesses in the process for detecting and referring likely fraud cases for COVID-19 EIDL and the PPP.

GAO examined SBA documentation, interviewed SBA officials, and reviewed prior reports by GAO, SBA's OIG, and SBA's independent financial statement auditor, and reports by the Pandemic Response Accountability Committee.

Recommendations

GAO recommends that SBA work with its OIG to develop a plan for referring potential or likely fraud for the COVID-19 EIDL program. SBA agreed with the recommendation.

Recommendations for Executive Action

Agency Affected | Recommendation | Status
Small Business Administration | The SBA Administrator should collaborate with the SBA's OIG to develop an effective plan, including the data elements to be provided and the process to be used, for referrals of potential or likely COVID-19 EIDL fraud cases. (Recommendation 1) | Open In February 2026, SBA told us they met with SBA OIG and reached an agreement on the terms of the disaster loan referral process. SBA said this agreement was captured in a memo. We have requested a copy of the memo and documentation supporting the new referral process is operational and working effectively. We will review this evidence once provided and continue to monitor SBA's efforts in this area.

Full Report

View Full Report Online

Highlights Page

(1 page)

Full Report

(41 pages)

Accessible PDF

(39 pages)

GAO Contacts

Seto J. Bagdoyan

Director

Forensic Audits and Investigative Service

bagdoyans@gao.gov

Media Inquiries

Sarah Kaczmarek

Managing Director

Office of Public Affairs

media@gao.gov

Public Inquiries

Contact Us

Topics

Business Regulation and Consumer Protection

Artificial intelligence Compliance oversight Disaster relief Financial statements Material weaknesses pandemics Public health emergencies Risk management Small business Loans Fraud

File and source

File

COVID-19-Relief-Improved-Controls-Needed-for-Referring--7d66359abc3b.html

Size

87,988 bytes

SHA-256

7d66359abc3bc522bf30f61af1e15575a0fce7f26f8c7a7e0611ee4f56f0585a

Our copy

COVID-19-Relief-Improved-Controls-Needed-for-Referring--7d66359abc3b.html

Original

No public link identified.