Priority Open Recommendations: Small Business Administration (GAO-21-503PR, June 2, 2021)

Summary

GAO letter GAO-21-503PR, "Priority Open Recommendations: Small Business Administration," dated June 2, 2021 and addressed to SBA Administrator Isabella Casillas Guzman. It states that as of April 2021 SBA had 54 open recommendations and that, since GAO's April 2020 letter, SBA had implemented one of eight open priority recommendations, by developing an organization-wide cybersecurity risk-assessment process. GAO adds eight recommendations on SBA's COVID-19 small business assistance, bringing the total number of priority recommendations to 15. For the Paycheck Protection Program and Economic Injury Disaster Loan program, the letter states that as of May 2021 SBA had yet to conduct a fraud risk assessment for PPP, and SBA officials stated the agency was developing an analysis to apply certain fraud indicators to all EIDL application data.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

441 G St. N.W.
Washington, DC 20548



June 2, 2021


Isabella Casillas Guzman
Administrator
U.S. Small Business Administration
409 3rd Street, SW
Washington, D.C. 20416


Priority Open Recommendations: Small Business Administration

Dear Administrator Guzman:

The purpose of this letter is to provide an update on the overall status of the Small Business
Administration’s (SBA) implementation of GAO’s recommendations and to call your personal
attention to areas where open recommendations should be given high priority. 1 In November,
2020, we reported that on a government-wide basis, 77 percent of the recommendations we
made 4 years ago were implemented. 2 As of April 2021, SBA’s implementation rate for this 4-
year period was 100 percent. As of April 2021, SBA had 54 open recommendations. Fully
implementing these open recommendations could significantly improve SBA’s operations.

Since our April 2020 letter, SBA has implemented one of our eight open priority
recommendations. To address our recommendation on cyber threats, the agency developed an
organization-wide cybersecurity risk-assessment process. We ask for your attention to the
remaining seven open priority recommendations. We also have added eight recommendations
related to SBA’s implementation of small business assistance programs in response to the
COVID-19 pandemic in 2020, bringing the total number of priority recommendations to 15. (See
enclosure for the list of recommendations.)

The 15 open priority recommendations fall into the following four areas:

COVID-19 pandemic response. Fully implementing the following eight recommendations
would improve SBA’s Paycheck Protection Program (PPP) and its Economic Injury Disaster
Loan (EIDL) program.

In June 2020, we recommended that SBA develop and implement plans to identify and respond
to risks in PPP. In December 2020, SBA officials said the agency had completed oversight
plans for PPP and provided GAO with a copy of a plan for the loan review process. However,

1Priority recommendations are those that GAO believes warrant priority attention from heads of key departments or

agencies. They are highlighted because, upon implementation, they may significantly improve government
operations—for example, by realizing large dollar savings; eliminating mismanagement, fraud, and abuse; or making
progress toward addressing a high-risk or duplication issue.

2GAO, Performance and Accountability Report: Fiscal Year 2020, GAO-21-4SP (Washington, D.C.: Nov. 16, 2020).




Page 1                                                        GAO-21-503PR SBA Priority Recommendations
the plan and related documents have not been updated to incorporate major changes to the
program, such as the additional loans made in 2021. Additionally, as of May 2021, SBA was still
implementing its oversight plan, but had yet to conduct other critical steps to address potential
fraud, including a fraud risk assessment. By fully implementing its plans, SBA can better ensure
program integrity and reduce the potential for fraud.

In November 2020, we recommended that SBA expeditiously estimate improper payments and
report estimates and error rates for PPP. In response to our recommendation, SBA stated it
planned to conduct improper payment testing for PPP. In February 2021, SBA officials stated
SBA had submitted the sampling plan for the testing to the Office of Management and Budget
and would use it to estimate improper payments and error rates for PPP. Given the large
amounts appropriated for PPP and the possibility of widespread improper payments, conducting
the testing is important to help expedite identification and recovery of such payments.

In January 2021, we recommended that SBA develop and implement portfolio-level data
analytics (to help detect potentially ineligible and fraudulent applications) for EIDL loans and
advances made in response to the COVID-19 pandemic. SBA neither agreed nor disagreed with
this recommendation at the time of the report. As of May 2021, SBA officials stated that the
agency was in the process of developing an analysis to apply certain fraud indicators to all
application data. We maintain that portfolio-level data analytics could help SBA better prevent
and detect fraud.

In March 2021, we made the following five recommendations to SBA: (1) conduct and document
a fraud risk assessment for the EIDL program; (2) develop a strategy to continuously address
fraud risks in EIDL; (3) implement an oversight plan to identify and respond to risks in EIDL; (4)
conduct and document a fraud risk assessment for PPP; and (5) develop a strategy to
continuously monitor and manage fraud risks in PPP. SBA agreed with all five
recommendations. SBA noted it would determine the appropriate resources and approach to
implement the recommendations. According to SBA officials, as of May 2021 SBA had begun
conducting a formal fraud risk assessment for PPP. SBA also stated that the agency started
work to build a fraud risk framework for the EIDL program. Conducting a comprehensive fraud
risk assessment and using it to develop an antifraud strategy would help SBA more strategically
manage fraud risks in EIDL and PPP, safeguarding billions of dollars in taxpayer funds.

The seven recommendations remaining from our 2020 letter are as follows.

Disaster response. Fully implementing two recommendations would improve SBA’s ability to
respond to disasters. In February 2020, we recommended that SBA (1) identify risks associated
with its disaster response and plans to mitigate the risks and include them in its disaster
planning documentation; and (2) identify key elements of a disaster action plan and provide
guidance to staff on incorporating them in future plans. In March 2021, SBA told us it would
document risks and mitigation plans in its Disaster Preparedness and Recovery Plan to be
released in 2021. SBA also told us it was on track to develop the key elements of, and
templates for, a disaster action plan by the end of fiscal year 2021. By identifying risks and
enhancing guidance on action plans, SBA can better design plans for and implementation of
disaster response efforts and help ensure staff are adequately prepared for post-disaster
operations.

Credit elsewhere requirement. Fully implementing two recommendations would improve
lender compliance with the credit elsewhere requirement—to only make SBA 7(a) loans to
creditworthy small businesses that cannot obtain credit through a conventional lender at


Page 2                                               GAO-21-503PR SBA Priority Recommendations
reasonable terms. In June 2018, we recommended that SBA (1) use its on- and off-site reviews
to collect information on lender use of credit elsewhere criteria, and (2) analyze the information
obtained. In June 2019, SBA provided us information on 7(a) lender reviews and a lender
training schedule on credit elsewhere. In November 2019, SBA provided more information on
reviewer training on and communication of best practices to lenders. In March 2021, SBA
provided information on its methods for reviewing lender compliance and stated that it had
analyzed fiscal year 2019 compliance data. SBA stated it was completing its analysis of
compliance data for fiscal year 2020. Collecting data on criteria used for credit elsewhere
justifications for a larger sample of loans and analyzing patterns in lender practices will help
SBA to better understand whether 7(a) loans reached intended borrowers. Improving
documentation and information on lenders’ use of credit elsewhere criteria would help promote
compliance with the requirement and help ensure the program reaches its target population.

Export promotion. Fully implementing three recommendations would improve operations in
export promotion programs. We recommended in January 2013 that SBA update its hiring plan
to more effectively implement statutory requirements for staffing 30 export finance specialists in
Export Assistance Centers across the country. In January 2020, SBA told us the agency had
hired 25 of the 30 specialists. SBA also told us it was establishing a strategy for future hires and
requesting fiscal year 2021 funding to fill the remaining five positions. In February 2021, SBA
told us three of 25 positions had become vacant, and that filling them—and the additional five
positions—was still contingent on funding availability. Putting all the specialists in place would
ensure compliance with statutory requirements, and help increase exports by small businesses.

We made another two recommendations in March 2019 that SBA establish a process to (1)
ensure documentation of states’ compliance with total match requirements before grant
closeout, and (2) determine states’ compliance with a cash match requirement. SBA generally
agreed with both recommendations and said it would develop the processes. In December
2020, SBA officials told us the agency was developing a Match Assurance Process to ensure
match requirements are monitored and managed each quarter, and met at closeout. In April
2021, SBA provided initial information about its rollout. Further developing and implementing
these processes through the end of the current grant cycle are important steps in ensuring
compliance with the statutory requirements of the program.

                                               -- -- -- -- --

In March 2021, we issued our biennial update to our High-Risk List, which identifies government
operations with greater vulnerabilities to fraud, waste, abuse, and mismanagement or that need
transformation to address economy, efficiency, or effectiveness challenges. 3 One of our high-
risk areas—emergency loans for small businesses—centers directly on SBA. 4

Several other government-wide high-risk areas also have direct implications for SBA and its
operations. These include (1) improving the management of IT acquisitions and operations, (2)
improving strategic human capital management, (3) managing federal real property, (4)
ensuring the cybersecurity of the nation, and (5) the government-wide personnel security
clearance process. We urge your attention to emergency loans for small businesses and other

3GAO, High-Risk Series: Dedicated Leadership Needed to Address Limited Progress in Most High-Risk Areas, GAO-

21-119SP (Washington, D.C.: Mar. 2, 2021).
4For a full discussion of the Emergency Loans for Small Businesses high-risk area, see pages 128–134 of our 2021

high-risk report.



Page 3                                                        GAO-21-503PR SBA Priority Recommendations
government-wide high-risk issues as they relate to SBA. Progress on high-risk issues has been
possible through the concerted actions and efforts of Congress, the Office of Management and
Budget, and the leadership and staff in agencies, including within SBA.

We are sending copies of this report to the Director of the Office of Management and Budget
and appropriate congressional committees including the Committees on Appropriations, Budget,
Homeland Security and Governmental Affairs, and Small Business and Entrepreneurship,
United States Senate; and the Committees on Appropriations, Budget, Oversight and Reform,
and Small Business, House of Representatives. In addition, the report will be available on the
GAO website at https://www.gao.gov.

I appreciate SBA’s continued commitment to these important issues. If you have any questions
or would like to discuss any of the issues outlined in the letter, please do not hesitate to contact
me or Daniel Garcia-Diaz, Managing Director, Financial Markets and Community Investment at
garciadiazd@gao.gov or 202-512-8678. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this report. Our teams will
continue to coordinate with your staff on all 54 open recommendations, as well as those
additional recommendations in the high-risk areas for which SBA has a leading role. Thank you
for your attention to these matters.




Gene L. Dodaro
Comptroller General
of the United States

Enclosure - 1

cc:      Antwaun Griffin, Chief of Staff
         Erica Gaddy, Deputy Chief Financial Officer, Office of Performance, Planning, and
         the Chief Financial Officer
         Patrick Kelley, Associate Administrator, Office of Capital Access
         James Rivera, Associate Administrator, Office of Disaster Assistance
         Michele Schimpp, Acting Associate Administrator, Office of International Trade
         The Honorable Shalanda Young, Acting Director, Office of Management
         and Budget




Page 4                                                 GAO-21-503PR SBA Priority Recommendations
Enclosure

Priority Open Recommendations to the Small Business Administration (SBA)


COVID-19 Pandemic Response

COVID-19: Opportunities to Improve Federal Response and Recovery Efforts. GAO-20-625.
Washington, D.C.: June 25, 2020.

Recommendation: The Administrator of the Small Business Administration should develop and
implement plans to identify and respond to risks in the Paycheck Protection Program (PPP) to
ensure program integrity, achieve program effectiveness, and address potential fraud, including
in loans of $2 million or less.

Action Needed: At the time of our report, SBA neither agreed nor disagreed with this
recommendation. Since then, SBA indicated that it plans to review all PPP loans of $2 million or
more and any other loans it deems appropriate and provided GAO with a copy of its plan to
review the loans. However, the plan and related documents have not been updated to
incorporate major changes to the program, such as the additional loans made in 2021.
Additionally, as of May 2021, SBA was still implementing its oversight plan, and had yet to
conduct other critical steps to address potential fraud, including a fraud risk assessment. To fully
implement this recommendation, SBA would have to finalize and implement its plans to identify
and respond to risks in PPP.

High-Risk Area: Emergency Loans for Small Businesses
Director: William B. Shear, Financial Markets and Community Investment
Contact information: shearw@gao.gov or (202) 512-8678




COVID-19: Urgent Actions Needed to Better Ensure an Effective Federal Response. GAO-21-
191. Washington, D.C.: November 30, 2020.

Recommendation: The Administrator of the Small Business Administration should
expeditiously estimate improper payments and report estimates and error rates for PPP due to
concerns about the possibility that improper payments, including those resulting from fraudulent
activity, could be widespread.

Action Needed: SBA neither agreed nor disagreed with this recommendation at the time of the
report. SBA stated that it was planning to conduct improper payment testing for PPP, but the
agency would have to finalize this plan and estimate improper payments and error rates for PPP
to fully implement this recommendation.

High-Risk Area: Emergency Loans for Small Businesses
Director: Beryl H. Davis, Financial Management and Assurance
Contact information: davisbh@gao.gov or (202) 512-2623




Page 5                                                GAO-21-503PR SBA Priority Recommendations
COVID-19: Critical Vaccine Distribution, Supply Chain, Program Integrity, and Other Challenges
Require Focused Federal Attention. GAO-21-265. Washington, D.C.: January 28, 2021.

Recommendation: The Administrator of the Small Business Administration should develop and
implement portfolio-level data analytics across Economic Injury Disaster Loan (EIDL) program
loans and advances made in response to COVID-19 as a means to detect potentially ineligible
and fraudulent applications.

Action Needed: SBA neither agreed nor disagreed with this recommendation at the time of the
report. As of May 2021, SBA officials stated that the agency was in the process of developing
an analysis to apply certain fraud indicators to all application data. To fully implement this
recommendation, SBA would have to develop and implement portfolio-level data analytics as a
means to detect applications from potentially ineligible businesses, such as those in the
insurance and real estate development industries, as well as to detect potentially fraudulent
applications.

High-Risk Area: Emergency Loans for Small Businesses
Director: William B. Shear, Financial Markets and Community Investment
Contact information: shearw@gao.gov or (202) 512-8678




COVID-19: Sustained Federal Action Is Crucial as Pandemic Enters Its Second Year. GAO-21-
387. Washington, D.C.: March 31, 2021.

Recommendation: The Administrator of the Small Business Administration should conduct and
document a fraud risk assessment for the EIDL program.

Action Needed: SBA agreed with this recommendation. As of May 2021, SBA stated that the
agency had started the work to build a fraud risk framework. To fully implement this
recommendation, SBA would have to conduct and document the fraud risk assessment for the
EIDL program.

Recommendation: The Administrator of the Small Business Administration should develop a
strategy that outlines specific actions to address assessed fraud risks in the EIDL program on a
continuous basis.

Action Needed: SBA agreed with this recommendation. SBA noted that it would work to
determine the appropriate resources and approach to monitor fraud risk on an ongoing basis.
To fully implement this recommendation, SBA would have to develop a strategy that outlines
specific actions to assess fraud risks on a continuous basis.

Recommendation: The Administrator of the Small Business Administration should implement a
comprehensive oversight plan to identify and respond to risks in the EIDL program to help
ensure program integrity, achieve program effectiveness, and address potential fraud.




Page 6                                              GAO-21-503PR SBA Priority Recommendations
Action Needed: SBA agreed with this recommendation. To fully implement this
recommendation, SBA would have to implement a comprehensive oversight plan to identify and
respond to risks in the EIDL program.

Recommendation: The Administrator of the Small Business Administration should conduct and
document a fraud risk assessment for PPP.

Action Needed: SBA agreed with this recommendation. According to SBA officials, as of May
2021 SBA had begun conducting a formal fraud risk assessment for PPP. To fully implement
this recommendation, SBA would have to complete a comprehensive fraud assessment.

Recommendation: The Administrator of the Small Business Administration should develop a
strategy that outlines specific actions to monitor and manage fraud risks in PPP on a continuous
basis.

Action Needed: SBA agreed with this recommendation. SBA noted that it would work to
determine the appropriate resources and approach to ensure that fraud risk for PPP is
monitored on a continuous basis. To fully implement this recommendation, SBA would have to
develop a strategy for continuous monitoring and managing of fraud risks in PPP.

High-Risk Area: Emergency Loans for Small Businesses
Director: William B. Shear, Financial Markets and Community Investment
Contact information: shearw@gao.gov or (202) 512-8678




Disaster Response

Small Business Administration: Disaster Loan Processing Was Timelier, but Planning
Improvements and Pilot Program Evaluation Needed. GAO-20-168. Washington, D.C.: February
7, 2020.

Recommendation: The Associate Administrator for the Office of Disaster Assistance should
identify and document risks associated with its disaster response and plans to mitigate these
risks in its disaster planning documentation.

Action Needed: SBA agreed with the recommendation. SBA noted that relevant agency offices
would collaborate to identify and document known risks associated with SBA’s disaster
response and implement a risk-informed approach to its direct response and recovery
operations. To fully implement this recommendation, SBA should identify potential risks that
could impede its ability to provide disaster assistance and ways to mitigate these risks. Once
identified, SBA should incorporate these risks and their mitigation into its disaster planning
documentation.

Recommendation: The Associate Administrator for the Office of Disaster Assistance should
identify the key elements of a disaster action plan and provide additional guidance to staff on
how to incorporate these elements into future action plans.




Page 7                                               GAO-21-503PR SBA Priority Recommendations
Action Needed: SBA agreed with the recommendation. SBA noted that the agency would
develop the key elements of and templates for a disaster action plan and provide guidance to
field operations centers. To fully implement this recommendation, SBA should develop a
standard template for field operations centers to use when developing action plans to guide their
initial disaster response.

Director: William B. Shear, Financial Markets and Community Investment
Contact information: shearw@gao.gov or (202) 512-8678




Credit Elsewhere Requirement

Small Business Loans: Additional Actions Needed to Improve Compliance with the Credit
Elsewhere Requirement. GAO-18-421. Washington, D.C.: June 5, 2018.

Recommendation: The Administrator of SBA should use its on-site and off-site reviews to
routinely collect information on lenders’ use of credit elsewhere criteria as part of its monitoring
of lender practices related to the credit elsewhere requirement.

Action Needed: SBA generally agreed with the recommendation. To fully implement this
recommendation, SBA should put into operation its plan to collect information on lenders’ use of
the credit elsewhere criteria when conducting reviews that include loan file reviews, whether
performed at the lender’s location (on-site reviews) or virtually (off-site reviews).

Recommendation: The Administrator of SBA should analyze information on lenders’ use of
credit elsewhere criteria obtained from its reviews to identify lenders that may be at greater risk
of noncompliance and to inform its selection of lenders for further review for credit elsewhere
compliance.

Action Needed: SBA generally agreed with the recommendation. To fully implement this
recommendation, SBA should implement its plan to analyze credit elsewhere compliance data
obtained from reviews conducted virtually and at the lender’s location to identify lender-level
portfolio trends or elevated lender risk to inform its selection of lenders for further review for
credit elsewhere compliance.

Director: William B. Shear, Financial Markets and Community Investment
Contact information: shearw@gao.gov or (202) 512-8678




Export Promotion

Export Promotion: Small Business Administration Needs to Improve Collaboration to Implement
Its Expanded Role. GAO-13-217. Washington, D.C.: January 30, 2013.

Recommendation: To more effectively implement SBA's expansion of Office of International
Trade field staff as required by the Small Business Jobs Act of 2010, the Administrator of SBA
should update SBA's plan for additional Office of International Trade staff to include funding


Page 8                                                 GAO-21-503PR SBA Priority Recommendations
sources and time frames, as well as possible efficiencies from clearly defining roles and
responsibilities and leveraging other entities' export assistance resources.

Action Needed: SBA agreed with this recommendation but noted resource constraints. SBA
told us the agency was establishing a strategy for future hires and requesting funding to hire
individuals to fill the remaining five positions, but SBA had not filled all the required positions as
of February 2021. Moreover, SBA told us that three of the 25 positions had become vacant, and
that filling these three positions—as well as hiring to fill the additional five positions—was
contingent on the availability of funding. To fully implement this recommendation, SBA needs to
hire 30 export finance specialists in accordance with legal requirements.

Director: Kimberly Gianopoulos, International Affairs and Trade
Contact information: gianopoulosk@gao.gov or (202) 512-8612



Small Business Administration: Export Promotion Grant Program Should Better Ensure
Compliance with Law and Help States Make Full Use of Funds. GAO-19-276. Washington,
D.C.: March 12, 2019.

Recommendation: The Administrator of SBA should establish a process that ensures
documentation of states' compliance with the total match requirement before grant closeout.

Action Needed: SBA generally agreed with the recommendation. SBA stated that it would
establish a process that ensures documentation of state recipients' compliance with the total
match requirement before grant closeout. To fully implement this recommendation, SBA should
create and maintain documentation of the agency’s annual analysis and determination that
grant recipients have or have not met the total match requirement.

Recommendation: The SBA Administrator should develop a process to determine states'
compliance with the cash match requirement.

Action Needed: SBA generally agreed with our recommendation. SBA stated that it would
develop a process to determine states’ compliance with the cash match requirement before
grant closeout. To fully implement this recommendation, SBA should create and document an
annual agency process to determine whether grant recipients have or have not met the cash
match requirement.

Director: Kimberly Gianopoulos, International Affairs and Trade
Contact information: gianopoulosk@gao.gov or (202) 512-8612




(104763)




Page 9                                                 GAO-21-503PR SBA Priority Recommendations
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
                         The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission            arm of Congress, exists to support Congress in meeting its constitutional
                         responsibilities and to help improve the performance and accountability of the
                         federal government for the American people. GAO examines the use of public
                         funds; evaluates federal programs and policies; and provides analyses,
                         recommendations, and other assistance to help Congress make informed
                         oversight, policy, and funding decisions. GAO’s commitment to good government
                         is reflected in its core values of accountability, integrity, and reliability.

                         The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of      through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and          released reports, testimony, and correspondence. You can also subscribe to
                         GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone           The price of each GAO publication reflects GAO’s actual cost of production and
                         distribution and depends on the number of pages in the publication and whether
                         the publication is printed in color or black and white. Pricing and ordering
                         information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
                         Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                         TDD (202) 512-2537.
                         Orders may be paid for using American Express, Discover Card, MasterCard,
                         Visa, check, or money order. Call for additional information.

                         Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO         Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
                         Visit GAO on the web at https://www.gao.gov.

                         Contact FraudNet:
To Report Fraud,
                         Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
                         Automated answering system: (800) 424-5454 or (202) 512-7700
Federal Programs
                         Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400,
Congressional            U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Relations                Washington, DC 20548

                         Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs           U.S. Government Accountability Office, 441 G Street NW, Room 7149
                         Washington, DC 20548

                         Stephen J. Sanford, Acting Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and   U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison         Washington, DC 20548




                            Please Print on Recycled Paper.


File and source

File

gao-21-503pr.pdf

Size

302,898 bytes

SHA-256

ec54a0a79afa45313f5f1125c0a9ea283d92a3d98e91b5717dfbc992eeb167eb

Our copy

gao-21-503pr.pdf

Original

www.gao.gov