GAO-25-108048: Priority Open Recommendations: Small Business Administration

Summary

A letter from the Comptroller General to Small Business Administration Administrator Kelly Loeffler, dated May 1, 2025 (GAO-25-108048), on 17 open priority recommendations in three areas. It states that there are 38 other GAO open recommendations and that from March 2020 through March 2022 SBA provided more than $1 trillion in loans and grants to small businesses through pandemic relief programs. It notes that GAO added SBA's emergency loans for small businesses to its High-Risk List in 2021, and that priority recommendations call for a communication strategy for future disasters and cross-program data analytics to detect fraud. The letter also addresses cybersecurity and IT management risks and oversight of small business research programs.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

441 G St. N.W.                                                                            Comptroller General
Washington, DC 20548                                                                      of the United States



May 1, 2025


The Honorable Kelly Loeffler
Administrator
U.S. Small Business Administration
409 3rd St., SW
Washington, DC 20416

Priority Open Recommendations: Small Business Administration

Dear Administrator Loeffler:

Congratulations on your appointment. The purpose of this letter is to call your personal attention
to three areas based on GAO’s past work and 17 open priority recommendations, which are
enclosed. 1 Additionally, there are 38 other GAO open recommendations that we will continue to
work with your staff to address.

We are highlighting the following areas that warrant your timely and focused attention.
Specifically:

Improving oversight and communication related to lessons learned from the COVID-19
pandemic response. From March 2020 through March 2022, the Small Business
Administration (SBA) provided more than $1 trillion in loans and grants to small businesses
through pandemic relief programs. SBA moved quickly and under challenging circumstances to
develop and launch these programs. However, rapid implementation increased the risk of
improper payments—that is, payments that should not have been made or were made in
incorrect amounts, including those resulting from fraud. GAO added SBA’s emergency loans for
small businesses to its High-Risk List in 2021.

Our prior work found potential weaknesses in SBA’s communication with applicants and its
oversight of pandemic relief programs, and our priority recommendations call for SBA to
address these issues. For example, we recommended that SBA develop a comprehensive
strategy for communicating with potential and actual program applicants during future disasters
to help reduce applicant confusion. Subsequently, we recommended that SBA develop cross-
program data analytics to better identify applicants attempting to defraud multiple programs and
obtain external data to help verify applicant information and detect potential fraud.

While SBA has taken steps to address these recommendations, fully implementing them could
help the agency more strategically manage fraud risks in ongoing and future programs.



1GAO considers a recommendation to be a priority if, when implemented, it may significantly improve government

operations—for example, by realizing large dollar savings; eliminating mismanagement, fraud, and abuse; or making
progress toward addressing a high-risk or duplication issue.



Page 1                                                                                          GAO-25-108048
Addressing cybersecurity and IT management challenges. SBA must take steps to more
effectively implement key practices for its privacy program and manage risk to its IT systems.
For example, we have recommended that SBA fully define and document a process for
involving its senior privacy official in addressing workforce needs to ensure a well-qualified
privacy workforce. We also recommended that SBA address critical risk management issues for
an IT system that helps small businesses participate in its contracting assistance programs.
Fully implementing these recommendations would help SBA better protect sensitive data and
respond to cybersecurity and IT management risks, two governmentwide challenges that have
been on GAO’s High-Risk List since 1997 and 2015, respectively.

Improving oversight of small business research programs. Fraud, waste, and abuse
compromise SBA programs that support small business research and development by limiting
opportunities for legitimate small businesses to contribute to program goals for technological
innovation, increased productivity, and economic growth.

We reported in September 2024 that almost 8 percent of the awardees we reviewed for fiscal
years 2016 through 2021 had four or more indicators of fraud, waste, or abuse. We
recommended that SBA take several actions to address fraud risks, including (1) leverage its
oversight mechanisms to identify, share, and report fraud-related information with 11
participating agencies through the primary website for these programs; (2) provide guidance to
participating agencies on conducting fraud risk assessments for the programs; and (3) improve
data quality related to the verification of awardee information. Fully implementing these
recommendations would help SBA better identify and share information to support agencies’
fraud risk management activities and support its efforts to ferret out fraud, waste, and abuse.

Please see Enclosure 1 for additional details about the status and actions needed to fully
implement all 17 open priority recommendations out of the 55 total recommendations that
remain open. These include priority recommendations on improving disaster recovery efforts,
meeting reporting requirements in a more timely manner, and supporting veteran-owned small
businesses. We provide in Enclosure 2 additional information on SBA’s recommendation
implementation rate, as well as implemented, closed, and new priority recommendations since
our May 2024 letter to Administrator Guzman.

Enclosure 2 also discusses SBA’s inability to receive an audit opinion on its fiscal years 2020
through 2024 financial statements and relevant management challenges from our High-Risk List
that apply to SBA. In response to legislation enacted in December 2022, this enclosure also
includes information on any additional congressional oversight actions that can help agencies
implement priority recommendations and address any underlying issues related to such
implementation.

Copies of this letter are being sent to the appropriate congressional committees. The letter will
also be available on the GAO website at Priority Recommendations | U.S. GAO. We also plan to
send separate letters specifically focused on open recommendations and key issues related to
financial management and information technology. These letters will be sent to your Chief
Financial Officer and Chief Information Officer, respectively.

If you have any questions or would like to discuss any of the issues outlined in this letter, please
do not hesitate to contact me or Daniel Garcia-Diaz, Managing Director, Financial Markets and
Community Investment, at garciadiazd@gao.gov. Contact points for our offices of
Congressional Relations and Public Affairs may be found on the last page of this letter. Our



Page 2                                                GAO-25-108048 SBA Priority Recommendations
teams will continue to coordinate with your staff on addressing these priority recommendations
and the remaining 38 open recommendations. I appreciate SBA’s continued commitment and
thank you for your personal attention to these important issues.



Sincerely,




Gene L. Dodaro
Comptroller General
of the United States

Enclosures – 2

cc:      Wesley Coopersmith, Chief of Staff

         Robin Wright, Chief Operating Officer, Office of the Administrator

         Nathan Davis, Chief Financial Officer & Chief Risk Officer, Office of Performance,
            Planning, and the Chief Financial Officer

         Douglas Robertson, Acting Deputy Chief Information Officer, Office of the Chief
            Information Officer

         Thomas Kimsey, Associate Administrator, Office of Capital Access

         Chris Stallings, Associate Administrator, Office of Disaster Recovery and Resilience

         Lisa Shimkat, Acting Associate Administrator, Office of International Trade

         Elias Hernandez, Associate Administrator, Office of Veterans Business Development

         Frank Salomone, Associate Administrator, Office of Investment and Innovation

         Larry Stubblefield, Deputy Associate Administrator, Office of Government Contracting &
         Business Development

         Anna Maria Calcagno, Director, Office of Strategic Management and Enterprise Integrity,
            Office of Performance, Planning, and the Chief Financial Officer




Page 3                                                GAO-25-108048 SBA Priority Recommendations
Enclosure 1


Priority Open Recommendations to the Small Business Administration

Improving Oversight and Communication Related to Lessons Learned from the COVID-19
Pandemic Response

Economic Injury Disaster Loan Program: Additional Actions Needed to Improve Communication
with Applicants and Address Fraud Risks. GAO-21-589. Washington, D.C.: July 30, 2021.

Year Recommendation Made: 2021

Recommendation: The Associate Administrator of the Small Business Administration’s (SBA)
Office of Disaster Assistance should develop a comprehensive strategy for communicating with
potential and actual program applicants in the event of a disaster. Such a strategy should
provide guidelines for the types of information and timing of information to be provided to
program participants throughout a disaster. The types of information to be addressed in the
strategy could include processing steps and time frames applicants might experience through
different stages of the loan process.

Actions Needed: SBA agreed with the recommendation. In March 2024, SBA stated that it
anticipated completing a new disaster loan application portal that would include improved
messaging features by fiscal year 2025. In March 2025, SBA stated that new senior leaders
were being onboarded and briefed on key audit reports and recommendations. SBA also noted
that it would provide an official update regarding its progress on this recommendation as soon
as possible.

To fully implement this recommendation, SBA needs to complete and launch the portal and
provide documentation of a comprehensive strategy for communicating with potential and actual
disaster loan applicants. Enhancing communication in this way would help reduce applicant
confusion and lessen the burden on SBA’s resources.

High-Risk Area: Improving the Delivery of Federal Disaster Assistance

Acting Director: Courtney LaFountain

Contact Information: lafountainc@gao.gov


Restaurant Revitalization Fund: Opportunities Exist to Improve Oversight. GAO-22-105442.
Washington, D.C.: July 14, 2022.

Year Recommendation Made: 2022

Recommendation: The Associate Administrator for the Office of Capital Access should develop
and implement a plan to respond to potentially fraudulent and ineligible Restaurant
Revitalization Fund awards in a prompt and consistent manner. This plan should include
coordinating with the SBA Office of Inspector General (OIG) to align efforts to address fraud.

Actions Needed: SBA disagreed with this recommendation, indicating that its planned efforts
were sufficient. However, in April 2024, SBA stated that it had prioritized reviewing awards


Page 4                                             GAO-25-108048 SBA Priority Recommendations
flagged for potential fraud and conducted initial reviews of all flagged awards for which
recipients submitted post-award reports. In March 2025, SBA described an analysis that it
conducts monthly to identify and prioritize potentially fraudulent awards.

To fully implement this recommendation SBA would need to provide documentation of its
procedures for prioritizing flagged awards and evidence of implementing these procedures. SBA
also would need to provide documentation of procedures for referring suspicious activity to its
OIG in a manner useful to OIG. Doing so would help SBA recover funds from potentially
fraudulent or ineligible award recipients in a timely manner and help ensure the efficient use of
OIG resources.

Potential Financial Benefit If Implemented: May Contribute to a Million or More Dollars in
Potential Financial Benefits 2

Acting Director: Courtney LaFountain

Contact Information: lafountainc@gao.gov


COVID Relief: Fraud Schemes and Indicators in SBA Pandemic Programs. GAO-23-105331.
Washington, D.C.: May 18, 2023.

Year Recommendations Made: 2023

Recommendation: The Administrator of SBA, in coordination with the Fraud Risk Management
Board, should ensure that SBA has mechanisms in place and utilizes them to facilitate cross-
program data analytics.

Actions Needed: SBA agreed with this recommendation. As of November 2024, SBA’s Fraud
Risk Management Board was developing a policy on program office actions for cross-program
analysis results, inventory management, and operational parameters. Additionally, one SBA
office began performing cross-program data analytics using taxpayer identification numbers for
new loan approvals. In March 2025, SBA stated that new senior leaders were being onboarded
and briefed on key audit reports and recommendations. SBA also noted that it would provide an
official update regarding its progress on this recommendation as soon as possible.

To fully implement this recommendation, SBA would need to document its policy for performing
cross-program data analytics and make it available to staff to support implementation. Doing so
could enhance SBA’s data analytics and ability to strategically manage fraud risks in ongoing
and future programs.

Recommendation: The Administrator of SBA, in coordination with the Fraud Risk Management
Board, should ensure that SBA has identified external sources of data that can facilitate the
verification of applicant information and the detection of potential fraud across its programs. It
should then develop a plan for obtaining access to those sources, which may involve pursuing
statutory authority or entering into data-sharing agreements to obtain such access.


2This potential financial benefit is not attributable to this recommendation alone but could result from the combined

effect of implementing two or more recommendations.



Page 5                                                          GAO-25-108048 SBA Priority Recommendations
Actions Needed: SBA agreed with this recommendation. As of November 2024, SBA was in
the process of implementing efforts to identify and develop a plan for obtaining access to
external data. SBA was in ongoing discussions with the Department of the Treasury to pursue
verification tools and explore potential data sharing on fraud actors. In March 2025, SBA stated
that new senior leaders were being onboarded and briefed on key audit reports and
recommendations. SBA also noted that it would provide an official update regarding its progress
on this recommendation as soon as possible.

To fully implement this recommendation, SBA needs to document its plan for obtaining access
to external data sources, identifying key milestones for each area of effort, and tracking
progress in achieving those milestones. Implementing this recommendation could enhance
SBA’s data analytics and ability to strategically manage fraud risks in ongoing and future
programs.

High-Risk Area: Emergency Loans for Small Businesses

Managing Director: Johana Ayers

Contact Information: ayersj@gao.gov


COVID-19 Relief: SBA and DOL Should Improve Processes to Identify and Recover
Overpayments. GAO-25-106199. Washington, D.C.: November 13, 2024.

Year Recommendation Made: 2025

Recommendation: The Administrator of SBA should ensure that the Office of Capital Access
expands and documents the Paycheck Protection Program (PPP) guarantee purchase process
to ensure that—prior to purchase approval—SBA has collected sufficient documentation to
verify that lenders complied with program requirements.

Actions Needed: SBA partially agreed with the recommendation. In its September 2024
comments on the draft report, SBA stated it would ensure that the proper documentation has
been collected to verify that lenders complied with program requirements for guarantee
purchase requests that indicate potential fraud or noncompliance with PPP lender underwriting
requirements.

To fully implement this recommendation, SBA would need to expand and document a process
to verify that PPP lenders complied with program requirements for all loans submitted for
guarantee purchase. Such a process would specify how SBA considers and mitigates risks
introduced by participation of financial technology lenders. It would also specify how SBA
verifies that PPP lenders and lender service providers complied with program requirements,
including debt collection activities, before SBA approval of guarantee purchase requests.
Without sufficient documentation to verify lenders’ compliance with program requirements,
SBA’s ability to recover overpayments is limited.




Page 6                                             GAO-25-108048 SBA Priority Recommendations
Potential Financial Benefit If Implemented: May Contribute to a Hundred Million or More
Dollars in Potential Financial Benefits 3

High-Risk Area: Emergency Loans for Small Businesses

Director: M. Hannah Padilla

Contact Information: padillah@gao.gov


Addressing Cybersecurity and IT Management Challenges

Privacy: Dedicated Leadership Can Improve Programs and Address Challenges. GAO-22-
105065. Washington, D.C.: September 22, 2022.

Year Recommendation Made: 2022

Recommendation: The Administrator of SBA should fully define and document a process for
ensuring that the senior agency official for privacy or other designated privacy official is involved
in assessing and addressing the hiring, training, and professional development needs of the
agency with respect to privacy.

Actions Needed: SBA agreed with this recommendation. SBA officials told us in March 2023
that the agency was updating its Privacy Program Plan, which would, among other things,
delineate hiring, training, and professional development needs related to privacy. SBA initially
expected to implement this plan by the second quarter of 2024. In March 2024, SBA said
changes in staffing and budget allocations led it to extend its implementation timeline to the end
of fiscal year 2024, using current staffing levels. SBA also described other actions taken to
bolster its privacy workforce. In March 2025, SBA stated that new senior leaders were being
onboarded and briefed on key audit reports and recommendations. SBA also noted that it would
provide an official update regarding its progress on this recommendation as soon as possible.

To fully implement the recommendation, SBA needs to define and document in its policies or
procedures how the senior agency official for privacy or other privacy officials are involved in
addressing workforce needs with respect to privacy—including hiring, training, and professional
development. Fully implementing the recommendation would help the agency more consistently
and effectively identify staffing needs and ensure a well-qualified privacy workforce.

High-Risk Area: Ensuring the Cybersecurity of the Nation

Director: Jennifer Franks

Contact Information: franksj@gao.gov

Director: Marisol Cruz Cain

Contact Information: cruzcainm@gao.gov

3This potential financial benefit is not attributable to this recommendation alone but could result from the combined

effect of implementing two or more recommendations.



Page 7                                                          GAO-25-108048 SBA Priority Recommendations
IT Modernization: SBA Urgently Needs to Address Risks on Newly Deployed System. GAO-25-
106963. Washington, D.C.: November 6, 2024.

Year Recommendations Made: 2025

Recommendation: The Administrator of SBA should direct the Associate Administrator of
SBA's Office of Government Contracting and Business Development to expeditiously address
critical Unified Certification Platform (UCP) project risk management issues, including
developing a project risk management strategy and risk mitigation plan.

Actions Needed: SBA partially agreed with this recommendation. In its October 2024
comments on the draft report, SBA noted that it intends to document a UCP project-level risk
management strategy and risk management plan; expand the risk register to ensure risks are
appropriately categorized, prioritized, and evaluated; and determine appropriate mitigation
strategies for the risks. In February 2025, SBA stated that new senior leaders were being
onboarded and briefed on key audit reports and recommendations. SBA also noted that it would
provide an official update regarding its progress on this recommendation in May 2025.

To fully implement this recommendation, SBA would need to document a risk management
strategy and risk mitigation plan that specifies key details, such as responsible parties and
required tasks, resources, and timelines. Without such a strategy and plan, SBA will be unable
to quickly or effectively address risks as it simultaneously operates the system and develops its
more complex functionality.

Recommendation: The Administrator of SBA should direct the Associate Administrator of
SBA's Office of Government Contracting and Business Development to expeditiously address
critical UCP project cybersecurity issues, including developing a plan for managing project
cybersecurity risks and documenting a traceability analysis for project security requirements.

Actions Needed: SBA partially agreed with this recommendation. In its October 2024
comments on the draft report, SBA outlined its planned process for assessing UCP security
through testing and addressing critical findings. SBA also planned to document traceability
between security requirements and how the system satisfies the requirements. In February
2025, SBA stated that new senior leaders were being onboarded and briefed on key audit
reports and recommendations. SBA also noted that it would provide an official update regarding
its progress on this recommendation in May 2025.

To fully implement this recommendation, SBA would need to document a plan for managing
UCP project cybersecurity risks and document traceability between the security requirements
and how UCP satisfies the requirements. Without such a plan and traceability, SBA faces an
increased risk of operating an insecure system and likely will be unprepared to address the
impacts of a cybersecurity incident.

Recommendation: The Administrator of SBA should direct the Chief Information Officer to
consider the probability and impact of accepted UCP deployment risks if deciding to issue a final
authorization to operate for the system.

Actions Needed: SBA partially agreed with this recommendation. In its October 2024
comments on the draft report, SBA outlined its procedures for approving an authorization to
operate for IT systems and agreed that additional security measures would enhance the
deployment risk assessment and validation for the UCP system. In February 2025, SBA stated


Page 8                                              GAO-25-108048 SBA Priority Recommendations
that new senior leaders were being onboarded and briefed on key audit reports and
recommendations. SBA also noted that it would provide an official update regarding its progress
on this recommendation in May 2025.

To implement this recommendation, SBA would need to document that it had fully considered
the impact of deployment risks when authorizing the system. Establishing such procedures
would help SBA better ensure that such risks do not affect small business certification services.

High-Risk Area: Improving IT Acquisitions and Management

Director: Carol C. Harris

Contact Information: HarrisCC@gao.gov

Acting Director: Courtney LaFountain

Contact Information: lafountainc@gao.gov


Improving Oversight of Small Business Research Programs

Small Business Research Programs: Opportunities Exist for SBA and Agencies to Reduce
Vulnerabilities to Fraud, Waste, and Abuse. GAO-24-105470. Washington, D.C.: September 9,
2024.

Year Recommendations Made: 2024

Recommendation: The Administrator of SBA should ensure that the Associate Administrator
for the Office of Investment and Innovation leverages its oversight mechanisms to identify,
share, and report fraud-related convictions and findings of civil liability to SBIR.gov and address
participating agencies' challenges in understanding and meeting the 15-day reporting
requirement.

Actions Needed: SBA agreed with this recommendation. In March 2025, SBA stated it would
continue to report final adjudicated fraud-related settlements, convictions, and findings of civil
liability to SBIR.gov. SBA also noted that it intended to address reporting requirement
challenges through a future update of the Small Business Innovation Research (SBIR)/Small
Business Technology Transfer (STTR) Policy Directive.

To implement this recommendation, SBA needs to leverage monthly program manager
discussions with participating agencies to ensure timely contributions to the website. Taking
these steps would better position SBA to address information gaps in detecting potential fraud
and meeting the reporting requirement, improving the website’s utility as a deterrent against
fraud.

Recommendation: The Administrator of SBA should ensure that the Associate Administrator
for the Office of Investment and Innovation, to the full extent of the SBA's legal authority,
provides guidance to participating agencies to conduct comprehensive SBIR/STTR program
fraud risk assessments, including all key elements, in support of the Policy Directive's fraud,
waste, and abuse prevention requirements and consistent with Fraud Risk Framework leading
practices.



Page 9                                                GAO-25-108048 SBA Priority Recommendations
Actions Needed: SBA agreed with this recommendation. In March 2025, SBA stated it would
provide this guidance to program managers through training during fiscal year 2025. SBA also
noted that it would reinforce the guidance, to the extent of SBA’s legal authority, through a
subsequent SBIR/STTR Policy Directive update.

To implement this recommendation, SBA needs to issue guidance reinforcing fraud risk
assessment requirements for participating agencies to ensure they have taken steps to prevent
fraud, waste, and abuse in their SBIR/STTR programs. Implementing this recommendation
would increase these agencies’ awareness of the need to conduct fraud risk assessments that
use available fraud risk information, among other key elements of a comprehensive assessment
process.

Recommendation: The Administrator of SBA should ensure that the Associate Administrator
for the Office of Investment and Innovation improves SBIR.gov data quality by updating
guidance to require that abstracts are sufficiently complete and that applicant and awardee
addresses are verified to support program eligibility determinations.

Actions Needed: SBA agreed with this recommendation. In March 2025, SBA stated it would
continue to make system enhancements to SBIR.gov, such as by reworking the registration
processes to require validation through SAM.gov. SBA also noted it would work with agencies to
ensure mechanisms are in place to verify addresses where work is to be performed.

To implement this recommendation, SBA needs to provide guidance to agencies for ensuring
they collect complete and accurate information for abstracts and addresses. Accurate and
complete data enable participating agencies to verify applicant and awardee information—a key
control for ensuring that ineligible entities do not receive SBIR/STTR awards. Implementing the
recommendation would support agencies’ use of these data for preventing fraud, waste, and
abuse.

Director: Rebecca Shea

Contact Information: shear@gao.gov


Improving Disaster Recovery Efforts

Disaster Recovery: Additional Actions Needed to Identify and Address Potential Recovery
Barriers. GAO-22-104039. Washington, D.C.: December 15, 2021.

Year Recommendations Made: 2022

Recommendation: The SBA Associate Administrator of the Office of Disaster Assistance
should, in coordination with the Federal Emergency Management Agency (FEMA) Administrator
and the Housing and Urban Development (HUD) Assistant Secretary for Community Planning
and Development, develop, with input from key recovery partners, and implement an
interagency plan to help ensure the availability and use of quality information that includes (1)
information requirements, (2) data sources and methods, and (3) strategies for overcoming
information challenges—to support federal agencies involved in disaster recovery in identifying
access barriers or disparate outcomes.




Page 10                                             GAO-25-108048 SBA Priority Recommendations
Actions Needed: SBA agreed with this recommendation. SBA officials told us in February 2024
that they were working with FEMA and HUD to develop such an interagency plan. According to
FEMA officials, this plan was to be developed by December 2024. SBA officials also noted that
they were renewing interagency agreements with FEMA and HUD to coordinate data sharing. In
March 2025, SBA stated that new senior leaders were being onboarded and briefed on key
audit reports and recommendations. SBA also noted that it would provide an official update
regarding its progress on this recommendation as soon as possible.

To fully address the recommendation, SBA needs to work with FEMA and HUD to develop and
implement an interagency plan that specifies the data needed and the sources and methods for
obtaining the data. In addition, SBA must subsequently analyze the data to identify access
barriers and ways to mitigate them. Implementing this recommendation could improve service
delivery to disaster survivors and communities, improve the effectiveness of recovery efforts,
and reduce federal fiscal exposure.

Recommendation: The SBA Associate Administrator of the Office of Disaster Assistance
should coordinate with the FEMA Administrator and the HUD Assistant Secretary for
Community Planning and Development to design and establish routine processes to be used
within and across federal recovery programs to address identified access barriers and disparate
outcomes on an ongoing basis.

Actions Needed: SBA agreed with this recommendation. SBA officials told us in February 2024
that they were working with FEMA and HUD to develop such processes, which were to be
incorporated in an interagency plan (described above). SBA officials also noted other steps they
took to address access barriers and disparate outcomes. For example, they said they simplified
the disaster declaration process for rural communities under the Disaster Assistance for Rural
Communities Act and established Portable Loan Outreach Centers to serve hard-to-reach areas
or those with limited services. In March 2025, SBA stated that new senior leaders were being
onboarded and briefed on key audit reports and recommendations. SBA also noted that it would
provide an official update regarding its progress on this recommendation as soon as possible.

To fully implement this recommendation, SBA needs to work with FEMA and HUD to develop
and implement the aforementioned interagency plan and analyze the collected data to identify
access barriers and mitigation strategies. Implementing this recommendation could improve
service delivery to disaster survivors and communities, enhance recovery efforts, and reduce
federal fiscal exposure.

High-Risk Area: Improving the Delivery of Federal Disaster Assistance

Director: Chris P. Currie

Contact Information: curriec@gao.gov


Meeting Reporting Requirements in a More Timely Manner

Small Business Research Programs: Reporting on Award Timeliness Could Be Enhanced.
GAO-23-105591. Washington, D.C.: October 12, 2022.

Year Recommendation Made: 2023



Page 11                                            GAO-25-108048 SBA Priority Recommendations
Recommendation: The Administrator of the Small Business Administration should develop,
document, and execute a plan to (1) identify actions that could improve timely publication of its
annual report to Congress, and (2) implement the actions identified.

Actions Needed: SBA agreed with this recommendation. In March 2024, SBA officials stated
that the agency had assessed processes for producing the annual report. Since March 2024,
SBA published the annual reports for 2020–2022. As of February 2025, SBA had not published
the fiscal year 2023 report. In March 2025, SBA stated that new senior leaders were being
onboarded and briefed on key audit reports and recommendations. SBA also noted that it would
provide an official update regarding its progress on this recommendation as soon as possible.

To fully implement the recommendation, SBA would have to document processes for
consistently publishing annual reports in a timely manner. Fully implementing this
recommendation would help SBA meet its statutory responsibilities and give Congress timely
information to inform its decision-making and oversight.

Director: Candice N. Wright

Contact Information: wrightc@gao.gov


Small Business Administration: Procedures for Reporting on Veteran-Owned Businesses Need
Improvement. GAO-24-106071. Washington, D.C.: December 21, 2023.

Year Recommendation Made: 2024

Recommendation: The Administrator of SBA should ensure that the Associate Administrator of
SBA's Office of Veterans Business Development develop and implement policies and
procedures to ensure SBA's compliance with Section 603 of the Veterans Entrepreneurship and
Business Development Act of 1999.

Actions Needed: SBA agreed with this recommendation. In June 2024, SBA described plans to
implement policies and procedures for submitting an annual report to congressional committees.
In March 2025, SBA stated that new senior leaders were being onboarded and briefed on key
audit reports and recommendations. SBA also noted that it would provide an official update
regarding its progress on this recommendation as soon as possible.

To fully implement this recommendation, SBA needs to develop and execute these policies and
procedures. Doing so would help SBA meet its statutory responsibilities and provide Congress
with information needed for effective oversight of SBA programs.

Acting Director: Courtney LaFountain

Contact Information: lafountainc@gao.gov


Supporting Veteran-Owned Small Businesses

Small Business Administration: Procedures for Reporting on Veteran-Owned Businesses Need
Improvement. GAO-24-106071. Washington, D.C.: December 21, 2023.



Page 12                                              GAO-25-108048 SBA Priority Recommendations
Year Recommendation Made: 2024

Recommendation: The Administrator of SBA should ensure that the Associate Administrator of
SBA's Office of Capital Access develop and implement policies and procedures to ensure SBA
gives special consideration to veterans in its lending programs in accordance with the Small
Business Act and SBA's implementing regulation.

Actions Needed: SBA agreed with this recommendation. In June 2024, SBA described
incorporating specific guidance on giving special consideration to veterans in its lending
platform and standard operating procedures. In March 2025, SBA stated that new senior
leaders were being onboarded and briefed on key audit reports and recommendations. SBA
also noted that it would provide an official update regarding its progress on this recommendation
as soon as possible.

To fully implement this recommendation, SBA needs to provide documentation that it has
completed these efforts to develop and incorporate policies related to veterans. Implementing
such policies and procedures would help ensure that SBA complies with the statutory
requirement and would provide better assurance that veterans receive the special consideration
they are due.

Acting Director: Courtney LaFountain

Contact Information: lafountainc@gao.gov




Page 13                                             GAO-25-108048 SBA Priority Recommendations
Enclosure 2

Key Information About the Status of GAO Recommendations and Improving Agency
Operations

The Small Business Administration’s Recommendation Implementation Rate

In November 2024, we reported that, on a government-wide basis, 70 percent of our
recommendations made 4 years ago were implemented. 4 The Small Business Administration’s
(SBA) recommendation implementation rate was 96 percent. 5 As of March 2025, SBA had 55
open recommendations.

Implemented, Closed, and New Priority Recommendations

Our May 2024 letter to Administrator Guzman identified 13 priority recommendations. 6 Since
then, two recommendations were implemented, we removed the priority recommendation
designation of one recommendation, and we added seven new priority recommendations.

Implemented recommendations:

    •   Disaster response planning. In September 2024, SBA implemented our 2020
        recommendation to identify and document risks associated with its disaster response and
        plans to mitigate these risks. 7 SBA finalized a framework for how the agency will engage
        communities in its disaster response, including identifying risks common in rural areas. SBA
        also began using Portable Loan Outreach Centers to serve rural and underserved
        communities. These steps improve SBA’s ability to plan and implement disaster response
        efforts.

    •   Annual reporting for 8(a) program. In January 2025, SBA implemented our 2022
        recommendation to assess and address delays in annual reporting for the 8(a) Business
        Development program. 8 Specifically, SBA developed a process map detailing the timeline,
        activity categories, steps, documents, data sources, risks, and mitigation strategies for
        creating each section of the report. SBA also posted annual reports for fiscal years 2009–
        2023 on its website. Implementing this recommendation helps SBA meet its statutory
        responsibilities and provides Congress more timely information to inform its decision-
        making and oversight.



4GAO, Performance and Accountability Report: Fiscal Year 2024 (Washington, D.C.: Nov. 15, 2024).


5We calculated the implementation rate based on the total number of recommendations we made 4 years ago that

we have closed as implemented. However, we sometimes close recommendations as no longer valid when the
circumstances have changed. SBA implemented 26 of 27 recommendations made 4 years ago. We closed the last
recommendation as no longer valid. Last year, SBA’s implementation rate was 100 percent.
6GAO, Priority Open Recommendations: Small Business Administration, GAO-24-107299 (Washington, D.C.: May

31, 2024).
7GAO, Small Business Administration: Disaster Loan Processing Was Timelier, but Planning Improvements and Pilot

Program Evaluation Needed, GAO-20-168 (Washington, D.C.: Feb. 7, 2020).
8GAO, Small Business Administration: Recent Changes to the 8(a) Program's Financial Thresholds Need Evaluation,

GAO-22-104512 (Washington, D.C.: Aug. 30, 2022).



Page 14                                                     GAO-25-108048 SBA Priority Recommendations
Removed priority recommendation designation:

    •   In March 2025, we removed the priority recommendation designation from a 2013
        recommendation for SBA to increase Office of International Trade field staff as required by
        the Small Business Jobs Act of 2010. 9 The act required that no fewer than three export
        finance specialists be staffed in each of the 10 SBA regions, for a total of 30 specialists.
        According to SBA, banking industry consolidation and technological advances since 2010
        have facilitated its ability to support lenders and small business exporters remotely. As a
        result, SBA submitted a legislative proposal to Congress in March 2024 to reduce the act’s
        staffing requirement to 20 specialists nationwide and remove the regional staffing
        requirement. Given these changes in the operating environment and SBA’s efforts to
        update the act accordingly, we have removed the priority recommendation designation.

New priority recommendations: The seven new priority recommendations fall into the following
areas: (1) improving oversight and communication related to lessons learned from the COVID-19
pandemic response; (2) addressing cybersecurity and IT management challenges; and (3)
improving oversight of small business research programs (see Enclosure 1).

Financial Statement Audit

As an auditor of the consolidated financial statements of the U.S. government, I have noticed that
SBA was unable to receive an audit opinion on its fiscal years 2020 through 2024 financial
statements. SBA’s auditor reported several material weaknesses in internal control in fiscal years
2020 through 2024 related to SBA’s COVID-19 relief programs. These limitations on the audit
opinion and underlying internal control weaknesses, as well as related auditor recommendations,
are important issues, and I encourage you to address them.

High-Risk List

In February 2025, we issued our biennial update to our High-Risk List. 10 This list identifies
government operations with greater vulnerabilities to fraud, waste, abuse, and mismanagement.
It also identifies the need for transformation to address economy, efficiency, or effectiveness
challenges. Four of our high-risk areas—emergency loans for small businesses; improving IT
acquisitions and management; ensuring the cybersecurity of the nation; and improving the
delivery of federal disaster assistance—center on SBA.

Several other government-wide, high-risk areas also have direct implications for SBA
and its operations. These include improving strategic human capital management
and the personnel security clearance process and managing federal real property.

In addition to SBA’s high-risk areas, we urge your continued attention to the other government-
wide, high-risk issues as they relate to SBA. Progress on high-risk issues has been possible
through the concerted actions and efforts of Congress, the Office of Management and Budget,
and the leadership and staff in agencies, including within SBA. In March 2022, we issued a



9GAO, Export Promotion: Small Business Administration Needs to Improve Collaboration to Implement Its Expanded

Role, GAO-13-217 (Washington, D.C.: Jan. 30, 2013).
10GAO, High-Risk Series: Heightened Attention Could Save Billions More and Improve Government Efficiency and

Effectiveness, GAO-25-107743 (Washington, D.C.: Feb. 25, 2025).



Page 15                                                    GAO-25-108048 SBA Priority Recommendations
report on key practices to successfully address high-risk areas, which can be a helpful resource
as your agency continues to make progress to address high-risk issues. 11

Congress’s Role on GAO Recommendations

We also recognize the key role Congress plays in providing oversight and maintaining focus on
our recommendations to ensure they are implemented and produce their desired results.
Legislation enacted in December 2022 includes a provision for GAO to identify any additional
congressional oversight actions that can help agencies implement priority recommendations
and address any underlying issues relating to such implementation. 12

Congress can use various strategies to address our recommendations, such as incorporating
them into legislation. Congress can also use its budget, appropriations, and oversight processes
to incentivize executive branch agencies to act on our recommendations and monitor their
progress. For example, Congress can hold hearings focused on SBA’s progress in
implementing GAO’s priority recommendations, withhold funds when appropriate, or take other
actions to provide incentives for agencies to act. Moreover, Congress can follow up during the
appropriations process and request periodic updates.

Congress also plays a key role in addressing any underlying issues related to the
implementation of these recommendations. For example, Congress can pass legislation
providing an agency explicit authority to implement a recommendation or requiring an agency to
take certain actions to implement a recommendation.




11GAO, High-Risk Series: Key Practices to Successfully Address High-Risk Areas and Remove Them from the List,

GAO-22-105184 (Washington, D.C.: Mar. 3, 2022).
12James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. No. 117-263, § 7211(a)(2), 136

Stat. 2395, 3668 (2022); H.R. Rep. No. 117-389 (2022) (accompanying Legislative Branch Appropriations Act, H.R.
8237, 117th Cong. (2022)).



Page 16                                                      GAO-25-108048 SBA Priority Recommendations
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
                      The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission         arm of Congress, exists to support Congress in meeting its constitutional
                      responsibilities and to help improve the performance and accountability of the
                      federal government for the American people. GAO examines the use of public
                      funds; evaluates federal programs and policies; and provides analyses,
                      recommendations, and other assistance to help Congress make informed
                      oversight, policy, and funding decisions. GAO’s commitment to good government
                      is reflected in its core values of accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of   through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and       released reports, testimony, and correspondence. You can also subscribe to
                      GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone        The price of each GAO publication reflects GAO’s actual cost of production and
                      distribution and depends on the number of pages in the publication and whether
                      the publication is printed in color or black and white. Pricing and ordering
                      information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card, MasterCard,
                      Visa, check, or money order. Call for additional information.

                      Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Connect with GAO      Subscribe to our Email Updates. Listen to our Podcasts.
                      Visit GAO on the web at https://www.gao.gov.

                      Contact FraudNet:
To Report Fraud,
                      Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
                      Automated answering system: (800) 424-5454
Federal Programs
                      Sarah Kaczmarek, Managing Director, Media@gao.gov
Media Relations

                      A. Nicole Clowers, Managing Director, CongRel@gao.gov
Congressional
Relations
                      https://www.gao.gov/about/contact-us
General Inquiries




                         Please Print on Recycled Paper.


File and source

File

gao-25-108048.pdf

Size

232,477 bytes

SHA-256

3ca4702e77a13b12f772703a03a31c5649e8a432f16afcd65847c3cb884a2bc1

Our copy

gao-25-108048.pdf

Original

www.gao.gov