Memorandum: Key Recommendations Based on Lessons Learned from Prior COVID-19 Loan Programs (December 23, 2020)

Summary

Memorandum dated December 23, 2020, from Hannibal "Mike" Ware, Inspector General, to Jovita Carranza, Administrator,, titled Key Recommendations Based on Lessons Learned from Prior COVID-19 Economic Injury Disaster and Paycheck Protection Program Loan Programs. It follows the Consolidated Appropriations Act, 2021, which the memo says authorized approximately $280 billion for the SBA. For PPP it recommends that SBA assess internal controls, have lenders validate loan amounts and business start dates, work with Treasury on using the Do Not Pay portal, and add industry and demographic fields to the application. For EIDL it recommends controls on deposits to legitimate bank accounts, photo ID verification, a Rule of Two requiring two people to approve each application, and freezing applications that reuse EINs, SSNs or addresses used by fraudsters.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

                               Office of Inspector General
                                U.S. Small Business Administration

                                       MEMORANDUM
DATE:           December 23, 2020

TO:             Jovita Carranza
                Administrator

FROM:           Hannibal “Mike” Ware
                Inspector General

SUBJECT:        Key Recommendations Based on Lessons Learned from Prior COVID-19
                Economic Injury Disaster and Paycheck Protection Program Loan Programs

On December 21, 2020, Congress passed the Consolidated Appropriations Act, 2021, which
includes an additional $900 billion in relief funding for the Coronavirus Disease 2019
(COVID-19) pandemic. The Act authorized approximately $280 billion for the Small
Business Administration (SBA) to assist struggling businesses. The bill will be presented to
the President for his consideration.
At your request and based on our prior and ongoing reviews of the Paycheck Protection
Program (PPP) and Economic Injury Disaster Loan (EIDL) program advances and loans, we
are offering key recommendations to strengthen internal controls to prevent fraud and
ensure only eligible businesses receive funds.
OIG has published four reports presenting findings pertaining to SBA’s pandemic response
programs, in addition to three White Papers we published last spring to increase risk
awareness and offer lessons learned from our reviews of SBA’s previous responses to
disasters and administration of economic stimulus loans. 1
OIG also has provided you with draft reports addressing the implementation of the PPP and
recipients of PPP loans who are on the U.S. Department of the Treasury’s Do Not Pay List.
These reports included seven recommendations to reduce significant fraud risks and
ensure integrity of the PPP and COVID-19 EIDLs.
Premised on our prior and ongoing reviews, OIG believes there are key actions that SBA
officials can take to ensure eligible businesses receive these funds and prevent fraud in the
programs. As we noted in our White Papers addressing risk awareness and lessons learned,
success depends on establishing appropriate internal controls and comprehensive, clear,
and consistent guidance at the outset.
As you implement these programs so critical to the nation’s small businesses and economic
well-being, please consider the following recommendations for the PPP and COVID-19 EIDL
programs.



1 Report 20-14, Report 20-16, Report 21-02, and Report 21-03.
PPP Considerations

   •   Assess vulnerabilities in internal controls and strengthen or implement necessary
       internal controls to address ineligible loans and potential fraud. At a minimum, we
       believe it is critical for the agency to implement a process to ensure lenders validate
       that
          o the loan amount does not exceed the maximum amount per employee.
          o the business was established before the mandated date. This may require
            coordination with the Department of Treasury to verify the dates the
            business applied for and received a Taxpayer Identification Number.
          o the loan amount does not exceed the maximum number of employees or
            other applicable size standards.
   •  Work with Treasury to develop a technical solution to enable use of Treasury’s Do
      Not Pay portal to determine loan applicant eligibility and prevent improper
      payments before the release of any federal funds.
   • Update the PPP borrower application to include a field for the North American
      Industry Classification System code for the business category and the business
      description to prevent potentially ineligible loan approvals.
    • Revise the application to include the demographic information of borrowers.

EIDL Considerations
   • Establish or strengthen controls to ensure loan deposits are made to legitimate bank
     accounts for eligible borrowers only. At a minimum, prevent the change of loan
     application information post-approval without having that information reviewed
     again by a person.
   • Strengthen or establish controls to ensure multiple loans are provided only to
     eligible applicants and prevent the erroneous duplication of loans. At a minimum:
         o Obtain a photo ID of the applicant to verify their identity.
         o Verify that the applicant is not on Treasury’s Do Not Pay List for delinquent
             child support and has not been suspended or debarred.
         o Verify the applicant is a legitimate business through tax returns,
             incorporation, not-for-profit records with secretary of state offices, or
             another method.
         o Institute a “Rule of Two” requiring two people to approve each loan
             application and eliminate the batch approval process.
         o Require human contact with applicants who submit multiple applications
             from the same IP addresses, email addresses, physical addresses, or bank
             account number to verify these applicants are legitimate.
         o Ensure the system promptly identifies all risk factors (fraud, duplicate
             applications, and information flags) and require full mitigation of those
             issues before approval.


                                              2
    •   Strengthen controls for verifying an entity’s start date to ensure applicants meet
        eligibility requirements. At a minimum:
          o Prevent illegitimate duplicate applications for applications with the same
              Employer Identification Number (EIN) or Social Security Number (SSN).
          o Establish a system to freeze applications with the same EINs, SSNs, Internet
              provider addresses, email addresses, physical addresses, or bank accounts
              used by fraudsters to prevent additional fraudulent applications from being
              submitted.
          o Ensure the EINs were registered before the eligibility date.

This memorandum summarizes recommendations pertaining to areas of concern identified
through prior and ongoing reviews and investigations. The suggested actions are intended
to align with review findings and recommendations made for corrective action. The prior
and ongoing reviews were performed under the Council of the Inspectors General for
Integrity and Efficiency’s Quality Standards for Inspection and Evaluation.
If you have any questions please contact me at 202-205-6586 or Andrea Deadwyler,
Assistant Inspector General for Audits, at 202-205-6616.




                                            3


File and source

File

ig-memo-administrator-covid-additional-funding.pdf

Size

167,343 bytes

SHA-256

8b2f17258fb142a45906fb5ae44fa94e2657fc5e874ab3614c77c392bbfc5a4a

Our copy

ig-memo-administrator-covid-additional-funding.pdf

Original

www.sba.gov