Independent Auditors' Report on SBA's Fiscal Year 2024 Compliance with the Payment Integrity Information Act of 2019 (2025-05-15)
Summary
In a May 15, 2025 memorandum to Administrator Kelly Loeffler, Deputy Inspector General Sheldon Shoemaker of the SBA Office of Inspector General transmits KPMG LLP's performance audit of SBA's fiscal year 2024 compliance with the Payment Integrity Information Act of 2019 (Report 25-15). KPMG found SBA was not compliant with the Act and OMB guidance. It states SBA did not publish improper and unknown payment estimates for the Shuttered Venue Operators Grant and Section 1112 Payments, and did not design adequate review procedures for estimates in programs including PPP loan forgiveness and PPP loan guaranty purchases. It also states SBA did not achieve an improper and unknown payment estimate of less than 10 percent for PPP loan forgiveness, PPP loan guaranty purchases and the Restaurant Revitalization Fund. SBA concurred with the recommendations.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Independent Auditors' Report on SBA's Fiscal Year 2024 Compliance with the Payment Integrity Information Act of 2019 (2025-05-15).”
Original at www.oversight.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/independent-auditors-report-on-sba-s-fiscal-year-2024-compliance-with-2dc3ce23bb/
, SHA-256 0a529f6570702df4748e11551af0ef3ef82af19c2530608779c949290c79d0a5.Full text
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
DATE: May 15, 2025
TO: Kelly Loeffler
Administrator
FROM: Sheldon Shoemaker
Deputy Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Fiscal Year 2024 Compliance with the
Payment Integrity Information Act of 2019 (Report 25-15)
This independent auditors’ report on the U.S. Small Business Administration’s (SBA) improper
payment reporting is required by the Payment Integrity Information Act of 2019. We contracted
with the independent certified public accounting firm KPMG LLP to conduct a performance audit
of SBA’s fiscal year (FY) 2024 compliance with the Act. The auditor was engaged to review the
payment integrity section of SBA’s Agency Financial Report Fiscal Year 2024 and accompanying
materials to determine whether the agency complied with the reporting requirements under the
Act.
KPMG was engaged to conduct the audit in accordance with Government Auditing Standards
issued by the Comptroller General of the United States and applicable American Institute of
Certified Public Accountants standards. The audit also complied with the Council of the
Inspectors General on Integrity and Efficiency’s Guidance for Payment Integrity Information Act
Compliance Reviews.
In the report, KPMG auditors found SBA was not compliant with reporting requirements under
the Act and Office of Management and Budget (OMB) guidance. Specifically, SBA is not
compliant with the Act because it did not:
• Publish improper and unknown payment estimates within the FY 2024 Agency Financial
Report and accompanying materials for the Shuttered Venue Operators Grant and the
payments for covered loans in the 7(a) and 504 loan guaranty programs under the Debt
Relief Program (Section 1112 Payments).
• Design and implement adequate review procedures to produce reliable sample results
that were used to develop and publish accurate improper and unknown payment
estimates for the 7(a) loan guaranty purchases, disaster assistance loans, Paycheck
Protection Program (PPP) loan forgiveness, and PPP loan guaranty purchases programs.
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
• Publish effective corrective action plans for the PPP loan forgiveness and PPP loan
guaranty purchases and did not publish corrective action plans for the Section 1112
payment programs and activities. Also, the reduction targets were not published for the
Section 1112 payments. Moreover, SBA did not appropriately disclose the root causes of
improper payments for the disaster assistance loans program in the accompanying
materials.
• Improve payment integrity for the 7(a) loan guaranty approvals and 504 Certified
Development Company loan approvals programs and activities as demonstrated by the
increase in improper payment estimates between FYs 2023 and 2024.
• Achieve an improper and unknown payment estimate of less than 10 percent for the PPP
loan forgiveness, PPP loan guaranty purchases, and Restaurant Revitalization Fund
programs and activities.
In connection with the contract, we reviewed KPMG’s report and related audit documentation
and spoke with KPMG staff. Our review, as differentiated from an audit in accordance with the
Government Auditing Standards, was not intended to enable us to express, and we do not
express, opinions on SBA’s compliance with the Act or internal controls over improper payment
reporting. KPMG is responsible for the attached auditors’ report dated May 15, 2025 and the
conclusions expressed.
Our oversight protocols include evaluation of major work products, attendance at critical
meetings, review of significant findings, and examination of related evidential matter. Our review
disclosed no instances where KPMG did not comply in all material respects with Government
Auditing Standards.
SBA concurred with the recommendations and indicated that it is committed to reducing the
dollar amount of improper payments, ensuring program integrity, and continuing to implement
effective risk management procedures in accordance with improper payment legislation, as well
as guidance prescribed in OMB Memorandum M-21-19, Appendix C to OMB Circular A-123,
Requirements for Payment Integrity Improvement.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or
your staff have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.
2
cc: Wesley Coopersmith, Chief of Staff, Office of the Administrator
Nathan Davis, Chief Financial Officer and Chief Risk Officer, Office of Performance Planning,
and the Chief Financial Officer
Deborah Chen, Deputy Chief Financial Officer, Office of Performance Planning, and the
Chief Financial Officer
Anna Maria Calcagno, Director, Office of Strategic Management and Enterprise Integrity
Walter B. Hill Jr., Financial Program Specialist, Office of Strategic Management and
Enterprise Integrity
Alex H. Wilson, Senior Policy Advisor, Office of Performance, Planning, and the Chief
Financial Officer
Thomas Kimsey, Associate Administrator, Office of Capital Access
Chris Stallings, Associate Administrator, Office of Disaster Recovery and Resilience
Wendell Davis, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Attachment
3
Performance Audit of the U.S. Small Business Administration’s Fiscal Year
2024 Compliance with the Payment Integrity Information Act of 2019
Prepared for: U.S. Small Business Administration, Office of Inspector General
Date: May 15, 2025
KPMG LLP
1801 K Street NW, Suite 12000
Washington DC 20006
Table of Contents
Auditor’s Report ......................................................................................................................... 3
I. BACKGROUND ................................................................................................................... 7
II. OBJECTIVE, SCOPE, AND METHODOLOGY..................................................................... 8
III. RESULTS AND CONCLUSIONS ......................................................................................... 9
IV. FINDINGS ...........................................................................................................................11
A. DEFICIENCIES IN INTERNAL CONTROL......................................................................11
B. RECOMMENDATIONS ...................................................................................................14
V. APPENDIX I: MANAGEMENT’S RESPONSE TO REPORT ...............................................15
2
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
Auditor’s Report
Administrator
Inspector General
U.S. Small Business Administration
This report presents the results of our performance audit related to the U.S. Small Business
Administration’s (SBA’s) compliance with the requirements contained in the Payment Integrity
Information Act of 2019 (PIIA), section 3351(2). We performed our work between December 12,
2024, and May 15, 2025, and our results are as of May 15, 2025.
We conducted this performance audit in accordance with the standards applicable to
performance audits contained in the Generally Accepted Government Auditing Standards
(GAGAS) issued by the Comptroller General of the United States. Those standards require that
we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable
basis for our findings and conclusions based on our audit objective. We believe that the
evidence obtained provides a reasonable basis for our findings and conclusions based on our
audit objective.
In addition to GAGAS, we conducted this performance audit in accordance with the Statements
on Standards for Consulting Services established by the American Institute of Certified Public
Accountants (AICPA). This performance audit did not constitute an audit of SBA’s financial
statements, or an attestation level report as defined under GAGAS and AICPA standards for
attestation engagements.
We used the Council of the Inspectors General on Integrity and Efficiency Guidance (CIGIE) for
Payment Integrity Information Act Compliance Reviews dated October 19, 2023, which provides
guidance regarding the fieldwork and reporting related to the performance audit objective. The
objective of our performance audit was to determine whether SBA complied with the PIIA for
fiscal year (FY) 2024.
Based on the results of our performance audit procedures, we have met our audit objective.
We determined that SBA was not compliant with PIIA due to the following:
• SBA did not publish improper and unknown payment estimates within the FY 2024
Agency Financial Report (AFR) and accompanying materials for the Shuttered Venues
Operator Grant (SVOG), and the payments for covered loans in the 7(a) and 504 loan
guaranty programs under the Debt Relief Program (Section 1112 payments). As a
result, these programs and activities did not comply with the requirement to report
improper and unknown payment rate estimates of less than 10 percent.
• SBA did not design and implement adequate review procedures to produce reliable
sample results that were used to develop and publish accurate improper and unknown
payment estimates for the 7(a) Loan Guaranty Purchases, Disaster Assistance Loans,
Paycheck Protection Program (PPP) Loan Forgiveness, and PPP Loan Guaranty
Purchases programs.
KPMG LLP, a Delaware limited liability partnership and a member firm of
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee. 3
• SBA did not publish effective corrective action plans for the PPP Loan Forgiveness and
PPP Loan Guaranty Purchases and did not publish corrective action plans for the
Section 1112 payment programs and activities. Also, the reduction targets were not
published for the Section 1112 payments. Moreover, SBA did not appropriately disclose
the root causes of improper payments for the Disaster Assistance Loans program in the
accompanying materials.
• SBA did not improve their payment integrity for the 7(a) Loan Guaranty Approvals and
504 Certified Development Loan Approvals programs and activities as demonstrated by
the increase in improper payment estimates between FYs 2023 and 2024.
• SBA did not report an improper and unknown payment estimate of less than 10 percent
for the PPP Loan Forgiveness, PPP Loan Guaranty Purchases, and Restaurant
Revitalization Fund (RRF) programs and activities.
See Table 1 for a summary of SBA’s compliance with the PIIA for FY 2024 for programs and
activities reported by SBA in the FY 2024 AFR or accompanying materials.
Table 1. Summary of SBA’s PIIA Compliance
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
5a) Published
Payment and Unknown
Integrity Information
and Accompanying
to Meet the Reduction
Program or
Concluded from Risk
Corrective Action Improvements to
Activity
Payment Estimate of
Payment Estimates
Materials on the
within the AFR Agency Website Assessment Assessment Plans Reduction Target Payment Integrity Target Less Than 10 Percent
7(a) Loan
Not Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant
Approvals
7(a) Loan
Not Not Not Not
Guaranty Compliant Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant
Purchases
504 Certified
Development Not Not Not Not
Compliant Compliant Compliant Compliant Compliant Compliant
Loan Applicable Applicable Compliant Compliant
Approvals
Disaster
Not Not Not Not Not
Assistance Compliant Compliant Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Compliant
Loans
Paycheck
Protection
Not Not Not Not Not Not Not
Program (PPP) Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Compliant Compliant Compliant
Loan
Forgiveness
Paycheck
Protection
Not Not Not Not Not Not Not
Program (PPP) Compliant Compliant Compliant
Applicable Applicable Compliant Compliant Compliant Compliant Compliant
Loan Guaranty
Purchases
Restaurant
Not Not Not Not Not Not Not
Revitalizatio Compliant Compliant Compliant
Applicable Applicable Applicable Applicable Applicable Applicable Compliant
n Fund (RRF)
Shuttered
Venues
Not Not Not Not Not Not Not Not Not Not
Operator
Compliant Compliant Applicable Applicable Compliant Applicable Applicable Applicable Applicable Compliant
Grant
(SVOG)
4
6) Reported Improper
1a) Published Payment
3) Published Improper
2b) Adequately 5c) Developed a Plan
2a) Conducted Risk
1b) Posted the AFR
4) Published 5b) Demonstrated
5a) Published
Payment and Unknown
Integrity Information
and Accompanying
to Meet the Reduction
Program or
Concluded from Risk
Improvements to
Activity
Corrective Action Payment Estimate of
Payment Estimates
Materials on the
within the AFR Agency Website Assessment Assessment Plans Reduction Target Payment Integrity Target Less Than 10 Percent
Section
1112 Not Not Not Not Not Not Not Not
Compliant Compliant
payments Compliant Compliant Compliant Compliant Compliant Applicable Compliant Compliant
The compliance requirements 2a and 2b are not applicable for programs and activities in the
second of two review phases for improper and unknown payments reporting (i.e., Phase 2)
because the risk assessments performed indicated that the programs were likely to make IPs
and UPs above the statutory threshold, as defined by the Office of Management and Budget
(OMB) Memorandum M-21-19, Transmittal of Appendix C to OMB Circular No. A-123,
Requirements for Payment Integrity Improvement (OMB Memorandum M-21-19). During our
testing, we found that the programs and activities included in Table 1 were in Phase 2 of review.
Additionally, we found that a risk assessment was performed for the Growth Accelerator Fund
Competition (GAFC) Program and SBA reasonably concluded that the program was not
susceptible to improper and unknown payments and was compliant with requirements 2a and
2b during the current fiscal year, and therefore is not included in Table 1. The GAFC Program
provides funding to parties and organizations that offer entrepreneurial support to science,
technology, engineering, and mathematical (STEM) and research and development (R&D)
entrepreneurs. We noted that GAFC exceeded $10M in disbursements during the FY2024 PIIA
cycle, thus triggering the requirement for SBA to perform a risk assessment for the program.
During our current year testing, we found that an updated risk assessment was conducted for
Section 1112 payments, and the program was deemed susceptible to improper and unknown
payments above or below the statutory threshold. We noted that an updated risk assessment for
Section 1112 payments should have been conducted in the prior fiscal year (i.e. FY 2023)
based on the SBA’s plan to revise the risk assessment process to ensure consideration for each
risk factor was adequate and fair. Given SBA’s conclusions, the program would have entered
into Phase 2 in the prior fiscal year and should have reported improper and unknown payments
in the current fiscal year to satisfy PIIA compliance requirement 3.
The compliance requirements for 4, 5a, and 5c are not applicable for the RRF, and SVOG
programs and activities since payments for these programs ended as of the FY 2024 reporting
period.
The compliance requirement 5b is not applicable for the RRF, SVOG, and Section 1112
payments programs and activities because the improper and unknown payment rate estimates
were not reported in the prior fiscal year for these programs and activities.
Our findings, identified internal control deficiencies, and related recommendations are detailed
in Section IV.
5
We caution that projecting the results of our performance audit, as described above, to future
periods is subject to the risks that controls may become inadequate due to changes in
conditions or compliance with controls may deteriorate.
SBA’s response to the findings identified in our performance audit is presented in Appendix I.
SBA’s response was not subjected to the auditing procedures applied in this performance audit
and, accordingly, we are unable to determine if management’s response provides a reasonable
basis for our findings and conclusions based on our audit objective.
This report is intended solely for the use of the U.S. Small Business Administration and
Inspector General, Comptroller General, the Office of Management and Budget, and relevant
congressional committees; and is not intended to be and should not be relied upon by anyone
other than these specified parties.
May 15, 2025
6
I. BACKGROUND
The Payment Integrity Information Act of 2019 (PIIA) Public Law (P.L.) 116-117 repealed the
Improper Payments Elimination and Recovery Act of 2010 (IPERA) P.L. 111-204 (and other
laws) but set forth similar improper payment reporting requirements, including an annual
compliance report by Inspectors General.
PIIA requires an annual compliance report by an agency’s Inspector General and defines what
constitutes compliance with the requirements. An agency has met the PIIA compliance
requirements if they:
• published improper payments information within an agency financial report (AFR) or
performance and accountability report (PAR) for the fiscal year ended September 30,
2024, and posted that report and any accompanying materials required by OMB on the
agency website;
• conducted a program specific risk assessment for each program that conforms with
section 3352(a) of PIIA (if required);
• published improper payment estimates for all programs identified as susceptible to
significant improper payments under its risk assessment under section 3352(a) of PIIA
(if required);
• published programmatic corrective action plans under section 3352(d) of PIIA in the
AFR or PAR or the accompanying materials (if required);
• published reduction targets under section 3352(d) of PIIA, developed a plan to meet the
reduction targets, and demonstrated improvements for each program assessed to be at
risk and estimated for improper payments (if required and applicable); and
• reported a gross improper payment rate of less than 10 percent for each program and
activity for which an improper payment estimate was published under section 3352(c) of
PIIA.
If an agency does not meet one or more of the six requirements above, then it is not compliant
under PIIA.
On March 5, 2021, OMB issued Memorandum M-21-19, Transmittal of Appendix C to OMB
Circular No. A-123, Requirements for Payment Integrity Improvement (OMB Memorandum M-
21-19), as updated implementation guidance to federal agencies. OMB Memorandum M-21-19
requires agencies to identify susceptible programs with an improper payment risk assessment,
report improper payment estimates, identify root causes of the improper payments, develop,
implement, and monitor corrective actions, and recapture improper payments identified.
We performed our fiscal year (FY) 2024 compliance review using the requirements set forth in
OMB Memorandum M-21-19, OMB Circular No. A-136, Financial Reporting Requirements dated
May 19, 2023, OMB Annual Data Call Instructions, OMB Payment Integrity Question and
Answer Platform, and the Council of the Inspectors General on Integrity and Efficiency (CIGIE)
Guidance for Payment Integrity Information Act Compliance Reviews.
7
II. OBJECTIVE, SCOPE, AND METHODOLOGY
Objective
We conducted this performance audit to determine whether SBA complied with the PIIA for FY
2024.
Scope
The scope of our performance audit was SBA’s FY 2024 improper payments and reporting data
in the payment integrity section of the agency’s FY 2024 AFR and any accompanying materials.
The accompanying materials to the AFR are the payment integrity information published on
paymentaccuracy.gov.
Methodology
During our planning and testing phases, we performed the following to achieve our objective:
• interviewed staff from SBA’s Offices of Performance, Planning, and the Chief Financial
Officer and Capital Access that performed the improper payment reviews;
• collected and inspected SBA provided documentation and evidence, and
• participated in process and control walkthroughs with SBA staff responsible for the
programs identified as susceptible to significant improper payments.
Our detailed procedures consisted of, but were not limited to, the following:
• obtained an understanding of SBA’s improper payments reporting process and relevant
controls through inquiries with management;
• reviewed SBA’s policies and procedures over the improper payments reporting process;
• reviewed management’s risk assessment for agency programs identified as susceptible
to significant improper payments;
• reviewed related legislation for significant changes or increases in funding levels for
each program;
• reviewed and evaluated the statistically determined improper payment and unknown
payment estimates for each program deemed susceptible to improper payments in
consultation with a statistician;
• reviewed and evaluated the population of outlays for each program for completeness
and accuracy;
• reviewed and evaluated SBA’s payment integrity section in the AFR and accompanying
materials for completeness and accuracy;
• evaluated the corrective actions published and determined whether they focus on the
true root cause, and were implemented;
• evaluated the root cause category classifications and determined whether SBA
accurately classified the true root causes of improper payments, and
• obtained OMB waivers/exemptions for improper payments reporting (if applicable).
We used the CIGIE Guidance for Payment Integrity Information Act Compliance Reviews, as it
provides guidance regarding the fieldwork and reporting related to the performance audit
objective.
8
We obtained sufficient and appropriate evidence to provide a reasonable basis for our
conclusions related to the audit objective.
III. RESULTS AND CONCLUSIONS
We determined that the SBA was not compliant under PIIA based on our audit procedures
performed. See below for additional details of our results.
Requirement 1a – Determine if SBA published payment integrity information within the AFR for
the fiscal year ended September 30, 2024.
• Not Compliant. SBA did not publish payment integrity information in its FY 2024 AFR for
the Shuttered Venues Operator Grant (SVOG), and the payments for covered loans in
the 7(a) and 504 loan guaranty programs under the Debt Relief Program (Section 1112
payments).
Requirement 1b – Determine if SBA posted the AFR and any accompanying materials required
by OMB on the agency website.
• Not Compliant. SBA did not publish payment integrity information in the AFR or any
accompanying materials for the SVOG, and the Section 1112 payments on the
agency’s website.
Requirement 2a – Determine if SBA conducted a program specific risk assessment for each
program with annual outlays greater than $10 million at least once in the last three years.
• Compliant. SBA performed risk assessments for the Growth Accelerator Fund
Competition Program and Section 1112 payments in FY 2024. During FY 2022 and
FY2023, SBA conducted risk assessments for all other programs with annual outlays
greater than $10 million at least once every three years, or earlier if a program
experiences a significant change in legislation or a significant increase in funding level
in accordance with OMB Memorandum M-21-19.
Requirement 2b – Determine if SBA adequately concluded whether the program is likely to
make improper payments and unknown payments above or below the statutory threshold.
• Compliant. SBA adequately concluded that the Growth Accelerator Fund Program was
not likely to, and correspondingly, the Section 1112 payments were likely to, make
improper payments and unknown payments above or below the statutory threshold in
accordance with the PIIA reporting requirements.
Requirement 3 – Determine if SBA published improper payment and unknown payment
estimates for all programs identified as susceptible to significant improper payments and
unknown payments in the accompanying materials to the AFR.
• Not Compliant. SBA did not design and implement adequate review procedures over
the documentation of the sample results used to produce the programs’ improper and
unknown payment estimates to ensure that the procedures could be reperformed and
the results independently validated for the 7(a) Loan Guaranty Purchases, Disaster
Assistance Loans, PPP Loan Forgiveness, and PPP Loan Guaranty Purchases
programs and activities. The improper payment amount was incorrectly reported for
several 7(a) Loan Guaranty Purchases and PPP loan Forgiveness transactions, and the
9
improper payment type (e.g. underpayment or overpayment) was incorrectly reported
for several Disaster Assistance Loans. Additionally, the interest portion for each PPP
Loan Forgiveness and PPP Loan Guaranty Purchases sample payment was not tested
for accuracy as part of the review procedures for the activities.
SBA did not report improper and unknown payment estimates for SVOG and Section
1112 payments. In prior years, SBA did not adequately perform risk assessments for
these programs to ensure PIIA compliance. Also, SBA did not adequately perform their
responsibility to review the criteria for reporting to ensure compliance for these
programs in FY 2024.
Requirement 4 – Determine if SBA published corrective action plans for each program for which
an estimate above the statutory threshold was published in the accompanying materials to the
AFR.
• Not Compliant. SBA did not publish corrective actions for the Section 1112 payments.
Further, the published corrective action plans for the PPP Loan Forgiveness and PPP
Loan Guaranty Purchases activities did not adequately address the root causes of the
improper and unknown payments. Therefore, these corrective actions would not be
effective in reducing the improper and unknown payment rates.
Additionally, the root causes for the Disaster Assistance Loans program improper
payments were not accurately reported in the accompanying materials.
Requirement 5a – Determine if SBA published improper payment and unknown payment
reduction targets for each program for which an estimate above the statutory threshold was
published in the accompanying materials to the AFR.
• Not Compliant. SBA did not accurately disclose the reduction targets in the AFR for all
reported and applicable programs.
Requirement 5b – Determine if SBA demonstrated improvements to payment integrity or
reached a tolerable improper payment and unknown payment rate.
• Not Compliant. SBA did not improve the payment integrity for 7(a) Loan Guaranty
Approvals and 504 Certified Development Loan Approvals as demonstrated by the
increase to the improper and unknown payment estimates between FYs 2023 and
2024.
Requirement 5c – Determine if SBA developed a plan to meet the improper payment and
unknown payment reduction target.
• Not Compliant. SBA did not meet the reduction targets established for PPP Loan
Forgiveness, and PPP Loan Guaranty Purchases activities. Additionally, SBA did not
develop improper payment and unknown payment reduction targets and a plan to meet
reduction targets for the Section 1112 payments.
10
Requirement 6 – Determine if SBA reported an improper payment and unknown payment rate
estimate of less than 10 percent for each program for which an improper payment estimate was
published in the accompanying materials to the AFR.
• Not Compliant. SBA published improper payment and unknown payment rate estimates
greater than 10 percent for the PPP Loan Forgiveness, PPP Loan Guaranty Purchases
and Restaurant Revitalization Fund (RRF) programs and activities. Additionally, SBA
did not report improper and unknown payment rate estimates for the SVOG, and
Section 1112 payments.
Our findings identified internal control deficiencies, and related recommendations for each
requirement are detailed in Section IV below.
IV. FINDINGS
See Section III. RESULTS AND CONCLUSIONS (above). Refer to Section IV.A and IV.B for
details on the identified internal control deficiencies, and related recommendations.
A. DEFICIENCIES IN INTERNAL CONTROL
In planning and performing our performance audit of SBA’s FY 2024 compliance with PIIA
reporting, we considered internal controls that were relevant to our audit objective by obtaining
an understanding of those controls and assessing control risk for the purposes of achieving our
objective.
The objective of our audit was not to provide assurance on internal controls; therefore, we did
not express an opinion on internal controls. Our consideration of SBA’s internal controls relevant
to our audit objective would not necessarily disclose all deficiencies that might be significant
within the context of the audit objective.
As a result of our assessment of internal controls relevant to the audit objective and our
compliance test work, we identified the following deficiencies in internal control:
Program or Activity Control Deficiencies
PPP Loan Forgiveness 1. The preventative controls implemented to reduce improper payments
for the PPP programs and activities, and the procedures implemented
PPP Loan Guaranty to obtain sufficient documentation from RRF award recipients, were not
Purchases effective as the improper and unknown payment rates reported exceed
the statutory compliance threshold of 10%.
RRF
7(a) Loan Guaranty 2. The preventative controls implemented to reduce improper payments
Approvals were not effective as the gross improper payment and unknown payment
rate increased from FY 2023 to FY 2024.
504 Certified
Development Loan
Approvals
11
Program or Activity Control Deficiencies
PPP Loan Forgiveness 3. The preventive controls to reduce improper payments were not effective
as the reduction targets established for FY 2024 were not met.
PPP Loan Guaranty
Purchases
Shuttered Venue 4. Management did not effectively review the criteria established for PIIA
Operators Grant reporting and excluded the improper and unknown payment estimates for
Program (SVOG) the SVOG and Section 1112 payments programs and activities.
Payments for Covered
Loans in the 7(a) and
504 Loan Guaranty
Programs under the
Debt Relief Program
(Section 1112
payments)
Disaster Assistance 5. The sampling and estimation methodology plan, as implemented by the
Loans statisticians, had errors in the statistical measures of precision and a
management review was not performed to ensure the results were
PPP Loan Forgiveness appropriate.
PPP Loan Forgiveness 6. There were not adequate review controls designed and implemented to
ensure the margins of error reported in the accompanying materials
PPP Loan Guaranty were accurate.
Purchases
7(a) Loan Guaranty 7. The review process established over sample testing to ensure results
Purchases were accurately reported was not effective.
Disaster Assistance
Loans
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
PPP Loan Forgiveness 8. The process designed and implemented to ensure that corrective action
plans developed, published, and addressed the root causes of the
PPP Loan Guaranty improper and unknown payments identified were not adequate.
Purchases
12
Program or Activity Control Deficiencies
7(a) Loan Guaranty 9. There were not adequate review controls designed and implemented to
Approvals ensure the improper and unknown payment root causes and reduction
targets presented in the AFR and in the accompanying materials were
7(a) Loan Guaranty accurate.
Purchases
504 Certified
Development Loan
Approvals
Disaster Assistance
Loans
PPP Loan Forgiveness
PPP Loan Guaranty
Purchases
PPP Loan Forgiveness 10. The process used by management to test samples in accordance with
PIIA requirements was not appropriate. Specifically, the interest portion of
PPP Loan Guaranty each sample payment was not tested for accuracy as part of the review
Purchases procedures.
13
B. RECOMMENDATIONS
Where noted, these recommendations are carried forward from the prior year.
We recommend the Administrator coordinate with the Chief Financial Officer to:
• Enhance existing procedures using the framework in the Government Accountability
Office’s Green Book to design and implement robust internal and quality control
processes to ensure complete and accurate reporting of annual improper payment
results and formalized risk assessment processes to ensure all programs and activities
are considered sufficiently to meet PIIA reporting objectives. (Deficiency 4, 8 & 9;
FY2023 Recommendation 3)
We recommend the Administrator coordinate with the Associate Administrator of the Office of
Capital Access to:
• Design and implement monitoring controls that strengthen SBA’s ability to obtain
required documentation from RRF recipients to satisfy agency requirements and
achieve PIIA reporting objectives. (Deficiency 1; FY2023 Recommendation 4)
• Formally document and implement the appropriate preventative and monitoring controls
to determine the eligibility of loans prior to 7(a) and 504 loan approvals and payments
and PPP loan forgiveness and PPP loan guaranty purchases. (Deficiency 2 & 3;
FY2023 Recommendation 5)
• Perform effective oversight over the statistician’s work by strengthening communication
in order to obtain sufficient understanding of the work performed and to verify that the
documentation (i.e. statistical measures of precision and margins of error) supports the
results of their work in alignment with internal control and/or PIIA requirements.
(Deficiency 5 & 6; FY2023 Recommendation 7)
• Design and implement adequate quality review procedures to ensure that the relevant
data fields including amount and improper payment type are completely and accurately
reported for the results of the sample(s) to meet PIIA objectives. (Deficiency 7 & 10;
FY2023 Recommendation 9)
• Design and implement a formal review process to ensure corrective actions plans
developed, implemented, and published respond to the root causes of improper and
unknown payments. (Deficiency 8; FY2023 Recommendation 10)
14
V. APPENDIX I: MANAGEMENT’S RESPONSE TO REPORT
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, D.C. 20416
DATE: May 13, 2025
TO: Sheldon Shoemaker, Deputy Inspector General
FROM: Nathan Davis, Associate Administration for Office of Performance, Planning, and
the Chief Financial Officer (OPPCFO) & Chief Financial Officer & Chief Risk
Officer
Thomas Kimsey, Associate Administrator for Office of Capital Access
SUBJECT: Response to Audit: Performance Audit of the U.S. Small Business Administration’s
Fiscal Year 2024 Compliance with the Payment Integrity Information Act of 2019
The Small Business Administration (SBA) appreciates the opportunity to review and respond to the
draft Performance Audit of the U.S. Small Business Administration’s Fiscal Year 2024 Compliance
with the Payment Integrity Information Act of 2019 (PIIA).
SBA is committed to reducing the dollar amount of improper payments, ensuring program integrity,
and continuing to implement effective risk management procedures in accordance with improper
payment legislation1, as well as guidance prescribed in the Office of Management and Budget
Memorandum M-21-19, Appendix C to Circular A-123, Requirements for Payment Integrity
Improvement.
SBA concurs with the Recommendations made in this audit report and is providing the following
comments in response to those recommendations.
Recommendation 1. We recommend the Administrator coordinate with the Chief Financial Officer to
enhance existing procedures using the framework in the Government Accountability Office’s Standards
for Internal Control in the Federal Government, known as the "Green Book,” to design and implement
robust internal and quality control processes to ensure complete and accurate reporting of annual
improper payment results and formalized risk assessment processes to ensure all programs and activities
are considered sufficiently to meet PIIA reporting objectives.
Agency Response. OPPCFO will evaluate the effectiveness of internal control using GAO’s Green
Book to enhance existing procedures and implement robust internal control processes. To ensure all
programs and activities meet PIIA reporting objectives sufficiently, management will identify and
analyze improper payment risks, considering factors such as program complexity and volume of
payments. Moreover, management will continuously oversee improper payment data reported in the
Agency Financial Report and the annual OMB improper payment data-call to publish payment
integrity information, including the Shuttered Venues Operator Grant (SVOG), and the payments
for covered loans in the 7(a) and 504 loan guaranty programs under the Debt Relief Program
1 Payment Integrity Information Act (2019)
15
(Section 1112 payments).
Recommendation 2. We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement monitoring controls that strengthen SBA’s ability
to obtain required documentation from RRF recipients to satisfy agency requirements and achieve PIIA
reporting objectives.
Agency Response. The Office of Capital Access (OCA) already has enforceable actions it can employ
to hold lenders accountable for not providing all documentation requested for loan samples in a timely
manner. OCA will continue to improve its controls to ensure these actions are exercised to ensure all
necessary documentation is provided in a timely manner.
Recommendation 3. We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to formally document and implement the appropriate preventative and
monitoring controls to determine the eligibility of loans prior to 7(a) and 504 loan approvals and
payments and PPP loan forgiveness and PPP loan guaranty purchases.
Agency Response. OCA designed and implemented comprehensive eligibility controls for all 7(a) and
504 loan programs prior to loan approval to ensure conformance with applicable loan program
requirements prior to loan approval. In addition, SBA maintains well-established controls to assess
borrow eligibility prior to PPP loan guaranty purchase and forgiveness. Further, SBA recently revised its
Origination SOP and issued SOP 50 10 8, which formally assigns responsibility for borrower eligibility
determinations to lenders. Eligibility will continue to be a critical component of the guaranty purchase
review process. Where appropriate, lenders will be referred to the Office of Credit Risk Management
(OCROM) for further oversight and evaluation. SBA remains committed to formally documenting and
continuously strengthening preventative and monitoring controls to ensure accurate eligibility
determines throughout the loan lifecycle.
Recommendation 4. We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to perform effective oversight over the statistician’s work by strengthening
communication in order to obtain sufficient understanding of the work performed and to verify that the
documentation (i.e. statistical measures of precision and margins of error) supports the results of their
work in alignment with internal control and/or PIIA requirements.
Agency Response. OCA will exercise effective management review controls over the statistician’s
work product by verifying that the documentation of the sampling and estimation methodology plans
comprehensively outlines the details of the implemented sampling and extrapolation methodology,
while maintaining statistical validity.
Recommendation 5. We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement adequate quality review procedures to ensure that
the relevant data fields including amount and improper payment type are completely and accurately
reported for the results of the sample(s) to meet PIIA objectives.
Agency Response. OCA will continue its efforts to design and document adequate review procedures to
ensure that the results of the sample meet the PIIA objectives.
Recommendation 6. We recommend the Administrator coordinate with the Associate Administrator of
the Office of Capital Access to design and implement a formal review process to ensure corrective
actions plans developed, implemented, and published respond to the root causes of improper and
unknown payments.
16
Agency Response. OCA will design and implement a formal review process to ensure corrective
actions plans developed, implemented, and published are adequately addressing the true root causes of
improper and unknown payments.
17
File and source
- File
- 25-15-fy2024-piia-compliance.pdf
- Size
- 624,691 bytes
- SHA-256
- 0a529f6570702df4748e11551af0ef3ef82af19c2530608779c949290c79d0a5
- Our copy
- 25-15-fy2024-piia-compliance.pdf
- Original
- www.oversight.gov