Full text
U.S. Small Business Administration
Office of Inspector General
TOP MANAGEMENT AND PERFORMANCE CHALLENGES
FACING THE SMALL BUSINESS ADMINISTRATION
IN FISCAL YEAR 2022
October 15, 2021
Report 22-02
1
CONTENTS
MESSAGE FROM THE INSPECTOR GENERAL.................................................................................................................. iv
Challenge 1: SBA’s Economic Relief Programs Are Susceptible to Significant Fraud Risks and Vulnerabilities ...............1
Why This Is a Challenge .......................................................................................................................................... 1
Issue: Paycheck Protection Program Susceptible to Abuse and Fraud.................................................................. 2
Agency Progress ..................................................................................................................................................... 4
Issue: Paycheck Protection Program Eligibility ...................................................................................................... 2
Agency Progress ..................................................................................................................................................... 3
Issue: Paycheck Protection Program Data Reliability............................................................................................. 4
Agency Progress ..................................................................................................................................................... 4
Issue: COVID-19 Economic Injury Disaster Loan Program Susceptible to Fraud ................................................... 5
Agency Progress ................................................................................................................................................................ 6
Challenge 2: Inaccurate Procurement Data and Eligibility Concerns in Small Business Contracting Programs
Undermine the Reliability of Contracting Goal Achievements .......................................................................................7
Why This Is a Challenge .......................................................................................................................................... 7
Issue: Agencies Receive Credit for Ineligible Firms or Those No Longer in the HUBZone or 8(a) Programs ........ 7
Agency Progress ..................................................................................................................................................... 8
Issue: Women-Owned Small Business Federal Certification Program Susceptible to Abuse ............................... 9
Agency Progress ..................................................................................................................................................... 9
Challenge 3: SBA Faces Significant Challenges in IT Investment, System Development, and Security Controls ...........11
Why This Is a Challenge ........................................................................................................................................ 11
Issue: SBA’s IT Investment Controls Need Improvement .................................................................................... 11
Issue: Existing System Development Controls Do Not Reflect Changing IT Application Landscape ................... 12
Issue: Additional Progress Needed on Security Controls ..................................................................................... 13
Agency Progress ................................................................................................................................................... 13
Challenge 4: SBA Risk Management and Oversight Practices Need Improvement to Ensure the Integrity of Loan
Programs ......................................................................................................................................................................14
Why This Is a Challenge ........................................................................................................................................ 14
Issue: SBA’s Oversight of High-Risk Lending Participants .................................................................................... 14
Agency Progress ................................................................................................................................................... 15
Issue: Increased Risk Introduced by Loan Agents ................................................................................................ 16
Agency Progress ................................................................................................................................................... 16
Issue: Increased Risk Introduced by Lender Service Providers ............................................................................ 17
Agency Progress ................................................................................................................................................... 17
Challenge 5: SBA’s Management and Monitoring of the 8(a) Business Development Program Needs Improvement .19
Why This Is a Challenge ........................................................................................................................................ 19
ii
Issue: SBA Continues to Address Its Ability to Develop Firms in the 8(a) Program and Measure Results .......... 19
Agency Progress ................................................................................................................................................... 20
Issue: Streamlined Application Process May Expose the 8(a) Program to Higher Fraud Risk ............................. 20
Agency Progress ................................................................................................................................................... 21
Issue: Corrective Actions Are Needed to Improve Continuing Eligibility Processes and Reduce Risks of
Ineligible Firms Participating in the 8(a) Program................................................................................................ 21
Agency Progress ................................................................................................................................................... 22
Issue: Economically Disadvantaged Determination Criteria Should Be Based on Sound Methodology ............. 22
Agency Progress ................................................................................................................................................... 23
Challenge 6: Identification of Improper Payments in SBA’s Loan Programs Remains a Challenge ...............................24
Why This Is a Challenge ........................................................................................................................................ 24
Issue: Improvements Needed to Ensure High-Risk 7(a) Loan Reviews Reduce the Risk of Losses ..................... 24
Agency Progress ................................................................................................................................................... 24
Challenge 7: SBA’s Disaster Assistance Program Must Balance Competing Priorities to Deliver Prompt Assistance but
Prevent Fraud ..............................................................................................................................................................26
Why This Is a Challenge ........................................................................................................................................ 26
Issue: Reserve Staff Need Training to Sustain Productivity During Mobilization ................................................ 26
Agency Progress..................................................................................................................................................................................27
Issue: Improper Payment Quality Assurance Process Needs Strengthening....................................................... 27
Agency Progress..................................................................................................................................................................................28
Issue: Inadequate Verification of Cause and Extent of Damages ........................................................................ 29
Agency Progress ................................................................................................................................................... 30
Issue: Unprecedented Increase in Servicing COVID-19 EIDLs .............................................................................. 30
Agency Progress ................................................................................................................................................... 31
Challenge 8: SBA Needs Robust Grants Management Oversight .................................................................................32
Why This Is a Challenge ........................................................................................................................................ 32
Issue: SBA’s Grants Management System Needs Improvement ......................................................................... 32
Agency Progress ................................................................................................................................................... 32
Issue: Better Performance Measurements Needed to Monitor Grant Program Achievements ........................ 33
Issue: Serious Concerns Over SBA’s Risk Assessment Used for Payment Distributions and Audits for the
Shuttered Venue Operators Grant Program ........................................................................................................ 34
Issue: Leveraging SBA’s Workforce to Ensure Effective Administration of New and Significantly Expanded
Grant Programs to Aid Small Businesses .............................................................................................................. 35
iii
MESSAGE FROM THE INSPECTOR GENERAL
I am pleased to present the Office of Inspector General (OIG) Report on the Top Management
and Performance Challenges Facing the Small Business Administration in Fiscal Year 2022, as
required by the Reports Consolidation Act of 2000.
In March 2020, the Coronavirus Disease 2019 (COVID-19) pandemic
catapulted the U.S. Small Business Administration (SBA) into the spotlight
as the primary agency responsible for providing nationwide assistance to
small businesses. Since then, SBA has faced a steady stream of
unprecedented new challenges.
However, even before the pandemic, SBA faced major challenges in
managing enormous financial lending programs, information technology,
and other areas. This report discusses eight major performance
challenge areas and the issues that contribute to the challenges, many of
which we have discussed in previous OIG reports (see Table 1).
I believe managing COVID-19 stimulus lending is the greatest overall challenge facing SBA, and it
may likely continue to be for many years as the agency grapples with fraud in the programs,
particularly in the COVID Economic Injury Disaster Loan Program, and the process of Paycheck
Protection Program loan forgiveness. Pandemic response has, in many instances, magnified the
challenging systemic issues in SBA’s mission-related work.
Overall, the agency has made progress addressing this year’s list of management challenges. We
are even retiring some issues we identified last year within major challenge areas because the
agency has made such significant progress that the problem has either been resolved or no
longer rises to the level of systemic challenge.
This progress is in large part attributed to the agency’s concerted effort to address outstanding
internal control recommendations reflected in many of the component challenge corrective
action areas.
OIG remains committed to spurring the agency to correct problems that endanger taxpayer
assets. However, our audits and investigations continue to find the agency facing significant risks
of fraud because of the size and scope of its loan programs and related internal control
environment; oversight of statutory programs, such as the 8(a) Business Development Program;
and information technology security.
iv
Table 1. Top Management and Performance Challenges Facing SBA in FY 2022
Challenge Issues
Paycheck Protection Program Susceptible to Abuse and Fraud
Challenge 1 Paycheck Protection Program Eligibility
SBA’s Economic Relief Programs Are
Paycheck Protection Program Data Reliability
Susceptible to Significant Fraud Risks and
Vulnerabilities COVID-19 Economic Injury Disaster Loan Program Susceptible to
Fraud
Challenge 2 Agencies Receive Credit for Ineligible Firms or Those No Longer in the
Inaccurate Procurement Data and Eligibility HUBZone or 8(a) Programs
Concerns in Small Business Contracting
Women-Owned Small Business Federal Certification Program
Programs Undermine the Reliability of
Susceptible to Abuse
Contracting Goal Achievements
SBA’s IT Investment Controls Need Improvement
Challenge 3
SBA Faces Significant Challenges in IT Existing System Development Controls Do Not Reflect Changing IT
Investment, System Development, and Application Landscape
Security Controls Additional Progress Needed on Security Controls
Challenge 4 SBA’s Oversight of High-Risk Lending Participants
SBA Risk Management and Oversight Increased Risk Introduced by Loan Agents
Practices Need Improvement to Ensure the
Integrity of Loan Programs Increased Risk Introduced by Lender Service Providers
SBA Continues to Address Its Ability to Develop Firms in the 8(a)
Program and Measure Results
Streamlined Application Process May Expose the 8(a) Program to
Challenge 5 Higher Fraud Risk
SBA’s Management and Monitoring of the
Corrective Actions Are Needed to Improve Continuing Eligibility
8(a) Business Development Program Needs
Processes and Reduce Risks of Ineligible Firms Participating in the 8(a)
Improvement
Program
Economically Disadvantaged Determination Criteria Should Be Based
on Sound Methodology
Challenge 6
Improvements Needed to Ensure High Risk 7(a) Loan Reviews Reduce
Identification of Improper Payments in SBA’s
the Risk of Losses
Loan Programs Remains a Challenge
Reserve Staff Need Training to Sustain Productivity During Mobilization
Challenge 7
SBA’s Disaster Assistance Program Must Improper Payment Quality Assurance Process Needs Strengthening
Balance Competing Priorities to Deliver Inadequate Verification of Cause and Extent of Damages
Prompt Assistance but Prevent Fraud Unprecedented Increase in Servicing COVID-19 EIDLs
SBA’s Grants Management System Needs Improvement
Better Performance Measurements Needed to Monitor Grant
Program Achievements
Challenge 8
Serious Concerns over SBA’s Risk Assessment Used for Payment
SBA Needs Robust Grants Management
Distributions and Audits for the Shuttered Venue Operators Grant
Oversight
Program
Leveraging SBA’s Workforce to Ensure Effective Administration of New
and Significantly Expanded Grant Programs to Aid Small Businesses
v
Color Coding the Challenges
Identification of an issue as a top challenge does not necessarily denote significant deficiencies
or lack of attention on SBA’s part. Many of the top management challenges are longstanding,
inherently difficult, and may likely continue to be challenges in the coming years.
Some of the challenges encompass new issues that have arisen. Resolving the challenges will
require consistent, focused attention from agency management and ongoing engagement with
Congress, the public, and other stakeholders.
It is also important to note that the top challenges are not listed in order of importance or
magnitude, except for the COVID 19 challenge, which we address first in this report. We also
view the other challenges as critically important to SBA operations.
Similar to last year’s report, this report uses a color gauge as a visual indicator of the agency’s
progress in confronting the issues that make a particular function a top management challenge.
Each issue that contributes to the main challenge includes a small color gauge image that
indicates whether the agency has made little, no, or significant progress on the issue to date.
(See Table 2).
The management challenges report is an important tool to help the agency prioritize its work to
improve program performance and enhance operations. These challenges will guide OIG work in
the coming year. We look forward to continuing to work with SBA’s leadership team to address
the agency’s top management and performance challenges.
Table 2. Color Code Definitions
Color Definition Color Indicator
Green Issue Resolved or Appropriately
Reduced
Yellow Substantial Progress
Orange Moderate or Limited Progress
Red No Progress
N/A New, not rated
N/A Not rated (extenuating
circumstances)
vi
Challenge 1: SBA’s Economic Relief Programs Are Susceptible to
Significant Fraud Risks and Vulnerabilities
Why This Is a Challenge
M ore than 30 million small businesses in the United States have been adversely affected by COVID-
19. The President signed the Coronavirus Aid, Relief, and Economic Security (CARES) Act into law
on March 27, 2020, to provide economic relief to our nation.
Under the CARES Act, SBA-guaranteed relief loans for eligible small businesses, individuals, and
nonprofit organizations can be forgiven if loan proceeds were used in accordance with law. Eligible
expenses include payroll, rent, utility payments, and other limited uses.
The speed of lending through these programs is unmatched by anything in SBA’s history and
necessitates the establishment of proper controls to mitigate risk and ensure that the programs operate
as intended. As of August 2021, we had received more than 215,000 Hotline fraud complaints in the
Paycheck Protection Program (PPP) and Economic Injury Disaster Loan (EIDL) program combined and 1.2
million EIDL loan complaints of identity theft.
OIG’s EIDL and PPP oversight and investigative work resulted in 307 indictments, 205 arrests, and 69
convictions related to PPP or EIDL by August 2021, with associated amounts totaling more than $460
million. Additionally, OIG collaboration with SBA and the U.S. Secret Service has resulted in the seizure
of more than $995 million stolen by fraudsters in the EIDL program. We also played a key role in
assisting financial institutions in the return of another $3.1 billion to SBA’s EIDL program.
OIG has actively engaged SBA leadership throughout the duration of the pandemic to notify them of
preliminary findings so they could respond in real time to prevent loss to the taxpayer. Our PPP and EIDL
reviews have revealed alarming findings.
We published a flash report on PPP in May 2020 that led to legislative changes to the program. In FY
2021, we also published reports on the agency’s implementation of the PPP, the U.S. Department of the
Treasury’s Do Not Pay List, SBA’s handling of identity theft in the EIDL program, and the agency’s initial
response to the pandemic. Our findings led the agency to strengthen controls to prevent fraud.
Paycheck Protection Program
The CARES Act appropriated $349 billion for the PPP under the 7(a) small business lending program. In
early April 2020, SBA launched the $349 billion PPP in collaboration with the U.S. Department of the
Treasury. On April 24, 2020, Congress appropriated an additional $310 billion for PPP through the
Paycheck Protection Program and Health Care Enhancement Act, bringing the total for the program to
$659 billion.
The Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act was enacted on December
27, 2020 to continue assistance under the PPP. Under the Economic Aid Act, the PPP was extended to
provide more than $284 billion in guaranteed SBA loans.
As of May 31, 2021, SBA had processed 11.8 million guaranteed PPP loans, totaling $799.8 billion,
1
through more than 5,400 private lenders, far more than all of SBA’s combined lending under the 7(a)
program from 1990 to 2019. In contrast, from FYs 2000-19, SBA made about 1.2 million 7(a) loans
totaling $333 billion. During that 20-year period, SBA made about 62,000 loans a year totaling about
$16.7 billion on average.
Once the laws were in place, SBA moved quickly to establish the new nationwide relief programs. But
the agency eased controls required in its lending programs to do so, increasing the risk of rampant
fraud.
Economic Injury COVID 19 Disaster Loan Program
In FY 2020, the CARES Act and the Paycheck Protection Program and Healthcare Enhancement Act
provided $470 billion for disaster assistance and $20 billion for emergency grants for eligible entities.
In FY 2021, the Economic Aid Act and the American Rescue Act combined provided an additional $30
billion in Targeted EIDL Advances and $5 billion in Targeted Supplemental EIDL Advances to eligible
entities that met additional criteria.
SBA’s existing application portal and processing system were initially overwhelmed by the 4.5 million
loan applications by April 10, 2020, for COVID-19 EIDL and Emergency EIDL grants. SBA turned to a
contractor that had previously assisted SBA in streamlining processing to manage initial processing of
COVID-19 EIDL applications. However, setting up a new application processing system presented
significant internal control risks.
SBA relaxed internal controls to speed funds to affected businesses, significantly increasing the risk of
program fraud. The unprecedented demand for COVID-19 EIDLs and the challenges of quickly
responding to the pandemic brought about the lowering of internal controls, added significant stress to
the system, and created opportunities for unscrupulous people to commit fraud.
SBA had approved 2.2 million disaster loans for $66.7 billion in its entire history since 1953. By contrast,
between March and the end of December 2020, SBA had received more than 17.7 million COVID-19
EIDL applications and approved 3.7 million loans totaling $197.2 billion.
During prior large-scale disasters, SBA brought on new loan officers to match the volume of loan
applications and prevent processing backlogs that delay the delivery of disaster assistance. In its COVID-
19 response, SBA increased its permanent and temporary trained staff size to more than 9,000,
significantly more than any other previous disaster.
Issue: Paycheck Protection Program Susceptible to Abuse and Fraud
Our oversight revealed fraudsters took aim at the program and
identified opportunities for prevalent potential abuse and fraud in the
PPP. Since the PPP began, OIG has had a major increase in reports of
suspected fraud.
These reports of suspected fraud have come from various sources,
including OIG Hotline complaints, contacts from financial institutions,
and other law enforcement agencies.
2
We have launched numerous investigations based on these reports. Examples of fraud schemes include
the following:
• False statements on applications
• Fraudulent supporting documents (such as payroll and tax forms)
• Accounts established using stolen identities
• Corporate and personal identity theft
• Inflation of payroll
• Misuse of proceeds
• Unqualified borrowers
• Lender fraud
As of August 2021, OIG had received more than 40,000 Hotline complaints of potential PPP fraud and
the numbers continue to rise. Complaints of potential fraud or scams include scenarios including the
following:
• Loan applicants asserting business ownership that did not exist
• Business owners who received loan funds but did not use the loan money for their business
• Business owners who laid off employees to reduce employment numbers to qualify for a PPP
loan
• Business owners who have refused to allow employees to return to work, telling them to
continue on unemployment assistance instead
• Online fraudsters who offered to prepare applications for a fee
• Business owners and individuals reporting identity theft because the SBA made loans in their
names that they did not apply for or receive
OIG has identified trends in the high number of complaints that indicate the potential for widespread
fraudulent activity in the PPP. These trends mirror the arrests and ongoing investigations our agents and
other government agencies are pursuing. As of January 2021, the Justice Department had filed 79 PPP
fraud cases, bringing charges against more than 140 defendants. Defendants are charged with bilking
taxpayers out of $341 million dollars.
Changes SBA made to expand access to the program for certain borrowers appear to have been
exploited by unscrupulous individuals. In March 2021, SBA issued an interim final rule to better align
with the intent of Congress. The rule allowed individuals who file an IRS Form 1040, Schedule C, to
calculate their maximum loan amount using gross income rather than net income.
This change led to a significant increase in the number of loans of $20,833 or less, the maximum
allowable loan amount for a Schedule C business with no employees.
In addition to Hotline complaints, multiple financial institutions have contacted OIG about a significant
number of PPP deposits in personal accounts or made to people whom the financial institutions believe
do not own businesses.
Many of the Schedule C loans were made by lenders that rely exclusively on third-party loan processing
3
or software platform vendors they hire to complete loan processes. SBA does not contract the third-
party vendors and they do not have relationships with SBA, only with the lenders.
The lenders used third parties to increase PPP loan volume. PPP volume data shows that 7 of the top 15
lenders made more than 2.4 million loans in
2021, or more than 18,000 loans per day, after
having made fewer than 22,000 PPP loans We identified 70,835
combined in 2020.
Based on our previous work and analysis of SBA's loans totaling more
loan data, we identified 70,835 loans totaling
over $4.6 billion in potentially fraudulent PPP
loans. These figures stem from three audit
than $4.6 billion in
projects about indicators and red flags for
potential fraud, including duplicate loans,
potentially
businesses created after February 15, 2020, and
loans that match Do Not Pay data sources. fraudulent PPP loans
These loans can only be considered potentially
fraudulent because OIG has not completed a document-by-document review of loan files to confirm or
resolve the suspicious activity; however, our investigations have substantiated these concerns on a case-
by-case basis. We believe this is the tip of a much larger iceberg, and we are working to identify the full
extent of PPP fraud.
OIG has seen an increase in inquiries from financial institutions seeking guidance on how to address
potentially fraudulent loans. The loan forgiveness process could evidence or potentially trigger more
fraud.
SBA should provide financial institutions sufficient guidance on dealing with potentially fraudulent
transactions. The agency should clarify how to return SBA program-related funds in instances of
suspected fraud and how to report that fraud to SBA. Strong controls will help reduce fraud risk and
enhance program integrity for the PPP and similar programs enacted in the future.
Agency Progress
SBA has made substantial progress to reduce fraud risks and prevent further losses. When the PPP
launched in 2020, SBA’s fraud risk management approach for PPP loans was intentionally developed
with more fraud and eligibility controls at the loan forgiveness phase rather than the application stage.
SBA was mandated by Congress to swiftly pay out, or disburse, funds to millions of struggling small
businesses. Speed became the highest priority in complying with the mandate. SBA implemented fraud
and eligibility controls as a part of the loan forgiveness phase and took additional corrective actions to
reduce the amount of fraud in the PPP, including the following:
4
• Developing and implementing Master Review Plan establishing guidelines for loan and
forgiveness reviews (October 2020)
• Developing and implementing SBA and contractor’s fraud risk management policy and
framework
• Increasing post-disbursement antifraud controls for loans that originated in 2020
• Increasing antifraud controls for loans originating in 2021
• Commencing manual loan and forgiveness reviews for loans that originated in 2020
• Using a contractor’s automated review tool and the Paycheck Protection Platform to analyze
loans for fraud and eligibility
• Implementing machine learning functionality to focus on areas of higher risk
• Providing outreach and training
Remaining Challenges
Although SBA has made substantial progress to reduce fraud risks and prevent further losses, difficulties
and challenges remain.
SBA’s approach in 2020 to fraud risk management allowed funds to disburse quickly but presented risks
of fraud when a loan was originated. The method essentially relies on the post-origination controls to
identify and report instances of fraud and abuse that has already occurred, with funds also already
disbursed. Fraudsters are not likely to seek forgiveness, resulting in defaulted loans at the expense of
the taxpayer. During loan origination, lenders are required to report suspected or known cases of fraud
to OIG and SBA’s Office of Credit Risk Management.
SBA faced challenges when developing an automated screening process because the PPP is the first
program of its kind, and it required disbursing a high volume of loan funds over a short time. In addition,
loans must be reviewed quickly because of the statutory timeframe for forgiveness. SBA has revised the
manual loan review process and procedures to reduce risks associated with loans that have alerts or
“flags.”
SBA’s plans and actions to reduce fraud risks and prevent further losses will determine how this
challenge will be rated in the future. Our investigations into suspected fraud and suspicious activities
continue. We have an ongoing review of the handling of potentially fraudulent PPP loans and SBA loan
reviews.
We anticipate future audit work on PPP loan eligibility, loan forgiveness, and lender activities to
determine the effectiveness of agency implemented controls, and we will continue to monitor agency
actions to assess and reduce fraud risk and address vulnerabilities in the PPP.
1
Issue: Paycheck Protection Program Eligibility
OIG’s inspection of SBA’s implementation of the PPP and coordination
with the Treasury Department have revealed systemic issues. Our results
found indications of deficiencies with internal controls related to
eligibility of borrowers. Our review of SBA’s implementation of PPP
identified thousands of loans to potentially ineligible borrowers.
For example, SBA lenders inappropriately approved loans for businesses
that
• exceeded maximum loan amounts for the number of employees,
• were in the government’s Do Not Pay database,
• exceeded the maximum size allowed, and
• obtained a Taxpayer Identification Number after the program began in February 2020, which
means the business was likely not operational before the onset of the pandemic, a CARES Act
requirement.
Approving loans for ineligible borrowers reduces the amount of critical program capital available to
eligible borrowers.
Businesses Exceeding Maximum Loan Amounts
We found tens of thousands of approved and disbursed loans were made to borrowers for amounts that
exceeded the loan maximum based on the number of employees and compensation rates, as defined in
the CARES Act (Report 21-07).
Borrowers on Do Not Pay Database
We coordinated with the U.S. Department of Treasury to compare Taxpayer Identification Numbers and
name data provided in SBA data files for 2020 PPP loans against Do Not Pay debt, exclusions, and death
data sources. We found tens of thousands of loans that matched a Do Not Pay data source record
indicating potential loan ineligibility (Report 21-06). SBA flagged these loans to be reviewed for PPP
eligibility.
The Treasury Department Do Not Pay system helps agencies fulfill the obligation to deny federal loans,
loan insurance, and loan guarantees to businesses delinquent on federal debts and obligations. To be
eligible to receive PPP funds, a business must not have any current federal debarments or suspensions,
and the applicant must not have delinquent federal loans or have defaulted on any federal loans in the
last seven years.
Businesses that Exceeded Maximum Size Standards
Under the CARES Act, an eligible business cannot exceed the greater of 500 employees or the SBA size
standard for number of employees in the industry, if applicable. We found hundreds of businesses
obtained PPP loans that may have been erroneously approved (Report 21-07). These businesses
exceeded both 500 employees and the applicable employee-based size standard for the business
industry.
2
Taxpayer Identification Number Registered after February 15, 2020
The CARES Act requires that businesses
must have been in operation before
February 15, 2020 to be eligible for a
Swift management action to
PPP loan. We found thousands of
businesses obtained PPP loans with
identify and review potentially
identification numbers that were not
registered until after that date (Report
ineligible loans could prevent
21-07). The businesses would have
been ineligible for PPP loans because
improper payments to lenders
they likely did not meet the CARES Act
eligibility requirement of being in
because loan forgiveness may
operation before February 15.
still be in process
Agency Progress
SBA has made substantial progress in strengthening controls to validate eligibility and ensure eligibility
requirements. SBA initiated several corrective actions to enhance and develop additional controls to
address loan reviews, loan forgiveness, and fraud, including:
• Developing the Master Review Plan establishing guidelines for loan and forgiveness reviews
(October 2020)
• Developing and implementing SBA and contractor fraud risk management policy and framework
The fraud control framework also includes a variety of antifraud controls in place designed to detect and
mitigate possible instances of eligibility fraud. These controls include approved lender lists, verification
with the Treasury Do Not Pay list, and compliance checks.
SBA also integrated affiliation data which shows business affiliation through ownership and maximum
number of employees, as well as maximum loan amount. SBA instituted an affiliation worksheet for PPP
loan and forgiveness reviews. Swift management action to identify and review potentially ineligible
loans could prevent improper payments to lenders because the associated loan forgiveness may still be
in process.
As we complete current reviews and conduct future audit work, SBA’s plans and actions to reduce and
prevent improper payments will determine how we will rate this challenge in the future.
3
Issue: Paycheck Protection Program Data Reliability
OIG’s inspection of SBA’s 2020 implementation of the PPP found the
data SBA reported and the loan-level PPP data were inaccurate and
incomplete. Without accurate and complete data, SBA cannot reliably
and accurately inform SBA management and Congress about program
effectiveness and measures needed to inform program decisions.
Underserved Market Data Was Incomplete
In our May 2020 flash report, we found that SBA’s demographic information for underserved markets
for PPP borrowers was incomplete (Report 20-14). SBA’s borrower application for PPP did not include
standard SBA fields to request demographic information. One week after we issued our flash report, SBA
issued the initial PPP loan forgiveness application, which included an optional page for borrower
demographic information. Notwithstanding, sufficient data may still not be collected.
Some borrowers may not apply for loan forgiveness while others may choose not to complete the
optional page. Although ethnic demographic information is optional for SBA’s traditional loan programs
and the PPP, SBA generally requests the demographic information as a section on a mandatory form.
Borrowers have the option to decline to provide the information.
North American Industry Classification System Data Was Incomplete
We found SBA’s loan-level data on PPP North American Industry Classification System codes was
incomplete (Report 21-07). SBA did not require the borrower to provide the industry classification code
on the application, so lenders did not have the information to put in the loan processing platform. As of
June 30, 2020, there were 222,096 loans totaling approximately $9.9 billion that were identified as
“Unclassified Establishments” because there was no industry classification data on the application.
Job Statistics Were Inaccurate and Incomplete
We found SBA’s loan-level data for job statistics was inaccurate and incomplete (Report 21-07). We also
found that 191,003 loans totaling approximately $11 billion did not include employment information in
the required job field for the number of current employees.
SBA officials said because of a backlog of loan applications before the beginning of the second round of
PPP funding, lenders were allowed to submit loan applications in bulk. The officials said they turned off
system controls to allow faster approval times.
Of the 191,003 applications that did not have data for the number of current employees, 83,374 were
approved during the first week of the second round of funding. Because SBA removed the control to
check data in the “number of current employees” field, these loans totaling approximately $4 billion
were not validated before approving and issuing loan numbers to PPP lenders.
Agency Progress
SBA made substantial progress to ensure the integrity of data and has added controls including the
following:
4
• Adding mandatory fields in borrower and lender application processes, including North American
Industry Classification System identification, demographic data, and number of employees.
• Updating controls to ensure data accuracy and completeness of lender-reported data.
• Instituting a procedure for lenders and borrowers to correct publicly available PPP loan data
provided to SBA by delegated PPP lenders.
• Adding controls for Taxpayer Identification Number data submission at origination and Do Not
Pay-LexisNexis data validation at origination.
We have an ongoing evaluation of SBA’s loan review processes and anticipate future audit work to
review PPP loan eligibility, loan forgiveness, and lender activities. We will continue to monitor the
agency’s efforts to improve data reliability.
Issue: COVID-19 Economic Injury Disaster Loan Program Susceptible to
Fraud
From the beginning of the COVID-19 EIDL program in March 2020 until
August 2021, OIG received 215,000 Hotline complaints which alleged
fraudulent activity in the COVID-19 EIDL program and PPP. Thousands of
complaints came from banks about potentially fraudulent activity, and
OIG has steadily received hundreds of additional complaints per day
from other sources.
OIG has launched numerous investigations into this fraudulent activity. In addition, our October 2020
inspection report of SBA’s initial disaster assistance response to COVID-19 identified $78.1 billion in
potentially fraudulent loans and loans and grants to ineligible entities (Report 21-02). Our May 2021
inspection report of SBA’s handling of identity theft allegations in the COVID-19 EIDL Program (Report
21-15) found $6.7 billion in loan and grants related to identity theft allegations. The recommendations
in both reports remain open.
In October 2020, we found significant problems with the EIDL process that could lead to fraud (Report
21-02). It is essential that internal controls are balanced to prevent fraud and include processes to
address concerns identified by the internal controls. Examples of internal control concerns include the
following:
Potentially Fraudulent Loans to Accounts that Differed from the Original Bank Accounts
Listed on Applications
SBA had approved $14.3 billion in COVID-19 EIDLs and Emergency EIDL grants to applicants who later
changed the bank account number to pay out the loan to a different account. For these applications,
additional funds were disbursed in advance grants.
Although there are reasons an applicant might need to change a bank account number during the loan
process, the number of applicants who changed their bank account numbers or accounts to an entirely
different bank before loan disbursements is concerning as a potential fraud indicator.
5
Potentially Fraudulent Loans Made to Applicants Using Duplicate Information
We found SBA had approved $62.7 billion in multiple COVID-19 EIDLs and Emergency EIDL grants to
applicants who used the same internet provider (IP) addresses, email addresses, business addresses, or
bank accounts. There are some legitimate reasons for individual occurrences of applicants using the
same addresses or accounts to apply for loans. For example, any time an applicant uses a loan packager
there will be duplications in addresses and contact info. Multiple occurrences, however, are a strong
indicator of fraud.
Potentially Fraudulent Loans Made to Ineligible Entities
We found SBA approved $1.1 billion, in COVID-19 EIDLs and Emergency EIDL grants to potentially
ineligible entities. In our July 2020 management alert, we warned SBA that we had already found
approximately $250 million in approved loans to ineligible entities. These entities had Employer
Identification Number registration dates after the date entities were required to be in business to
qualify for relief funding in the CARES Act.
COVID-19 Applications Related to Identity Theft Allegations
In a May 2021 inspection (Report 21-15), OIG reported that SBA had referred more than 840,000
COVID-19 applications to OIG for suspected identity theft. SBA disbursed 112,196 COVID-19 EIDLs
totaling $6.2 billion and 98,613 advance grants for $468 million that were associated with identity theft.
The numbers continue to grow.
Agency Progress
SBA has enhanced system controls and validations. Some of the major control changes include
• requiring evidence that loan officers addressed issues identified and flagged by the
subcontractor’s processing system,
• enabling fund holding at any stage,
• invalid corporate owner Employer Identification Number check,
• obtaining Internal Revenue Service tax transcripts for all loan approvals, and
• validation against the Treasury Do Not Pay List.
Despite the control enhancements, the sheer volume of loans and advances will continue to pose a
challenge for the agency to reduce the ongoing risk of fraud in these programs. OIG will continue to
monitor these issues and conduct oversight work to assess the effectiveness of the agency’s controls
and identify areas for improvement.
6
Challenge 2: Inaccurate Procurement Data and Eligibility Concerns
in Small Business Contracting Programs Undermine the Reliability
of Contracting Goal Achievements
Why This Is a Challenge
T he Small Business Act government-wide goal is to ensure that 23 percent of all prime contracts be
awarded to small businesses each fiscal year. Since FY 2013, the SBA has reported in its annual Small
Business Procurement Scorecard that the federal government has met or exceeded that goal.
Over the years, Congress has expressed concerns about the accuracy of the report. OIG and
Government Accountability Office (GAO) audits have revealed a widespread problem of misreporting by
agencies that award contracts to small firms with provisions or other contract language that allows
larger companies to do most of the work.
As the federal government’s primary advocate for small business, SBA must continue to strive to ensure
federal agencies award small business contracts only to eligible entities counted in the assessment of
this measure. However, SBA’s achievement reports do not portray federal contract dollars obligated
only to small businesses, reducing the ability of Congress and other federal policymakers to determine
whether the government is maximizing contracting opportunities for small businesses.
Issue: Agencies Receive Credit for Ineligible Firms or Those No Longer in the
HUBZone or 8(a) Programs
SBA has made some program eligibility requirements less focused on
disadvantaged businesses and historically underused business zones,
deviating from congressional intent. OIG continues to find that SBA does
not consistently detect ineligible firms in its small business contracting
certification programs.
Agency contracting officers have reported ineligible firms as certified either in the HUBZone or 8(a)
programs in the Federal Procurement Data System – Next Generation. In 2020, the General Services
Administration Office of Inspector General found $89 million in procurements erroneously recorded as
small business in the Federal Procurement Data System–Next Generation.
Historically, OIG audits have found that SBA did not consistently detect ineligible firms in its preference
contracting programs. In 2018 and 2019, we found SBA did not ensure only eligible firms entered the
HUBZone program or consistently detect ineligible firms in the 8(a) program.
In 2020, SBA changed a HUBZone requirement, allowing certified businesses to have employees who are
not current HUBZone residents. Under the new requirements, the business continues to meet the
requirement as long as the employee lived in a HUBZone for at least 180 days after the business was
first certified.
HUBZone businesses could have no employees residing in the HUBZone at all and still qualify because
employees initially hired as HUBZone residents moved out of the HUBZone after the 180-day period.
7
The requirements of the rule are clearly inconsistent with legislative intent.
SBA program success and integrity could be reduced if the agency admits ineligible firms into programs
intended for disadvantaged small businesses. Before 2008, SBA certified small, disadvantaged
businesses. SBA terminated its small, disadvantaged certification program in 2008, and since then, firms
have self-certified. The awards made to these firms count toward the agency’s contracting goals.
The goals require that 5 percent of all prime and subcontracts for the federal government be awarded
with special considerations for contractors with small, disadvantaged business subcontractors.
Participants in the 8(a) program are considered small, disadvantaged businesses and awards made to
them are also counted toward agency goals.
As of September 2021, SBA’s Dynamic Small Business Search database included 153,126 firms that self-
certified as small, disadvantaged businesses. Firms that falsely certify they are socially and economically
disadvantaged may receive federal contracts counted toward the agency’s goal achievements.
Although self-certification is inherently risky, SBA removed regulations allowing for protests of a firm’s
disadvantaged business status in FY 2020. While firms are still subject to protests related to their small
business size, business owners’ status as a socially and economically disadvantaged individual cannot be
challenged.
Agency Progress
SBA has made substantial progress in adding controls to detect ineligible firms in the 8(a) and HUBZone
programs. In FY 2020, SBA updated and trained staff on its HUBZone policy directives to standardize
analysis and oversight. SBA also required that HUBZone firms annually recertify that they meet program
eligibility requirements. Further, SBA instituted procedures to ensure program officials justified their
recommendations to admit firms applying to the 8(a) program. The agency is now tracking complaints
about firms’ eligibility to participate in the program.
SBA should continue to strengthen its oversight of these contracting programs to ensure only eligible
firms participate.
The new employee residency requirement may reduce the HUBZone program’s ability to meet
legislative intent. Allowing certified businesses to count employees who are not current HUBZone
residents to meet employee residency requirements does not ensure continual employment of
individuals who live in distressed areas. Consequently, full economic benefits may not be realized in
these areas.
Similarly, SBA’s termination of the small, disadvantaged business certification program and removal of
regulations allowing for protest of a firm’s disadvantaged business status jeopardizes the integrity of the
small, disadvantaged business goaling achievements. According to contract data retrieved from
SAM.gov, in FY 2020, as much as $11.6 billion of prime contracts were awarded to small, disadvantaged
businesses that were not certified as either 8(a) firms, Woman Owned Small Businesses, Economically
Disadvantaged Woman Owned Small Businesses, HUBZones, Service-Disabled Veteran Owned Small
Businesses, or a joint venture that included a firm with one of these designated contracting program
certifications. Given the sheer amount of the federal contract dollars awarded to these self-certified
8
businesses, it is crucial for SBA to ensure that only eligible firms benefit from these contracting
opportunities.
As SBA expands procurement activities to deliver on the President’s goal of increasing the share of
federal contracts awarded to small, disadvantaged businesses from 5 to 15 percent by 2025, program
officials should consider the impact this regulatory void could create on the accuracy of the small,
disadvantaged business goal achievements.
Issue: Women-Owned Small Business Federal Certification Program
Susceptible to Abuse
SBA’s Women-Owned Small Business (WOSB) program is intended to
give eligible companies greater access to federal contracting
opportunities, ensuring a level playing field for women business owners.
Both OIG and GAO have reported weaknesses in SBA’s controls intended
to ensure only eligible firms receive federal contracts set aside for
WOSBs.
The federal government’s annual contracting goal for WOSBs is set at 5 percent of all federal contracting
dollars. The WOSB Program is a subset of this larger goal but not the sole driver. The government limits
competition for set-aside WOSB and Economically Disadvantaged WOSB federal contracts to
participants in the WOSB Federal Contracting Program.
Some contracts are awarded directly with no competitive bidding . Such contracts are known as sole
source awards. This means significant contracting dollars and taxpayer funds are at stake, beginning
with program eligibility and certification of the designation.
The National Defense Authorization Act of FY 2015 required qualifying small businesses to be certified
by a federal agency, a state government, SBA’s Administrator, or a national certifying entity approved by
the Administrator.
Women business owners seeking to participate in the WOSB Program may submit an application and
supporting documents to SBA at no cost using the website beta.Certify.sba.gov or pay a fee to use one
of four approved third-party certifiers. As mandated in FY 2015, SBA has four approved third-party
certifiers that are allowed to charge a fee to certify the WOSB or an Economically Disadvantaged
Women-Owned Small Business.
In 2014, GAO recommended that SBA establish procedures to assess the performance of the SBA-
approved third-party certifiers.
Government contracting officers have a history of improperly awarding WOSB contracts because of
certification complexities. In a 2018 audit (Report 18-18), OIG found contracting officers at various
federal agencies made sole-source awards without having the necessary documentation to determine
WOSB eligibility.
Agency Progress
SBA has made substantial progress toward addressing this challenge. In July 2020, SBA launched a new
9
free, online portal for WOSB and economically disadvantaged WOSB self-certification.
In October 2020, SBA began conducting WOSB certification determinations. SBA hired additional WOSB
analysts and a program director and increased the number of staff supporting the program.
Beta.Certify.sba.gov, is the live and operational platform for the WOSB Program certification process.
This new system is used to manage the certification process for the Women-Owned Small Business and
Economically Disadvantaged Women-Owned Small Business programs. The program office is partnering
with the Office of the Chief Information Officer to find a viable information technology solution or
platform for all of the certification programs.
The agency intends for the new beta.Certify.sba.gov certification management portal to modernize a
process that has been difficult for decades. However, the system has been plagued by technical
challenges which could result in failing to reach program objectives.
Launched in 2020, beta.Certify.sba.gov received about 15,000 WOSB and Economically Disadvantaged
WOSB applications. The WOSB Program has approved 3,242 into the program and denied 87 .
Additionally, as part of SBA’s review process, 12,000 applications were screened and returned to the
applicant for more information. The slow progress in issuing prompt certifications affects SBA’s ability to
adequately serve the needs of women-owned businesses.
10
Challenge 3: SBA Faces Significant Challenges in IT Investment,
System Development, and Security Controls
Why This Is a Challenge
O ver the past decade, the agency has struggled with big, high-dollar information technology (IT)
projects. OIG has published a number of reports documenting problems and management missteps
during efforts to develop new IT systems, including Certify.sba.gov, a 5-year, $30 million system that
was so unsuccessful that the agency had to replace it. The new system is currently being tested (see
Challenge 2).
The dramatic chain of events caused by the COVID-19 relief funding the agency received last year
highlighted the significant need for the agency to invest in IT upgrades to improve the portal interfaces
for small businesses. Portal interfaces are digital entryways into computer systems via websites. SBA
must establish effective IT investment controls to ensure IT investments meet functional requirements,
projected schedules, and estimated costs.
Portals should also be designed to handle significant growth in user transactions and be developed
according to guidance in federal laws and regulations. The agency also must ensure portals address
numerous IT needs and are developed in a reasonable timeframe
Program demands may result in testing protocols not being fully addressed within the limited
timeframes needed to deliver taxpayer assistance. For example, the agency stated the cause for the
month delay in the Shuttered Venue Operators Grant program was the contractor production
environment did not fully mirror agency the test environment. This risk would have normally surfaced in
a limited parallel production test where all requirements were confirmed to be operational.
SBA enterprise systems need constant maintenance to prevent security vulnerability to multiple types of
threats. SBA must maintain and establish IT security control baselines essential to protect information
and preserve data integrity. The agency will need to develop guidance that requires continuous
monitoring of controls over high-risk transactions.
Issue: SBA’s IT Investment Controls Need Improvement
Growth in program requirements and increasing transaction volumes
require SBA to make significant investments in its IT systems.
The Certify system was intended to improve small business access to
SBA contracting and assistance programs. Certify was also to be the
single gateway to all of SBA’s contracting programs, streamlining the
applicant certification process, and improving management productivity.
In July 2020, we reported the Certify project lacked planning and performance oversight during its
development (Report 20-17). Certify.sba.gov did not meet its original goal of improving SBA’s small
business certification processes. The $30-million investment in this project did not yield the intended
results. Our recommendations from this review were intended to improve enterprise-wide investment
11
controls and beta.Certify.sba.gov is the agency's most recent endeavor in this program area.
Since our review, SBA has taken steps to improve oversight of beta.Certify.gov. For example,
beta.Certify.gov is included on the agency’s high-risk list, and the agency IT investment board is
monitoring cost, schedule, and performance baselines. The agency continues to complete work on
revising the project’s scope but still needs to improve several management areas, including baseline
reviews and completing functionality.
The agency expects to have these efforts complete by the end of 2021. OIG will monitor the agency’s
progress and review the results in FY 2022.
Issue: Existing System Development Controls Do Not Reflect Changing IT
Application Landscape
SBA’s system development policy is a roadmap for the purchase,
launching, and management of software and related application
development activities. This guidance helps ensure appropriate risk
management, security and application development activities are
consistently used throughout the agency’s systems.
However, the existing policy dates to 2009 and does not fully address changes in the IT development
landscape, including extensive use of third-party application service providers. A third-party service
provider is an external entity that performs wide ranging activities under a contract for the agency.
The scope of these activities and related software applications varies. In all cases, the agency is
responsible for maintaining internal control over operations, reporting, and compliance with laws and
regulations over these services and related data.
Updated system guidance is crucial for monitoring third-party applications used to process transactions
integral to the mission of SBA, primarily, delivery of COVID assistance. Currently, the agency uses such
applications for PPP loan forgiveness, EIDLs, the Shuttered Venue Operators Grant program, and the
Restaurant Revitalization Fund. Federal guidance requires that data processed by the third-party
services be subject to the same controls as internally developed systems.
Federal guidance also requires financial and related reporting controls be designed and tested in third-
party applications that process financial activity. The external financial auditor found that critical
financial controls for the EIDL application were not documented and tested by an independent third
party.
The agency must produce a System and Organization Controls Report, commonly known as a SOC 1, to
validate financial controls have been properly designed and tested. This report assesses a service
provider’s internal controls over financial processes and reporting.
To meet the challenges of rapidly delivering financial assistance and reduce risks, the agency must
update its guidance for purchasing and related system development to validate essential controls exist
before an application may be placed in production. At the same time, continuous monitoring
procedures should be established over production activities to address potential security vulnerabilities.
12
Issue: Additional Progress Needed on Security Controls
Inspectors General are required by the Federal Information Security
Modernization Act (FISMA) to assess the effectiveness of information
security programs on a maturity model spectrum and assess security
capability in eight domains.
The current benchmark for an effective program within the context of
the maturity model is level 4, “Managed and Measurable.” In the
maturity model, domain performance that scores below the level of managed and measurable, such as
ad hoc, defined, or consistently implemented, means IT security is ineffective.
Our most recent evaluation indicated SBA continued to achieve level 4 in the area of incident response
but is at level 2 “Defined” or level 3 “Consistently Implemented” in the remaining seven areas.
Consequently, SBA is at an overall level of “not effective.” At the same time, however, progress is being
made toward an “effective” level under FISMA requirements.
Agency Progress
COVID-19 relief efforts diverted SBA resources from some daily compliance activities. As a result, SBA
continues to experience security challenges in areas of user access, configuration management, and
security training.
Although COVID-19 assistance activity increased transaction volumes, SBA made progress in automated
security control testing and protection of personal identifiable information. Continued improvement is
needed in risk management and configuration management controls. The agency should update
authorizations to operate for systems, promptly correcting vulnerabilities.
In addition, areas for improvement include tracking of plans of action and milestones. The agency
should also update software and hardware inventories. Challenges also remain in the areas of access
control and security training.
13
Challenge 4: SBA Risk Management and Oversight Practices Need
Improvement to Ensure the Integrity of Loan Programs
Why This Is a Challenge
S BA’s Office of Credit Risk Management manages lender oversight, credit and compliance risk for the
agency’s loan portfolio of more than $744 billion including loans made through the Paycheck
Protection Program. However, those loans are originated by lenders and non-bank lenders that have
various degrees of expertise in SBA loan program requirements.
Lenders often rely on the services of loan agents and lender service providers to help originate, close,
service, and liquidate SBA loans of traditional SBA 7(a) and 504 Certified Development Company loans
are originated by lenders with delegated approval authority. Our previous audits have found SBA has
not adequately recognized or managed significant lender weaknesses. In FY 2020, in an audit of SBA’s
oversight of high-risk lenders, we identified additional internal control weaknesses in lender oversight.
SBA has worked to address these issues and strengthen its oversight of lenders, in part by incorporating
our audit recommendations.
We note that SBA has implemented several actions to create a more structured lender oversight
methodology and address recommendations made in the 2020 audit that should improve SBA’s
oversight of lenders in the 7(a) program. However, SBA still needs to make improvements, including
developing effective oversight policies and procedures and implementing a workflow management tool
to interact with its comprehensive portfolio management data warehouse to manage oversight of high-
risk lenders.
Previous OIG audits have also shown that SBA did not effectively identify and track third-party agent
involvement in its 7(a) and 504 loan portfolios. Tracking such agents is crucial to manage portfolio risk
because many lenders rely on the services of fee-based and other third-party agents to help originate,
close, service, and liquidate SBA loans.
Issue: SBA’s Oversight of High-Risk Lending Participants
The risks inherent in delegated lending require effective oversight to
monitor compliance with SBA policies and procedures and corrective
actions to address noncompliance. However, OIG’s 2020 audit of SBA’s
oversight of high-risk lenders found that the SBA Office of Credit Risk
Management did not always effectively oversee high-risk lenders to
identify and mitigate risks (Report 20-03).
SBA did not always
• conduct planned high-risk lender reviews,
• recommend appropriate and consistent risk mitigation actions for the deficiencies identified
during the oversight reviews of high-risk lenders, or
14
• communicate loan deficiencies noted during high-risk lender reviews to SBA approval and
purchase loan centers.
Agency Progress
In FY’s 2020 and 2021, SBA took actions to improve its ability to oversee high-risk lenders, including:
1. Issuance of the Final 7(a) Lending Oversight Rule
2. Publication of the SOP 50 53 2 for Supervision and Enforcement (January 2021). This SOP has been
instrumental in facilitating supervision and enforcement actions.
3. Realignment of the organizational structure of the Office of Credit Risk Management to strengthen
lender oversight and add resources to the review teams for effective oversight.
4. Quarterly meetings to assess high-risk lender activity and review results and develop risk mitigation
alternatives.
5. Enhanced quarterly analysis using historical and forward-looking metrics to identify high risk lenders.
6. Revising Standard Operating Procedure (SOP) 51 00 2 – Examinations and updating the process for
Risk-Based Reviews and Safety and Soundness Examinations.
The Office of Credit Risk Management has made progress by communicating deficiencies identified
during loan file reviews and sharing this information with the SBA loan servicing and purchase centers
and other internal stakeholders. The office continues to work with SBA leadership to define the
requirements for the workflow management system, and how it will utilize the data Loan and Lender
Monitoring System and authorize its funding. SBA reports that its goal is to develop this technology in FY
2022.
Although SBA has made progress by increasing and improving its use of data to identify and manage
lenders with elevated risk profiles. as noted above with the publication of the SOP 50 53 2 for
Supervision and Enforcement, agency management has indicated it needs time to finalize and
implement policies and procedures to document its Risk-Based Review and Safety and Soundness
Examination processes, including SOP 51 00 2.
This SOP will provide specific guidance to Reviewers in Charge and Financial Analysts on appropriate and
consistent corrective actions for lenders whose reviews result in findings that require monitoring and
implementation of corrective actions to attain compliance. SBA also needs to provide documentation
showing the agency is conducting periodic overall assessments of the high-risk lender review results and
recommended risk mitigation actions during the High-Risk Lender Quarterly Meeting.
In FY 2022 SBA plans to develop the database to manage oversight of high-risk lenders. We will continue
to monitor SBA’s ongoing efforts to address open recommendations in Report 20-03, including
developing effective oversight policies and procedures and a workflow management system to help
manage oversight of high-risk lenders.
15
Issue: Increased Risk Introduced by Loan Agents
Previous OIG audits and investigations have shown SBA could not
effectively identify and track loan agent involvement in its 7(a) and 504
loan portfolios. OIG investigations have also revealed a pattern of fraud by
loan packagers and other fee-based agents in the 7(a)-loan program
involving hundreds of millions of dollars. This all reinforces the need for
SBA to update its enforcement regulations.
Despite the prevalence of fraud in its loan portfolios, SBA’s oversight of loan agents was limited. Over
the course of a decade, OIG investigated at least 22 cases of confirmed loan-agent fraud, totaling
approximately $335 million (Report 15-16). The audit determined that loan agents were involved in
approximately 15 percent of all 7(a) loans, increasing the risk of default. SBA reports this percentage
decreased to approximately 7 percent in FY 2020.
Form 159
SBA requires lenders to provide a loan agent disclosure form (Form 159) to SBA’s fiscal and transfer
agent for 7(a) loans that involve a loan agent. The fiscal and transfer agent is a contractor who supports
SBA by serving as paying agent for all investor payments, processes lender loan reporting, and payment
remittance reconciliations.
The fiscal and transfer agency also serves as the central registry for all guaranteed secondary-market
interests. The fiscal and transfer agent must enter the data into a database accessible to SBA.
In our 2015 report on SBA’s loan agent oversight, we identified significant issues in the data quality of
Form 159. We also found that SBA had not begun tracking Form 159 in the 504-loan program.
Agency Progress
In response to our 2015 report on SBA’s oversight of loan agents, SBA managers stated the agency
would explore the feasibility of implementing a registration system for the 7(a) loan program. SBA
determined the best way to gather information on loan agents was by improving Form 159. The
enhanced Form 159 was approved by the Office of Management and Budget and rolled out with official
notification and lender training.
Beginning in January 2020, SBA initiated targeted Form 159 reviews of lenders to determine compliance
with SBA requirements. The improved Form 159 allows SBA to aggregate and report on loan agent
activity to analyze the lender’s portfolio.
In FY 2019, SBA also undertook a new, more effective method of disclosing and tracking loan agent
involvement in the 504-loan program. SBA requires 504 lenders to electronically submit Form 159
directly into SBA’s electronic lending system.
In addition, SBA awarded a new fiscal and transfer agent contract. The contract requires the fiscal and
transfer agent to develop application and follow-up controls over 7(a) lender submissions to ensure
critical fields on each form are completed.
With assistance from the fiscal and transfer agent, the agency implemented Form 159 controls to only
16
allow lenders to electronically submit Form 159s through the Capital Access Financial System.
Lenders put information into the system, such as broker name, service provided, and the amount of
compensation paid, which then populates Form 159. The lender signs the form and may upload the
form into the system.
Form 159 controls are now fully in place. Our review of the Form 159 data from the beginning of the
new controls in 2021 shows loan agent information is generally tracked and should give SBA more
complete data to evaluate loan agent performance.
Because loan agent involvement in the 7(a) program is significant, it is important for SBA to have
oversight tools in place to identify and track loan agent involvement in this sizeable program. SBA also
needs to effectively manage the risk introduced by high-risk loan agents. OIG will continue to monitor
risks in this area and SBA’s oversight of loan agents and conduct audits and reviews as necessary.
Issue: Increased Risk Introduced by Lender Service Providers
In 2019, five former officers and employees at one of the largest lender
service providers were charged for their alleged roles in a 13-year
conspiracy to defraud SBA in connection with programs to guarantee
loans made to small businesses. In August 2021, the individuals were
convicted on all charges.
The officers fraudulently obtained guarantees for loans SBA deemed
ineligible. The officers hid signs of ineligibility from the SBA by misrepresenting the use of SBA loan
proceeds and unlawfully diverting previously denied loan applications into expedited approval channels.
The officers originated dozens of loans, totaling more than $10 million in disbursements, that were not
eligible for SBA guarantees.
SBA has had to contend with the issue of risks introduced by lender service providers for some time. In a
March 2015 audit (Report 15-06), we noted that the outsourcing of traditional lender functions to
lender service providers, a type of loan agent, had significantly increased.
Since then, the number of SBA-approved lender service provider agreements has grown significantly, in
part because of SBA’s effort to better control access to its systems by lender service providers. SBA
assigns an identifying number for all lender service providers that access SBA systems and records all
SBA-approved agreements.
Use of the identification number has made it possible for the Office of Credit Risk Management to
develop initial statistics on provider participation in SBA’s 7(a) program, but the agency’s oversight is still
limited. SBA’s analysis of the performance of loan agents does not include loan-level information from
lenders to make it possible to identify high-risk lender service providers.
Agency Progress
In response to our 2015 report on SBA’s oversight of lender service providers, SBA established a method
to track lender service provider involvement at the loan level. However, this information was not
analyzed to evaluate performance.
17
In FY 2020, SBA worked with a contractor to develop a performance analysis report for lender service
provider portfolios to identify any high-risk lender service providers. SBA managers said the agency is
working with the contractor to determine if the information from the analysis can signal whether the
lender service provider adds to the risk in the lender’s portfolio of loans. OIG plans to review the analysis
as soon as it is available, anticipated in FY 2021.
As lender service provider involvement in the 7(a) program increases, it will be especially important for
SBA to evaluate performance and effectively reduce the incurred risks. OIG will continue to monitor
SBA’s oversight of lender service providers, assess risks, and conduct audits and reviews as necessary.
18
Challenge 5: SBA’s Management and Monitoring of the 8(a)
Business Development Program Needs Improvement
Why This Is a Challenge
SBA’s 8(a) Business Development Program was created to provide business development assistance to
eligible small disadvantaged businesses seeking to compete in the American economy. A major
benefit of the 8(a) program is that 8(a) firms can receive sole source, as well as set-aside, competitive
federal contracts, which means small businesses do not have to compete against large businesses that
may have an industry advantage.
Sole-source awards are contracts proposed for award without competition. A set-aside award is a
proposed contract with competition limited to small businesses.
SBA has had two significant challenges with the program. The agency has struggled to provide effective
business development assistance to 8(a) firms and ensure only eligible firms are admitted into and
remain in the program. Additionally, SBA faces the challenge of developing objective and reasonable
criteria for determining, at which point socially disadvantaged individuals are also deemed to be
economically disadvantaged.
Issue: SBA Continues to Address Its Ability to Develop Firms in the 8(a)
Program and Measure Results
In the past, SBA emphasized business development to enhance the
ability of 8(a) firms to better compete for federal contracts. SBA offers
individualized development assistance to program participants and also
makes referrals to its resource partners, the Small Business
Development Centers; SCORE, a volunteer mentor network composed of
retired executives and entrepreneurs; Women’s Business Centers;
Veterans Business Outreach Centers; and affiliate Procurement Technical Assistance Centers.
Despite these improvements, SBA has not fully established an IT system to perform regular performance
monitoring and reporting for 8(a) participants to ensure progress with their business plans. Without an
effective IT system to monitor 8(a) participant progress in meeting individualized business development
goals, SBA may not be able to consistently determine if 8(a) participants have demonstrated the ability
to compete in the marketplace without 8(a) assistance.
SBA has made previous unsuccessful attempts to revamp its IT systems. The agency partially
implemented an IT system, Certify, that was intended to be a comprehensive approach to service
delivery for all SBA contracting certification programs.
Certify fell short of expectations because of serious challenges to needed features, such as searchability,
data collection, and reporting (see challenges 2 and 3 for more discussion about the unsuccessful Certify
system).
Certify did not include tools to track, measure, and monitor 8(a) participant progress and outcomes. To
19
bridge the gap, SBA created the Business Opportunity Specialist Annual Review Workbook in FY 2020.
This tool is not automated and still exploratory. This workbook helps specialists determine continuing
eligibility and summarizes current financial conditions for each firm during annual reviews.
When used, the Business Opportunity Specialist maintains the workbook in the participant’s case file on
the Certify platform.
Agency Progress
Program officials began monthly phone calls to discuss questions raised by SBA’s business opportunity
specialists. The agency conducted training sessions for business opportunity specialists as all types of
issues from the district offices were raised.
To respond to emerging issues related to COVID-19 economic response, SBA issued regulations and
provided prompt guidance allowing 8(a) participants to suspend program participation for up to an
additional year. These options allowed participants to recoup development and contracting
opportunities that may have been lost during a time when business was not operating as usual.
However, the poor and unworkable IT system is only a factor, not the reason the agency has not
improved 8(a) program business development.
Business Opportunity Specialists are encouraged but not required to use the annual review workbook.
The workbook focuses on assessing firms’ eligibility to continue in the program instead of business
development.
SBA does not have an effective system to measure and monitor 8(a) participants’ progress from year to
year to assess whether they were receiving effective business development help throughout the 9-year
term.
As a result, there is no assurance that participants received the business development assistance
necessary for them to become viable competitors in the federal marketplace.
Issue: Streamlined Application Process May Expose the 8(a) Program to
Higher Fraud Risk
From 2010 to 2016, the number of firms participating in the 8(a)
program steadily decreased from about 7,000 to approximately 4,900. In
FY 2016, SBA leadership developed a growth plan to increase the
number of participants by 5 percent for 2016 and 2017 using a
streamlined application process.
However, the plan did not reach its goal.
Participation numbers continued to decline through 2020. As of August 2021, program participation is
back to 2016 numbers with SBA reporting 4,906 firms in the program.
According to SBA officials, the streamlined application process is less burdensome for applicants. As part
of this modified process, various documents previously used to determine an applicant’s eligibility would
no longer be requested or would be required in a modified version. For example, SBA no longer required
20
that applicants submit information about the applicant firm’s business structure and information on tax
liens, judgements, or lawsuits.
However, shortening the review process by eliminating documents may erode core safeguards that
prevent questionable firms from entering the program. At the request of SBA’s former Deputy
Administrator, we followed up on a report issued in FY 2016 (Report 16-13) to determine whether SBA
resolved eligibility concerns for the 30 firms we had reviewed. We determined SBA resolved eligibility
concerns for 20 of the 30 firms, but we still questioned the eligibility of 10 firms (Report 17-15).
Agency Progress
SBA took corrective actions, reducing the risks OIG found in previous audits. In 2020, we verified SBA
added controls to the application review process and implemented corrective actions to address
recommendations from previous audits of SBA’s initial eligibility review procedures (Report 20-09). SBA
updated its 8(a) program policies and procedures to include a statement in the review notes of each
application when a final decision differs from a lower-level reviewer recommendation, a risk we
reported in Report 16-13 and Report 17-15).
SBA updated its policies and procedures to require business opportunity specialists to submit a request
to the Internal Revenue Service for the tax transcripts to verify the applicant’s financial information. SBA
also updated its internal policies and procedures and the corresponding regulations to make these
recent changes mandatory, effective November 2020. Tax records are now required to verify applicant
financial information.
In response to our recent work (Report 21-12), SBA published procedures to verify 8(a) business owners
who claim socially disadvantaged eligibility as members of a federally or state-recognized tribe. We
found SBA admitted two firms in the 8(a) program although the owners were members of unrecognized
tribes, which resulted in questioned costs of $10.9 million in 8(a) set-aside contracts. SBA finalized the
procedures in a desk guide, developed a list of recognized tribes, and trained staff to use objective,
consistent, documented processes and official information to verify eligibility and ensure that enrolled
members are from federally or state-recognized Indian tribes.
Issue: Corrective Actions Are Needed to Improve Continuing Eligibility
Processes and Reduce Risks of Ineligible Firms Participating in the 8(a)
Program
In FY 2018, we reported SBA did not sufficiently ensure that 8(a) Business
Development Program participants met continuing eligibility requirements
(Report 18-22).
We found SBA did not consistently identify ineligible firms in the program
and did not always act to remove firms that had been determined no
longer eligible. SBA also did not log all complaints or perform required
continuing eligibility reviews when it received specific and credible complaints.
21
Agency Progress
During FY 2020, SBA implemented corrective actions to appropriately reduce the risk that ineligible firms
continue to participate in the 8(a) program. SBA updated and implemented its 8(a) program policies and
procedures governing its continuing eligibility review process and evaluation standards in December
2020. The agency also updated its process for removing firms deemed ineligible for program assistance.
SBA implemented the Business Development Hotline Complaints Tracker as the official system to track
8(a) eligibility complaints and actions taken to address them. Since launching the tracker in FY 2019, SBA
has determined two businesses were ineligible and terminated them from the program.
Issue: Economically Disadvantaged Determination Criteria Should Be Based
on Sound Methodology
The Small Business Act requires that 8(a) participants be socially and
economically disadvantaged. The Act defines economic disadvantage as
diminished capital and credit opportunities compared to owners of
similar businesses that are not disadvantaged. However, SBA has not
adequately determined what constitutes diminished capital and credit
opportunities.
Section 8(a)(6)(A) of the Small Business Act states: “In determining the degree of diminished credit and
capital opportunities, the Administration shall consider, but not be limited to, the assets and net worth
of such socially disadvantaged individual[s].”
According to SBA regulations, when considering diminished capital and credit opportunities, SBA is to
review such factors as personal income, personal net worth, and the fair market value of all assets. SBA
also compares the financial condition of the company with other small businesses in the same primary
industry classification.
SBA evaluates several factors when determining economic disadvantage, including the applicant’s
adjusted gross income, net worth, and total assets. Assets (including net income) and net worth do not
accurately reflect diminished capital and credit opportunities.
In 1989, SBA set limits that applicants needed personal net worth of less than $250,000 (excluding
ownership in the 8(a) firm and equity in his or her primary residence) at the time of entry into the
program, and less than $750,000 for continuing eligibility. In 2011, SBA started excluding funds invested
in an official retirement account from the net worth calculation.
More recently, in 2020, SBA issued a final rule that defined an economically disadvantaged individual as
having a net worth of less than $750,000 (excluding ownership interest in the applicant’s business,
equity in their primary personal residence and funds invested in an official retirement account), no more
than $350,000 in average adjusted gross income during the previous 3 years, and no more than $6
million in assets (excluding funds invested in an official retirement account).
SBA’s economic disadvantage definition should be based on justifiable, objective, and supportable data
to ensure that the program benefits the small businesses that Congress had intended. An objective
22
definition is fundamental for ensuring the agency has designed a system of controls that safeguard the
program from firms participating in the program that are not truly economically disadvantaged.
Agency Progress
In FY 2018, a contractor issued a draft report of its study to assist SBA in setting criteria to determine
what constitutes economic disadvantage. The study determined, based on a review of available
literature, that there have been no attempts at the federal, state, or municipal level to define economic
disadvantage beyond referencing the SBA 8(a) program. The study developed three estimated
thresholds using separate methodologies to set the thresholds for economic disadvantage.
A year later, the contractor issued a final report that revised the three separate methodologies for
calculating net worth thresholds, which at the time of the study resulted in thresholds of $59,100,
$65,650, and $183,900 with exclusions. SBA excludes business and primary residence equity and
retirement accounts. These amounts were revised from the contractor’s draft report that recommended
SBA use the methodology that concluded that individuals with an adjusted net worth of $375,000 – or
$1.1 million without adjustments – should be considered economically disadvantaged.
SBA published a proposed rule in May 2019 to revise economic disadvantage to adopt $750,000 as a net
worth for eligibility for all economically disadvantaged programs.
SBA solicited comments to the proposed rule on whether the $375,000 or $750,000 net worth standard
should be used for entry into the 8(a) program. SBA considered the 146 comments that supported the
$750,000 adjusted net worth standard to be representative of all public opinion.
SBA concluded that the $375,000 net worth was not appropriate as the standard for determining
economic disadvantage. The agency determined the net worth figure was only a benchmark for entering
the 8(a) program, as opposed to participating in the free enterprise system as an economically
disadvantaged business owner.
On July 15, 2020, SBA finalized the rule and used the $750,000 adjusted net worth figure it had
established for other small business contracting programs. This amount has been part of SBA’s definition
for economic disadvantage since 1989, with adjustments to increase the assets to be excluded for
calculating the individual business owners net worth.
SBA’s determination of net worth is a critical starting point for many programs. The 8(a) program is
intended to benefit eligible small, disadvantaged businesses. When crafting a program that strives to
benefit a select demographic group, the financial limits to determine eligibility should be based on
verifiable empirical analysis to ensure the intended population of small, disadvantaged businesses
benefit from this program.
We are currently planning an audit of the agency’s procedures used to define economic disadvantage in
2022. Currently, the Government Accountability Office is reviewing the impact SBA’s net worth limits
have on program participants and plans to report on the findings in 2022. We did not rate the agency’s
progress on defining economic disadvantage for the 8(a) program this year.
23
Challenge 6: Identification of Improper Payments in SBA’s Loan
Programs Remains a Challenge
Why This Is a Challenge
I n FY 2019, the dollar amount of SBA’s 7(a) loan approvals totaled $23.6 billion. Most of these loans
were made by lenders with delegated approval authority. When a loan goes into default, SBA reviews
the lender’s actions on the loan to determine if it is appropriate to pay the lender the guaranty, which
SBA refers to as a “guaranty purchase.” (“Guaranty” is a variant of “guarantee” used in financial
terminology.)
In FY 2014, OIG established a High-Risk 7(a) Loan Review Program to evaluate lender compliance with
SBA requirements for high-dollar, early defaulted 7(a) loans. High-dollar, early defaulted loans are
$500,000 or more and default within the first 18 months of initial disbursement.
During FY 2019, OIG found lenders were out of compliance for 5 of the 8 loans we reviewed, totaling
approximately $8.7 million in questioned costs. Although SBA completed purchase and quality control
reviews on all the loans, the agency did not identify or fully address the material deficiencies noted in
the OIG review.
We continue to communicate with the agency about previous recommendations for recoveries as part
of the audit follow-up process.
Issue: Improvements Needed to Ensure High-Risk 7(a) Loan Reviews Reduce
the Risk of Losses
OIG audits and reviews have identified 7(a) loans that were ineligible, given to borrowers who did not
have the ability to repay, or were not properly closed, resulting in improper payments. Improper
payments occurred in part because SBA did not adequately review related loans.
The OIG High-Risk 7(a) Loan Review Program uses an internal scoring system to prioritize loans for
review by level of risk. This evaluation includes a review of high-risk loans purchased by SBA to
determine whether lenders complied with SBA requirements and
identify suspicious activity.
Since FY 2014, we have recommended recoveries on 17 loans totaling
more than $19.3 million. In addition, we identified suspicious activity on
5 loans totaling nearly $4 million, which were ultimately referred to our
Investigations Division.
Our reviews of high-risk loans have consistently identified issues regarding eligibility, repayment ability,
size standards, franchise agreements, business valuations, appraisals, equity injection, and debt
refinance. Our review program also has helped us identify concerns with change of ownership
transactions and SBA’s identification of improper payments.
Agency Progress
In FY 2020, SBA began to allow loan specialists more time to review complex early defaulted loans. In
24
addition, the agency improved its review of loans, training loan specialists, and updating the loan review
checklist.
In FY 2020, SBA internally evaluated its purchase process and quality control reviews for 7(a) guaranteed
loans to determine why the loan center reviews did not identify or correct lenders’ noncompliance with
SBA requirements, as has also been noted in OIG reports.
In FY 2021, SBA held a training session at the loan center that focused on the requirements and SBA
review of documentation related to the source of funds used for equity injection, which was a
continuing issue in our reviews and the agency’s internal evaluation.
SBA has begun drafting a revision to the 7(a) loan servicing and liquidation requirements. For continual
progress, SBA should finalize and issue its revised requirements designed to reduce improper payments.
We will continue to monitor risks in this area and conduct audits and reviews as necessary.
25
Challenge 7: SBA’s Disaster Assistance Program Must Balance
Competing Priorities to Deliver Prompt Assistance but Prevent
Fraud
Why This Is a Challenge
T he disaster loan program plays a vital role in the aftermath of disasters by providing long-term, low-
interest loans to affected homeowners, renters, businesses of all sizes, and nonprofit organizations.
SBA must continually balance the priority of quickly assisting disaster survivors in the immediate
aftermath of a devastating life event with the need to ensure program integrity and mitigate the risk of
fraud. To do so, the agency faces challenges in staffing, quality assurance, and financial controls.
Staff
During large-scale disasters such as COVID-19, SBA must hire enough loan officers to match the volume
of loan applications and prevent processing backlogs. When the COVID-19 pandemic began, SBA
increased the permanent and temporary trained staff size to more than 9,000, which was significantly
more than any other previous disaster. SBA has been challenged to hire and train large numbers of staff.
Quality Assurance
In February 2020 (Report 20-07), we found weaknesses in the improper payment quality assurance
process. Although the improper payment quality assurance appeal process appeared to be working as
intended, the initial review process needed strengthening.
Controls
In September 2019 (Report 19-23), we found the desktop loss verification process helped SBA meet its
timeframe goals for disaster applications, but controls needed strengthening to reduce the risk of fraud
and ensure program integrity. We also identified significant fraud risks due to internal control
weaknesses in the COVID-19 EIDL program, which we describe in Challenge 1.
Although we have not completed recent work in the loan servicing area, based on the recent surge in
EIDLs because of the COVID-19 pandemic, the number of loans requiring servicing will increase to
unprecedented levels.
Issue: Reserve Staff Need Training to Sustain Productivity During
Mobilization
SBA management has dealt with this issue for several years but has
recently made progress. The magnitude of the COVID-19 pandemic (21.7
million applications received as of May 31, 2021) required SBA to rapidly
increase and train staff, and numbers rose to historic levels.
The number of personnel needed to serve during the pandemic was
almost twice the previous record high staff total. In addition, the agency
had to develop the needed training to address the new criteria for COVID-19 EIDLs.
26
SBA’s Office of Disaster Assistance increased its trained staff from 800 to more than 5,000 employees in
December 2017 to respond to hurricanes Harvey, Irma, and Maria. In response to the COVID-19
pandemic, SBA increased its permanent and temporary staff size to more than 9,000.
SBA outsourced the COVID-19 EIDL processing to a subcontractor to make recommendations for
approval or denial of loan applications. SBA staff made the final decision to approve or deny COVID-19
EIDLs. SBA had to train the existing staff and the newly hired employees on the new contractor’s system,
a tremendous undertaking.
Agency Progress
SBA had previously made progress in this area by implementing a cross-functional training plan, as well
as online and automated tutorials, a change that resulted from an after-action report’s findings on SBA’s
response to prior major disasters. The COVID-19 pandemic required SBA to train and mobilize the
largest number of new employees ever in its history. A similar after-action evaluation will be needed to
determine how SBA can better respond to future declared disasters.
The Office of Disaster Assistance was drafting a new staffing strategy during the summer of 2021. At the
end of June 2021, management of the COVID-19 EDIL Program transitioned from the Office of Disaster
Assistance to the Office of Capital Access. The agency moved the program to revise staffing, operations,
and other aspects of the program, which will also affect staff training. The Office of Disaster Assistance
will continue to manage the agency’s other disaster programs.
Bringing on a large temporary staff in response to a major natural disaster may always be a
management challenge for SBA. To address this challenge, the agency needs to develop training that is
comprehensive and reoccurring to improve the overall customer experience, reduce applicant
processing times, and increase the number of loans and grants designated for approval, resulting in
eligible applicants receiving the federal assistance they need and deserve in a timely manner.
Issue: Improper Payment Quality Assurance Process Needs Strengthening
SBA received a historic number of loan applications in FY 2020 when
COVID relief programs were established. SBA tests a statistical sample of
these loans for improper payments. Because the total number of
number of loans that have been approved and disbursed is so large, the
statistical sample is also large, which has highlighted issues in SBA’s
improper payment process.
An improper payment is any federal government payment made to an ineligible recipient or for an
ineligible good or service, duplicate payment, or payment for goods or services not received (except for
such payment authorized by law).
The Payment Integrity Information Act of 2019 requires agencies to evaluate fraud risks and use a risk-
based approach for financial and administrative controls to counter identified fraud risks. The law
reinforces the requirement for agencies to review prepayment and pre-award procedures.
SBA removed typical initial controls in the EIDL program and relied on self-certification by the applicants
27
to get funding out quickly to struggling businesses at the beginning of the pandemic. This led to
significant fraudulent activity in the program. We published two reports in FY 2021 detailing a significant
number of potentially fraudulent loans (Reports 21-02 and 21-15). SBA’s improper payment rate could
increase dramatically over that of previous years.
COVID-19 EIDLs had different requirements than other SBA disaster assistance loans. EIDLs typically
represent a small percentage of the SBA’s disaster loans. However, COVID-19 EIDLs have changed the
ratio significantly; EIDLs are now the predominant loan type in SBA’s disaster assistance portfolio.
The deadline to apply for COVID-19 EIDLs was extended to December 31, 2021. SBA will continue to
process these loan applications as well as other disaster relief. EIDLs are more complicated for loan
specialists to calculate properly, so the agency faces many challenges that could easily result in improper
payments. The agency will need to stringently apply the improper payments process to the entire EIDL
portfolio to ensure no funds have been paid out to people or entities on the government’s Do Not Pay
list.
In February 2020, we reported on weaknesses we found in the improper payment quality assurance
process (Report 20-07). We found the improper payments appeal process effectively assessed improper
payments, but the initial review process was inefficient.
Agency Progress
SBA has made numerous changes in response to our February 2020 report to strengthen improper
payment quality assurance, including:
• Creating guidance for the quality assurance leadership team on the quarterly improper payment
audit review process.
• Providing team training based on the guidance, as well as additional specific training to keep
staff abreast of updated changes to processing systems.
• Developing detailed auditing checklists for accounts and loan processing to ensure consistency.
• Updating the quality assurance database.
• Hiring additional staff to handle increased workflow and creating two separate groups within
quality assurance, one for COVID-19 lending and one for other lending.
• Changing to weekly reviews instead of monthly to provide immediate feedback to departments.
Although these improvements address the weaknesses identified in our February 2020 report, OIG has
serious concerns about how the rate of improper payments of COVID-19 EIDLs is measured. According
to SBA management, the agency has implemented a multitiered approach to prevent improper
payments.
These processes use internal and independent third-party resources. Agency managers say the new
approach will allow SBA to minimize the number of fraud and improper payments effectively and
efficiently when an application is submitted or before funds are awarded. In addition, agency managers
said the Office of Disaster Assistance has trained four groups of quality control specialists, leads, and a
supervisor to ensure they know how to identify improper payments.
28
We have not reviewed to determine whether SBA’s multitiered approach and the training has been
effective and efficient to prevent fraud and additional improper payments. We have, however, identified
additional potential fraud that indicates the agency needs to do more to prevent fraud and reduce the
likelihood of improper payments.
In an October 2020 report, OIG identified numerous instances of potential fraud in COVID-19 EIDLs and
Emergency EIDL advances resulting from a lack of controls that allowed multiple loans to duplicate
internet provider addresses or the same physical addresses, changes to bank account numbers before
disbursement, and other activities that have led to massive fraud.
In May 2021, we reported more than $6.2 billion in potentially fraudulent loans from applicants who
allegedly stole identities and then used that information to apply for disaster assistance loans.
We have concerns that the agency’s current approach ignores whether sufficient internal controls exist
to identify and prevent improper payments.
OIG contends that payments to fraudulent applicants are always an improper payment if this fact is
known at time of improper payment review, regardless of the circumstances that allowed the fraud to
occur.
By restricting improper payment identification to cases in which program staff made an error during the
processing or disbursement of the loan, SBA risks understating the COVID-19 EIDL improper payment
rate by a significant margin.
Issue: Inadequate Verification of Cause and Extent of Damages
A critical part of the disaster lending process is evaluating the cause and
extent of property damage to establish eligibility for disaster loan funds.
Verifying loss claims used to be done solely through on-site inspections.
But in early 2017, the agency adopted a new desktop loss verification
process to speed financial help to disaster survivors.
Desktop loan verification is a two-part process with an initial desktop
verification used to estimate the cost of repairs followed by a post-desktop review to confirm the
estimates in the initial phase. For loans of $25,000 or less, SBA’s loss verifiers can do the post-desktop
verification using information from the Federal Emergency Management Agency’s (FEMA’s) on-site
inspection reports. However, if FEMA did not inspect the disaster site, SBA must do an on-site inspection
or use documents from the applicant deemed to be acceptable to verify the loss.
In 2019, we reported on the desktop loss verification process (Report 19-23). We found SBA did not
always validate the cause and extent of damages and repair and replacement costs before disbursing
loan funds. SBA simply relied on FEMA reports without enough information to validate damages and
losses reported in the initial loss verification. In addition, loan files did not contain sufficient
documentation to support loan-making decisions.
As a result, SBA paid out more than 36,400 loans totaling more than $585,000,000 without validating
damages and losses. We recommended SBA strengthen controls to reduce the risk of fraud and ensure
29
program integrity for the loss verification process.
Agency Progress
The agency has made substantial progress strengthening the controls to reduce the risk of fraud and
ensure program integrity. In FY 2020, the agency updated its policies and controls to prevent loan
disbursement before a post-desktop review.
The agency also stopped basing post-desktop verification reviews on FEMA and has confirmed that all
post-desktop reviews will be done onsite. In September 2020, SBA began requiring all approved loans to
have an on-site verification before paying out any loan funds. In addition, on June 7, 2021, SBA
expanded its efforts by launching the automated damage estimation pilot and is actively monitoring the
system.
We believe the agency’s progress is substantial and this issue is no longer a contributing factor to the
overall management challenge. We plan to remove this issue from the challenge in future reports.
Issue: Unprecedented Increase in Servicing COVID-19 EIDLs
SBA has two Disaster Loan Servicing Centers, one in Birmingham,
Alabama, and the other in El Paso, Texas, servicing disaster loans that
have been approved and fully disbursed. The two centers manage the
portfolio and provide customer service, including accepting and
processing loan payments; making routine collection efforts by phone,
email, and postal letters; and any loan-related issues such as insurance,
title, or lien matters.
After a disaster loan becomes 90 days delinquent, it is transferred to a third center known as the
National Disaster Loan Resolution Center in Santa Ana, California. The loan resolution center manages
the portfolio of defaulted disaster loans with increased collection efforts, including foreclosure when
necessary.
The center also handles other loan servicing activities, such as processing loan payments. When disaster
loans are deemed ultimately uncollectable and charged-off, or removed from the agency’s loan
portfolio, the borrowers and guarantors are referred the U.S. Treasury Department.
Treasury has the authority to take stronger efforts to collect, including offset of other federal payments.
In this context, offset means diverting federal payments to satisfy the delinquent loan.
Before the COVID-19 pandemic, SBA was servicing about 263,000 outstanding disaster loans, totaling
approximately $9 billion, across the three servicing centers. By July 31, 2021, as a result of the
unprecedented number of pandemic relief loans, SBA has 4 million outstanding disaster loans totaling
approximately $216.3 billion that must be serviced.
This increase in the number of loans is 15.2 times and the dollar amount is 24 times the size of the pre-
pandemic disaster loan portfolio. By the end of 2021, SBA could have a disaster loan portfolio size of
$470 billion. The demand on the current servicing centers is going to increase dramatically. We
anticipate the agency will face significant challenges in managing this volume.
30
Lending billions in pandemic relief loans now means that SBA has millions of additional loans in its
portfolio that must be serviced unless they are forgiven. However, SBA does not have the staff or
infrastructure to manage the unprecedented volume.
Agency Progress
SBA told us the agency contracted with a vendor on May 3, 2021, to determine the most effective way
to service the COVID-19 EIDL portfolio. Potential options include use of a third-party servicer, asset
sales, or having SBA manage the servicing.
The contractor’s preliminary analysis is due on August 31, 2021, with the final recommendation due on
September 31, 2021.
SBA officials told us the agency has added additional staffing resources across the disaster servicing and
liquidation centers to accommodate the corresponding increase in borrower inquiries and requests. The
COVID-19 EIDL program allows a 24-month deferment of the first payment due date. As a result, SBA
officials said they intend to evaluate the contractor’s recommendation and establish a plan before the
end of that two-year deferment period.
31
Challenge 8: SBA Needs Robust Grants Management Oversight
Why This Is a Challenge
I n FY 2021, pandemic relief legislation authorized new, multibillion-dollar grant programs in addition to
the SBA’s entrepreneurial development grant program portfolio. The new laws provided supplemental
funds that nearly doubled the amount and value of SBA technical assistance grant programs. Congress
authorized $45.3 billion for SBA to administer as grants to provide economic relief and technical
assistance.
In light of the government-wide emphasis on grants-management reform, it is SBA’s responsibility to
maximize the value of its grant funding to ensure its programs accomplish program objectives. In recent
OIG audits, we found systemic issues with SBA’s accuracy of grant data for both financial and
performance reporting and ineffective oversight of its grant recipients.
Issue: SBA’s Grants Management System Needs Improvement
Previous OIG reports found that SBA used an inefficient and error-prone
system to manage its grant awards. The federal Procurement Request
Information System Management (PRISM) that SBA used to award,
monitor, and report on technical assistance programs required
substantial manual data entry, which can lead to input errors.
Data inaccuracies inhibit the ability to effectively track federal spending.
Errors also affect the agency’s ability to report complete and accurate information on time, as required
by the Digital Accountability and Transparency Act of 2014. In March 2018, we issued an advisory
memorandum (Report 18-15) on material weaknesses identified by an independent accounting firm in
SBA’s controls over the accuracy of grant award data reported in USASpending.gov.
Immediately after the alert was issued, program officials requested an internal A-123 review on the
grant management process to assess and verify OIG’s findings. SBA’s internal auditors found that all 45
of the sampled awards included inaccuracies and reported a number of deficiencies per award.
PRISM also was not completely integrated with SBA’s financial system and required additional manual
entry to obligate funds and authorize payments to grant recipients. Those problems increased the
number of manual entries required by grants management personnel. Reliable data in a grants
management system ensures the federal funds are awarded to eligible recipients, disbursements are
accurate, and that management can make informed decisions to effectively administer programs.
Agency Progress
SBA has made substantial progress in modernizing its grants management system. In 2019, SBA entered
into an interagency agreement with the U.S. Department of Health and Human Services for transition
analysis, infrastructure setup, and training services to launch GrantSolutions.gov. SBA will spend $2.5
million over 5 years to help the agency
• improve funding management, awarding of grants, processing payments, and closeouts;
32
• enhance ability to develop accurate performance metrics reporting;
• reduce compliance violations; and
• increase auditability, accountability, and transparency.
During FYs 2020 and 2021, the SBA Office of Grants Management implemented the GrantSolutions
system for program office use. Although most of the program offices adopted the system in 2021, the
Shuttered Venue Operators Grant (SVOG) program opted to use another system to manage the SVOG
grants, Salesforce. Officials must ensure the system is customized to meet each program’s needs.
SBA is working to integrate the SBA’s Joint Accounting and Administrative Management financial system
with GrantSolutions.gov. SBA continues to make progress implementing the system despite the
competing priorities of managing the CARES Act programs. The next phase is to include the financial
interface in GrantSolutions.
Until the agency integrates the financial interface, program offices are still required to use the PRISM
system, which is not completely integrated with SBA’s financial system and requires manual entry to
obligate funds and authorize payments to grant recipients. Without an effective grants management
system, the agency must continue manual and burdensome processes to manage compliance
requirements, which may continue to hinder its ability to effectively oversee and manage SBA grant
programs.
Issue: Better Performance Measurements Needed to Monitor Grant Program
Achievements
Recent OIG reviews of SBA’s administration of the SVOG program
(Report 21-13) found SBA did not establish performance goals and
measurements for the grant recipients.
We also found in our review of CARES Act entrepreneurial development
cooperative agreements and grants (Report 21-11) the agency did not
establish clearly defined goals with targets for the grant recipients. SBA cannot effectively measure and
accurately report performance results to assess whether the grant recipient’s performance met
objectives, ensuring the pandemic relief programs were effective.
Federal regulations require awards to include performance goals. The agency must provide a standard
to effectively measure performance of nonfederal entities, such as the estimated number of jobs saved
or created, tax revenue generated, or entity operational status.
Without specific grantee performance reporting measures and requirements, SBA may disburse $16.25
billion for the SVOG program without knowing whether the program successfully aided small businesses
in the live arts and entertainment industry.
Program officials did establish performance goals and indicators for the supplemental CARES Act funds
provided to Small Business Development Centers, Women’s Business Centers, and the Resource Partner
Training Portal. But SBA should have clearly defined the performance goals and set targets to more
effectively ensure performance goals are achieved as intended.
33
We first identified oversight of grant program performance as a top management challenge in FY 2019.
To address these weaknesses, SBA updated its grant management policies and procedures.
The agency required grant officers to enforce performance requirements and verify reported
information as well as to ensure applicants’ proposals include plans to measure performance in a way
that will help SBA achieve program goals.
The Office of Entrepreneurial Development had until September 2020 to fully adopt the updated
policies, which are not reflected in the CARES Act Entrepreneurial Development grants. Without clearly
defined performance goals and targets, SBA cannot effectively measure and accurately report
performance results.
The authorizing language for the SVOG program included no specific performance measurements, so
SBA worked with the Office of Performance, Analysis, and Evaluation in the Office of Chief Financial
Officer to create a logic model in March 2021. The model helped identify outputs and outcomes for the
program.
Using this logic model, SBA is developing an end-of-program survey to be sent when the grantee
initiates the closeout process. The was still in development when this report was published in mid-
October. SBA plans to record metrics, including whether the grant helped the entity reopen sooner, find
additional funding sources, or hire or rehire employees.
Issue: Serious Concerns Over SBA’s Risk Assessment Used for Payment
Distributions and Audits for the Shuttered Venue Operators Grant Program
We alerted SBA management of concerns over the program office’s
initial plans for assessing applicants risks and setting payment
disbursements. The SVOG program could be vulnerable to fraud or
misuse of taxpayer funds because of initial plans for assessing applicant
risks and setting payment disbursements. We recommended that the
agency conduct mandatory oversight to require additional documentation and audit SVOG program
recipients.
Since the majority of SVOG grant awards will be under a certain dollar threshold, they will be
categorized as low risk. These awards will be disbursed in lump sum payments with minimal financial
reporting requirements and expectations for post-award accountability.
As of September 15th, awards under $1 million totaled $2.27 billion of the $9.68 billion awarded funds.
Recently SBA noted that 70 percent of the 11,928 grants awarded were valued at $500,000 or less. The
sheer volume of these smaller grants poses a risk of fraud that could have been reduced if proper
controls had been put in place from the start.
The Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act of 2020 required SBA to
submit the policies and procedures used to conduct oversight and audits of the grants to Congress. It
also required metrics, or measurement standards, to determine which grants would undergo audit. The
SBA Office of Disaster Assistance based its audit plan for this program on the risk level established for
the payment distributions and financial reporting requirements for the grant recipients.
34
All grant recipients receiving $10 million, which is the maximum amount for any single award, will be
audited. It’s likely only a minimal number of recipients will be subject to an audit.
The office’s audit plan exposed the $16.25 billion grant program to potential misuse of funds because
the bulk of grant funds will not be subject to a reasonable degree of scrutiny. SBA is currently revising its
oversight plan to include monitoring, audit, and closeout strategies that address the agency’s obligation
to uphold federal grant regulations and other applicable requirements.
SBA management is planning a number of actions to improve award oversight and grant closeout,
including the following:
• A risk-based monitoring strategy for intensive reviews of shuttered venue grantees
• A multifaceted audit approach of ongoing fraud and improper payment reviews
• Guidance and controls to verify grantee single audit compliance
• Technical help to communicate program instructions, grant compliance, and the grant closeout
process
The office’s audit plan exposes this $16.25 billion grant program to potential misuse of funds because
the bulk of grant funds will not be subject to a reasonable degree of scrutiny.
Issue: Leveraging SBA’s Workforce to Ensure Effective Administration of
New and Significantly Expanded Grant Programs to Aid Small Businesses
Although the SVOG program started with only one official and
temporary staff, SBA has since trained a substantial workforce to review
and approve applications.
As of September 15, 2021, SBA has awarded 11,928 grants, totaling $9.7
billion. With more than $6.5 billion of authorized funds remaining, SBA
will need to leverage and maintain a skilled workforce to meet the demands of ongoing grant
management and administration of new awards.
Approving and awarding federal funds is an inherently governmental function. According to SBA’s
federal assistance directive, only warranted grant officers can commit the agency to enter into a federal
assistance agreement, such as a grant, obligating federal funds.
Despite the federal assistance directive, the SBA acting Chief Operating Officer waived several of the
criteria necessary for new grants management staff, including training and certification requirements.
This may expedite hiring for COVID-19 emergency grant programs, but it could also open these
programs up to mismanagement. SBA established the grants management requirements and the
training plan to address the systemic weaknesses OIG found in previous audits of SBA’s grants
management.
Since SBA will make lump sum advance payments with minimal financial reporting requirements and
agency oversight, it is important that the application reviewing officials carefully review the applicants’
proposed budgets to ensure funds will be used for allowable, allocable, and reasonable expenses.
35
Insufficient oversight of the SVOG program increases the risk that funds will be misspent, inadequately
monitored, or improperly paid.
36