SBA, Independent Auditors’ Report on SBA’s Compliance with Payment Integrity
Summary
A May 12, 2021 memorandum from Inspector General Hannibal "Mike" Ware to SBA Administrator Isabella Casillas Guzman transmits Report 21-16, KPMG LLP's independent auditors' report on SBA's compliance with the Payment Integrity Information Act. KPMG reported that SBA is compliant with four of the six reporting requirements. SBA is not compliant because the Disaster Direct Loan Program had an estimated improper payments rate of 11.98 percent, above the 10 percent threshold, and did not meet the 5.67 percent reduction target for FY 2020. The memo says SBA's Acting Chief Financial Officer and the Associate Administrators for Disaster Assistance and Capital Access concurred with the findings and recommendations.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“SBA, Independent Auditors’ Report on SBA’s Compliance with Payment Integrity.”
Original at legacy.sba.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/sba-independent-auditors-report-on-sba-s-compliance-with-payment-integ-b7d1e3684a/
, SHA-256 fa2bcc8787b4f9744daa253687cb7e43825adf587d1b3e126d0cb8c27f6ca19d.Full text
U.S. SMALL BUSINESS ADMINISTRATION
OFFICE OF INSPECTOR GENERAL
WASHINGTON, D.C. 20416
DATE: May 12, 2021
TO: Isabella Casillas Guzman
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Compliance with Payment Integrity
Information Act (Report 21-16)
We contracted with the independent certified public accounting firm KPMG LLP (KPMG) to
conduct a performance audit, as required by the Payment Integrity Information Act of 2019.
The objectives of the engagement were to review the payment integrity section of the Small
Business Administration’s (SBA’s) Fiscal Year 2020 Agency Financial Report to determine
whether the agency was in compliance with the Act. KPMG also evaluated the agency’s
accuracy and completeness of reporting and performance in preventing and reducing
improper payments.
The attached independent auditors’ report presents KPMG’s findings on the agency’s
improper payment reporting required under the Act. KPMG reported that SBA is compliant
with four of the six reporting requirements in the Act. However, SBA is not compliant with
the Act because the Disaster Direct Loan Program reported an improper payments rate that
exceeded the 10 percent threshold for compliance and did not demonstrate improvements
as evidenced by not meeting its planned FY 2020 improper payments target reduction.
In addition, KPMG found the agency needs to improve the completeness and accuracy of
improper payment reporting. The agency also needs to improve controls to prevent and
reduce improper payments.
We reviewed a copy of KPMG’s report and related documentation. Our review was not
intended to enable us to express—and we do not express—an opinion on SBA’s FY 2020
improper payment reporting or KPMG’s conclusions about the effectiveness of internal
controls.
However, our review did not find any instances in which KPMG did not comply, in all
material respects, with the U.S. Government Accountability Office’s Government Auditing
Standards as issued by the Comptroller General of the United States.
KPMG conducted the engagement in accordance with consulting services standards
established by the American Institute of Certified Public Accountants, the standards
applicable to government performance audits, and the Council of the Inspectors General on
Integrity and Efficiency Guidance for Payment Integrity Information Act Compliance
Reviews.
We have also provided a draft of KPMG’s report to SBA’s Acting Chief Financial Officer and
the Associate Administrators for Disaster Assistance and Capital Access, who concurred
with its findings and recommendations and agreed to implement the recommendations. We
included agency comments in Attachment I of this report.
We appreciate the cooperation and assistance of SBA and KPMG. Should you or your staff
have any questions, please contact me at (202) 205-6586 or Jeffrey R. Brindle, Director of
the Information Technology, Financial Management and Operations Group at (202) 205-
7490.
cc: Antwaun Griffin, Chief of Staff
Arthur Plews, Deputy Chief of Staff
Peggy Delinois Hamilton, General Counsel
Jason Bossie, Acting Associate Administrator for Performance and Performance
and Chief Financial Officer
James Rivera, Associate Administrator, Disaster Assistance
Patrick Kelly, Associate Administrator, Capital Access
Martin Conrey, Attorney Advisor, Legislation and Appropriations
Tonia Butler, Director, Office of Internal Control
Michael A. Simmons, Attorney Advisor
Rafaela Monchek, Director, Continuous Operations and Risk Management
Attachment
Performance Audit of the U.S. Small Business Administration’s Fiscal Year
2020 Compliance with the Payment Integrity Information Act of 2019 (PIIA)
Prepared for: U.S. Small Business Administration, Office of Inspector General
Date: May 11, 2021
KPMG LLP
1801 K Street NW, Suite 12000
Washington DC 20006
Table of Contents
Auditors’ Report ............................................................................................................................ 3
I. Background ............................................................................................................................. 6
II. Objectives, Scope and Methodology ...................................................................................... 7
III. Results and Conclusions ........................................................................................................ 8
IV. Findings ................................................................................................................................ 12
A. Deficiencies in Internal Control ........................................................................................ 14
B. Recommendations........................................................................................................... 17
V. Attachment I – Management’s Response to Report .............................................................. 18
Page | 2
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
Administrator
Inspector General
U.S. Small Business Administration
This report presents the results of our work conducted to address the performance audit objectives related to
the U.S. Small Business Administration’s (SBA’s) compliance with the requirements contained in the Payment
Integrity Information Act of 2019 (PIIA), section 3351(2). We performed our work between January 11, 2021
and May 11, 2021, and our results are as of May 11, 2021.
We conducted this performance audit in accordance with the standards applicable to performance audits
contained in Government Auditing Standards issued by the Comptroller General of the United States. Those
standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
In addition to Government Auditing Standards, we conducted this performance audit in accordance with
Consulting Services Standards established by the American Institute of Certified Public Accountants (AICPA).
This performance audit did not constitute an audit of financial statements or an attestation level report as
defined under generally accepted government auditing standards and the AICPA standards for attestation
engagements.
The audit objectives of our work were to 1:
1. Review the payment integrity section of the fiscal year (FY) 2020 agency financial report (AFR) and
accompanying materials to determine whether SBA is in compliance with PIIA reporting requirements;
2. Evaluate the accuracy and completeness of SBA’s reporting; and
3. Evaluate SBA’s performance to prevent and reduce improper payments.
Based on the results of our performance audit procedures, we have met our audit objectives.
For objective 1, we determined that SBA did not meet the minimum reporting requirements to be compliant with
PIIA. Specifically, the Disaster Direct Loan Program disbursements was not compliant with PIIA because (1)
the estimated 11.98 percent for the improper payments rate exceeded the 10 percent rate necessary to be
compliant with PIIA and (2) they did not demonstrate improvement by not meeting the 5.67 percent reduction
target for FY 2020 (see Table 1).
1 The Council of the Inspectors General on Integrity and Efficiency Guidance for Payment Integrity Information Act
Compliance Reviews (dated November 2020) provides guidance regarding the fieldwork and reporting related to these
performance audit objectives.
KPMG LLP, a Delaware limited liability partnership and a member firm of
Page | 3
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
Table 1. Summary of SBA’s PIIA Compliance
Published and
Published
Developed a Reported
Improper Published Published
Performed Plan to Meet Improper
Program or Payments Improper Programmatic
Risk the Reduction Payment Rate
Activity Information Payment Corrective
Assessment Targets and of Less Than
within the Estimates Action Plans
Demonstrated 10 Percent
Posted AFR
Improvements
Section 7(a)
Loan Guaranty Compliant Compliant Compliant Compliant Compliant Compliant
Purchases
Section 7(a)
Loan Guaranty Compliant Compliant Compliant Compliant Compliant Compliant
Approvals
Section 504
CDC Loan
Compliant Compliant Compliant Compliant Compliant Compliant
Guaranty
Approvals
Disaster Direct
Loan Compliant Compliant Compliant Compliant Not Compliant Not Compliant
Disbursements
Supplemental
Disaster Relief
Compliant Compliant Compliant Not Applicable Compliant Compliant
Administrative
Funds - Payroll
Supplemental
Disaster Relief
Compliant Compliant Compliant Not Applicable Compliant Compliant
Administrative
Funds - Travel
For objective 2, with respect to the accuracy and completeness of SBA’s reporting, we determined SBA
developed and published the gross improper payment rate estimates for each program and activity (program)
using appropriate sampling and estimation plans given program characteristics. However, we identified areas of
improvement. Specifically, the populations of outlays and disclosures for 7(a) loan guaranty purchases, 7(a)
loan guaranty approvals, 504 CDC loan guaranty approvals, and Disaster Direct Loan Program disbursements
included as part of SBA’s reporting were not accurate and complete. Section IV contains details of our findings,
identified internal control deficiencies, and related recommendations.
For objective 3, with respect to SBA’s performance to prevent and reduce improper payments, we determined
that from FY 2019 to FY 2020, SBA had a reduction in the improper payment estimate for all programs except
for 7(a) loan guaranty purchases, 504 CDC loan guaranty approvals, and the Disaster Direct Loan Program
disbursements. Section IV contains details of our findings, identified internal control deficiencies, and related
recommendations.
KPMG cautions that projecting the results of our performance audit, as noted above, to future periods is subject
to the risks that controls may become inadequate because of changes in conditions or because compliance
with controls may deteriorate.
SBA’s response to the findings identified in our performance audit is presented in Attachment I. SBA’s
response was not subjected to the auditing procedures applied in this performance audit and, accordingly, we
are unable to determine if management’s response provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Page | 4
This report is intended solely for the use of the U.S. Small Business Administration and Inspector General,
Comptroller General, the Office of Management and Budget, and relevant congressional committees; and is not
intended to be and should not be relied upon by anyone other than these specified parties.
Very truly yours,
May 11, 2021
Page | 5
I. BACKGROUND
The Improper Payments Elimination and Recovery Act of 2010 (IPERA) (Public Law 111-204)
amended the Improper Payments Information Act of 2002 and required agencies to identify and
review all programs and activities (programs) they administer that may be susceptible to
significant improper payments based on guidance provided by the Office of Management and
Budget (OMB). For programs with estimated improper payments, each agency was required to
prepare a report on actions it has taken or plans to take to recover improper payments and
prevent future improper payments. In addition, section 3 of IPERA required Inspectors General
to review each agency’s improper payment reporting and issue an annual report.
On March 2, 2020, the Payment Integrity Information Act of 2019 (PIIA) (Public Law 116-117)
repealed IPERA (and other laws) but set forth similar improper payment reporting requirements,
including an annual compliance report by Inspectors General.
PIIA requires an annual compliance report by agency Inspectors General and defines what
constitutes compliance with the requirements. An agency has met the PIIA compliance
requirements if they:
• published improper payments information within an agency financial report (AFR) or
performance and accountability report (PAR) for the fiscal year ended September 30,
2020, and posted that report and any accompanying materials required by the OMB on
the agency website;
• conducted a program specific risk assessment for each program or activity that
conforms with section 3352(a) of PIIA (if required);
• published improper payment estimates for all programs and activities identified as
susceptible to significant improper payments under its risk assessment under section
3352(a) of PIIA (if required);
• published programmatic corrective action plans under section 3352(d) of PIIA in the
AFR or PAR or the accompanying materials (if required);
• published reduction targets under section 3352(d) of PIIA, developed a plan to meet
the reduction targets, and demonstrated improvements for each program assessed to
be at risk and estimated for improper payments (if required and applicable); and
• reported a gross improper payment rate of less than 10 percent for each program and
activity for which an improper payment estimate was published under section 3352(c)
of PIIA.
If an agency does not meet one or more of the six requirements above, then it is not compliant
under PIIA.
On June 26, 2018 OMB issued Memorandum M-18-20, Appendix C to OMB Circular No. A-123,
Requirements for Payment Integrity Improvement (OMB Memorandum M-18-20), as updated
implementation guidance to federal agencies. OMB Memorandum M-18-20 requires agencies to
report improper payment estimates, root causes of the improper payments, corrective actions
taken, and the recapture of improper payments identified. Agencies must provide reasonable
assurance that controls are in place and working. OMB Memorandum M-18-20 further provides
that agency Inspectors General should review their agency’s annual AFR and accompanying
materials to assess the following:
• the accuracy and completeness of agency reporting
Page | 6
• agency’s performance in reducing and recapturing improper payments
• whether agency corrective action plans are focused on the true root cause, are
actually reducing improper payments, and are implemented effectively
• agency efforts to prevent and reduce improper payments
OMB revised Appendix C to OMB Circular No. A-123 (March 2021). Unless otherwise noted in
the revised guidance, the requirements found in the guidance are effective starting in FY 2021.
Therefore, we performed our FY 2020 annual compliance review using a combination of the
requirements in Appendix C to OMB Circular No. A-123 (OMB Memorandum M-18-20), OMB
Circular No. A-136, Financial Reporting Requirements (August 2020), OMB Annual Data Call
Instructions, OMB Payment Integrity Question and Answer Platform, and the Council of the
Inspectors General on Integrity and Efficiency Guidance for Payment Integrity Information Act
Compliance Reviews (November 2020).
II. OBJECTIVES, SCOPE, AND METHODOLOGY
Objectives
We conducted this audit to:
1. Evaluate whether SBA is in compliance with the reporting requirements contained in
section 3351(2) of PIIA and OMB Memorandum M-18-20;
2. Evaluate the accuracy and completeness of SBA’s reporting; and
3. Evaluate SBA’s performance in preventing and reducing improper payments.
Scope and Methodology
The scope of our performance audit was SBA’s FY 2020 improper payments and reporting data
as presented in the payment integrity section of the FY 2020 AFR and any accompanying
materials. SBA’s improper payment reporting in the FY 2020 AFR and accompanying materials
was not impacted by the enactment of the Coronavirus Aid, Relief, and Economic Security Act
of 2020 and related legislation as the latest 12-month reporting period for the programs
presented ended on March 31, 2020.
During our planning and testing phases, and to achieve our objectives, we interviewed staff from
SBA’s Offices of Internal Control, Capital Access, and Disaster Assistance that performed the
improper payment reviews, collected and inspected auditee-provided documentation and
evidence, and participated in process and control walkthroughs with SBA staff responsible for
the programs identified as susceptible to significant improper payments. As part of these
procedures, we performed the following:
• obtained an understanding of SBA’s improper payments reporting process and relevant
controls through inquiries with management;
• reviewed SBA’s policies and procedures over the improper payments reporting process;
• reviewed management’s risk assessment for agency programs identified as susceptible
to significant improper payments;
Page | 7
• reviewed for significant changes in legislation or increases in funding levels for each
program or activity;
• reviewed and evaluated the statistically determined improper payments estimates for
each program deemed susceptible to improper payments in consultation with a
statistician;
• reviewed and evaluated the population of outlays for each program for completeness
and accuracy;
• reviewed and evaluated SBA’s payment integrity section in the AFR and accompanying
materials for completeness and accuracy;
• evaluated the corrective actions published and determined whether they focus on the
true root cause, and are implemented;
• evaluated the root cause category classifications and determined whether SBA
accurately classified the true root causes of improper payments, and
• obtained OMB waivers/exemptions for improper payments reporting (if applicable).
In carrying out this methodology, we obtained sufficient, appropriate evidence to provide a
reasonable basis for our conclusions related to our audit objectives.
III. RESULTS AND CONCLUSIONS
For objective 1, based on our audit procedures performed, we determined SBA was not
compliant with all six PIIA reporting requirements. See below for additional details of our results.
Requirement 1 – Determine if SBA published improper payments information within the AFR for
the fiscal year ended September 30, 2020 and posted that report and any accompanying
materials required by OMB on the Agency website.
• Compliant. SBA published its FY 2020 AFR on December 18, 2020 and posted the AFR
on the agency’s website at www.sba.gov. The AFR included a payment integrity section
and OMB’s required sections including the Fraud Reduction Report.
Requirement 2 – Determine if SBA conducted a program specific risk assessment for each
program or activity that conforms with section 3352(a) of PIIA.
• Compliant. In accordance with OMB Memorandum M-18-20, SBA conducts a qualitative
or quantitative risk assessment at least once every three years for all programs that
exceed $10 million in disbursements or losses in a fiscal year in order to identify
programs susceptible to significant improper payments. If a program or activity
experiences a significant change in legislation and/or a significant increase in its funding
level, SBA will perform an assessment even if it is less than three years since the last
assessment.
SBA conducted risk assessments for all programs, including payments made to
employees, for susceptibility to improper payments in FY 2020. SBA did not identify any
significant changes in legislation or increases in funding level for any program or activity
during the reporting period of FY 2020 (as of March 31, 2020). SBA did note that the
Additional Supplemental Appropriations for Disaster Relief Requirements Act of 2017
deemed all programs receiving funds to be susceptible to significant improper payments
Page | 8
for purposes of section 3352(a) of PIIA. As such, SBA assessed supplemental disaster
relief administrative funds – payroll and supplemental disaster relief administrative funds
– travel as susceptible for improper payments. In addition, SBA continued to identify 7(a)
loan guaranty purchases, 7(a) loan guaranty approvals, 504 CDC loan guaranty
approvals, and the Disaster Direct Loan Program disbursements as susceptible to
improper payments.
Requirement 3 – Determine if SBA published improper payment estimates for all programs
identified as susceptible to significant improper payments under its risk assessment under
section 3352(a) of PIIA (if required).
• Compliant. SBA published gross improper payment estimates for all six programs
identified as susceptible to significant improper payments. Each program utilized a
statistical estimation approach that applied a 95 percent confidence level, and at least a
plus or minus 3 percent margin of error. See below for each program’s estimated
improper payment rate and gross improper payments.
Program or Activity Improper Gross Improper
Payment Rate Payment (in millions)
7(a) Loan Guaranty Purchases 5.51% $69.82
7(a) Loan Guaranty Approvals 2.06% $323.23
504 CDC Loan Guaranty Approvals 3.81% $216.53
Disaster Direct Loan Disbursements 11.98% $94.75
Supplemental Disaster Relief Administrative Funds – 0.00% $0.00
Payroll
Supplemental Disaster Relief Administrative Funds – 0.13% $0.04
Travel
Requirement 4 – Determine if SBA published programmatic corrective action plans under
section 3352(d) of PIIA in the AFR or accompanying materials (if required).
• Compliant. SBA reported corrective actions for 7(a) loan guaranty purchases, 7(a) loan
guaranty approvals, 504 CDC loan guaranty approvals, and the Disaster Direct Loan
Program disbursements. In accordance with OMB Memorandum M-18-20, the
supplemental disaster relief administrative funds – payroll, and supplemental disaster
relief administrative funds – travel were not required to report corrective action plans in
the AFR because their gross annual improper payments (i.e., the total amount of
overpayments and underpayments) did not exceed both 1.5 percent of reported outlays
and $10,000,000 of all payments made during the fiscal year reported. See below for a
summary of the reported root cause categories and whether corrective actions were
published for each program.
Page | 9
Program or Activity Reported Root Cause Categories Corrective
Action
Published
7(a) Loan Guaranty Purchases Administrative or Process Error Made Yes
7(a) Loan Guaranty Approvals Failure to Verify: Financial Data Yes
504 CDC Loan Guaranty Failure to Verify: Financial Data Yes
Approvals
Disaster Direct Loan Failure to Verify: Financial Data Yes
Disbursements
Administrative or Process Error Made
Supplemental Disaster Relief Administrative or Process Error Made Not Required
Administrative Funds - Payroll
Supplemental Disaster Relief Administrative or Process Error Made Not Required
Administrative Funds - Travel
While SBA met the compliance requirement, the root cause category classification was
not appropriately classified based on the true root cause of the improper payments noted
from the sample results for 7(a) loan guaranty approvals and 504 CDC loan guaranty
approvals. As a result, we identified an internal control deficiency over SBA’s improper
payment reporting and proposed related recommendations. Section IV contains details
of our findings, identified internal control deficiencies, and related recommendations.
While we noted that the reported root cause category for 7(a) loan guaranty approvals
and 504 CDC loan guaranty approvals was inaccurate, the corrective actions published
for these programs was for the correct root cause category – Failure to Verify: Other
Eligibility Data. In addition, the corrective action plans focused on the true root cause
and were implemented.
Requirement 5 – Determine if SBA published reduction targets under section 3352(d) of PIIA,
developed a plan to meet the reduction targets, and demonstrated improvements for each
program assessed to be at risk and estimated for improper payments.
• Not Compliant. SBA published a reduction target for FY 2021 for each program. See
below for each program’s reduction target published in the FY 2019 AFR, the FY 2020
improper payments rate, and the FY 2021 reduction target published in the FY 2020
AFR. In addition, SBA developed and published corrective action plans to meet the
reduction targets.
For evaluating the requirement of whether each program demonstrated improvements,
we used the guidance provided by OMB within the Council of the Inspectors General on
Integrity and Efficiency Guidance for Payment Integrity Information Act Compliance
Reviews (November 2020). In accordance with this guidance, we evaluated whether
SBA met the established reduction targets published in the FY 2019 AFR. SBA met the
established reduction targets published in the FY 2019 AFR for all programs except the
Disaster Direct Loan Program disbursements as noted earlier.
Page | 10
Program or Activity FY 2020 Reduction FY 2020 FY 2021 Reduction
Target Published Improper Target Published in
in the FY 2019 AFR Payment Rate the FY 2020 AFR
7(a) Loan Guaranty Purchases 3.52% 5.51% 5.41%
7(a) Loan Guaranty Approvals 2.05% 2.06% 1.96%
504 CDC Loan Guaranty 2.04% 3.81% 3.71%
Approvals
Disaster Direct Loan 5.67% 11.98% 9.99%
Disbursements
Supplemental Disaster Relief 1.00% 0.00% 1.00%
Administrative Funds – Payroll
Supplemental Disaster Relief 2.77% 0.13% 1.00%
Administrative Funds – Travel
For the 7(a) guaranty purchases, 7(a) guaranty approvals, and 504 CDC loan guaranty
approvals programs, the FY 2020 improper payment rate point estimate shown above
was greater than the target reduction rates published in the FY 2019 AFR. However, in
accordance with OMB Memorandum M-18-20, if a program has a sampling plan that
meets or exceeds the 95 percent confidence level, plus or minus 3 percent margin of
error guidance, then the program should be considered as having met its reduction
target if the lower bound for its confidence interval is equal to or less than the reduction
target. The 7(a) loan guaranty purchases, 7(a) loan guaranty approvals, and 504 CDC
loan guaranty approvals programs were considered to have met the reduction targets as
the lower bound of their confidence intervals under their sampling methodologies which
meet the 95 percent confidence level, plus or minus 3 percent margin of error guidance,
were lower than the reduction targets.
As noted earlier, the Disaster Direct Loan Program disbursements did not meet the
reduction target as the lower bound of its confidence interval under the sampling
methodology, which did meet the 95 percent confidence level, plus or minus 3 percent
margin of error guidance, was greater than the reduction target.
Requirement 6 – Determine if SBA reported a gross improper payment rate of less than 10
percent for each program and activity for which an improper payment estimate was published
under section 3352(c) of PIIA.
• Not Compliant. SBA reported an improper payment rate of less than 10 percent for all of
the programs except the Disaster Direct Loan Program disbursements. The improper
payments rate for this program was 11.98 percent.
For objective 2, with respect to the accuracy and completeness of SBA’s reporting, we
determined SBA developed and published gross improper payment rate estimates for each
program using appropriate sampling and estimation plans given program characteristics. In
accordance with OMB Memorandum M-18-20, each program’s sampling plan was determined
to be in the statistically valid and rigorous category as the sampling plans were based on
unbiased, randomized sampling and produced improper payment point estimates at the 95
percent confidence level within at least a plus or minus 3 percent margin of error.
However, certain populations of outlays and disclosures included as part of SBA’s reporting
were not accurate and complete. Specifically, we noted the population of outlays for the 7(a)
Page | 11
loan guaranty purchases, 7(a) loan guaranty approvals, 504 CDC loan guaranty approvals, and
the Disaster Direct Loan Program disbursements, were not complete and reconciled to the
general ledger. As a result, we identified certain internal control deficiencies over SBA’s
improper payment reporting and proposed related recommendations. Section IV contains details
of our findings, identified internal control deficiencies, and related recommendations.
For objective 3, with respect to SBA’s performance to prevent and reduce improper payments,
we determined that from FY 2019 to FY 2020, SBA had a reduction in the improper payment
estimate for all programs except for the 7(a) loan guaranty purchases, 504 CDC loan guaranty
approvals, and the Disaster Direct Loan Program disbursements. SBA determined the root
causes of the improper payments and formalized and implemented corrective action plans that
includes internal training for purchase processors, reviewers, and approvers and external
training for lenders. Section IV contains details of our findings, identified internal control
deficiencies, and related recommendations.
IV. FINDINGS
Objective 2 – Accuracy and Completeness of SBA’s Reporting
Improvements Needed Over the Completeness and Accuracy of Reporting
While SBA met the compliance requirement related to publishing improper payment estimates
for all programs identified as susceptible to significant improper payments, we noted that
additional improvements were needed to ensure the information in the payment integrity section
of the AFR and accompanying materials is complete and accurate.
Specifically, for some programs, we noted the following conditions related to the accuracy and
completeness of improper payment reporting:
• There were insufficient and inaccurate disclosures within the payment integrity section
and accompanying materials. The root causes and amounts presented within certain
tables were not accurate.
• The population of outlays reported in the payment integrity section and subjected to
sampling, were not reconciled to the general ledger and were not complete.
Consequently, certain transactions that should have been included in the population
and subjected to review were omitted.
Refer to Section IV.A and IV.B for details on the identified internal control deficiencies, and
related recommendations.
The Government Accountability Office (GAO) Standards for Internal Control in the Federal
Government, section OV1.01 states that “Internal control is a process effected by an entity’s
oversight body, management, and other personnel that provides reasonable assurance that
the objectives of an entity will be achieved. These objectives and related risks can be broadly
classified into one or more of the following three categories:
• Operations – Effectiveness and efficiency of operations
• Reporting – Reliability of reporting for internal and external use
• Compliance – Compliance with applicable laws and regulations”
Page | 12
Section OV1.06 states that “Management is responsible for an effective internal control system.
As part of this responsibility, management sets the entity’s objectives, implements controls, and
evaluates the internal control system.”
Section 10.02: “Management designs control activities in response to the entity’s objectives and
risks to achieve an effective internal control system. Control activities are the policies,
procedures, techniques, and mechanisms that enforce management’s directives to achieve the
entity’s objectives and address related risks.”
Section 10.03: “Management clearly documents internal control and all transactions and other
significant events in a manner that allows the documentation to be readily available for
examination. The documentation may appear in management directives, administrative policies,
or operating manuals, in either paper or electronic form. Documentation and records are
properly managed and maintained.”
The conditions noted above were caused by the lack of an adequate quality control review
process over the payment integrity section and accompanying materials. In addition, SBA
program offices did not have internal controls implemented requiring the timely reconciliation of
the population of outlays to the general ledger. The lack of an adequate review process resulted
in the payment integrity section and accompanying materials not completely and accurately
disclosing relevant information regarding SBA’s FY 2020 improper payment reviews. By not
reconciling the population of outlays to the general ledger, this results in an incomplete sample
which may result in an inaccurate improper payment estimate. This could potentially result in
increases to the improper payment rates and noncompliance with PIIA.
Objective 3 – Prevent and Reduce Improper Payments
Improvements Needed Over Controls to Prevent and Reduce Improper Payments
SBA did not meet the compliance requirements related to demonstrating improvements and
reporting a gross improper payment rate of less than 10 percent for the Disaster Direct Loan
Program disbursements. In addition, the improper payment estimate increased from FY 2019 to
FY 2020 for the 7(a) loan guaranty purchases, 504 CDC loan guaranty approvals, and the
Disaster Direct Loan Program disbursements. Therefore, we noted that additional improvements
were needed to prevent and reduce improper payments.
Specifically, we noted the following conditions related to SBA’s efforts in preventing and
reducing improper payments:
• The improper payment rates increased in certain programs from FY 2019 to FY 2020.
• The Disaster Direct Loan Program disbursements had a gross improper payment rate
exceeding the statutory compliance threshold of 10%.
Payment Integrity Information Act of 2019, Sec. 3351, states: “(2) Compliance … (E) publishes
improper payments reduction targets established under section 3352(d) that the executive
agency may have in the accompanying materials to the annual financial statement for each
program and activity assessed to be at risk and has demonstrated improvements and
developed a plan to meet the reduction targets; and (F) has reported an improper payment rate
of less than 10 percent for each program and activity for which an estimate was published
under section 3352(c).”
Page | 13
The conditions noted above were caused by the lack of effective preventative controls
implemented to reduce improper payments. This results in the Disaster Direct Loan Program
disbursements being not compliant with PIIA. In addition, not implementing effective
preventative controls could potentially result in increases to the improper payment rates and
further noncompliance with PIIA.
A. DEFICIENCIES IN INTERNAL CONTROL
In planning and performing our audit of SBA’s FY 2020 compliance with PIIA reporting, we
considered internal controls that were relevant to our audit objectives by obtaining an
understanding of those controls and assessing control risk for the purposes of achieving our
objectives.
The objective of our audit was not to provide assurance on internal controls; therefore, we did
not express an opinion on internal controls as a whole. Our consideration of SBA’s internal
controls relevant to our audit objectives would not necessarily disclose all deficiencies that might
be significant within the context of the audit objectives.
As a result of our assessment over internal controls relevant to the audit objectives and our
compliance test work, we identified the following deficiencies in internal control:
Program or Activity Control Deficiencies
7(a) Loan Guaranty 1. There was not an adequate review process in place over the
Purchases population of outlays reported in table 1 of the payment integrity
section and subjected to sampling as it excluded certain transactions
7(a) Loan Guaranty processed after the effective date and was incomplete.
Approvals
504 CDC Loan
Guaranty Approvals
7(a) Loan Guaranty 2. The population of outlays reported in table 1 of the payment integrity
Purchases section and subjected to sampling, were not reconciled timely to the
general ledger and are not complete.
7(a) Loan Guaranty
Approvals
504 CDC Loan
Guaranty Approvals
Disaster Direct Loan
Disbursements
7(a) Loan Guaranty 3. There was not an adequate review process in place over the
Approvals population of outlays as it excluded loan approval increases
occurring after the month in which the initial approval occurred and
504 CDC Loan reinstatements of previously cancelled loans and was incomplete.
Guaranty Approvals
Page | 14
Program or Activity Control Deficiencies
4. There was not an adequate review process in place to ensure the root
causes of improper payment rates presented in table 2 of the payment
integrity section and in the accompanying materials were accurate.
7(a) Loan Guaranty 5. There were not effective controls implemented to prevent and reduce
Purchases improper payments.
504 CDC Loan
Guaranty Approvals
Disaster Direct Loan
Disbursements
504 CDC Loan 6. The review process in place did not ensure that the total improper
Guaranty Approvals payment amounts reported in table 1 and table 2 of the payment
integrity section are consistent.
Disaster Direct Loan
Disbursements
Supplemental Disaster 7. The review process in place did not ensure sufficient disclosure was
Relief Administrative provided regarding the specific disaster events that were included
Funds – Payroll within the population of outlays subjected to sampling and presented in
the payment integrity section.
Supplemental Disaster
Relief Administrative 8. The was not sufficient documentation available for the sampling and
Funds – Travel estimation methodology used to develop the improper payment rate
estimates presented.
Supplemental Disaster 9. There was not documentation readily available to support the
Relief Administrative recalculation of certain benefits.
Funds – Payroll
7(a) Guaranty Loan 10. There was not an adequate review process in place as the amount of
Purchases improper payments recaptured in table 3 of the payment integrity
section and accompanying materials was not accurate.
Disaster Direct Loan 11. There was not an adequate review process in place as the calculation
Disbursements of the estimated improper payment rate, by root cause, was not
consistent with the sample design because it disregards the
stratification and different extrapolation impact of the sampled items
based on their stratum and size.
12. There was not sufficient documentation supporting the stratification of
the population by disaster size, including how the criteria for
stratification was determined and whether it was consistently applied.
13. There were not effective controls implemented to prevent and reduce
improper payments as the gross improper payment rate exceeded the
statutory compliance threshold of 10%.
All Programs 14. There was not an adequate process in place to ensure the risk
assessment considered all SBA programs.
Page | 15
Program or Activity Control Deficiencies
15. There was not sufficient documentation available to evidence the
review and approval of the risk assessment.
16. The review process in place did not ensure there was sufficient
disclosure regarding the enactment of the PIIA legislation in the
payment integrity section.
Page | 16
B. RECOMMENDATIONS
We recommend the Administrator coordinate with the Chief Financial Officer to:
1. Continue to update SBA Standard Operating Procedure (SOP) 20 32 1, Estimating and
Reporting Improper Payments, using the framework in GAO’s Standards for Internal
Control in the Federal Government (Green Book) to design and implement robust internal
and quality control processes to ensure complete and accurate reporting of annual
improper payment results, formalized risk assessment process to ensure all programs
are considered, the maintenance of sample documentation, and to ensure the sampling
methodology documentation is consistent and updated annually with the population,
sample results, and information in the payment integrity section of the AFR and
accompanying materials.
2. Provide training to responsible staff in the Offices of Internal Control, Capital Access and
Disaster Assistance regarding updates to SBA SOP 20 32 1.
3. Ensure that staff in the Office of Internal Control oversee and provide adequate quality
control reviews over improper payment disclosures submitted by SBA program offices.
4. Continue to provide training to program office staff, as needed, on the timely and complete
reconciliation of the population of transactions used for estimating improper payments to
the general ledger.
We recommend the Administrator coordinate with the Associate Administrator of the Office of
Capital Access to:
5. Implement additional preventative and monitoring controls to determine the eligibility of
borrowers prior to approval.
6. Ensure there is adequate training of staff at the Guaranty Purchase Centers.
7. Collaborate with the Chief Financial Officer to ensure a timely and complete
reconciliation is performed on the population subject to sampling for improper payment
reviews.
We recommend the Administrator coordinate with the Associate Administrator of the Office of
Disaster Assistance to:
8. Formally document and implement additional preventative and monitoring controls to
determine the eligibility of borrowers prior to approval and disbursement.
9. Ensure there is adequate training of staff at the Processing and Disbursement Center.
10. Collaborate with the Chief Financial Officer to ensure a timely and complete reconciliation
is performed on the population subject to sampling for improper payment reviews.
11. Coordinate with the Office of Disaster Assistance’s statistician to ensure the estimated
improper payment amounts are calculated consistently and the sampling methodology
adequately describes the criteria for stratification.
Page | 17
V. Attachment I - MANAGEMENT’S RESPONSE TO REPORT
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, D.C. 20416
DATE: May 6, 2021
TO: Hannibal M. Ware, Inspector General
FROM: Jason Bossie, Acting Associate Administrator for Performance, Planning, and
Chief Financial Officer, OPPCFO
James Rivera, Associate Administrator for Disaster Assistance, ODA
John Miller, Deputy Associate Administrator, OCA
SUBJECT: Response to Audit: Performance Audit of the U.S. Small Business
Administration’s Fiscal Year 2020 Compliance with the Payment Integrity
Information Act of 2019 (PIIA)
The Small Business Administration (SBA) appreciates the opportunity to review and respond to
the draft Performance Audit of the U.S. Small Business Administration’s Fiscal Year 2020
Compliance with the Payment Integrity Information Act of 2019 (PIIA).
SBA is committed to reducing the dollar amount of improper payments, ensuring program
integrity, and continuing to implement effective risk management procedures in accordance with
improper payment legislation 1, as well as guidance prescribed in Office of Management and
Budget Memorandum M-21-19, Appendix C to Circular A-123, Requirements for Payment
Integrity Improvement.
SBA concurs with the Recommendations made in this audit report and is providing the following
comments in response to those recommendations.
Recommendation 1. Continue to update SBA Standard Operating Procedure (SOP) 20 32 1,
Estimating and Reporting Improper Payments, using the framework in GAO’s Standards for
Internal Control in the Federal Government (Green Book) to design and implement robust
internal and quality control processes to ensure complete and accurate reporting of annual
improper payment results, formalized risk assessment process to ensure all programs are
considered, the maintenance of sample documentation, and to ensure the sampling methodology
documentation is consistent and updated annually with the population, sample results, and
information in the payment integrity information of the AFR and accompanying materials.
Agency Response. SBA will continue to update SOP 20 32 1, Estimating and Reporting
Improper Payments, using the framework in GAO’s Green Book to design and implement
1
Payment Integrity Information Act (2019)
Page | 18
internal and quality control processes to ensure complete and accurate reporting of annual
improper payment results, formalized the risk assessment process to ensure all programs are
considered, draft a documentation retention policy to ensure proper maintenance of sample
documentation, and ensure sampling methodology documentation is consistent and updated
annually with the population, sample results, and information in the payment integrity
information section of the Agency Financial Report (AFR) and accompanying materials.
Recommendation 2. Provide training to responsible staff in Offices of Internal Control, Capital
Access and Disaster Assistance regarding updates to SBA SOP 20 32 1.
Agency Response. SBA will continue to provide training to responsible staff in Office of
Capital Access (OCA) and Office of Disaster Assistance (ODA), and ensure conformance of
training materials with updates from SBA SOP 20 32 1.
Recommendation 3. Ensure that staff in the Office of Internal Control oversee and provide
adequate quality control reviews over disclosures submitted by SBA program offices.
Agency Response. SBA will continue to ensure the Internal Controls Division (ICD),
previously named Office of Internal Controls (OIC), staff oversee and provide adequate quality
control reviews over disclosures submitted by SBA program offices.
Recommendation 4. Continue to provide training to program office staff, as needed, on the
timely and complete reconciliation of the population of transactions used for estimating improper
payments to the general ledger.
Agency Response. SBA will continue to coordinate with program office staff and provide
training, as needed, on the timely and complete reconciliation of the population of transactions
used for estimating improper payments to the general ledger.
Recommendation 5. Implement additional preventative and monitoring controls to determine
the eligibility of borrowers prior to approval.
Agency Response. SBA will implement additional preventative and monitoring controls to
determine the eligibility of borrowers prior to approval. In those instances where approval is
delegated to the Lender, SBA will provide guidance to Lenders regarding eligibility of
borrowers.
Recommendation 6. Ensure there is adequate training of staff at the Guaranty Purchase
Centers.
Agency Response. SBA will ensure that staff at the National Guaranty Purchase Center, the
Little Rock Loan Servicing Center and the Fresno Loan Servicing Centers are adequately trained
in order to avoid improper payments in the guaranty purchasing process.
Page | 19
Recommendation 7. Collaborate with the Chief Financial Officer to ensure a timely and
complete reconciliation is performed on the population subject to sampling for improper
payment reviews.
Agency Response. SBA will collaborate with the Office of the Chief Financial Officer to ensure
timely and complete reconciliations are performed on the population subject to sampling for
improper payment reviews.
Recommendation 8. Formally document and implement additional preventative and monitoring
controls to determine the eligibility of borrowers prior to approval and disbursement.
Agency Response. SBA will formally document and implement additional preventative and
monitoring controls to determine the eligibility of borrowers prior to a loan approval and
disbursement.
Recommendation 9. Ensure there is adequate training of staff at the Processing and
Disbursement Center.
Agency Response. SBA will make sure there is adequate training of staff at the Processing and
Disbursement Center.
Recommendation 10. Collaborate with the Chief Financial Officer to ensure a timely and
complete reconciliation is performed on the population subject to sampling for improper
payment reviews.
Agency Response. SBA will collaborate with the Chief Financial Officer to ensure a timely and
complete reconciliation is performed on the population subject to sampling for improper
payment reviews.
Recommendation 11. Coordinate with the Office of Disaster Assistance’s statistician to ensure
the estimated improper payment amounts are calculated consistently and the sampling
methodology adequately describes the criteria for stratification.
Agency Response. SBA will coordinate with the Office of Disaster Assistance’s statistician to
ensure the estimated improper payment amounts are calculated consistently and the sampling
methodology adequately describes the criteria for stratification.
We appreciate your efforts and those of your colleagues in the Office of the Inspector General, as
well as those of the independent auditor. The independent audit process continues to provide us
with new insights and valuable recommendations that improve SBA’s overall compliance with
improper payment legislation.
Page | 20
File and source
- File
- SBA-OIG-Report-21-16.pdf
- Size
- 592,741 bytes
- SHA-256
- fa2bcc8787b4f9744daa253687cb7e43825adf587d1b3e126d0cb8c27f6ca19d
- Our copy
- SBA-OIG-Report-21-16.pdf
- Original
- legacy.sba.gov