SBA, Independent Auditors’ Report on SBA’s Fiscal Year 2022 Financial Statements

Summary

A November 15, 2022 memorandum from Inspector General Hannibal “Mike” Ware to Administrator Isabella Casillas Guzman, transmitting KPMG LLP’s independent auditors’ report on SBA’s Fiscal Year 2022 financial statements (Report 23-02). KPMG issued a disclaimer of opinion on the consolidated balance sheets as of September 30, 2022 and 2021, stating that SBA could not provide adequate evidential matter for a significant number of transactions and account balances tied to the Paycheck Protection Program, the Economic Injury Disaster Loan program, the Restaurant Revitalization Fund and the Shuttered Venue Operators Grant program. It reports six material weaknesses and two significant deficiencies, and SBA’s Chief Financial Officer concurred with the findings.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“SBA, Independent Auditors’ Report on SBA’s Fiscal Year 2022 Financial Statements.” Original at legacy.sba.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/sba-independent-auditors-report-on-sba-s-fiscal-year-2022-financial-st-bbcbcb9418/, SHA-256 b0a462aa089c1fb44eb724a3184be5831feed2d77ca667d5530bf029d23285a0.

Full text

Office of Inspector General
U.S. Small Business Administration

MEMORANDUM

DATE: November 15, 2022
TO: Isabella Casillas Guzman
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Fiscal Year 2022 Financial
Statements (Report 23-02)
I am pleased to present the attached independent auditors’ report on the U.S. Small
Business Administration’s (SBA) financial statements for fiscal year (FY) 2022, as required
annually by the Chief Financial Officers Act of 1990, as amended.
We contracted with the independent certified public accounting firm KPMG LLP to conduct
an audit of SBA’s consolidated balance sheets as of September 30, 2022 and 2021, and the
related notes to these statements. Our contract with KPMG required that the audit be
performed in accordance with auditing standards generally accepted in the United States of
America, Government Auditing Standards issued by the Comptroller General of the United
States, and Office of Management and Budget (OMB) Bulletin No. 22-01, Audit
Requirements for Federal Financial Statements.
KPMG’s responsibility was to express an opinion on the consolidated balance sheets based
on their audit. KPMG was not engaged to audit the consolidated statements of net cost and
changes in net position, and combined statements of budgetary resources for the years
ended September 30, 2022 and 2021, and the related notes to these statements.
In the audit, KPMG reported significant matters for which they were unable to obtain
sufficient and appropriate audit evidence to provide a basis for an audit opinion on SBA’s
balance sheet as of September 30, 2022. Accordingly, KPMG issued a disclaimer of opinion
on the consolidated balance sheets as of September 30, 2022 and 2021.
The basis for the disclaimer was that due to inadequate processes and controls, SBA was
unable to provide adequate evidential matter in support of a significant number of
transactions and account balances related to the Paycheck Protection Program, Economic
Injury Disaster Loan program, the Restaurant Revitalization Fund, and Shuttered Venue
Operators Grant program.
As a result, KPMG was unable to determine whether any adjustments might have been
necessary with respect to the following:

409 3rd Street SW, Washington, DC 20416 • phone (202) 205-6586 • fax 202-205-7382
• Credit Program Receivables and Related Foreclosed Property, Net
• Other than Intragovernmental Advances and Prepayments
• Downward Reestimate Payable to Treasury
• Loan Guarantee Liabilities
For the period ended September 30, 2022, KPMG identified six material weaknesses and
two significant deficiencies in internal control over financial reporting. Appendixes I and II
of this report describe details of KPMG’s conclusions about the material weaknesses and
significant deficiencies. Appendix III describes instances of noncompliance with applicable
laws or other matters required to be reported under Government Auditing Standards or
OMB Bulletin No. 22-01.
In connection with the contract, we reviewed KPMG’s report and related documentation
and inquired of its representatives. Our oversight protocols included evaluation of major
work products, attendance at critical meetings, review of significant findings and
examination of related evidential matter. Our review, as differentiated from an audit of the
financial statements in accordance with U.S. generally accepted government auditing
standards, was not intended to enable us to express—and we do not express—opinions on
SBA’s financial statements or internal control over financial reporting or conclusions on
SBA’s compliance with applicable laws and other matters. Our review disclosed no
instances where KPMG did not comply in all material respects with U.S. generally accepted
government auditing standards. KPMG is responsible for the attached auditors’ report
dated November 15, 2022 and the conclusions expressed. However, OIG provides negative
assurance of this audit.
We provided a draft of KPMG’s report to SBA’s Chief Financial Officer, who concurred with
its findings and recommendations and agreed to implement the recommendations. SBA
remains committed to excellence in financial management and looks forward to furthering
progress in the coming year. The Chief Financial Officer’s response is included in Appendix
IV.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should
you or your staff have any questions, please contact me or Andrea Deadwyler, Assistant
Inspector General for Audits, at (202) 205-6586.
cc: Arthur Plews, Chief of Staff
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk
Katherine Aaby, Associate Administrator, Office of Performance, Planning,
and the Chief Financial Officer
Patrick Kelly, Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Erica Gaddy, Deputy Chief Financial Officer, Office of Performance, Planning, and the
Chief Financial Officer
Joshua Barnes, Recovery Director, Office of Disaster Assistance
Therese Meers, General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls

Attachment
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006

Independent Auditors’ Report

Inspector General
U.S. Small Business Administration

Administrator
U.S. Small Business Administration

Report on the Audit of the Consolidated Financial Statements
Disclaimer of Opinion
We were engaged to audit the consolidated balance sheets of the United States (U.S.) Small Business
Administration (SBA) as of September 30, 2022 and 2021, and the related notes to the consolidated balance
sheets (the consolidated financial statements).

We do not express an opinion on the accompanying consolidated financial statements of the SBA. Because of
the significance of the matter described in the Basis for Disclaimer of Opinion section of our report, we have not
been able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion on the
consolidated financial statements.

Basis for Disclaimer of Opinion
During fiscal year 2022, SBA continued to execute provisions of the Paycheck Protection Program and
Economic Injury Disaster Loan programs, and the Restaurant Revitalization Fund and Shuttered Venues
Operators Grant programs that were authorized by the Coronavirus Aid, Relief, and Economic Security Act of
2020 and related legislations. SBA was unable to provide adequate evidential matter in support of a significant
number of transactions and account balances related to these programs due to inadequate processes and
controls. As a result of this matter, we were unable to determine whether any adjustments might have been
necessary related to Credit Program Receivables and Related Foreclosed Property, Net; Other than
Intragovernmental Advances and Prepayments; Downward Reestimate Payable to Treasury; and Loan
Guarantee Liabilities.

Other Matter – Report on Certain Fiscal Year 2022 and 2021 Information
We were not engaged to audit the consolidated statements of net cost and changes in net position, and
combined statements of budgetary resources for the years ended September 30, 2022 and 2021, and the
related notes to these statements. Accordingly, we express no opinion on them.

Other Matter - Interactive Data
Management has elected to reference to information on websites or other forms of interactive data outside the
Agency Financial Report to provide additional information for the users of its consolidated financial statements.
Such information is not a required part of the consolidated financial statements or supplementary information
required by the Federal Accounting Standards Advisory Board. The information on these websites or the other
interactive data has not been subjected to any of our auditing procedures, and accordingly we do not express
an opinion or provide any assurance on it.

KPMG LLP, a Delaware limited liability partnership and a member firm of
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
Responsibilities of Management for the Consolidated Financial Statements
Management is responsible for the preparation and fair presentation of the consolidated financial statements in
accordance with U.S. generally accepted accounting principles, and for the design, implementation, and
maintenance of internal control relevant to the preparation and fair presentation of consolidated financial
statements that are free from material misstatement, whether due to fraud or error.

Auditors’ Responsibilities for the Audit of the Consolidated Financial Statements
Our responsibility is to conduct an audit of the SBA’s consolidated financial statements in accordance with
auditing standards generally accepted in the United States of America (GAAS), Government Auditing
Standards, and Office of Management and Budget (OMB) Bulletin No. 22-01, Audit Requirements for Federal
Financial Statements, and to issue an auditors’ report. However, because of the matter described in the Basis
for Disclaimer of Opinion section of our report, we were not able to obtain sufficient appropriate audit evidence
to provide a basis for an audit opinion on these consolidated financial statements.

We are required to be independent of the SBA and to meet our other ethical responsibilities, in accordance with
the relevant ethical requirements relating to our audit.

Required Supplementary Information
U.S. generally accepted accounting principles require that the information in the Management’s Discussion and
Analysis and Required Supplementary Information sections be presented to supplement the basic consolidated
financial statements. Such information is the responsibility of management and, although not a part of the basic
consolidated financial statements, is required by the Federal Accounting Standards Advisory Board who
considers it to be an essential part of financial reporting for placing the basic consolidated financial statements
in an appropriate operational, economic, or historical context. We were unable to apply certain limited
procedures to the required supplementary information in accordance with GAAS because of the significance of
the matter described in the Basis for Disclaimer of Opinion paragraph. We do not express an opinion or provide
any assurance on the information.

Report on Internal Control Over Financial Reporting
In connection with our engagement to audit the SBA’s consolidated balance sheet as of September 30, 2022,
we considered the SBA’s internal control over financial reporting (internal control) as a basis for designing audit
procedures that are appropriate in the circumstances for the purpose of expressing an opinion on the
consolidated financial statements, but not for the purpose of expressing an opinion on the effectiveness of the
SBA’s internal control. Accordingly, we do not express an opinion on the effectiveness of the SBA’s internal
control. We did not test all internal controls relevant to operating objectives as broadly defined by the Federal
Managers’ Financial Integrity Act of 1982.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was
not designed to identify all deficiencies in internal control that might be material weaknesses or significant
deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified.
However, as described in the accompanying Appendices I and II, we identified certain deficiencies in internal
control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or detect and correct,
misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in
internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies
described in Appendix I to be material weaknesses.
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe
than a material weakness, yet important enough to merit attention by those charged with governance. We
consider the deficiencies described in Appendix II to be significant deficiencies.

Report on Compliance and Other Matters
In connection with our engagement to audit the SBA’s consolidated balance sheet as of September 30, 2022,
we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant
agreements, noncompliance with which could have a direct and material effect on the consolidated balance
sheet. However, providing an opinion on compliance with those provisions was not an objective of our
engagement, and accordingly, we do not express such an opinion. The results of our tests disclosed instances
of noncompliance or other matters that are required to be reported under Government Auditing Standards or
OMB Bulletin No. 22-01, and which are described in Appendix III.

We also performed tests of the SBA’s compliance with certain provisions referred to in Section 803(a) of the
Federal Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with
FFMIA was not an objective of our engagement, and accordingly, we do not express such an opinion. The
results of our tests disclosed instances in which the SBA’s financial management systems did not substantially
comply with the (1) Federal financial management systems requirements, and (2) applicable Federal
accounting standards. The results of our tests disclosed no instances in which the SBA’s financial management
systems did not substantially comply with the United States Government Standard General Ledger at the
transaction level.

Additionally, if the scope of our work had been sufficient to enable us to express an opinion on the consolidated
financial statements, other instances of noncompliance or other matters may have been identified and reported
herein.

SBA’s Response to Findings
Government Auditing Standards requires the auditor to perform limited procedures on the SBA's response to
the findings identified in our engagement and described in Appendix IV. The SBA’s response was not subjected
to the other auditing procedures applied in the engagement to audit the consolidated financial statements and,
accordingly, we express no opinion on the response.

Purpose of the Reporting Required by Government Auditing Standards
The purpose of the communication described in the Report on Internal Control Over Financial Reporting and
the Report on Compliance and Other Matters sections is solely to describe the scope of our testing of internal
control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the
SBA’s internal control or compliance. Accordingly, this communication is not suitable for any other purpose.

Washington, DC
November 15, 2022
Appendix I

U.S. Small Business Administration

Material Weaknesses

The following deficiencies are considered to be material weaknesses in internal controls over financial
reporting.

1. Controls over Paycheck Protection Program (PPP) Loan Guarantees Need Improvement

2. Controls over COVID-19 Economic Injury Disaster Loans (EIDLs) Need Improvement

3. Controls over the Subsidy Reestimate Need Improvement

4. Controls over the Evaluation of Service Organizations Need Improvement

5. Controls over Accounting and Monitoring of Restaurant Revitalization Fund (RRF) and
Shuttered Venues Operators Grant (SVOG) Programs Need Improvement

6. Entity Level Controls Need Improvement

For purposes of presentation and as described below, material weaknesses (1) and (4) have multiple
components. Material weakness (1) Controls over PPP Loan Guarantees Need Improvement, is
comprised of: (A) Reporting of PPP Loan Guarantees, (B) Forgiveness Review of PPP Loan Guarantees,
and (C) Purchases of PPP Loan Guarantees. Material weakness (4) Controls over the Evaluation of
Service Organizations Need Improvement, is comprised of: (A) Service Organization Used for COVID-
19 EIDLs; (B) Service Organizations Used for Loan Guarantee Programs; and (C) Service
Organization Used for the SVOG Program.

During fiscal year 2022, SBA continued to implement provisions of the PPP, COVID-19 EIDLs, RRF, and
SVOG programs. These programs were authorized and funded by the Coronavirus Aid, Relief, and
Economic Security Act of 2020, the Paycheck Protection Program and Health Care Enhancement Act,
the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act, and the American
Rescue Plan Act. The referenced laws from this point forward are collectively referred to as the
CARES Act and related legislation. The CARES Act and related legislation were passed by Congress to
provide emergency assistance in response to the extensive effects of the public health and economic
crisis arising from the Coronavirus Disease 2019 (COVID-19) pandemic. In fiscal year 2022, SBA
processed forgiveness and purchase payments for the 2020 and 2021 cohort of PPP loan guarantees,
and continued to issue additional COVID-19 EIDLs, and RRF and SVOG program awards.

1. Controls over PPP Loan Guarantees Need Improvement
A. Reporting of PPP Loan Guarantees
Management did not adequately design and implement controls to determine that the status of PPP
loan guarantees was complete and accurate to enable the fair presentation of the Loan Guarantee
Liabilities and related elements in the consolidated financial statements. Specifically, management
did not have adequate processes and controls in place to review the status of PPP loan guarantees
where lender loan status reports had not been submitted, had been submitted incorrectly, or were
not processed.

For fiscal year 2022, the average number of monthly, lender loan status reports for the 7(a) and PPP
loan guarantee programs that had not been submitted or not processed was 16 percent and 9
percent, respectively, of the average active loans. Additionally, we tested a sample of 135 PPP loan
guarantees and noted variances for 39 sampled items with the accuracy of the outstanding principal
balance recorded by SBA and the confirmation response received from the respective lenders.

The deficiencies were caused by insufficient monitoring controls over the follow-up process performed for
lender loan status reports that were not submitted, submitted incorrectly, or not processed and a lack of
accountability over the lenders who do not submit loan status reports timely or correctly.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• Government Accountability Office’s (GAO’s) Standards for Internal Control in the Federal
Government (Green Book), Principle 10, Design Control Activities; and Principle 16, Perform
Monitoring Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above may result in material misstatements to the Loan Guarantee Liabilities,
Downward Reestimate Payable to Treasury line items and related elements in the consolidated
financial statements.

Recommendations – Reporting of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for the Office of
Capital Access to:

1. Design and implement controls to ensure the population of nonreporting loan status reports or
loan status reports with errors is complete and accurate.

2. Determine and enforce policies and controls to hold lenders accountable for submitting loan
status reports timely and correctly.

3. Design and implement controls to monitor incomplete or inaccurate PPP lender loan status
reports on an ongoing basis, including the review and resolution of loan status reports with
errors.

We also recommend the Administrator coordinate with the Chief Financial Officer to:

4. Design and implement controls to assess the accounting considerations, based on the results of
the lender loan status reports review process for PPP loan guarantees, including the impact on
the reestimate and balances presented in the consolidated financial statements, and record any
necessary adjustments.

B. Forgiveness Review of PPP Loan Guarantees
Management did not adequately design and implement controls to ensure PPP loan guarantees
were completely and accurately reviewed to address their respective eligibility flags and ultimately
determine their eligibility for forgiveness. Specifically, management did not demonstrate controls
over the review and validation of identified flags from the case management system. Additionally,
management did not demonstrate effective monitoring controls over the results from the key
contractor involved in the review process. The loan guarantees determined by the contractor as ‘No
Further Action’ were not subsequently reviewed by SBA. During fiscal year 2022, $167 billion of loan
forgiveness payments were processed for loans determined by the contractor as ‘No Further Action’.

In addition, SBA’s process for the 2021 cohort of PPP loan guarantees did not identify and resolve a
complete population of potential noncompliance flags. More specifically, SBA did not ensure the
2021 cohort of PPP loan guarantees met select program eligibility requirements by verifying with all
validation checks available within its case management system. Instead, only a limited number of
checks were performed. Furthermore, for the limited flags that were identified, SBA did not have a
sufficient monitoring process implemented to ensure that lenders followed established procedures
and adequately addressed the eligibility concerns raised for the limited number of flags identified by
the case management system’s automated screening.

The deficiencies were caused by the lack of a policy in place to adequately review outputs of the case
management system, insufficient design and implementation of monitoring controls over the contractor’s
loan review process, and insufficient design of the loan forgiveness review process prior to the processing
of forgiveness payments.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6, Define
Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks; Principle 10,
Design Control Activities; and Principle 16, Perform Monitoring Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above may result in a material misstatement to the Loan Guarantee Liabilities
and Downward Reestimate Payable to Treasury line items, and the related elements in the
consolidated financial statements.

Recommendations – Forgiveness Review of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for the Office of
Capital Access to:

5. Develop and enforce a policy and controls that require the adequate review, validation, and
monitoring of the outputs of the case management system and maintenance of documentation
evidencing the review.

6. Develop and enforce a policy and controls to monitor the results of the contractor’s loan review
process including a review of loans with a ‘No Further Action’ determination and maintenance of
documentation evidencing the review.

7. Perform a thorough review of the 2021 cohort of PPP loan guarantees. Based on the review,
determine the impact on the outstanding loan guarantee and the eligibility for forgiveness of
loans that are determined to not be in conformance with the CARES Act and related legislation
and program requirements.

8. Develop and document an effective funds recovery plan and controls to ensure funds disbursed
to ineligible recipients as part of the forgiveness review process are recovered and reported
accurately in a timely manner.

C. Purchases of PPP Loan Guarantees
Management did not adequately design and implement controls to ensure purchase requests of PPP
loan guarantees were reviewed to verify that requesting lenders met the origination requirements
prior to approving and disbursing the loan. There was not an approved, documented, comprehensive
process implemented prior to purchase transactions being processed.

In addition, SBA performs a manual review of purchase requests of PPP loan guarantees with a
subset of flags while all other requests are automatically approved and processed. There was not an
adequate review of the determination of the subset of flags requiring manual review as 16 additional
flags were added at the end of the fiscal year after purchase requests for PPP loan guarantees with
those flags had already been processed.

Also, when determining which subset of flags would require a manual review for purchase requests,
SBA determined the flags that may indicate lenders did not meet the origination requirements prior
to approving and disbursing the PPP loan. However, SBA did not consider all guidance issued to
lenders when determining the subset of flags that would require a manual purchase review and
indicate that lenders did not meet origination requirements. Specifically, SBA did not consider the
procedural notices issued to lenders to address the flags identified prior to approving the 2021
cohort of PPP loan guarantees.

The PPP loan guarantee purchases review process also relies on the identified flags from the case
management system. However, management did not have adequate controls to ensure the
completeness and accuracy of flags identified and resolved.

The deficiencies were caused by an inadequate risk assessment performed to ensure sufficient controls
were designed and implemented for the review of PPP loan guarantee purchase transactions and a lack
of policy and controls that require the adequate training, onboarding, and monitoring of lenders executing
their responsibilities in the PPP loan origination process.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

Recommendations – Purchases of PPP Loan Guarantees
We recommend the Administrator coordinate with the Associate Administrator for the Office of
Capital Access to:

9. Perform a thorough and complete analysis of all requirements communicated to lenders for the
PPP program and determine how to evaluate whether lenders met the requirements prior to
disbursing a PPP loan. The analysis should include evidence to support the adequacy of SBA’s
review process when determining which purchase requests will require additional review.

10. Develop and document an effective funds recovery plan and controls to ensure funds disbursed
to ineligible recipients as part of the purchases review process are recovered and reported
accurately in a timely manner.

2. Controls over COVID-19 EIDLs Need Improvement
Management did not adequately design and implement controls to ensure that approved COVID-19
EIDLs were provided to eligible borrowers and accurately recorded. Specifically, SBA approved and
disbursed COVID-19 EIDLs in the following instances:

• More than one COVID-19 EIDL was approved and disbursed to the same borrower;

• COVID-19 EIDLs were issued to borrowers with fraudulent tax identification numbers;
• COVID-19 EIDLs were issued that management flagged to be potentially fraudulent, a victim of
identity theft, or where the borrower or the bank was involved in an Office of Inspector General
investigation; and

• COVID-19 EIDLs with eligibility concerns were issued to borrowers.

As of September 30, 2022, there were a total of 182,298 approved and disbursed COVID-19 EIDLs (with
a total value of $15,618,781,808) flagged within the loan repository system that were potentially issued to
ineligible borrowers. The loans were flagged for one or more of 14 different codes. The codes
corresponding to COVID-19 EIDLs are: Research Duplicate 9 Digit Tax Identification Issue; Potential
Fraud; EIDL Criminal Record; EIDL Bankruptcy; Treasury – Do Not Pay - Death Sources; Treasury - Do
Not Pay – SAM; Treasury – Do Not Pay - TOP Education; Confirmed Fraud; Fraud; Potential Identity
Theft; Confirmed Identity Theft; Manual Review Potential Fraud; Original Loan was Correct but Identity
Theft on the Loan Modification; and DCI Awaiting Legal Review.

Also, management did not implement adequate procedures and controls to address certain alerts within
the system. Specifically, the system’s Reference Guide that is used by loan officers during the approval
process did not have adequate procedures to address the following alerts: Public records search did not
find business; Bank account or routing number could not be verified; Bank account could not be
confirmed to be associated with the business; Deferred student loans; Foreclosure; and Outstanding
lawsuit.

According to management, a review plan was implemented and ongoing to address the COVID-19 EIDLs
identified with eligibility concerns and indicated in the loan repository system by hold codes. However,
management was not able to provide sufficient evidence of a consistent process documenting how the
COVID-19 EIDLs with eligibility concerns were identified and resolved. This would include the specific
rules that were developed and applied for the COVID-19 EIDLs portfolio to identify and designate COVID-
19 EIDLs with hold codes that may indicate eligibility concerns, the approved rationale for why only those
rules were applied, and any testing or review performed on the implementation and application of the
rules.

The deficiencies were caused by an inadequate design and implementation of controls within the COVID-
19 EIDLs processing portal, a lack of effective procedures implemented to adequately train, onboard, and
monitor the performance of loan officers involved in the COVID-19 EIDLs origination process, and the
inadequate design and implementation of controls in the COVID-19 EIDLs loan review process to ensure
hold codes were appropriate, reviewed, and resolved consistently.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above may result in a material misstatement of the Credit Program
Receivables and Related Foreclosed Property, Net and Downward Reestimate Payable to Treasury
line items, and related elements in the consolidated financial statements.
Recommendations – Controls over COVID-19 EIDLs Need Improvement
We recommend the Administrator coordinate with the Associate Administrator for the Office of
Capital Access to:

11. Perform a thorough review of the COVID-19 EIDLs and determine which transactions were not in
conformance with the CARES Act and related legislation and provided to ineligible recipients.

12. Implement adequate controls over the loan review process to ensure that COVID -19 EIDLs
identified with eligibility concerns are complete and the specific eligibility concerns identified are
accurate.

13. Document a comprehensive process for the COVID-19 EIDLs review process, including how
loans with eligibility concerns are identified, tracked, and resolved.

14. Develop and document an effective funds recovery plan and controls to ensure funds disbursed
to ineligible recipients as part of the COVID-19 EIDLs review process are recovered and
reported accurately in a timely manner.

We also recommend the Administrator coordinate with the Chief Financial Officer to:

15. Assess the accounting considerations, based on the results of the review process for COVID-19
EIDLs, including the impact on the consolidated financial statements, and record any necessary
adjustments for transactions determined not to be in conformance with the CARES Act and
related legislation.

3. Controls over the Subsidy Reestimate Need Improvement

Management did not adequately design and implement controls over the review of the data inputs
used in the PPP subsidy reestimate. Specifically, management did not consider and document the
effects on the subsidy reestimate methodology regarding:

• PPP loan guarantees with lender loan status report errors that were not reviewed or processed to
update the outstanding loan principal balance. This includes lender loan status reports submitted
incorrectly, or did not process due to an error. As such, management did not have sufficient controls
to ensure the unpaid principal balance of loan guarantees within the portfolio, on which the reestimate
is performed, is complete and accurate.

• The results from the PPP loan forgiveness review process were used to develop a significant
assumption in the PPP reestimate model. However, there were not effective monitoring controls over
the performance of the PPP loan forgiveness review process. As such, management did not have
sufficient controls in place to ensure the completeness and accuracy of the data used to develop the
significant assumption.

• The forgiveness transactions processed by SBA during the year that were also used to develop
another significant assumption. The PPP loan forgiveness review process was not adequately
designed to ensure that forgiveness transactions processed were appropriate and in accordance with
the program terms. As such, management did not have sufficient controls in place to ensure the
completeness and accuracy of the data used to develop forgiveness related significant assumption.

• The impact that the PPP purchases review process may have on another assumption in the PPP
reestimate model. In particular, management did not adequately design and implement controls to
ensure the purchase requests for PPP loan guarantees were reviewed to verify that requesting
lenders met the origination requirements prior to approving and disbursing the loan. There was not an
approved, documented, comprehensive process implemented prior to purchase transactions being
processed and changes made to the process at the end of the fiscal year were not communicated
and evaluated for impact on the reestimate model.

In addition, management did not adequately design and implement controls to ensure the
assumptions used in the subsidy reestimate for the COVID-19 EIDLs were commensurate with their
risks. Management is in process of reviewing the COVID-19 EIDLs portfolio to address eligibility concerns
on disbursed loans. This review was not completed at the time of the year-end reestimate. As such,
management does not have a reasonable basis to determine whether the assumptions applied are
appropriate to COVID-19 EIDLs in the portfolio based on their specific risk characteristics.

The deficiencies were caused by an inadequate entity wide control environment related to the design,
implementation, and operating effectiveness of controls related to the review of the loan portfolio at a
precision level necessary to ensure the data inputs used for the reestimate models are complete and
accurate. In addition, the deficiencies were caused by the inherent challenges with the implementation
and development of subsidy reestimate models for new programs that do not have a significant volume of
historical data or precedence.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 10, Design Control Activities; and Principle 13, Use Quality Information

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above may result in a material misstatement to the Loan Gua rantee
Liabilities, Credit Program Receivables and Related Foreclosed Property (Net), and Downward
Reestimate Payable to Treasury line items, and the related elements in the consolidated financial
statements.

Recommendations – Controls over the Subsidy Reestimate Need Improvement
We recommend the Administrator coordinate with the Chief Financial Officer to:

16. Continue implementing controls to accumulate relevant, complete, and accurate data on which to
base the subsidy reestimate models for the PPP and COVID-19 EIDLs portfolios.

17. Design and implement adequate review and approval controls over the reestimate models for the
PPP and COVID-19 EIDLs portfolios by appropriate levels of management, and to coordinate
with relevant program offices to assess the integrity of relevant data inputs used in the
development of assumptions, and reasonableness for the selected assumptions used and the
resulting estimates.

4. Controls over the Evaluation of Service Organizations Need Improvement
A. Service Organization Used for COVID-19 EIDLs
Management did not obtain reasonable assurance on the operating effectiveness of internal controls
in the service organization’s control environment relevant to the processing of COVID -19 EIDLs
transactions. The service organization control environment includes the operation of the system
used for COVID-19 EIDLs processing and the application controls within the system. In addition, the
relevant control environment includes the data transmissions over the internet between the system
and various third-party organizations.

In addition, management did not provide evidence of adequate monitoring activities performed over
the relevant internal control environment at the service organization, such as obtaining and
reviewing an attestation report on the design, implementation, and operating effectiveness of
controls at the service organization. Management also did not provide evidence whether adequate
user entity controls were designed, implemented, and operated effectively to complement the
service organization’s controls. Management’s assessment of internal controls over financial reporting is
not complete without the sufficient consideration of existing and non-existing controls at relevant service
organizations and the effectiveness of those controls.

The deficiencies were caused by management not holding the service organization accountable for the
assigned internal control responsibilities by obtaining reasonable assurance on the operating
effectiveness of internal controls in the service organization’s control environment (e.g., requiring a
service organization control (SOC) 1 Type 2 report for the control environment relevant to the
processing of COVID-19 EIDLs transactions).

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above prevented SBA from obtaining an understanding of relevant service
organization controls and any weaknesses that increase the risk of misstatements in the Credit
Program Receivables and Related Foreclosed Property (Net), and Downward Reestimate Payable
to Treasury line items, and related elements in the consolidated financial statements.

Recommendations – Service Organization Used for COVID-19 EIDLs
We recommend the Administrator coordinate with the Associate Administrator for the Office of
Capital Access to:

18. Continually evaluate the established policy for SOC 1 reports that requires new service
organizations to provide a SOC 1 report over the control environment that is relevant and
significant to the processing and recording of SBA’s transactions as it relates to COVID-19
EIDLs. If a SOC 1 report cannot be obtained, identify, and evaluate relevant controls at the
service organizations that have an impact on SBA’s internal controls over financial reporting.

19. Assess the risk posed by the service organization’s control environment and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine the
integrity of the COVID-19 EIDLs transactions processed on behalf of and recorded by SBA. If a
SOC 1 report is obtained for the relevant control environment at the service organization,
determine and document the following:

• SOC 1 report is sufficiently scoped to cover transaction processing and related control activities
performed by the service organization on behalf of SBA (e.g., that services, business applications
and other information technology, service organization departments and locations, control
objectives and activities, and other aspects of scope that are relevant to SBA’s internal controls
over financial reporting are included in the scope of SOC 1 reports).

• All exceptions noted in the SOC 1 report – not just those described in the independent service
auditor’s report – are evaluated to determine applicability to SBA’s internal controls over financial
reporting, the potential impact to SBA’s financial statements, and mitigating controls other
considerations made during their risk assessment.
• All complementary user entity controls described in the SOC 1 reports are evaluated using
current information and with consideration to their applicability to SBA’s internal controls over
financial reporting.

• Evaluation procedures performed to assess whether complementary user entity controls and
other SBA-performed controls were tested and found effective and, if they are not, the impact of
such deficiencies on SBA’s internal controls over financial reporting.

• All complementary subservice organization controls described in SOC 1 reports are evaluated to
determine whether they provided services and performed controls considered relevant to SBA’s
internal controls over financial reporting and, if relevant subservice organizations were identified,
an evaluation is performed to obtain an understanding of the subservice organization(s) and their
controls.

• SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.

B. Service Organizations Used for Loan Guarantee Programs
Management did not obtain reasonable assurance on the operating effectiveness of internal controls
in multiple service organizations’ control environments relevant to the 7(a) loan guarantee program
fiscal transfer agent, the financial service providers for the 7(a) and 504 loan guarantee programs,
and the PPP forgiveness and purchases platform. With regards to the financial service providers for
the 7(a) and 504 loan guarantee programs, the relevant control environments include the facilitation,
maintenance, and reporting of the account balances for the respective secondary market programs.
With regards to the PPP forgiveness and purchases platform, the relevant control environment
includes the operation of the PPP loan forgiveness and PPP loan purchase modules, the data
transmissions over the internet between the relevant modules and SBA systems used in the
configured checks, the cloud-based infrastructure hosting provider, and the application controls
within the application intake platform.

In addition, management did not provide evidence of adequate monitoring activities performed over
the relevant internal control environments at the respective service organizations and subservice
organizations, such as obtaining and reviewing an attestation report on the design, implementation,
and operating effectiveness of controls at the service organization.

Management’s evaluation of SOC 1 reports obtained for the 7(a) loan guarantee program fiscal transfer
agent and the 504 loan guarantee program financial service provider were not sufficient or properly
documented to aid in management’s assessment of internal controls over financial reporting. Specifically,
management’s review of complementary user entity controls within the SOC 1 reports identified control
gaps or placed reliance on controls for which deficiencies were noted. Management’s assessment of
internal controls over financial reporting is not complete without the sufficient consideration of existing and
non-existing controls at relevant service organizations and the effectiveness of those controls.

Management did not hold the service organizations accountable for the assigned internal control
responsibilities by obtaining reasonable assurance on the operating effectiveness of internal controls in
the service organizations’ control environments (e.g., by requiring a SOC 1 Type 2 report for the control
environment relevant to the processing of SBA’s transactions).

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Section 4, Additional Considerations: Service Organizations; Principle 5, Enforce
Accountability; Principle 10, Design Control Activities; and Principle 16, Perform Monitoring Activities
• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above prevented SBA from obtaining an understanding of relevant service
organization controls and any weaknesses that increase the risk of misstatements in the Loan
Guarantee Liabilities line item and related elements in the consolidated financial statements.

Recommendations – Service Organizations Used for Loan Guarantee Programs
We recommend the Administrator coordinate with the Associate Administrator for the Office of
Capital Access to:

20. Continually evaluate the established policy for SOC 1 reports that requires new service
organizations to provide a SOC 1 report over the control environment that is relevant and
significant to the processing and recording of SBA’s transactions as it relates to loan guarantee
programs. If a SOC 1 report cannot be obtained, identify, and evaluate relevant controls at the
service organizations that have an impact on SBA’s internal controls over financial reporting.

21. Assess the risk posed by the service organizations’ control environments and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine the
integrity of loan guarantee program transactions processed on behalf of and recorded by SBA. If
a SOC 1 report is obtained for the relevant control environment at the service organization,
determine and document the following:

• All complementary user entity controls described in the SOC 1 reports are evaluated using
current information and with consideration to their applicability to SBA’s internal controls over
financial reporting.

• SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.
C. Service Organization Used for the SVOG Program
Management did not obtain reasonable assurance on the operating effectiveness of internal controls
in the service organization’s control environments relevant to the external cloud service provider
used for the SVOG platform in the processing of applications and monitoring the status of awards.

While a SOC 1 report was obtained for the service provider, management did not provide evidence
of adequate monitoring activities performed over the relevant internal control environments at the
respective subservice organizations identified in the report. In addition, management also did not
provide evidence whether adequate user entity controls were designed, implemented, and operated
effectively to complement the service organization’s controls. Finally, management did not provide
evidence of adequate evaluation of the control exceptions noted in the report and the impact to
SBA’s internal control over financial reporting. Management’s assessment of internal controls over
financial reporting is not complete without the sufficient consideration of existing and non-existing controls
at relevant service and subservice organizations and the effectiveness of those controls.

The deficiencies were caused by management not implementing effective monitoring of the effectiveness
of internal control over the assigned processes performed by relevant service organizations.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above prevented SBA from obtaining an understanding of relevant service
organization controls and any weaknesses that increase the risk of misstatements in the Other than
Intragovernmental Advances and Prepayments line item and related elements in the consolidated
financial statements.

Recommendations – Service Organizations Used for the SVOG Program
We recommend the Administrator coordinate with the Acting Chief Information Officer to:

22. Assess the risk posed by the service organizations’ control environments and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine the
integrity of SVOG program transactions processed on behalf of and recorded by SBA and
communicate the results to the relevant program offices. If a SOC 1 report is obtained for the
relevant control environment at the service organization, determine and document the following:

• All exceptions noted in the SOC 1 report – not just those described in the independent service
auditor’s report – are evaluated to determine applicability to SBA’s internal controls over financial
reporting, the potential impact to SBA’s financial statements, and mitigating controls
considerations made during their risk assessment.
• All complementary user entity controls described in the SOC 1 reports are evaluated using
current information and with consideration to their applicability to SBA’s internal controls over
financial reporting.

• SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.

5. Controls over Accounting and Monitoring of RRF and SVOG Programs Need Improvement
Management did not adequately design and implement monitoring controls over RRF and SVOG
awards to ensure accurate financial reporting as of the fiscal year-end, and the funds were used in
accordance with the CARES Act and related legislation. According to management, monitoring plans
were implemented and ongoing. However, the monitoring process could not be relied upon for financial
reporting purposes at fiscal year-end. Specifically, we noted that management was unable to provide
evidence that the accounting treatment and financial reporting for the RRF and SVOG awards were in
accordance with U.S. generally accepted accounting principles. The full amount of the awards was
expensed immediately upon disbursement without evidence supporting the existence, accuracy, and
timely recognition of expenses, instead of advances, as they were incurred by the recipients during the
fiscal year.

In addition, management did not adequately design and implement controls to ensure the RRF and
SVOG awards were approved and disbursed to eligible recipients in conformance with the related
legislation. Management approved and disbursed RRF and SVOG awards to recipients that also had
PPP loan guarantees that were flagged in SBA’s loan repository system. SBA placed flags on PPP
loan guarantees if the loans were indicative of potential noncompliance with select eligibility
requirements. We noted that RRF and SVOG award recipients also had a PPP loan guarantee with
an alert or flag that were not resolved prior to the approval of the (RRF) award.

The deficiencies were caused by an inadequate entity wide control environment to design and implement
sufficient review and monitoring controls related to the RRF and SVOG programs. In addition, there was a
lack of a sufficient analysis performed to determine the appropriate accounting treatment for the
programs.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 10, Design Control Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies noted above may result in a material misstatement to the Other than
Intragovernmental Advances and Prepayments line item and the related elements in the consolidated
financial statements.
Recommendations – Controls over Accounting and Monitoring of RRF and SVOG Programs Need
Improvement
We recommend the Administrator coordinate with the Associate Administrators for the Office of
Capital Access and the Office of Disaster Assistance to:

23. Design and implement a sufficient ongoing review of RRF and SVOG awards disbursed and
identify recipients that may not have been eligible to receive the awards in accordance with the
program’s terms, especially for recipients with flagged PPP loan guarantees.

24. Design and implement effective monitoring controls to ensure that RRF and SVOG award
recipients are complying with the program’s terms and to ensure complete, accurate, and timely
reporting for the use of the award.

25. Develop and document an effective funds recovery plan and controls to ensure funds disbursed
to ineligible recipients as part of the RRF and SVOG review process are recovered and reported
accurately in a timely manner.

We recommend the Administrator coordinate with the Chief Financial Officer to:

26. Design and implement controls to ensure the accounting treatment established to record the
balances related to the RRF and SVOG programs are in accordance with U.S. generally
accepted accounting principles and the basis for the appropriate treatment is sufficiently
documented.

6. Entity Level Controls Need Improvement
Due to the implementation of the new and expanded programs, management faced challenges in
maintaining an adequate entity level controls system that produces reliable and accurate financial
reporting. The significance of the internal control matters indicated weaknesses across several entity level
control categories. We noted the following conditions.

Risk Assessment: Management did not design and implement an effective risk assessment process. For
example, the following matters were noted:

1. The materiality threshold developed and documented was not adequately considered and
applied by program offices when key decisions regarding controls and review processes were
implemented. The controls within the relevant offices were not designed, implemented, and
operating effectively to a sufficient precision level to ensure the reporting objective of preparing
the financial statements free of material misstatement could be achieved. For example, the 2021
cohort of PPP loan guarantees were subject to a limited set of validation checks as compared to
the 2020 cohort of PPP loan guarantees without a documented risk assessment determining the
rationale for why a lower response was appropriate. Additionally, the PPP loan guarantee
forgiveness review process was not designed to ensure the reviews performed were to a
sufficient level of precision to ensure the related balances were free of material misstatement.

2. While risk assessments were planned, they were not completed in fiscal year 2022 for material
programs, including COVID-19 EIDLs, PPP, and Debt Relief Program payments.

Monitoring: Management did not design and implement effective monitoring processes. The following
matters were noted concerning various program areas. Specifically, we noted that SBA did not have
adequate or effective monitoring controls related to:

3. PPP lenders

4. Internal control over processes performed by service organizations.
5. RRF and SVOG program award recipients.

6. Entity level controls, manual controls, general information technology controls, and sy stem
application controls for key financial statement line items and risks. Specifically, evidence was
not provided to substantiate that the testing of controls was complete for significant new and
expanded programs authorized from the CARES Act and related legislation.

The deficiencies were primarily caused by the prioritization and the urgent need to implement the
provisions of the CARES Act and related legislation as quickly and efficiently as possible over internal
control processes and related remediation of prior year control deficiencies. In addition, these deficiencies
were caused by the inherent challenges with the implementation of new and expanded programs that do
not have any historical precedence. The challenges included implementing programs with inadequate
systems to implement such large-scale programs, and an insufficient number of personnel to assist in the
design, implementation, and execution of internal controls. Finally, these deficiencies were caused by the
lack of an effective risk assessment, communication, and monitoring processes and controls to ensure
financial statement reporting objectives were achieved.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 6, Define Objectives and Risk Tolerances; Principle 7, Identify, Analyze,
and Respond to Risks; Principle 9, Identify, Analyze, and Respond to Change; Principle 10, Design
Control Activities; Principle 12, Implement Control Activities; and Principle 16, Perform Monitoring
Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

As a result of the deficiencies noted above, transactions were approved and in certain cases disbursed
to potentially ineligible entities and not in conformance with the CARES Act and related legislation, and
the Office of Chief Financial Officer placed reliance on controls that were not designed, implemented, and
operating effectively to ensure the financial statements are free from potential material misstatements.
Without the proper level of entity level controls in place and operating effectively, there is an increased
risk that a material misstatement exists in the consolidated financial statements, and noncompliance
with the relevant laws and regulations would not be prevented or detected and timely corrected.

Recommendations – Entity Level Controls Need Improvement
We recommend that the Administrator coordinate with the Associate Administrators for the Office of
Capital Access and Disaster Assistance to:

27. In conjunction with the Office of the Chief Financial Officer, complete the internal control risk
assessments for programs that have a material impact on the financial statements at a process
level in a timely manner. The risk assessments should include the consideration of whether
controls designed and implemented are operating at a sufficient precision level in accordance
with management’s materiality threshold and will be sufficient for financial reporting purposes.

28. Develop and implement monitoring controls as required by the GAO’s Standards for Internal
Control in the Federal Government to ensure implementation of an effective internal control
environment.

We recommend that the Administrator coordinate with the Chief Financial Officer to:

29. Perform and document a thorough risk assessment at the financial statement assertion level to
identify process level risks and communicate the results to relevant program offices.
30. In conjunction with relevant program offices, assess the effectiveness of key process level
controls to respond to the identified risks.

31. In conjunction with relevant program offices, develop and implement processes to ensure the
timely completion of the testing and monitoring of the design, implementation, and operating
effectiveness of key, relevant controls that affect financial reporting and compliance with relevant
laws and regulations.
Appendix II

U.S. Small Business Administration

Significant Deficiencies

The following deficiencies are considered to be significant deficiencies in internal controls over financial
reporting.

1. Controls over Payments for Covered Loans under the Debt Relief Program Need
Improvement

2. Controls over General Information Technology Need Improvement

1. Controls over Payments for Covered Loans under the Debt Relief Program Need Improvement
Management did not adequately design and implement controls to determine that payments made to
lenders for covered loans under the Debt Relief Program were accurate, reviewed, and approved prior to
payment to enable the fair presentation of the Loan Guarantee Liabilities. Specifically, management did
not have a documented process and sufficient controls in place to substantiate the accuracy of the
payments made to lenders.

The deficiency was caused by an inadequate entity wide control environment to implement processes,
and procedures to account for new and expanded programs under the CARES Act and related legislation
with sufficiently designed, implemented, and effectively operating controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities

The deficiency noted above may result in misstatements of the Loan Guarantee Liabilities line item and
related elements in the consolidated financial statements.

Recommendations – Payments for Covered Loans under the Debt Relief Program
We recommend the Administrator coordinate with the Associate Administrator for the Office of Capital
Access to:

32. Perform a review of the payments made by SBA for covered loans under the Debt Relief
Program to identify, review, and remediate any potential over or under payments made on the
related loans.

2. Controls over General Information Technology Need Improvement

Management had control deficiencies that limited SBA’s ability to effectively manage its information
system risks. Collectively, these conditions increase the risk of unauthorized use, modification, or
destruction of financial data, which may impact the integrity of information used to prepare the financial
statements. In the sections below, we have omitted some technical details from the conditions and
recommendations due to the sensitivity of the information. These details were communicated to
management in notices of findings and recommendations.

The following criteria were considered with respect to the matters described in the following paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 11,
Design Activities for the Information System
• National Institute of Standards and Technology Special Publication 800-53, Revision 5, Security and
Privacy Controls for Federal Information Systems and Organizations

We have summarized the information technology control deficiencies by the following general information
technology control objectives: logical access controls and system configuration management.

Logical Access Controls
Management did not consistently follow established policy and procedure requirements for the timely
removal of access to SBA systems for separated employees and contractors.

The deficiency was caused by the lack of a separated personnel report being provided to the relevant
points of contact in program offices.

The deficiency noted above increases the risk that unauthorized users may retain access to the system
resulting in unauthorized modification, destruction, or exposure to SBA systems and data.

Recommendations – Logical Access Controls
We recommend the Administrator coordinate with the Chief Human Capital Officer to:

33. Review and update current processes and procedures for notifying program offices of personnel
separations to ensure inclusion of current primary and secondary points of contacts for each
program office responsible for managing information systems.

We recommend the Administrator coordinate with the Associate Administrator for the Office of Capital
Access to:

34. Review the activities of the terminated employees and contractors to ensure that their accounts
were not used after they separated from SBA.

35. Update the Office of Capital Access procedures to identify the control activities, responsible
parties, and the process for the removal of access for terminated users upon notification from the
Office of the Chief Human Capital Officer.

System Configuration Management
Management did not implement corrective actions to remediate the prior year deficiency related to the
testing of patches prior to implementation. Specifically, management did not follow established policy and
procedures by maintaining supporting evidence to consistently demonstrate that database and operating
system patches were tested and approved prior to migration into the production environment.

The deficiency was caused by a lack of sufficient resources to implement a testing team for the patch
management process and a lack of prioritization to remediate this prior year deficiency.

The deficiencies noted above increase the risk that known vulnerabilities can be exploited and
unauthorized changes can be applied to the system, resulting in possible disclosure, modification, or
destruction of SBA system programs and data.

Recommendations – System Configuration Management
We recommend the Administrator coordinate with the Associate Administrator for the Office of Capital
Access to:

36. Implement controls and a monitoring process to ensure that patches applied to the database and
operating system and application changes are appropriately tested prior to being moved into the
production environment.
37. Update the system configuration management plan to require internal control documentation for
patch management and application changes as required by GAO’s Standards for Internal Control
in the Federal Government.

38. Periodically train personnel involved with the implementation of database and operating system
patches, and the review and approval of application changes, to follow the respective controls
and requirements of the patch management and application change management processes in
accordance with existing policies.
Appendix III

U.S. Small Business Administration

Compliance and Other Matters

A. Federal Managers’ Financial Integrity Act of 1982 (FMFIA)
Management performed an internal control assessment as required under FMFIA; however,
management’s assessment did not substantially comply with FMFIA and the related OMB Circular No. A-
123 requirements. Specifically, management did not:

1. Perform, document, and demonstrate that they completed an internal control over financial reporting
evaluation regarding the new or expanded programs, including the evaluation and consideration of
the risks and controls of significant service organizations.

2. For the risks significant to financial reporting, consistently document financial statement risks and
assertions covered, testing procedures performed, extent of sampling performed, testing results,
corrective action plans to respond to deficiencies identified, and provide evidence of management
review. Additionally, management did not complete testing over significant areas and did not plan for
and test information technology controls as part of the internal control evaluation program.

3. Ensure their own assurance process was sufficient to identify material weaknesses that existed
during the fiscal year in addition to those identified by external auditors.

Management did not substantially meet FMFIA requirements due to the urgent need to implement the
provisions of the CARES Act and related legislation as quickly and efficiently as possible, the lack of
historical precedence, and other inherent challenges faced in implementing and expanding programs. In
addition, management did not consider all FMFIA and OMB Circular No. A-123 requirements when
performing their evaluation over internal controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• Section 2 of FMFIA

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

Management did not substantially comply with FMFIA and the related OMB Circular No. A-123
requirements, which may lead to not identifying the appropriate risks and key controls, and not detecting
internal control or compliance deficiencies. The risk of not detecting and correcting control deficiencies
could result in misstatements to the consolidated financial statements.

Recommendations – FMFIA
We recommend the Administrator coordinate with the Chief Financial Officer to:

39. Update the risk assessment regarding the evaluation of internal controls to ensure it includes all
significant programs, key processes, and other material line items on the consolidated financial
statements.

40. In conjunction with relevant program offices, perform and document the internal control
evaluation over all programs. This should include entity level controls, manual controls, general
information technology controls, and system application controls covering key financial statement
line items and risks.
41. Update the existing policy and implement adequate controls to ensure that the statement of
assurances provided by the program offices are adequately documented and reviewed for
completeness and accuracy to provide a sufficient basis to support the Administrator’s statement
of assurance.

B. Federal Financial Management Improvement Act of 1996 (FFMIA)
Management did not establish and maintain financial management systems that substantially comply with
the following FFMIA requirements:

1. Federal Financial Management Systems Requirements. As discussed in Appendix I – Material
Weaknesses, control deficiencies over transactions arising from the implementation of the CARES
Act and related legislation do not enable reliable and accurate financial reporting and do not ensure
budgetary resources are safeguarded against waste, loss, and misuse. In addition, the deficiencies
may not support compliance objectives related to ensuring financial transactions are in conformance
with the CARES Act and related legislation are achieved.

2. Federal Accounting Standards. The deficiencies identified and reported in Appendix I – Material
Weaknesses, provide an indication that SBA’s financial management systems were substantially non-
compliant with applicable federal accounting standards. Specifically, management was unable to
provide evidence that the accounting treatment and financial reporting for the RRF and SVOG awards
were in accordance with U.S. generally accepted accounting principles. The full amount of the awards
was expensed immediately upon disbursement without evidence supporting the existence, accuracy,
and timely recognition of expenses, instead of advances, as they were incurred by the recipients
during the fiscal year.

Management did not substantially meet FFMIA requirements because of the reasons discussed in
Appendix I – Material Weaknesses and due to an inadequate entity wide control environment to
implement the provisions of the CARES Act and related legislation with sufficiently designed and
implemented controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• Section 803(a) of FFMIA

• GAO’s Green Book, Section 2, Establishing an Effective Internal Control System

• Appendix D to OMB Circular No. A-123, Compliance with the Federal Financial Management
Improvement Act of 1996

Management did not substantially comply with FFMIA increasing the risk that transactions are incorrectly
recorded to the general ledger, impacting the completeness, existence, and accuracy of the balances in
the consolidated financial statements.

Recommendations – FFMIA
We recommend the Administrator coordinate with the Chief Financial Officer to:

42. Address the control deficiencies over transactions arising from the implementation of the CARES
Act and related legislation by working with the Office of Capital Access and the Office of Disaster
Assistance to implement the recommendations in Appendix I – Material Weaknesses.
Appendix IV

CFO Response to Audit Report on
FY 2022 Financial Statements
November 15, 2022

TO: Hannibal M. Ware, Inspector General

FROM: Kate Aaby, Associate Administrator for Performance, Planning and the Chief
Financial Officer

SUBJECT: FY 2022 Financial Statement Audit

The Small Business Administration has reviewed the Independent Auditors’ Report from KPMG that
includes the auditors’ disclaimer of opinion on the Agency’s FY 2022 and FY 2021 Consolidated Balance
Sheets. The independent audit of the Agency’s financial statements and related processes is a core
component of SBA’s financial management program, and we are concerned by this result.

The FY 2022 Agency Financial Report includes the programs implemented under the American Rescue
Plan Act, the Economic Aid Act, in addition to those programs funded under the CARES Act and
subsequent legislation. As in FY 2021, the expansion of these programs during prolonged
unprecedented times continued to emphasize the importance of serving small businesses as they
navigate extraordinary circumstances.

The SBA has continued making tremendous progress strengthening internal controls for pandemic-
focused programs and is dedicated to accountability and transparency to the American public. SBA
implemented the Fraud Risk Management Board (FRMB) this year to effectively mitigate, manage and
monitor fraud risks. The FRMB is chaired by the CFO and members include Deputy Associate
Administrators of key Program Offices. In addition, to the governance bodies SBA has in place, the CFO
and key SBA Program Offices have partnered in the development and implementation of corrective
actions that will strengthen internal controls as well as address audit identified deficiencies.

The SBA Senior Management Council (SMC) which is chaired by the Deputy Chief Financial Officer and
comprised SBA managers from program and support offices, actively plans and executes the Agency’s
internal control activities that include assessing and improving compliance, monitoring and remediation
of identified deficiencies and communicating results of reviews to senior management.

As in FY 2021, the auditors identified material weaknesses related to the internal controls over six areas;
PPP Loan Guarantees, COVID-19 EIDLs and Grants, Subsidy Reestimate, Restaurant Revitalization and
Shuttered Venues Operators Grant Program, Entity Level Controls, and Evaluation of Service
Organizations. The SBA has undergone tremendous efforts to strengthen internal controls, policies and
procedures and will continue remediation efforts in the coming audit year.

We appreciate your efforts and those of your colleagues in the Office of the Inspector General, as well as
those of KPMG. The independent audit process continues to provide us with beneficial
recommendations that support our efforts to further enhance the SBA's financial management practices.
We remain committed to excellence in financial management and look forward to furthering progress in
the coming year.

File and source

File: SBA-OIG-Report-23-02.pdf
Size: 683,485 bytes
SHA-256: b0a462aa089c1fb44eb724a3184be5831feed2d77ca667d5530bf029d23285a0
Our copy: SBA-OIG-Report-23-02.pdf
Original: legacy.sba.gov