SBA, Independent Auditors’ Report on SBA’s Fiscal Year 2023 Financial Statements

Summary

A November 15, 2023 memorandum from Inspector General Hannibal “Mike” Ware to Administrator Isabella Casillas Guzman, transmitting KPMG LLP’s independent auditors’ report on SBA’s Fiscal Year 2023 financial statements (Report 24-03). KPMG issued a disclaimer of opinion on the consolidated balance sheets as of September 30, 2023 and 2022. The report states that SBA could not provide adequate evidential matter for a significant number of transactions and account balances related to the Paycheck Protection Program, Economic Injury Disaster Loan program, Restaurant Revitalization Fund and Shuttered Venue Operators Grant program. KPMG identified material weaknesses over six areas and significant deficiencies over three areas; the Chief Financial Officer generally concurred with the findings.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“SBA, Independent Auditors’ Report on SBA’s Fiscal Year 2023 Financial Statements.” Original at legacy.sba.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/sba-independent-auditors-report-on-sba-s-fiscal-year-2023-financial-st-c25bd55b6c/, SHA-256 ef9c3f7d8c7441b621c3bb06595bbacdd04b0fdb7c3638517882ee843eb7e706.

Full text

OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION

DATE: November 15, 2023
TO: Isabella Casillas Guzman
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: Independent Auditors’ Report on SBA’s Fiscal Year 2023 Financial Statements
(Report 24-03)
I am pleased to present the attached independent auditors’ report on the U.S. Small Business
Administration’s (SBA) financial statements for fiscal year 2023, as required annually by the Chief
Financial Officers Act of 1990, as amended.
We contracted with the independent certified public accounting firm KPMG LLP to conduct an
audit of SBA’s consolidated balance sheets as of September 30, 2023 and 2022 and the related
notes to these statements. Our contract with KPMG required that the audit be performed in
accordance with auditing standards generally accepted in the United States of America,
Government Auditing Standards issued by the Comptroller General of the United States, and
Office of Management and Budget (OMB) Bulletin No. 24-01, Audit Requirements for Federal
Financial Statements.
KPMG’s responsibility was to express an opinion on the consolidated balance sheets based on
their audit. KPMG was not engaged to audit the consolidated statements of net cost and changes
in net position and combined statements of budgetary resources for the years ended September
30, 2023 and 2022 and the related notes to these statements.
In the audit, KPMG reported significant matters for which they were unable to obtain sufficient
and appropriate audit evidence to provide a basis for an audit opinion on SBA’s balance sheet as
of September 30, 2023. Accordingly, KPMG issued a disclaimer of opinion on the consolidated
balance sheets as of September 30, 2023 and 2022.
The basis for the disclaimer was that due to inadequate processes and controls, SBA was unable
to provide adequate evidential matter in support of a significant number of transactions and
account balances related to the Paycheck Protection Program, Economic Injury Disaster Loan
program, the Restaurant Revitalization Fund, and the Shuttered Venue Operators Grant
program.
As a result, KPMG was unable to determine whether any adjustments might have been
necessary with respect to the following line items and related notes:
• Credit Program Receivables and Related Foreclosed Property, Net
• Other than Intragovernmental Accounts Receivable, Net
• Downward Reestimate Payable to Treasury
• Loan Guarantee Liabilities

For the period ended September 30, 2023, KPMG identified material weaknesses over six areas
and significant deficiencies over three areas in internal control over financial reporting.
Appendices I and II of this report describe details of KPMG’s conclusions about the material
weaknesses and significant deficiencies. Appendix III describes instances of noncompliance with
applicable laws or other matters required to be reported under Government Auditing Standards
or OMB Bulletin No. 24-01.
In connection with the contract, we reviewed KPMG’s report and related documentation and
inquired of its representatives. Our oversight protocols included evaluation of major work
products, attendance at critical meetings, review of significant findings, and examination of
related evidential matter. Our review, as differentiated from an audit of the financial statements
in accordance with government auditing standards, was not intended to enable us to express,
and we do not express, opinions on SBA’s financial statements or internal control over financial
reporting or conclusions on SBA’s compliance with applicable laws and other matters. Our
review disclosed no instances where KPMG did not comply in all material respects with auditing
standards. KPMG is responsible for the attached auditors’ report dated November 15, 2023 and
the conclusions expressed. However, OIG provides negative assurance of this audit.
We provided a draft of KPMG’s report to SBA’s Chief Financial Officer, who generally concurred
with its findings and recommendations and agreed to implement the recommendations. The
Chief Financial Officer stated that SBA remains committed to excellence in financial management
and looks forward to furthering progress in the coming year. The Chief Financial Officer’s
response is included in Appendix IV.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or
your staff have any questions, please contact me or Andrea Deadwyler, Assistant Inspector
General for Audits, at (202) 205-6586.
cc: Dilawar Syed, Deputy Administrator, Office of the Administrator
Arthur Plews, Chief of Staff, Office of the Administrator
Isabelle James, Deputy Chief of Staff, Office of the Administrator
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk, Office of the Administrator
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and the Chief
Financial Officer
Kathryn Frost, Acting Associate Administrator, Office of Capital Access
Francisco Sanchez Jr., Associate Administrator, Office of Disaster Assistance
John Miller, Deputy Associate Administrator, Office of Capital Access
Therese Meers, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Anna M. Calcagno, Director, Office of Program Performance, Analysis, and Evaluation
Tonia Butler, Director, Office of Internal Controls

Attachment
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006

Independent Auditors’ Report

Inspector General
U.S. Small Business Administration

Administrator
U.S. Small Business Administration

Report on the Audit of the Consolidated Financial Statements
Disclaimer of Opinion
We were engaged to audit the consolidated balance sheets of the United States (U.S.) Small Business
Administration (SBA) as of September 30, 2023 and 2022, and the related notes to the consolidated balance
sheets (the consolidated financial statements).

We do not express an opinion on the accompanying consolidated financial statements of the SBA. Because of
the significance of the matter described in the Basis for Disclaimer of Opinion section of our report, we ha ve not
been able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion on the se
consolidated financial statements.

Basis for Disclaimer of Opinion
The SBA’s pandemic relief programs include the Paycheck Protection Program, Economic Injury Disaster Loan
program, Restaurant Revitalization Fund program, and Shuttered Venues Operators Grant program, which
were authorized by the Coronavirus Aid, Relief, and Economic Security Act of 2020 and related legislations.
These programs affect a substantial proportion of SBA’s consolidated financial statements. The SBA was
unable to provide adequate evidential matter in support of a significant number of transactions and account
balances related to these programs due to inadequate processes and controls. As a result of this matter, we
were unable to determine whether any adjustments might have been necessary related to the Credit Program
Receivables and Related Foreclosed Property, Net; Other than Intragovernmental Accounts Receivable, Net;
Downward Reestimate Payable to Treasury; Loan Guarantee Liabilities; and the related notes.

Other Matter – Report on Certain Fiscal Year 2023 and 2022 Information
We were not engaged to audit the consolidated statements of net cost and changes in net position, and
combined statements of budgetary resources for the years ended September 30, 2023 and 2022, and the
related notes to these statements. Accordingly, we express no opinion on them.

Other Matter - Interactive Data
Management has elected to reference to information on websites or other forms of interactive data outside the
Agency Financial Report to provide additional information for the users of its consolidated financial statements.
Such information is not a required part of the consolidated financial statements or supplementary information
required by the Federal Accounting Standards Advisory Board. The information on these websites or the other
interactive data has not been subjected to any of our auditing procedures, and accordingly we do not express
an opinion or provide any assurance on it.

KPMG LLP, a Delaware limited liability partnership and a member firm of
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
Responsibilities of Management for the Consolidated Financial Statements
Management is responsible for the preparation and fair presentation of the consolidated financial statements in
accordance with U.S. generally accepted accounting principles, and for the design, implementation, and
maintenance of internal control relevant to the preparation and fair presentation of consolidated financial
statements that are free from material misstatement, whether due to fraud or error.

Auditors’ Responsibilities for the Audit of the Consolidated Financial Statements
Our responsibility is to conduct an audit of the SBA’s consolidated financial statements in accordance with
auditing standards generally accepted in the United States of America (GAAS), Government Auditing
Standards, issued by the Comptroller General of the United States, and Office of Management and Budget
(OMB) Bulletin No. 24-01, Audit Requirements for Federal Financial Statements, and to issue an auditors’
report. However, because of the matter described in the Basis for Disclaimer of Opinion section of our report,
we were not able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion on these
consolidated financial statements.

We are required to be independent of the SBA and to meet our other ethical responsibilities, in accordance with
the relevant ethical requirements relating to our audit.

Required Supplementary Information
U.S. generally accepted accounting principles require that the information in the Management’s Discussion and
Analysis and Required Supplementary Information sections be presented to supplement the basic consolidated
financial statements. Such information is the responsibility of management and, although not a part of the basic
consolidated financial statements, is required by the Federal Accounting Standards Advisory Board who
considers it to be an essential part of financial reporting for placing the basic consolidated financial statements
in an appropriate operational, economic, or historical context. We were unable to apply certain limited
procedures to the required supplementary information in accordance with GAAS because of the significance of
the matter described in the Basis for Disclaimer of Opinion paragraph. We do not express an opinion or provide
any assurance on the information.

Report on Internal Control Over Financial Reporting
In connection with our engagement to audit the SBA’s consolidated financial statement as of September 30,
2023, we considered the SBA’s internal control over financial reporting (internal control) as a basis for
designing audit procedures that are appropriate in the circumstances for the purpose of expressing an opinion
on the consolidated financial statement, but not for the purpose of expressing an opinion on the effectiveness of
the SBA’s internal control. Accordingly, we do not express an opinion on the effectiveness of the SBA’s internal
control. We did not test all internal controls relevant to operating objectives as broadly defined by the Federal
Managers’ Financial Integrity Act of 1982.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was
not designed to identify all deficiencies in internal control that might be material weaknesses or significant
deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified.
However, as described in the accompanying Appendices I and II, we identified certain deficiencies in internal
control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or detect and correct,
misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in
internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies
described in Appendix I to be material weaknesses.
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe
than a material weakness, yet important enough to merit attention by those charged with governance. We
consider the deficiencies described in Appendix II to be significant deficiencies.

Report on Compliance and Other Matters
In connection with our engagement to audit the SBA’s consolidated financial statement as of September 30,
2023, we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant
agreements, noncompliance with which could have a direct and material effect on the consolidated financial
statement. However, providing an opinion on compliance with those provisions was not an objective of our
engagement, and accordingly, we do not express such an opinion. The results of our tests disclosed instances
of noncompliance or other matters that are required to be reported under Government Auditing Standards or
OMB Bulletin No. 24-01, and which are described in Appendix III.

We also performed tests of the SBA’s compliance with certain provisions referred to in Section 803(a) of the
Federal Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with
FFMIA was not an objective of our engagement, and accordingly, we do not express such an opinion. The
results of our tests disclosed instances, described in Appendix III, in which the SBA’s financial management
systems did not substantially comply with the (1) Federal financial management systems requirements, and (2)
applicable Federal accounting standards. The results of our tests disclosed no instances in which the SBA’s
financial management systems did not substantially comply with the United States Government Standard
General Ledger at the transaction level.

Additionally, if the scope of our work had been sufficient to enable us to express an opinion on the consolidated
financial statements, other instances of noncompliance or other matters may have been identified and reported
herein.

SBA’s Response to Findings
Government Auditing Standards requires the auditor to perform limited procedures on the SBA's response to
the findings identified in our engagement and described in Appendix IV. The SBA’s response was not subjected
to the other auditing procedures applied in the engagement to audit the consolidated financial statements and,
accordingly, we express no opinion on the response.

Purpose of the Reporting Required by Government Auditing Standards
The purpose of the communication described in the Report on Internal Control Over Financial Reporting and
the Report on Compliance and Other Matters sections is solely to describe the scope of our testing of internal
control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the
SBA’s internal control or compliance. Accordingly, this communication is not suitable for any other purpose.

Washington, DC
November 15, 2023
Appendix I

U.S. Small Business Administration

Material Weaknesses

The following deficiencies are considered to be material weaknesses in internal controls over financial
reporting.

1. Controls over Paycheck Protection Program (PPP) Loan Guarantees Need Improvement

2. Controls over Coronavirus Disease 2019 (COVID-19) Economic Injury Disaster Loans (EIDLs)
Need Improvement

3. Controls over Monitoring of Restaurant Revitalization Fund (RRF) and Shuttered Venues
Operators Grant (SVOG) Programs Need Improvement

4. Controls over Financial Reporting for Programs Funded by CARES Act and Related Legislation
Need Improvement

5. Controls over the Evaluation of Service Organizations Need Improvement

6. Entity Level Controls Need Improvement

Background
The PPP, COVID-19 EIDLs, RRF, and SVOG programs were authorized and funded by the Coronavirus Aid,
Relief, and Economic Security Act of 2020, the Paycheck Protection Program and Health Care Enhancement
Act, the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act, and the American Rescue
Plan Act. The referenced laws are collectively referred to as the CARES Act and related legislation. The
CARES Act and related legislation were passed by Congress to provide emergency assistance in response to
the extensive effects of the public health and economic crisis arising from the COVID-19 pandemic. The PPP,
COVID-19 EIDLs, RRF, and SVOG programs affect a substantial proportion of the consolidated financial
statements.

1. Controls over PPP Loan Guarantees Need Improvement

A. Reporting of PPP Loan Guarantees

As part of the PPP, lenders must report on the status of PPP loans using the lender loan status reports on a
monthly basis. The SBA updates the outstanding principal balances and ultimately the Loan Guarantee
Liabilities and related accounting entries based on the submitted lender reports.

Management did not have adequate processes and controls in place to determine the status of PPP loan
guarantees based on the lender loan status reports that were not submitted, submitted incorrectly, or submitted
but not processed and evaluated by SBA for the majority of the fiscal year 2023. Also, management did not
design and implement effective controls to ensure that the population of active PPP loan guarantees reviewed
by management for status determination was complete and accurate.

Management did not implement controls to identify and resolve variances between SBA’s and the lenders’
records for 6 of 28 PPP loan guarantees samples tested. In addition, management flagged PPP loan
guarantees that had eligibility concerns as part of their review process and did not have controls to support the
existence and accuracy for 11 of 28 samples tested due to unresolved eligibility concerns as of September 30,
2023.
These deficiencies were caused by insufficient risk assessment and monitoring controls over the follow-up
process for lender loan status reports. Also, management did not design and implement an effective process of
accountability over the lenders that were not submitting loan status reports timely or accurately. Further, the
automated system control used to reduce the outstanding principal balance for loan guarantees that received
partial forgiveness payments is not designed and implemented effectively to prevent errors.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• Government Accountability Office’s (GAO’s) Standards for Internal Control in the Federal Government
(Green Book), Principle 7, Identify, Analyze, and Respond to Risks; Principle 10, Design Control
Activities;

• Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for
Enterprise Risk Management and Internal Control

The deficiencies described above may result in material misstatements to the Loan Guarantee Liabilities,
Downward Reestimate Payable to Treasury line items and related elements in the consolidated financial
statements.

Recommendations – Reporting of PPP Loan Guarantees

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

1. Design and implement controls to ensure the population used in the review and follow-up of
nonreporting loan status reports or loan status reports with errors is complete and accurate.

2. Determine enforceable actions and controls to hold lenders accountable for submitting loan status
reports timely and correctly.

3. Assess the sufficiency of implemented controls to monitor incomplete or inaccurate PPP lender loan
status reports on an ongoing basis, including the identification and resolution of the root causes of
reporting noncompliance.

4. Design and implement an automated system control to accurately reduce the outstanding principal
balance after the processing of all forgiveness payments.

B. Forgiveness Review of PPP Loan Guarantees

The PPP program terms, authorized by the CARES Act and related legislation, permitted for the forgiveness of
PPP loan guarantees if the borrower met the forgiveness criteria. To request forgiveness, borrowers submit the
forgiveness application to the lenders for approval. The lenders will subsequently notify SBA of their
forgiveness decision and submit the request to SBA.

Management did not design and implement adequate monitoring controls over the work performed by a
contractor and the use of its case management system to ensure that the population of PPP loan guarantees
identified with eligibility flags was complete and accurate and ultimately determine their eligibility for
forgiveness. Moreover, management did not provide sufficient evidence to demonstrate that an effective control
environment existed when the case management system was used to perform the automated screening of the
PPP loan guarantees. Management did not effectively perform independent review controls to determine
whether the results of the contractor’s screening process of certain loan guarantees were effective and
accurate. These loan guarantees included those with no flags identified for eligibility concerns, or those that
had flags identified for eligibility concerns but were not reviewed further based on management’s policy
decision.
Management did not design and implement an effective review and monitoring process for the 2021 cohort of
PPP loan guarantees, which comprises the majority of the outstanding principal balance of PPP loan
guarantees as of September 30, 2023. While the case management system contains a comprehensive series
of validation checks to identify potential noncompliance with PPP loan guarantee program eligibility
requirements, management communicated that the case management system performed only a limited number
of validation checks against program eligibility requirements for the 2021 cohort of PPP loan guarantees.
Further, management did not implement a sufficient monitoring process to ensure that lenders followed
established procedures and adequately resolved the eligibility concerns identified by the case management
system’s limited automated screening.

Management did not design and implement effective controls to determine the accuracy and completeness for
their sample of PPP loan guarantee forgiveness transactions. Management’s review of the sample from the
largest subset of PPP loan forgiveness transactions did not address the eligibility for forgiveness and the
accuracy of the approved loan guarantee and forgiveness amounts. In addition, management’s review process
did not consider a follow-up requirement when a difference exists for each sample’s loan approval amount and
the loan forgiveness amount within an acceptable variance threshold. Instead, management’s review process
allowed for a variance threshold between the calculated loan guarantee approval amount as compared to the
actual approved loan guarantee amount. Similarly, management’s review process allowed for a variance
threshold between the calculated loan forgiveness amount and requested loan forgiveness amount. As a result,
management’s sample review process was not properly designed to sufficiently evaluate and quantify the
magnitude of the actual error amounts for the loan guarantee approval and loan guarantee forgiveness
variances.

Management did not adequately design and implement the post payment review control to determine the
appropriate status and financial reporting impacts of PPP loan guarantees forgiven as of the end of the fiscal
year. Also, management’s process and related control activities for funds recovery of PPP loan guarantees that
were erroneously forgiven was not documented.

These deficiencies were caused by management’s reliance on the contractor’s automated and manual loan
review processes without adequate monitoring controls to evaluate and assess the work product. Further, there
was reliance placed on the lenders’ self-certifications prior to the approval of the 2021 cohort of PPP loan
guarantees without adequate monitoring controls. In addition, management did not perform an adequate risk
assessment process to identify and mitigate relevant risks and design appropriate controls to ensure a
complete and accurate portfolio of PPP loan guarantees that were disbursed to eligible recipients.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6, Define
Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks; Principle 10,
Design Control Activities; and Principle 16, Perform Monitoring Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above may result in a material misstatement to the Loan Guarantee Liabilities and
Downward Reestimate Payable to Treasury line items, and the related elements in the consolidated financial
statements.
Recommendations – Forgiveness Review of PPP Loan Guarantees

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

5. Perform a thorough review of the outstanding PPP loan guarantees and determine the impact on the
outstanding guarantee and eligibility for forgiveness of loans determined to not be in conformance with
the related legislation and program’s terms.

6. Design, implement, and document an effective PPP forgiveness review process for loan guarantees
that were forgiven that addresses both the eligibility and the accuracy of the loan approval and
forgiveness amounts.

7. Design and implement an effective funds recovery plan to ensure PPP funds disbursed on behalf of
ineligible recipients are recovered and reported accurately in a timely manner. The plan should include
an effective process to provide the information necessary to the Office of Performance, Planning, and
the Chief Financial Officer to record any required accounting adjustments.

C. Purchases of PPP Loan Guarantees

The PPP program terms, authorized by the CARES Act and related legislation, fully guaranteed the PPP loans
disbursed by lenders on behalf of the SBA. Lenders are required to service the PPP loans and continue to
report on their status on a monthly basis until the loan is fully forgiven, repaid, or the borrower defaults. In the
event of default, the lender may request that SBA honor its full guarantee and purchase the loan.

Management did not adequately design and implement controls to ensure that purchase requests of PPP loan
guarantees were appropriately reviewed to verify that requesting lenders met the program requirements prior to
approving and disbursing the original loan.

The PPP loan guarantee purchases review process relied on the identification of flags by the case
management system indicating that the lender may not have fulfilled the program requirements. Management
did not design and implement adequate controls to ensure the completeness and accuracy of flags identified
and resolved. In addition, management added additional flags that would require a manual purchase review at
various stages of the program. However, management did not retroactively review PPP loan guarantee
purchase requests that were previously automatically approved that subsequently required a manual review.

The PPP loan guarantee purchases review process documentation did not consider all guidance issued to
lenders as part of the origination process when determining the subset of flags that would require a manual
purchase review. Specifically, SBA did not include adequate evaluation of flags communicated to lenders in the
procedural notices related to the cohort 2021 loan approval requirements.

These deficiencies were caused by an inadequate risk assessment performed to ensure sufficient controls
were designed and implemented for the review of PPP loan guarantee purchase transactions.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

8. Perform a thorough and complete analysis of all requirements communicated to lenders for the PPP
program and determine how to evaluate whether lenders met the requirements prior to disbursing a
PPP loan. The analysis should include evidence to support the adequacy of SBA’s review process
when determining which purchase requests will require additional review.

9. Develop and implement an effective process to review purchase requests for outstanding PPP loan
guarantees and for loans that have already been purchased that addresses whether the lender met
their requirements in accordance with the program requirements.

10. Develop and implement an effective funds recovery plan to ensure funds related to PPP purchases
disbursed to ineligible recipients are recovered and reported accurately in a timely manner. The plan
should include an effective process to provide the information necessary to the Office of Performance,
Planning, and the Chief Financial Officer to record any required accounting adjustments.

2. Controls over COVID-19 EIDLs Need Improvement

COVID-19 EIDLs were approved in fiscal years 2020 through 2022 and have a 30-year term. Payments on
COVID-19 EIDLs were deferred by the SBA for up to 30 months after loan disbursement. The payment deferral
period ended for a significant number of COVID-19 EIDLs during fiscal year 2023.

Management did not design and implement adequate monitoring controls over the COVID-19 EIDLs portfolio to
ensure reliable financial reporting as of the end of the fiscal year. Management’s review was not appropriately
designed to identify a complete and accurate COVID-19 EIDLs population of outstanding loans disbursed to
eligible recipients. The review process relied on hold codes in the SBA’s loan repository system to identify the
COVID-19 EIDLs with eligibility concerns. However, management was not able to provide evidence of the
completeness and accuracy of the population of loans with hold codes as of the end of the fiscal year.

Management’s review controls over loans with existing hold codes were not properly designed. The review did
not contain sufficient evidence about the identification, research, and resolution of hold codes to support
management’s reliance for financial reporting purposes as of the end of the fiscal year. Management did not
identify and research COVID-19 EIDLs with unresolved hold codes for loans charged-off, in deferment,
repayment, and delinquent stages as of the end of the fiscal year.

Management did not fully design and implement effective controls over their charge-off process for non-
performing COVID-19 EIDLs. The non-performing loans are those that are 90 days or more past due.
Management implemented a process to automatically charge-off non-performing COVID-19 EIDLs that have an
original loan balance of $200,000 or less without any unresolved hold codes. These loans subject to automated
charge-off are significant to the COVID-19 EIDLs portfolio, were not reviewed, did not have justification to
support the charge-off decision, and were not assessed for recoverability. In addition, management’s charge-off
process was primarily based on the number of days past due without sufficient regard to the recoverability of
the loan. Thus, management’s controls were not appropriately designed to identify the root cause of the
delinquency of the charged-off COVID-19 EIDLs.
These deficiencies were caused by an inadequate risk assessment process to identify and mitigate relevant
risks and design appropriate controls to ensure a complete and accurate population of COVID-19 EIDLs that
were disbursed to eligible recipients. In addition, management implemented a policy that was not adequately
supported because the review of the COVID-19 EIDLs portfolio was incomplete. Therefore, the information
used by management to make an informed charge-off policy decision was not relevant and reliable. In addition,
management’s risk assessment process did not adequately consider the accounting and financial reporting
implications of charging off a loan without assessing the impact of the likelihood of recovery.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6, Define
Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks; Principle 9,
Identify, Analyze, and Respond to Change; and Principle 10, Design Control Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above may result in a material misstatement of the Credit Program Receivables and
Related Foreclosed Property, Net and Downward Reestimate Payable to Treasury line items, and related
elements in the consolidated financial statements.

Recommendations – Controls over COVID-19 EIDLs Need Improvement

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

11. Perform and update the program’s internal control risk assessment to identify changes to risks that may
require the design and implementation of effective monitoring controls over the review of the COVID-19
EIDLs portfolio.

12. Design and implement an effective funds recovery plan to ensure COVID-19 EIDLs funds disbursed to
ineligible recipients are recovered and reported accurately and in a timely manner. The plan should
include an effective process to provide the information necessary to the Office of Planning,
Performance, and the Chief Financial Officer to record any required accounting adjustments.

13. Reevaluate the appropriateness and update SBA’s existing policies and procedures to ensure they are
supported by quality information stemming from effective control activities. This includes assessing the
recoverability of COVID-19 EIDLs prior to charge-off. Perform a regular review of implemented policies
to ensure they are responding to relevant risks.

3. Controls over Monitoring of RRF and SVOG Programs Need Improvement

A. Monitoring of RRF Awards

The period to use RRF awards for eligible purposes expired on March 11, 2023. Management’s process relies
on award recipients to submit Post Award Reports by April 30, 2023, to disclose the amount of the award used
on eligible purposes prior to expiration. If any amount of the award was not used for eligible purposes before
expiration, the unused funds must be returned to SBA.

Management did not design and implement the appropriate monitoring controls over RRF awards to ensure
that the funds were used in accordance with the CARES Act and related legislation and accurate financial
reporting as of the end of the fiscal year. Specifically, a Post Award Report was not submitted for a significant
number of awards as of September 30, 2023. While management performed follow-up procedures to ensure
the outstanding Post Award Reports were submitted by the remaining recipients, the procedures were not
substantial enough to support the completeness and accuracy of financial reporting as of the end of the fiscal
year. Management selected a sample of RRF awards for review to determine the accuracy of submitted Post
Award Reports. However, management did not initiate or fully complete reviews for a significant number of
samples to ensure accurate financial reporting as of the end of the fiscal year. Further, management’s process
for funds recovery was not fully implemented for RRF awards that had eligibility concerns.

These deficiencies were caused by an inadequate risk assessment process to identify and mitigate relevant
risks and design appropriate controls to ensure funds were spent on eligible expenses to be relied upon for
financial reporting.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 10, Design Control Activities; Principle 12, Implement Control Activities;
and Principle 13, Use Quality Information

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above may result in a material misstatement to the Other than Intragovernmental
Accounts Receivable, Net, line item and the related elements in the consolidated financial statements.

Recommendations – Monitoring of RRF Awards

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

14. Perform and update the program’s internal control assessment to identify changes to risks that may
require the design and implementation of effective monitoring controls and review processes of RRF
awards to identify recipients that may not have been eligible to receive awards or that may have spent
awards on ineligible expenses in accordance with the program’s terms.

15. Design and implement effective follow-up procedures for RRF award recipients that are not complying
with the program’s terms and to ensure complete, accurate, and timely reporting for the use of the
award.

16. Design and implement an effective funds recovery plan and controls to ensure RRF awards disbursed
to ineligible recipients or spent on ineligible expenses are recovered and reported accurately and in a
timely manner. In conjunction with the Office of Planning, Performance, and the Chief Financial Officer,
design and implement an effective process to provide the information necessary to record any required
accounting adjustments.

B. Monitoring of SVOG Awards

The period to use SVOG funds for eligible purposes expired for a majority of SVOG awards as of
September 30, 2023. Management’s process relies on award recipients to submit an Expense Report and
Standard Form (SF) 425, Federal Financial Report, to disclose the amount of the award used for eligible
purposes prior to expiration. If any amount of the award was not used for eligible purposes before expiration,
the unused funds must be returned to SBA.

Management did not design and implement appropriate monitoring controls over SVOG awards to ensure that
the funds were used in accordance with the CARES Act and related legislation and accurate financial reporting
as of the end of the fiscal year. Specifically, as of September 30, 2023, an Expense Report or SF-425 was not
submitted for a significant number of awards. In addition, management selected samples of SVOG awards to
review the accuracy of report submissions and eligibility of award recipients. However, management did not
initiate or fully complete the sample reviews for a significant number of samples. Thus, management’s sample
review process is not adequately designed and implemented to ensure accurate financial reporting as of the
end of the fiscal year.
Management’s process for funds recovery was not fully implemented for SVOG awards that had identified
eligibility concerns. Additionally, management’s process to review the recipients’ single audit reports was not
fully implemented by the end of the fiscal year. Therefore, management could not determine the impact of
potential control and compliance deficiencies noted in the single audit reports over the use of SVOG awards.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 10, Design Control Activities; Principle 12, Implement Control Activities;
and Principle 13, Use Quality Information

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

Recommendations – Monitoring of SVOG Awards

We recommend the Administrator coordinate with the Associate Administrator for the Office of Disaster
Recovery and Resilience to:

17. Perform and update the program’s internal control assessment to identify changes to risks that may
require the design and implementation of effective monitoring controls and review processes of SVOG
awards to identify recipients that may not have been eligible to receive awards or that may have spent
awards on ineligible expenses in accordance with the program’s terms.

18. Design and implement effective follow-up procedures for SVOG award recipients that are not
complying with the program’s terms and to ensure complete, accurate, and timely reporting for the use
of the award.

19. Design and implement an effective funds recovery plan and controls to ensure SVOG awards
disbursed to ineligible recipients or spent on ineligible expenses are recovered and reported accurately
and in a timely manner. In conjunction with the Office of Planning, Performance, and the Chief
Financial Officer, design and implement an effective process to provide the information necessary to
record any required accounting adjustments.

4. Controls over Financial Reporting for Programs Funded by CARES Act and Related Legislation
Need Improvement

A. Accounting for Funds Recovery

The PPP, COVID-19 EIDLs, RRF, and SVOG programs affect a significant portion of SBA’s consolidated
financial statements. As these programs are either in the servicing or post payment review phases, SBA began
the process to recover funds or identify funds that need to be recovered.
Management did not adequately design and implement controls to account for the recovery of funds related to
these programs. Management did not provide evidence of documented policies and procedures for the
recovery of funds related to the RRF and SVOG programs and the recording of activities associated with the
related accounts receivable, and the allowance for estimated uncollectible amounts. For example, management
was not able to demonstrate the application of the accounts receivable recognition criteria for the determination
of a claim to cash or other assets due to recovery of funds for each program. Also, management did not have
adequate documentation about the estimation methodology used to determine the accounts receivables and
the related allowance for estimated uncollectible amounts. Finally, management did not have adequate
documentation about the financial reporting considerations related to the recovery of funds for the RRF and
SVOG programs including the respective accounting entries.

Management did not provide sufficient evidence of documented accounting policies for the recovery of funds
related to the COVID-19 EIDLs and PPP loan programs. Further, management did not have adequate
documentation about the appropriate accounting treatment and the respective accounting entries throughout
each step of the recovery life cycle in accordance with generally accepted accounting principles.

These deficiencies were caused by an inadequate risk assessment to identify and mitigate relevant financial
reporting risks. Also, management did not develop the appropriate policies and procedures for considerations
related to the recovery of funds through the applicable programs’ lifecycle including the servicing and post
payment review phases.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies identified above may result in a material misstatement to the Other than Intragovernmental
Accounts Receivable, Net, Credit Program Receivables and Related Foreclosed Property, Net, and Downward
Reestimate Payable to Treasury line items, and related elements in the consolidated financial statements.

Recommendations – Accounting for Funds Recovery

We recommend the Administrator coordinate with the Chief Financial Officer to:

20. Develop and document the policies and procedures for the recovery of funds, the accounts receivable,
and the allowance for estimated uncollectible amounts related to the programs created or expanded by
the CARES Act and related legislation.

21. Document the current state of accounting policies and procedures for the recovery of funds, including
the respective accounting entries for all applicable scenarios (e.g., fraud related, ineligibility) for
COVID-19 EIDLs and PPP loans that have been charged-off or forgiven.

22. Inquire with standard setting bodies to confirm the appropriate accounting treatment throughout each
step of the recovery lifecycle for COVID-19 EIDLs and the PPP loans that have been charged-off or
forgiven. Memorialize the response by updating management’s documented policies and procedures
including the respective accounting entries under generally accepted accounting principles for all
applicable scenarios.

23. Design and implement effective controls and communication processes to timely obtain the information
necessary from program offices to record any required accounting adjustments for programs created or
expanded by the CARES Act and related legislation.
B. Subsidy Reestimate

Statement of Federal Financial Accounting Standards Number 2, Accounting for Direct Loans and Loan
Guarantees, requires that direct loans and loan guarantees committed after September 30, 1991, be recorded
on a present value basis consistent with the intent of the Federal Credit Reform Act of 1990. As such, SBA
developed an estimation methodology to reestimate the future net cash inflows and outflows for the COVID-19
EIDLs and PPP loan portfolios as of the end of the fiscal year.

Management did not design and implement adequate controls over the review of the data inputs used in the
PPP subsidy reestimate. Specifically, management did not adequately design and implement controls to ensure
the data inputs used in the PPP subsidy reestimate methodology that are derived from the lender loan status
reporting, and the forgiveness and purchases processes, are complete and accurate. Therefore, management
did not have sufficient controls in place to ensure the development of significant assumptions in the
methodology were appropriate.

Management did not adequately design and implement controls to ensure the assumptions used in the subsidy
reestimate for the COVID-19 EIDLs were appropriate with their risks. Management’s review was not
appropriately designed to identify a complete and accurate COVID-19 EIDLs population of outstanding loans
disbursed to eligible recipients. Management’s review was still in process as of the end of the fiscal year and
management did not sufficiently document an assessment to demonstrate that the assumptions applied are
appropriate for the COVID-19 EIDLs in the portfolio based on their specific risk characteristics.

Further, the loan-level projection datasets included projected cash flows for COVID-19 EIDLs that were
charged-off without an outstanding loan receivable balance as of September 30, 2023. The projected cash
flows for these charged-off loans inappropriately affected the allowance for subsidy balances without the
related recognition of the gross loans receivable.

These deficiencies were caused by an inadequate entity wide control environment related to the design,
implementation, and operating effectiveness of controls related to the review of the loan portfolio at a precision
level necessary to ensure the data inputs used for the reestimate models are complete and accurate. In
addition, the deficiencies were caused by the implementation and development of subsidy reestimate models
for new programs that do not have a significant volume of historical data or precedence and inadequately
designed and implemented controls to ensure the reestimate output complied with the applicable accounting
standards related to charged-off loans.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 10, Design Control Activities; and Principle 13, Use Quality Information

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above may result in a material misstatement to the Credit Program Receivables and
Related Foreclosed Property (Net), Downward Reestimate Payable to Treasury, and Loan Guarantee Liabilities
line items, and the related elements in the consolidated financial statements.

Recommendations – Subsidy Reestimate

We recommend the Administrator coordinate with the Chief Financial Officer to:

24. Continue implementing controls in collaboration with relevant program offices for the PPP and COVID-
19 EIDLs portfolios to accumulate relevant, complete, and accurate data on which to base the subsidy
reestimate.

25. Design and implement adequate review and approval controls over the reestimate for the PPP and
COVID-19 EIDLs portfolios by appropriate levels of management, and to coordinate with relevant
program offices to assess the integrity of relevant data inputs used in the development of assumptions,
and reasonableness for the selected assumptions used and the resulting estimates.

26. Refine existing review and approval controls to ensure the reestimate output is in accordance with
accounting standards for charged-off loans.

5. Controls over the Evaluation of Service Organizations Need Improvement

A. Service Organizations Used for Loan Guarantee Programs

Management did not obtain reasonable assurance on the operating effectiveness of internal controls in multiple
service organizations’ control environments relevant to the 7(a) loan guarantee program fiscal transfer agent,
the financial service providers for the 7(a) and 504 loan guarantee programs, and the PPP forgiveness and
purchases platform. With regards to the financial service providers for the 7(a) and 504 loan guarantee
programs, the relevant control environments include the facilitation, maintenance, and reporting of the account
balances for the respective secondary market programs. With regards to the PPP forgiveness and purchases
platform, the relevant control environment includes the operation of the PPP loan forgiveness and PPP loan
purchase modules, the data transmissions over the internet between the relevant modules and SBA systems
used in the configured checks, the cloud-based infrastructure hosting provider, and the application controls
within the application intake platform.

In addition, management did not provide evidence of adequate monitoring activities performed over the relevant
internal control environments at the respective service organizations and subservice organizations, such as
obtaining and reviewing an attestation report on the design, implementation, and operating effectiveness of
controls at the service organization.

Management did not have adequate evidence that complementary user entity controls identified in the service
organization control (SOC) 1 Type 2 reports obtained for the 504 loan guarantee program central servicing
agent and the financial service provider were designed, implemented, and operating effectively. Specifically,
management’s review of complementary user entity controls indicated that controls were in process of being
identified as of the end of the fiscal year. Management’s assessment of internal controls over financial reporting
is not complete without the sufficient consideration of existing and non-existing controls at relevant service
organizations and the effectiveness of those controls.

These deficiencies identified above were caused by inadequate monitoring controls over the relevant service
organizations for their assigned internal control responsibilities to obtain reasonable assurance on the operating
effectiveness of internal controls in the service organizations’ control environments.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Section 4, Additional Considerations: Service Organizations; Principle 5, Enforce
Accountability; Principle 10, Design Control Activities; and Principle 16, Perform Monitoring Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above prevent SBA from obtaining an understanding of relevant service
organization controls and their operating effectiveness to identify all relevant control gaps and deficiencies that
require a complementary user control to mitigate the risk of error to the Loan Guarantee Liabilities line item and
related elements in the consolidated financial statements.
Recommendations – Service Organizations Used for Loan Guarantee Programs

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

27. Continually evaluate the established policy for SOC 1 reports that requires service organizations to
provide a SOC 1 report over the control environment that is relevant and significant to the processing
and recording of SBA’s transactions as it relates to loan guarantee programs. If a SOC 1 report cannot
be obtained, management should design, implement, and operate controls within SBA’s control
environment.

28. Assess the risk posed by the service organizations’ control environments and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine the
integrity of loan guarantee programs transactions processed on behalf of and recorded by SBA. To
achieve this, consider obtaining a SOC 1 report for the relevant control environments at the service
organizations, and perform and document the following:

• SOC 1 report is sufficiently scoped to cover transaction processing and related control activities
performed by the service organizations on behalf of SBA.

• All exceptions noted in the SOC 1 report – not just those described in the independent service
auditor’s report – are evaluated to determine applicability to SBA’s internal controls over financial
reporting, the potential impact to SBA’s financial statements, and mitigating controls considerations
made during their risk assessment.

• All complementary user entity controls described in the SOC 1 reports are evaluated using current
information and with consideration to their applicability to SBA’s internal controls over financial
reporting.

• Evaluation procedures performed to assess whether complementary user entity controls and other
SBA-performed controls were tested on a frequency determined by SBA and found operating
effectively and, if they are not, assess the impact of such deficiencies on SBA’s internal controls
over financial reporting.

• All complementary subservice organization controls described in SOC 1 reports are evaluated to
determine whether they provided services and performed controls considered relevant to SBA’s
internal controls over financial reporting and, if relevant subservice organizations were identified,
an evaluation is performed to obtain an understanding of the subservice organization(s) and their
controls.

• SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.

B. Service Organization Used for the SVOG Program

Management did not obtain reasonable assurance on the operating effectiveness of internal controls in the
service organization’s control environments relevant to the external cloud service provider used for the SVOG
platform in monitoring the status of awards.

Management did not obtain and review the SOC 1 report for the service provider in a timely manner as of fiscal
year-end. Additionally, management did not provide evidence of adequate monitoring activities performed over
the relevant internal control environment at the respective subservice organizations identified in the SOC 1
report for an earlier period in the fiscal year. Further, management did not provide evidence of adequate
evaluation of the control exceptions identified in the SOC 1 report and the impact to SBA’s internal controls
over financial reporting. Management’s assessment of internal controls over financial reporting is not complete
because it did not fully consider the existing and non-existing controls at relevant service and subservice
organizations and the effectiveness of those controls.

These deficiencies were caused by management not implementing effective monitoring of the effectiveness of
internal control over the assigned processes performed by the relevant service organization.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above prevented SBA from obtaining an understanding of relevant service
organization controls and their operating effectiveness to identify all relevant control gaps and deficiencies that
require a complementary user control to mitigate the risk of error to the Other than Intragovernmental Accounts
Receivable, Net line item and related elements in the consolidated financial statements.

Recommendations – Service Organizations Used for the SVOG Program

We recommend the Administrator coordinate with the Associate Administrator for the Office of Disaster
Recovery and Resilience to:

29. Continually evaluate the established policy for SOC 1 reports that requires service organizations to
provide a SOC 1 report over the control environment that is relevant and significant to the processing
and recording of SBA’s transactions as it relates to the SVOG program. If a SOC 1 report cannot be
obtained, management should design, implement, and operate controls within SBA’s control
environment.

30. Assess the risk posed by the service organizations’ control environments and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine the
integrity of SVOG program transactions processed on behalf of and recorded by SBA. To achieve this,
consider obtaining a SOC 1 report for the relevant control environments at the service organizations,
and perform and document the following:

• SOC 1 report is sufficiently scoped to cover transaction processing and related control activities
performed by the service organizations on behalf of SBA.

• SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.

6. Entity Level Controls Need Improvement

Management faced challenges in maintaining an adequate entity level controls system that produces reliable
and accurate financial reporting. The significance of the internal control matters indicated weaknesses across
several entity level control categories. The following conditions were identified.

A. Control Environment and Risk Assessment

Management did not establish an effective control environment and did not perform effective risk assessment
processes. The following deficiencies were identified across the SBA:

• The materiality threshold developed and documented was not adequately considered and applied by
program offices when key decisions regarding controls and review processes were implemented. The
controls within the relevant offices were not designed, implemented, and operating effectively to a
sufficient precision level to ensure the reporting objective of preparing the financial statements free of
material misstatement could be achieved. For example, the COVID-19 EIDLs and PPP loan review
processes were not designed to ensure the reviews performed were to a sufficient level of precision to
ensure the related balances were free of material misstatement. Management implemented a policy in
fiscal year 2022 to automatically charge-off non-performing COVID-19 EIDLs with an original loan
balance of $200,000 or less that do not have eligibility concerns without further review. However,
management did not reassess this policy in fiscal year 2023 given relevant risks and materiality
thresholds to ensure the review controls over COVID-19 EIDL charge-offs were operating effectively to
a sufficient precision level.

• Management did not complete the planned risk assessments for material programs, including COVID-
19 EIDLs, PPP, COVID-19 EIDL grants, and Debt Relief Program payments in fiscal year 2023.

• Management did not implement adequate risk assessment processes to identify, analyze, and respond
to relevant risks. For example, management did not adequately respond to the increased risk of
noncompliance due to the significant volume of COVID-19 EIDLs going into servicing phase beginning
in fiscal year 2023.

B. Monitoring

Management did not design and implement effective monitoring processes. SBA did not have adequate or
effective monitoring controls related to:

• PPP lenders.

• Internal control over processes performed by service organizations.

• RRF and SVOG program award recipients.

• The COVID-19 EIDLs portfolio to identify a complete and accurate population of loans disbursed to
eligible recipients for financial reporting purposes as of fiscal year-end.

These deficiencies were caused by the prioritization of the continued execution and servicing of the CARES Act
and related legislation programs over internal control processes and related remediation of prior year control
deficiencies. In addition, these deficiencies were caused by the lack of dedicated staff to perform an adequate
risk assessment, appropriately remediate prior year control deficiencies, implement, and monitor the operating
effectiveness of controls, and operationally service large-scale programs effectively.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 6, Define Objectives and Risk Tolerances; Principle 7, Identify, Analyze,
and Respond to Risks; Principle 9, Identify, Analyze, and Respond to Change; Principle 10, Design
Control Activities; Principle 12, Implement Control Activities; Principle 16, Perform Monitoring Activities;
Principle 17, Evaluate Issues and Remediate Deficiencies

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

As a result of the deficiencies described above, we noted that without the proper level of entity level controls in
place and operating effectively, there is an increased risk that a material misstatement in the consolidated
financial statements, and noncompliance with the relevant laws and regulations would neither be prevented or
detected and corrected in a timely manner.

Recommendations – Entity Level Controls Need Improvement

We recommend that the Administrator coordinate with the Acting Associate Administrator of the Office of
Capital Access and the Associate Administrator of the Office of Disaster Recovery and Resilience to:

31. In conjunction with the Office of the Chief Financial Officer, complete the internal control risk
assessments for programs that have a material impact on the financial statements at a process level in
a timely manner including the consideration of whether controls are designed, implemented, and are
operating at a sufficient precision level in accordance with management’s materiality threshold and will
be sufficient for financial reporting purposes.

32. Design, implement, and monitor the operating effectiveness of key controls that respond to significant
risks of material misstatements and compliance with relevant laws and regulations.

We recommend that the Administrator coordinate with the Chief Financial Officer to:

33. Perform and document a thorough risk assessment at the financial statement assertion level to identify
process level risks and communicate the results to relevant program offices. Also, assess the
effectiveness of the key process level controls to respond to the identified risks in conjunction with
relevant program offices.
Appendix II

U.S. Small Business Administration

Significant Deficiencies

The following deficiencies are considered to be significant deficiencies in internal controls over financial
reporting.

1. Controls over Payments for Covered Loans under the Debt Relief Program Need Improvement

2. Controls over General Information Technology Need Improvement

3. Controls over Subsequent Events Need Improvement

1. Controls over Payments for Covered Loans under the Debt Relief Program Need Improvement

The CARES Act and related legislation authorized the Debt Relief Program that allowed SBA to make
payments on behalf of certain loans in the 7(a) and 504 loan guarantee programs and the Microloan program.

Management did not design and implement effective controls over the Debt Relief Program post payment
review process. Management used a contractor to develop and perform a risk-based methodology to identify
the payments for covered loans that may have a higher risk for overpayments and would require further review.
However, management did not provide documentation evidencing adequate monitoring controls over the
methodology produced by the contractor. Specifically, management did not provide evidence of an effective
review over the accuracy of the inputs, appropriateness of significant assumptions, and the application of the
methodology.

Further, management did not provide evidence of an effective review of the other alternative methodologies
considered and a documented approved basis for the selected risk-based methodology. In addition,
management did not provide documentation evidencing a risk assessment for the impact of the payments that
were not considered, determined to be of lower risk, and the application of variance thresholds. Despite the
high rate of false positive loan payments that were identified for review by the methodology, management did
not provide documentation considering whether the applied methodology was still appropriate.

These deficiencies were caused by management’s reliance on the contractor’s work product without adequate
monitoring controls. Also, management’s lack of an adequate risk assessment process to identify and mitigate
relevant risks and design appropriate controls to ensure an effective post payment review of payments for
covered loans under the Debt Relief Program caused the deficiency identified above.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 6, Define
Objectives and Risk Tolerances; Principle 10, Design Control Activities; and Principle 16, Perform
Monitoring Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiencies described above may result in misstatements of the Loan Guarantee Liabilities line item and
related elements in the consolidated financial statements.
Recommendations – Payments for Covered Loans under the Debt Relief Program

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

34. Design and implement controls that demonstrate oversight over the contractor, including
documentation that provides evidence over the adequate review and validation of the contractor’s work
product.

35. Perform and document a thorough risk assessment of the payments for covered loans under the Debt
Relief Program, including the impact of payments not considered, determined to be of lower risk, for
which a variance threshold was applied, and the appropriateness and sufficiency of the applied
methodology given the results of the review.

36. Based on the results of the risk assessment performed, design and implement appropriate controls to
ensure an effective post payment review of payments for covered loans under the Debt Relief Program.

2. Controls over General Information Technology Need Improvement

Management had control deficiencies that limited SBA’s ability to effectively manage its information system
risks. Collectively, these conditions increase the risk of unauthorized use, modification, or destruction of
financial data, which may impact the integrity of information used to prepare the financial statements. In the
sections below, we have omitted some technical details from the conditions and recommendations due to the
sensitivity of the information. These details were communicated to management in notices of findings and
recommendations.

The following criteria were considered with respect to the matters described in the following paragraphs:

• GAO’s Green Book, Principle 7, Identify, Analyze, and Respond to Risks; Principle 10, Design Control
Activities; Principle 11, Design Activities for the Information System; and Principle 12, Implement
Control Activities

• National Institute of Standards and Technology Special Publication 800-53, Revision 5, Security and
Privacy Controls for Federal Information Systems and Organizations

We have summarized the information technology control deficiencies by the following general information
technology control objectives: logical access controls and system configuration management.

Logical Access Controls
Management did not have adequate controls designed, implemented, and operating effectively for the timely
removal of access to SBA systems for separated employees and contractors. In addition, management did not
consistently implement recertification and authentication controls to the network and applications.

These deficiencies were caused by the lack of a policy defining an overall timeframe for the removal of access
following separation, an improper reliance of separated personnel reports, lack of effective monitoring of job
processing failures, lack of enforcement of authentication controls, and an inadequate risk assessment process
to identify and mitigate the risk of inappropriate access.

The deficiencies described above increases the risk that unauthorized users may retain access to the system
resulting in unauthorized modification, destruction, or exposure to SBA systems and data.
Recommendations – Logical Access Controls

We recommend the Administrator coordinate with the Acting Chief Information Officer to:

37. Review and update current processes and procedures for defining a time period by which system
access must be disabled or removed for separated individuals.

38. Develop procedures to validate that access for separated employees is removed in accordance with
required timeframes.

39. Develop procedures to validate that access for separated contractors is removed in accordance with
required timeframes.

40. Design, implement, and document controls for monitoring job failures to ensure complete and accurate
reports are generated.

41. Design and implement multi-factor authentication controls for non-privileged users.

42. Implement monitoring controls to track compliance with the multi-factor authentication controls.

We recommend the Administrator coordinate with the Chief Financial Officer to:

43. Design and implement controls to validate that access for separated employees is removed in
accordance with required timeframes.

44. Develop, design, and implement controls for access recertification for accounts with administrative or
privileged roles annually.

45. Perform a risk assessment and obtain an approved waiver in accordance with established policy of not
updating authentication controls due to system limitations. Design and implement relevant
compensatory controls if necessary.

System Configuration Management
The general ledger system was not properly configured to retain the actual preparer of a manually uploaded
journal entry. Once the manually uploaded journal entry transaction is approved and posted, the transaction
history is modified, and the preparer’s name is replaced with a generic system name.

The deficiency was caused by an information system not designed to obtain and process information to meet
each operational process’ information requirements and respond to the entity’s objectives and risks.

Without capturing auditable application system events, the risk increases that unauthorized or inappropriate
access and actions could occur. Such actions could negatively affect the completeness, accuracy, and
availability of the system and its data.

Recommendations – System Configuration Management

46. We recommend the Administrator coordinate with the Chief Financial Officer to make the necessary
adjustments to system configurations to ensure a complete record of the journal entry process is
maintained, including the actual user identification of the preparer, for all journal entry transactions.
3. Controls over Subsequent Events Need Improvement

Statement of Federal Financial Accounting Standards Number 39, Subsequent Events, establishes the
accounting and financial reporting requirements for subsequent events. Subsequent events are events or
transactions that affect the consolidated financial statements that occur after the end of the reporting period, but
before the financial report is issued. Certain subsequent events require adjustments to amounts recognized in
the consolidated financial statements and others may require disclosure.

Management did not have adequate controls designed and implemented to identify and determine whether
significant subsequent events required disclosure in the consolidated financial statements in accordance with
generally accepted accounting principles.

The deficiency was caused by the lack of an effective communication process between the Office of
Performance, Planning, and the Chief Financial Officer and the Office of General Counsel. Also, management
did not adequately consider the requirements of generally accepted accounting principles for the treatment of
subsequent events.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 4, Demonstrate Commitment to Competence; Principle 10, Design
Control Activities; and Principle 14, Communicate Internally

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

The deficiency described above may result in misstatements or omissions to the subsequent events disclosure
in the consolidated financial statements.

Recommendations – Subsequent Events

We recommend the Administrator coordinate with the Chief Financial Officer to:

47. Design and implement effective communication processes with other relevant offices, including the
Office of General Counsel, to ensure subsequent events are timely identified and reported completely
and accurately.

48. Improve training plans to ensure individuals responsible for financial reporting functions are adequately
prepared to respond to the occurrence of events or transactions that may require financial reporting
considerations, including subsequent events, under generally accepted accounting principles.
Appendix III

U.S. Small Business Administration

Compliance and Other Matters

A. Debt Collection Improvement Act of 1996, as amended (DCIA)

Certain provisions of the DCIA require agencies to notify and refer debts that are delinquent by 120 days or
more, for purposes of administrative offset and centralized collection, to the U.S. Department of Treasury
(Treasury).

The SBA did not refer delinquent loans to the Treasury for collection within the required timeframe.
Management identified and communicated that over one million COVID-EIDLs and 16,814 PPP loans were
noncompliant with DCIA requirements for the fiscal year ended September 30, 2023.

In addition, management implemented a policy to end collection efforts on certain delinquent PPP loans and
COVID-19 EIDLs and cease the referral of these loans to Treasury. However, management did not provide
evidence that the policy was reassessed in fiscal year 2023 given the updated status of outstanding loans and
relevant risks.

The conditions identified were caused by inadequate design and implementation of risk assessment and
monitoring processes that enable management to identify, analyze, and respond to the relevant risks of
noncompliance and to ensure delinquent loans were referred to Treasury within the required timeframe. Also,
the SBA’s operational infrastructure could not accommodate the volume of delinquent loans.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• DCIA

• GAO’s Green Book, Principle 10, Design Control Activities; and Principle 13, Use Quality Information

As a result of delays and absence of referrals of delinquent borrowers and guarantors to Treasury, SBA did not
comply with DCIA requirements. The absence of referrals of delinquent borrowers and guarantors to Treasury,
based on the policy to end collections and cease referral to Treasury, increases the risk of additional instances
of noncompliance with DCIA.

Recommendations – DCIA

We recommend the Administrator coordinate with the Acting Associate Administrator for the Office of Capital
Access to:

49. Reassess existing policies to ensure they are supported by quality information stemming from an
effective control environment that reviews the root causes of borrower delinquency prior to charge-off
and referral to Treasury. Perform a regular review of the implemented policies to ensure they are
responding to relevant risks of noncompliance for the current fiscal year.

50. Design, implement, and document appropriate monitoring controls to address compliance with DCIA.

51. Reevaluate the operational infrastructure to address relevant risks of noncompliance and ensure that
borrowers are notified timely of delinquency, and if applicable, subsequently referred to Treasury
timely.
B. Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

Management performed an internal control assessment as required under FMFIA. However, management’s
assessment did not substantially comply with FMFIA and the related OMB Circular No. A-123 requirements.
Specifically, management did not:

• Perform, document, and demonstrate that they completed an internal control over financial reporting
evaluation regarding significant programs while giving consideration to relevant risks during the fiscal
year.

• For the risks significant to financial reporting, consistently document financial statement risks and
assertions covered, testing procedures performed, extent of sampling performed, testing results,
corrective action plans to respond to deficiencies identified, and provide evidence of management
review. Additionally, management did not complete testing over significant areas and did not plan for
and test information technology controls as part of the internal control evaluation program.

• Ensure their own assurance process was sufficient to identify material weaknesses that existed during
the fiscal year in addition to those identified by external auditors.

Management did not substantially meet FMFIA requirements due to the urgent need to implement the
provisions of the CARES Act and related legislation as quickly and efficiently as possible, the lack of historical
precedence, and other inherent challenges faced in implementing and expanding programs. In addition,
management did not consider all FMFIA and OMB Circular No. A-123 requirements when performing their
evaluation over internal controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• Section 2 of FMFIA

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal
Control

Management did not substantially comply with FMFIA and the related OMB Circular No. A-123 requirements,
which may lead to not identifying the appropriate risks and key controls, and not detecting internal control or
compliance deficiencies. The risk of not detecting and correcting control deficiencies could result in
misstatements to the consolidated financial statements.

Recommendations – FMFIA

We recommend the Administrator coordinate with the Chief Financial Officer to:

52. Update the risk assessment regarding the evaluation of internal controls to ensure it includes all
significant programs, key processes, and other material line items on the consolidated financial
statements.

53. In conjunction with relevant program offices, perform and document the internal control evaluation for
significant programs or processes affecting the financial statements. This should include entity level
controls, manual controls, general information technology controls, and system application controls
covering key financial statement line items and risks.

54. Update the existing policy and implement adequate controls to ensure that the statement of assurances
provided by the program offices are adequately documented and reviewed for completeness and
accuracy to provide a sufficient basis to support the Administrator’s statement of assurance.
C. Federal Financial Management Improvement Act of 1996 (FFMIA)

Management did not establish and maintain financial management systems that substantially comply with the
following FFMIA requirements:

• Federal Financial Management Systems Requirements. As discussed in Appendix I – Material
Weaknesses, control deficiencies over transactions arising from the implementation of the CARES Act
and related legislation do not enable reliable and accurate financial reporting, do not ensure
compliance objectives are met, and do not ensure budgetary resources are safeguarded against waste,
loss, and misuse.

• Federal Accounting Standards. The deficiencies identified and reported in Appendix I – Material
Weaknesses, provide an indication that SBA’s financial management systems were substantially
noncompliant with applicable federal accounting standards. Specifically, management was unable to
provide evidence that the accounting treatment and financial reporting of the recovery of funds related
to the RRF, SVOG, COVID-19 EIDLs, and PPP programs were in accordance with U.S. generally
accepted accounting principles.

Management did not substantially meet FFMIA requirements because of the reasons discussed in Appendix I –
Material Weaknesses and due to an inadequate entity wide control environment to implement the provisions of
the CARES Act and related legislation with sufficiently designed and implemented controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• Section 803(a) of FFMIA

• GAO’s Green Book, Section 2, Establishing an Effective Internal Control System

• Appendix D to OMB Circular No. A-123, Compliance with the Federal Financial Management
Improvement Act of 1996

Management did not substantially comply with FFMIA increasing the risk that transactions are incorrectly
recorded to the general ledger, impacting the completeness, existence, and accuracy of the balances in the
consolidated financial statements.

Recommendations – FFMIA

We recommend the Administrator coordinate with the Chief Financial Officer to:

55. Address the control deficiencies over transactions arising from the implementation of the CARES Act
and related legislation by working with the Office of Capital Access and the Office of Disaster Recovery
and Resilience to implement the recommendations in Appendix I – Material Weaknesses.
Appendix IV

CFO Response to Audit Report on FY
2023 Financial Statements

DATE: November 15, 2023

TO: Hannibal M. Ware, Inspector General

FROM: Kate Aaby, Associate Administrator for Performance, Planning and the Chief Financial
Officer

SUBJECT: FY 2023 Financial Statement Audit

The Small Business Administration has reviewed the Independent Auditors’ Report from KPMG that includes
the auditors’ disclaimer of opinion on the Agency’s FY 2023 and FY 2022 Consolidated Balance Sheets. The
independent audit of the Agency’s financial statements and related processes is a core component of SBA’s
financial management program, and we are concerned by this result.

The FY 2023 Agency Financial Report includes pandemic relief programs: the Paycheck Protection Program,
COVID-19 Economic Injury Disaster Loan program, Restaurant Revitalization Fund program, and Shuttered
Venues Operators Grant program, which were authorized by the Coronavirus Aid, Relief, and Economic
Security Act of 2020, the Economic Aid Act, the American Rescue Plan Act and related legislations. As in FY
2022, the management of these programs during prolonged unprecedented times continued to emphasize the
importance of serving small businesses as they navigate extraordinary circumstances.

The SBA has continued making tremendous progress strengthening internal controls for pandemic-focused
programs and is dedicated to accountability and transparency to the American public. SBA’s Fraud Risk
Management Board (FRMB) mitigates, manages, and monitors fraud risks aligned with GAO’s Fraud Risk
Management Framework. The FRMB is chaired by the CFO and members include Deputy Associate
Administrators of key Program Offices, who are supported by an Advisory Team of SBA leaders with subject
matter expertise across cyber security, data, systems, learning and development, and more. In addition, to the
governance bodies SBA has in place, the CFO and key SBA Program Offices have partnered in the
development and implementation of corrective actions that will strengthen internal controls as well as address
audit identified deficiencies.

The SBA Senior Management Council (SMC) which is chaired by the Deputy Chief Financial Officer and
comprised SBA managers from program and support offices, actively plans and executes the Agency’s internal
control activities that include assessing and improving compliance, monitoring and remediation of identified
deficiencies and communicating results of reviews to senior management.

As in FY 2022, the auditors identified material weaknesses related to the internal controls over six areas; PPP
Loan Guarantees, COVID-19 EIDL Loans, Restaurant Revitalization Fund and Shuttered Venues Operators
Grant Program, Financial Reporting for Programs Funded by CARES Act and Related Legislation, Entity Level
Controls, and Evaluation of Service Organizations. The SBA has undergone tremendous efforts to strengthen
internal controls, policies and procedures and will continue remediation efforts in the coming audit year.

We appreciate your efforts and those of your colleagues in the Office of the Inspector General, as well as those
of KPMG. The independent audit process continues to provide us with beneficial recommendations that support
our efforts to further enhance the SBA's financial management practices. We remain committed to excellence
in financial management and look forward to furthering progress in the coming year.

File and source

File: SBA-OIG-Report-24-03.pdf
Size: 580,409 bytes
SHA-256: ef9c3f7d8c7441b621c3bb06595bbacdd04b0fdb7c3638517882ee843eb7e706
Our copy: SBA-OIG-Report-24-03.pdf
Original: legacy.sba.gov