SBA, Independent Auditors' Report on SBA's FY 2020 Financial Statements (December 18, 2020)

Summary

A December 18, 2020 memorandum from Inspector General Hannibal “Mike” Ware to Administrator Jovita Carranza, transmitting KPMG LLP’s independent auditors’ report on SBA’s FY 2020 financial statements. KPMG issued a disclaimer of opinion on the consolidated financial statements for the year ended September 30, 2020, citing the implementation of new programs under the Coronavirus Aid, Relief, and Economic Security Act of 2020, including the Paycheck Protection Program and the expanded Economic Injury Disaster Loan program. The report gives an opinion on the 2019 financial statements that they present fairly the financial position as of September 30, 2019. The memorandum says SBA’s Chief Financial Officer did not agree with five material weaknesses and partially agreed with two.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“SBA, Independent Auditors' Report on SBA's FY 2020 Financial Statements (December 18, 2020).” Original at legacy.sba.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/sba-independent-auditors-report-on-sba-s-fy-2020-financial-statements-06cfc55ec1/, SHA-256 5f8a1e4a58e322634c703ef4dd1b1b70577c35153875bc045de0de76e7fc2f8e.

Full text

U.S. Small Business Administration
Office of Inspector General
Washington, D.C. 20416

DATE: December 18, 2020

TO: Jovita Carranza
Administrator

FROM: Hannibal “Mike” Ware
Inspector General

SUBJECT: Independent Auditors’ Report on SBA’s FY 2020 Financial Statements

I am pleased to present the attached independent auditors’ report on the U.S. Small Business
Administration’s (SBA’s) consolidated financial statements for fiscal years 2020 and 2019, as required
annually by the Chief Financial Officers Act of 1990, as amended.
We contracted with the independent certified public accounting firm KPMG LLP to conduct an audit of the
SBA’s consolidated financial statements for the fiscal years ended September 30, 2020, and September 30,
2019. KPMG was engaged to conduct the audit in accordance with U.S. generally accepted auditing
standards. The audit also complied with the applicable standards for financial audits in Government
Auditing Standards issued by the Comptroller General of the United States and Office of Management and
Budget Bulletin No. 19-03, Audit Requirements for Federal Financial Statements.
In the report, KPMG auditors found significant matters for which they were unable to obtain sufficient,
appropriate audit evidence to provide a basis for an audit opinion on SBA’s consolidated financial
statements for the year ended September 30, 2020. Accordingly, KPMG issued a disclaimer of opinion on
the consolidated financial statements as of and for the year ended September 30, 2020. The following
paragraph describes the basis for the disclaimer of opinion related to the implementation of new programs
under the Coronavirus Aid, Relief, and Economic Security Act of 2020 and related legislation, most notably
the Paycheck Protection Program and the expanded Economic Injury Disaster Loan program.
SBA was unable to provide adequate evidential matter in support of a significant number of transactions
and account balances related to these programs because of inadequate processes and controls. As a result,
KPMG was unable to determine whether any adjustments might have been necessary with respect to Credit
Program Receivables and Related Foreclosed Property, Downward Reestimate Payable to Treasury,
Liability for Loan Guarantees, and the related elements in the consolidated statements of net cost and
changes in net position, the combined statement of budgetary resources, and related notes to the
consolidated financial statements.
SBA’s 2019 consolidated financial statements present fairly, in all material respects, the financial position of
the SBA as of September 30, 2019.
However, for the year ended September 30, 2020, KPMG identified seven material weaknesses, two
significant deficiencies in internal controls over financial reporting, and two instances of reportable
noncompliance with provisions of applicable laws, regulations, contracts, and grant agreements. Details of
KPMG’s conclusions about the material weaknesses and significant deficiencies are described in
attachments I and II of this report. Instances of noncompliance or other matters required to be reported
under Government Auditing Standards or OMB Bulletin No. 19-03 are described in attachment III.

1
We reviewed KPMG’s report and related documentation and inquired of its representatives. Our review, as
differentiated from an audit of the financial statements in accordance with U.S. generally accepted
government auditing standards, was not intended to enable us to express—and we do not express—
opinions on SBA’s financial statements or internal control over financial reporting or conclusions on SBA’s
compliance with applicable laws and other matters.
KPMG is responsible for the attached auditors’ report dated December 18, 2020, and the conclusions
expressed. However, the OIG provides negative assurance of this audit. Our oversight protocols include
evaluation of major work products, attendance at critical meetings, review of significant findings and
examination of related evidential matter. Our review disclosed no instances where KPMG did not comply in
all material respects with U.S. generally accepted government auditing standards.
We provided a draft of KPMG’s audit report to SBA’s Chief Financial Officer, who did not agree with five
material weaknesses included in the report under “Accounting and Reporting for Programs Implemented
Under the CARES Act and Related Legislation” and “Entity Level Controls.” The Chief Financial Officer
partially agreed with the remaining two material weaknesses, grouped in the report under “Evaluation and
Monitoring of Service Organization Controls.”
SBA’s responses, as communicated to KPMG during the audit, detail the agency’s concerns with the analysis
and conclusions drawn by KPMG. The Chief Financial Officer’s response is included in attachment IV, and
KPMG’s response to the Chief Financial Officer’s response is included in attachment V of this report.
We appreciate the cooperation and assistance of SBA and KPMG during the audit. Should you or your staff
have any questions, please contact me or Andrea Deadwyler, Assistant Inspector General for Audits, at
(202) 205-6586.

cc: William Manger, Chief of Staff and Associate Administrator, Office of Capital Access
Christopher Gray, Deputy Chief of Staff
Stephen Kong, Acting Chief Operating Officer
Patricia Gibson, Senior Advisor
Tami Perriello, Chief Financial Officer
Brittany Biles, General Counsel
Martin Conrey, Attorney Advisor, Legislation and Appropriations
Tonia Butler, Director, Office of Internal Controls
Rafaela Monchek, Director, Office of Continuous Operations and Risk Management

Attachment

2
2
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006

Independent Auditors’ Report

Inspector General
U.S. Small Business Administration

Administrator
U.S. Small Business Administration

Report on the Financial Statements
We have audited the accompanying consolidated financial statements of the United States (U.S.) Small
Business Administration (SBA), which comprise the consolidated balance sheet as of September 30, 2019, and
the related consolidated statements of net cost and changes in net position, and combined statement of
budgetary resources for the year then ended, and the related notes to the consolidated financial statements.
Further, we were engaged to audit the accompanying consolidated financial statements of the SBA, which
comprise the consolidated balance sheet as of September 30, 2020, and the related consolidated statements of
net cost and changes in net position, and combined statement of budgetary resources for the year then ended,
and the related notes to the consolidated financial statements.

Management’s Responsibility for the Financial Statements
Management is responsible for the preparation and fair presentation of these consolidated financial statements
in accordance with U.S. generally accepted accounting principles; this includes the design, implementation, and
maintenance of internal control relevant to the preparation and fair presentation of consolidated financial
statements that are free from material misstatement, whether due to fraud or error.

Auditors’ Responsibility
Our responsibility is to express an opinion on these consolidated financial statements based on our audits.
Except as explained in the Basis for Disclaimer of Opinion paragraph, we conducted our audits in accordance
with auditing standards generally accepted in the United States of America, in accordance with the standards
applicable to financial audits contained in Government Auditing Standards issued by the Comptroller General of
the United States, and in accordance with Office of Management and Budget (OMB) Bulletin No. 19-03, Audit
Requirements for Federal Financial Statements. Those standards require that we plan and perform the audit to
obtain reasonable assurance about whether the consolidated financial statements are free from material
misstatement.

An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the
consolidated financial statements. The procedures selected depend on the auditors’ judgment, including the
assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud
or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s
preparation and fair presentation of the consolidated financial statements in order to design audit procedures
that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness
of the entity’s internal control. Accordingly, we express no such opinion. An audit also includes evaluating the
appropriateness of accounting policies used and the reasonableness of significant accounting estimates made
by management, as well as evaluating the overall presentation of the consolidated financial statements.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our
audit opinion on the 2019 consolidated financial statements.

KPMG LLP, a Delaware limited liability partnership and a member firm of
the KPMG global organization of independent member firms affiliated with
KPMG International Limited, a private English company limited by guarantee.
3
Basis for Disclaimer of Opinion
During fiscal year 2020, the Coronavirus Aid, Relief, and Economic Security Act of 2020 and related legislation
authorized funding for SBA to implement the Paycheck Protection Program and the expanded Economic Injury
Disaster Loan program. SBA was unable to provide adequate evidential matter in support of a significant
number of transactions and account balances related to these programs due to inadequate processes and
controls. As a result of these matters, we were unable to determine whether any adjustments might have been
necessary with respect to Credit Program Receivables and Related Foreclosed Property, Downward
Reestimate Payable to Treasury, Liability for Loan Guarantees, and the related elements in the consolidated
statements of net cost and changes in net position, the combined statement of budgetary resources, and
related notes to the consolidated financial statements.

Disclaimer of Opinion on the Fiscal Year 2020 Financial Statements
Because of the significance of the matters described in the Basis for Disclaimer of Opinion paragraph, we have
not been able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion on the
consolidated financial statements as of and for the year ended September 30, 2020. Accordingly, we do not
express an opinion on these consolidated financial statements.

Opinion on the Fiscal Year 2019 Financial Statements
In our opinion, the 2019 consolidated financial statements referred to above present fairly, in all material
respects, the financial position of the United States Small Business Administration as of September 30, 2019,
and its net costs, changes in net position, and budgetary resources for the year then ended in accordance with
U.S. generally accepted accounting principles.

Other Matters
Interactive Data
Management has elected to reference to information on websites or other forms of interactive data outside the
U.S. Small Business Administration’s Agency Financial Report for FY 2020 to provide additional information for
the users of its financial statements. Such information is not a required part of the basic consolidated financial
statements or supplementary information required by the Federal Accounting Standards Advisory Board. The
information on these websites or the other interactive data has not been subjected to any of our auditing
procedures, and accordingly we do not express an opinion or provide any assurance on it.

Required Supplementary Information
U.S. generally accepted accounting principles require that the information in the Management’s Discussion and
Analysis and Required Supplementary Information sections be presented to supplement the basic consolidated
financial statements. Such information, although not a part of the basic consolidated financial statements, is
required by the Federal Accounting Standards Advisory Board who considers it to be an essential part of
financial reporting for placing the basic consolidated financial statements in an appropriate operational,
economic, or historical context. We were unable to apply certain limited procedures to such information in
accordance with auditing standards generally accepted in the United States of America because of the
significance of the matters described in the Basis for Disclaimer of Opinion paragraph. We do not express an
opinion or provide any assurance on the information.

Other Information
We were engaged to audit the basic consolidated financial statements as a whole. The Table of Contents, How
this Report is Organized, Message from the Administrator, Message from the Chief Financial Officer, Other
Information, and the Appendices in the U.S. Small Business Administration’s Agency Financial Report for FY
2020 are presented for purposes of additional analysis and are not a required part of the basic consolidated
financial statements. Such information has not been subjected to the procedures applied in our engagement to
audit the basic consolidated financial statements, and accordingly, we do not express an opinion or provide any
assurance on it.

4
Other Reporting Required by Government Auditing Standards
Internal Control over Financial Reporting
In connection with our engagement to audit the consolidated financial statements as of and for the year ended
September 30, 2020, we considered SBA’s internal control over financial reporting (internal control) as a basis
for designing procedures that are appropriate in the circumstances for the purpose of expressing our opinion on
the consolidated financial statements, but not for the purpose of expressing an opinion on the effectiveness of
SBA’s internal control. Accordingly, we do not express an opinion on the effectiveness of SBA’s internal control.
We did not test all internal controls relevant to operating objectives as broadly defined by the Federal
Managers’ Financial Integrity Act of 1982.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was
not designed to identify all deficiencies in internal control that might be material weaknesses or significant
deficiencies and therefore, material weaknesses or significant deficiencies may exist that have not been
identified. However, as described in the accompanying Attachments I and II, we did identify certain deficiencies
in internal control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or detect and correct,
misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in
internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies
described in Attachment I to be material weaknesses.

SBA management did not report these material weaknesses in its Management Assurances: FMFIA and
FFMIA Assurance Statement for FY 2020, included in the Management’s Discussion and Analysis section of
the FY 2020 Agency Financial Report.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe
than a material weakness, yet important enough to merit attention by those charged with governance. We
consider the deficiencies described in Attachment II, to be significant deficiencies.

Compliance and Other Matters
In connection with our engagement to audit SBA’s consolidated financial statements as of and for the year
ended September 30, 2020, we performed tests of its compliance with certain provisions of laws, regulations,
contracts, and grant agreements, noncompliance with which could have a direct and material effect on the
financial statements. However, providing an opinion on compliance with those provisions was not an objective
of our audit, and accordingly, we do not express such an opinion. The results of our tests disclosed an instance
of noncompliance or other matters that are required to be reported under Government Auditing Standards or
OMB Bulletin No. 19-03 and which are described in Attachment III. Additionally, if the scope of our work had
been sufficient to enable us to express an opinion on the basic fiscal year 2020 consolidated financial
statements, other instances of noncompliance or other matters may have been identified and reported herein.

We also performed tests of SBA’s compliance with certain provisions referred to in Section 803(a) of the
Federal Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with
FFMIA was not an objective of our audit, and accordingly, we do not express such an opinion. The results of
our tests disclosed instances, described in Attachment III, in which SBA’s financial management systems did
not substantially comply with (1) Federal financial management systems requirements and (2) applicable
Federal accounting standards. The results of our tests disclosed no instances in which SBA’s financial
management systems did not substantially comply with the United States Standard General Ledger at the
transaction level. Additionally, if the scope of our work had been sufficient to enable us to express an opinion
on the basic fiscal year 2020 consolidated financial statements, other instances of substantial noncompliance
with FFMIA may have been identified and reported herein.

5
SBA’s Response to Findings
SBA’s response to the findings identified in our engagement is described in Attachment IV. SBA’s response
was not subjected to the procedures applied in the engagement to audit the consolidated financial statements
and, accordingly, we express no opinion on the response.

Our response to SBA’s response is included in Attachment V.

Purpose of the Other Reporting Required by Government Auditing Standards
The purpose of the communication described in the Other Reporting Required by Government Auditing
Standards section is solely to describe the scope of our testing of internal control and compliance and the
results of that testing, and not to provide an opinion on the effectiveness of the SBA’s internal control or
compliance. Accordingly, this communication is not suitable for any other purpose.

Washington, DC
December 18, 2020

6
Attachment I

U.S. Small Business Administration

Material Weaknesses

The following deficiencies are considered to be material weaknesses in internal controls over financial
reporting.

1. Approval of PPP Loan Guarantees

2. Reporting of PPP Loan Guarantees

3. Subsidy Reestimate of PPP Loan Guarantees

4. Approval of COVID-19 EIDLs and Grants

5. Service Organization Used for COVID-19 EIDLs and Grants

6. Service Organizations Used for Loan Guarantee Programs

7. Entity Level Controls

For purposes of presentation and as described below, material weaknesses (1) through (4) are grouped into (A)
Accounting and Reporting for Programs Implemented under the Coronavirus Aid, Relief, and Economic
Security Act of 2020 (CARES Act) and Related Legislation; material weakness (5) and (6) are grouped into (B)
Evaluation and Monitoring of Service Organization Controls; and material weakness (7) is under (C) Entity
Level Controls.

A. Accounting and Reporting for Programs Implemented under the CARES Act and Related Legislation

On March 27, 2020, Congress passed the CARES Act to provide emergency assistance in response to
the extensive effects of the public health and economic crisis arising from the Coronavirus Disease 2019
(COVID-19) pandemic. This law was followed by the Paycheck Protection Program and Health Care
Enhancement Act passed by Congress on April 24, 2020. The largest component of these laws was the
Paycheck Protection Program (PPP), which provided funding of $670 billion. The PPP is a loan guarantee
program whereby third-party lenders issue loans that are fully guaranteed by SBA. In addition, the two rounds
of legislation provided a total funding of $20 billion for COVID-19 Economic Injury Disaster Loan (EIDL) grants
and an additional $50 billion of funding for SBA to issue up to approximately $367 billion in COVID-19 EIDLs.
COVID-19 EIDLs are direct loans that SBA issues to eligible borrowers. These laws from this point forward
are collectively referred to as the CARES Act and related legislation.

1. Approval of PPP Loan Guarantees

Due to the volume of loans being processed as a result of the PPP, the Office of Capital Access
developed a one-time process to accept bulk loan files from lenders. The lenders sent batch files to the
Office of Capital Access and direct uploads of PPP loans were made in SBA’s loan repository system. As
of August 8, 2020 (expiration of the program), SBA had approved over 5.2 million loan guarantees for an
approximate total of $525 billion.

Management did not adequately design and implement controls to ensure PPP loan guarantees were
accurate to enable the fair presentation of the Liability for Loan Guarantees and related elements in the
fiscal year 2020 consolidated financial statements. Specifically, management identified approved loans
disbursed by its third-party lenders that, in numerous cases, were not accurate and potentially not in
conformance with the CARES Act and related legislation. In addition, there were over 2 million approved
PPP loan guarantees (with an approximate total value of $189 billion) flagged by management within the
loan repository system that are potentially not in conformance with the CARES Act and related legislation.

7
The loans were flagged for one or more of 35 reasons (e.g., Business in Operation After February 15,
2020; Mismatch of Taxpayer Identification Number/Employer Identification Number/Social Security
Number; Criminal Record; Mismatch of Individual or Company Entity Name; Aggregate Data Mismatch;
Potential Multiple Data Universal Numbering System Issue; or Inactive Business).

The deficiencies were caused by an inadequate entity wide control environment to implement processes and
procedures to account for new and expanded programs under the CARES Act and related legislation with
sufficiently designed, implemented, and effectively operating controls.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• The Government Accountability Office’s (GAO’s) Standards for Internal Control in the Federal
Government (“Green Book”), Principle 3, Establish Structure, Responsibility, and Authority; and
Principle 10, Design Control Activities

• Office of Management and Budget (OMB) Circular No. A-123, Management’s Responsibility for
Enterprise Risk Management and Internal Control

The deficiencies noted above may result in material misstatements to the Liability for Loan Guarantees,
Downward Reestimate Payable to Treasury line items, and related elements in the consolidated financial
statements.

Recommendations – Approval of PPP Loan Guarantees

We recommend the Administrator coordinate with the Associate Administrator of Office of Capital Access
to:

1. Finalize the review plan and execute the loan review process for all loans in the PPP portfolio
to determine whether loans were or not in conformance with the CARES Act and related
legislation.

2. Determine the impact on the outstanding guarantee and eligibility for forgiveness of loans
determined to be not in conformance with the CARES Act and related legislation.

3. Implement adequate controls to prevent loans from being approved that are potentially not in
conformance with the legislation and program terms.

4. Develop and enforce a policy that requires the adequate training and monitoring of PPP
lenders to execute their responsibilities in the loan origination process.

We also recommend the Administrator coordinate with the Chief Financial Officer to:

5. Assess the accounting considerations, including the impact on the consolidated financial
statements, from the results of the loan review process for PPP loans and record any
necessary adjustments for loans determined to not be in conformance with the CARES Act
and related legislation.

2. Reporting of PPP Loan Guarantees

As part of the PPP, lenders must report any PPP loans that have been fully disbursed or cancelled to SBA
through the SBA Form 1502 (1502 report) or the loan repository system. SBA records the Liability for
Loan Guarantee and related accounting entries once the lender reports the loan disbursement. Lenders
were required to electronically submit the 1502 report to SBA by the latter of (1) May 29, 2020 or (2) 10
calendar days after disbursement or cancellation of a PPP loan. After reporting the initial disbursement,
lenders are responsible for reporting on the status of each loan by submitting a monthly 1502 report until
the lender notifies SBA that the loan has been paid in full. Through the 1502 reporting process, the
outstanding loan principal balance and ultimately the liability for loan guarantees balances are updated.

8
The portfolio of PPP loans with an outstanding loan principal balance is also used as an input into the
subsidy estimation cash flow models.

Management did not adequately design and implement controls to determine that the status of PPP loan
guarantees was complete and accurate to enable the fair presentation of the Liability for Loan Guarantees
and related elements in the consolidated financial statements. Specifically, management did not have
processes and controls in place to review the status of PPP loans where:

• 1502 reports have not been submitted.

• 1502 reports may have been submitted incorrectly.

• 1502 reports were not processed.

As of September 30, 2020, SBA reported approximately $6 billion of PPP loans approved but not
disbursed due to unreported or unprocessed 1502 reports from lenders. In addition, there were over
896,000 errors from 1502 reports that were not reviewed or processed to update the outstanding loan
principal balance. The affected PPP loans comprised of 63 distinct 1502 report error codes (e.g., PPP
loans must be fully disbursed; Loan is in inactive status; Invalid Guarantee Service Status Code;
Outstanding balance plus Total Amount Undisbursed cannot exceed Loan Approval Amount; Outstanding
Balance must be less than or equal to Current Loan Approval Amount).

The deficiencies were caused by an inadequate entity wide control environment to implement processes, and
procedures to account for new and expanded programs under the CARES Act and related legislation with
sufficiently designed, implemented, and effectively operating controls.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

Recommendations – Reporting of PPP Loan Guarantees

We recommend the Administrator coordinate with the Associate Administrator of Office of Capital Access
to:

6. Identify and review PPP loans with incomplete or inaccurate 1502 reports.

7. Determine and update the loan repository system with correct PPP loan related balances.

8. Develop and enforce a policy that requires the adequate training and monitoring of lenders to
execute their responsibilities in the PPP loan servicing process.

9. Develop and enforce a policy to monitor incomplete or inaccurate PPP 1502 reports on an
ongoing basis.

We also recommend the Administrator coordinate with the Chief Financial Officer to:

10. Assess the accounting considerations, including the impact on the consolidated financial

9
statements, from the results of the loan review process for PPP loans and record any
necessary adjustments for loans determined to not be in conformance with the CARES Act
and related legislation.

3. Subsidy Reestimate of PPP Loan Guarantees

PPP loans can be forgiven up to the full principal amount of the loan plus any accrued interest if certain
criteria are met by the borrower. In general, if the borrower uses 60 percent of the loan amount on payroll
costs, the full principal amount of the loan plus any accrued interest can be forgiven. As of September 30,
2020, SBA had received over 128,000 (or approximately 2.5% of total loan guarantees approved)
forgiveness applications from lenders. SBA began remitting forgiveness payments to lenders on October
2, 2020.

Statement of Federal Financial Accounting Standards (SFFAS) No. 2, Accounting for Direct Loans and
Loan Guarantees, requires that loan guarantees committed after September 30, 1991, be recorded on a
present value basis consistent with the intent of the Federal Credit Reform Act of 1990. As such, SBA
developed an estimation methodology to reestimate the future net cash inflows and outflows for the P PP
loan portfolio as of September 30, 2020.

Management did not adequately design and implement controls over the review of the data inputs and
assumptions used in the subsidy reestimate to determine that the portfolio of PPP loans was complete
and accurate. Specifically, management did not consider and document the effects on the reestimate
methodology for more than:

• 2 million approved PPP loan guarantees with a total approximate value of $189 billion that are
flagged as potentially not in conformance with the CARES Act and related legislation, which
may affect the accuracy of such loan guarantees, within the loan repository system.
Management did not evaluate and document the impact of these loan guarantees on the key
assumptions such as the Forgiveness Rate and Forgiveness Curve, and on the methodology
of the overall PPP loan portfolio.

• 896,000 errors in 1502 reports that were not reviewed or processed to update the outstanding
loan principal balance. This includes 1502 reports that were not submitted, submitted
incorrectly, or did not process due to an error.

In addition, management did not adequately design and implement controls to verify the completeness
and accuracy of relevant loan characteristics that are used in the development of key assumptions.
Specifically, the North American Industry Classification System code is the data attribute used for each
loan to develop key assumptions related to loan forgiveness. However, the code was not a field included
on the borrower’s application form and the reestimate methodology relies on this data attribute being
accurately reported by lenders.

Additionally, management did not adequately design and implement controls over the development and
support of the Forgiveness Rate assumption. The methodology did not include documentation regarding
how the Forgiveness Rates for the ‘High’ and ‘Very High’ Risk Group categories were determined.
Further, management did not consider and document the availability of actual loan forgiveness
applications received from the lenders to address the potential existence of disconfirming evidence related
to the assumption.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

10
• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 10,
Design Control Activities; and Principle 13, Use Quality Information

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

• Federal Accounting Standards Advisory Board (FASAB) Technical Release 6, Preparing Estimates
for Direct Loan and Loan Guarantee Subsidies under the Federal Credit Reform Act –
Amendments to Technical Release No. 3 Preparing and Auditing Direct Loan and Loan Guarantee
Subsidies under the Federal Credit Reform Act

The deficiencies noted above may result in a material misstatement to the Liability for Loan Guarantees
and Downward Reestimate Payable to Treasury line items, and the related elements in the consolidated
financial statements.

Recommendations – Subsidy Reestimate of PPP Loan Guarantees

We recommend the Administrator coordinate with the Chief Financial Officer to:

11. Document the development of significant assumptions used in the PPP reestimate, including
the consideration of the most recent, best available data to address the potential existence of
disconfirming evidence.

12. Accumulate relevant, complete, and accurate data to develop and support the PPP
reestimate.

13. Design and implement review and approval controls of the PPP reestimate by appropriate levels
of management, including review of sources of relevant data inputs, development of assumptions,
and reasonableness of assumptions and resulting estimates.

4. Approval of COVID-19 EIDLs and Grants

The authority to lend up to $367 billion in COVID-19 EIDLs and $20 billion in COVID-19 EIDL emergency
advance grants represents more disaster loan funding than all of the previous years combined in SBA’s
history. To receive, review, and process applications for COVID-19 EIDLs and grants, SBA contracted with a
service organization to create a portal for borrowers and grant recipients to submit applications. The portal
intakes and processes applications, and it supports the disaster assistance loan officer’s decisions of
whether to approve or reject an application.

Applicants are subjected to certain identity, fraud, and credit checks within the portal. For COVID-19 EIDLs and
grants, the portal may perform an automatic approval function for borrowers and grant recipients based on the
data elements entered. If no further research is required by a loan officer, the application is sent directly to a
supervisory loan officer for approval and obligation. If an automatic approval is not performed, the portal
provides alerts for the loan officer to address before a loan or grant can be routed to the senior loan officer for
review, approval, and obligation of funds.

Management did not adequately design and implement controls to ensure approved COVID-19 EIDLs and
grants were provided to eligible borrowers and accurately recorded. Specifically, SBA approved and disbursed
EIDLs and grants in the following instances:

• More than one COVID-19 EIDL or grant was approved and disbursed to the same borrower;

• Loans and grants were issued to borrowers with inaccurate or invalid Tax Identification
Numbers, Employee Identification Numbers, or Social Security Numbers;

• Loans were issued that management flagged to be potentially fraudulent; and

11
• Loans were issued to borrowers that management flagged because the borrowers were excluded
from doing business with the government.

For loans approved as of September 30, 2020, there were a total of over 6,000 approved and disbursed
COVID-19 EIDLs (with a total value of over $212 million) flagged within the loan repository system that were
issued to potentially ineligible borrowers.

In addition, management noted as part of an improper payment review that adequate controls were not
designed and implemented to determine that fraud alerts raised by the portal related to applications submitted
by borrowers were sufficiently addressed before loans were approved. The fraud alerts noted include: Large
number of applications with other lenders; Suspicious online behavior; Fraud alert detected on credit report;
Owner/client information failed validation; Owner/client information failed online identity verification; or Fraud
found on related deals. Management also noted instances where the applicant indicated the business was a
franchise or indicated a potential issue with their character that management had not adequately addressed in
accordance with its procedures.

Management did not have adequate procedures and controls implemented to address certain alerts within the
portal. Specifically, the portal Reference Guide does not have adequate procedures to address the following
alerts: Public records search did not find business; Bank account or routing number could not be verified; and
Bank account could not be confirmed to be associated with the business.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

The deficiencies noted above may result in a material misstatement of the Credit Program Receivables
and Related Foreclosed Property, Net and Downward Reestimate Payable to Treasury line items, and
related elements in the consolidated financial statements.

Recommendations – Approval of COVID-19 EIDLs and Grants

We recommend the Administrator coordinate with the Associate Administrator of Office of Disaster
Assistance to:

14. Perform a thorough review of the COVID-19 EIDLs and grants portfolio and determine which
transactions were made to ineligible recipients and not in conformance with the CARES Act
and related legislation.

15. Implement controls that prevent or detect loans from being approved that are not in
conformance with the related legislation and program’s eligibility terms.

16. Update the Reference Guide to require a more thorough review to clear certain alerts and
enforce the actions recommended by the Reference Guide to adequately address and mitigate
the alerts prior to loan approval.

17. Provide training of loan officers and supervisory loan officers to execute their responsibilities in
accordance with established guidance and standard operating procedures.

We also recommend the Administrator coordinate with the Chief Financial Officer to:

12
18. Assess the accounting considerations, including the impact on the consolidated financial
statements, from the results of the loan review process for PPP and record any necessary
adjustments for loans determined not to be in conformance with the CARES Act and related
legislation.

B. Evaluation and Monitoring of Service Organization Controls

Management did not adequately design and implement internal controls with respect to the evaluation and
monitoring of service organization controls. Adequate controls were not implemented related to the
evaluation and monitoring of the service organization controls used to process COVID-19 EIDLs and
emergency advance grants and for the service organization controls used for SBA loan guarantee
programs.

5. Service Organization Used for COVID-19 EIDLs and Grants

SBA contracted with a service organization to develop and use a portal for COVID-19 EIDL and grant
processing. The portal intakes and processes applications, and it supports the disaster assistance loan
officer’s decisions of whether to approve or reject an application. Approved loan applications are ultimately
disbursed as COVID-19 EIDLs or grants, which are a part of the consolidated financial statements. As part
of processing, the portal transmits application data to various external databases and sources to perform
numerous fraud and validation checks, among which include the duplicate application check, business
owner identity check, and bank account verification.

Management did not obtain reasonable assurance on the operating effectiveness of internal controls in
the service organization’s control environment relevant to the processing of SBA’s COVID-19 EIDL
transactions, which do not enable the fair presentation of the Credit Program Receivables and Related
Foreclosed Property line item and related elements in the consolidated financial statements. The relevant
control environment at the service organization includes the operation of the portal and the application
controls within the portal. In addition, the relevant control environment includes the data transmissions
over the Internet between the portal and various third-party organizations.

In addition, management did not provide evidence of adequate monitoring activities performed over the
relevant internal control environment at the service organization, such as obtaining and reviewing an
attestation report on the design, implementation, and operating effectiveness of controls at the service
organization. Management also did not provide evidence whether adequate user entity controls that are
designed, implemented, and operating effectively to complement the service organization’s controls.
Management’s assessment of internal controls over financial reporting is not complete without the sufficient
consideration of existing and non-existing controls at relevant service organizations and the effectiveness of
those controls.

The deficiencies were caused by an inadequate entity wide control environment to implement the provisions of
the CARES Act and related legislation with sufficiently designed and implemented controls resulting from the
urgent need to provide financial assistance to the public. In addition, management did not hold the service
organization accountable for the assigned internal control responsibilities by obtaining reasonable assurance
on the operating effectiveness of internal controls in the service organization’s control environment (e.g.,
requiring a service organization control (SOC) 1 Type 2 report for the control environment relevant to the
processing of SBA’s COVID-19 EIDL transactions).

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Section 4, Additional Considerations: Service Organizations; Principle 5,
Enforce Accountability; Principle 10, Design Control Activities; and Principle 16, Perform Monitoring
Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

13
The deficiencies noted above prevented SBA from obtaining an understanding of relevant service
organization controls and any weaknesses that increase risks of misstatements in the Credit Program
Receivables and Related Foreclosed Property line item and related elements in the consolidated financial
statements and potential noncompliance with provisions of laws or regulations.

Recommendations – Service Organization Used for COVID-19 EIDLs and Grants

We recommend the Administrator coordinate with the Associate Administrator of Office of Disaster
Assistance to:

19. Develop and implement a policy requiring new service organizations to provide a SOC 1 report
over the control environment that is relevant and significant to the processing and recording of
SBA’s transactions. If a SOC 1 report cannot be obtained, identify and evaluate relevant
controls at the service organizations that have an impact on SBA’s internal controls over
financial reporting.

20. Assess the risk posed by the service organization’s control environment and obtain sufficient
assurance over the operating effectiveness of relevant and significant controls to determine
the integrity of transactions processed on behalf of and recorded by SBA. If a SOC 1 report is
obtained for the relevant control environment at the service organization, determine and
document the following:

• SOC 1 report is sufficiently scoped to cover transaction processing and related control
activities performed by the service organization on behalf of SBA (e.g., that services, business
applications and other information technology, service organization departments and locations,
control objectives and activities, and other aspects of scope that are relevant to SBA’s internal
controls over financial reporting are included in the scope of SOC 1 reports).

• All exceptions noted in the SOC 1 report – not just those described in the independent service
auditor’s report – are evaluated to determine applicability to SBA’s internal controls over
financial reporting, the potential impact to SBA’s financial statements, and mitigating controls
other considerations made during their risk assessment.

• All complementary user entity controls described in the SOC 1 reports are evaluated using
current information and with consideration to their applicability to SBA’s internal controls over
financial reporting.

• Evaluation procedures include an assessment of whether complementary user entity controls
and other SBA-performed controls were tested and found effective and, if they are not, the
impact of such deficiencies on SBA’s internal controls over financial reporting.

• All complementary subservice organization controls described in SOC 1 reports are evaluated
to determine whether they provided services and performed controls considered relevant to
SBA’s internal controls over financial reporting and, if relevant subservice organizations were
identified, an evaluation is performed to obtain an understanding of the subservice
organization(s) and their controls.

• SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient
coverage to assess impacts on SBA’s internal controls over financial reporting.

6. Service Organizations Used for Loan Guarantee Programs

The use of service organizations is integral to the servicing and reporting of SBA’s loan guarantee
programs. To facilitate the collection of the 1502 reports from lenders, SBA uses a contracted fiscal transfer
agent to collect the 7(a) and PPP loan data from lenders. The loan data collected from 7(a) Program and
PPP lenders affect the Liability for Loan Guarantees line item and related elements in the consolidated

14
financial statements. The fiscal transfer agent also sells loans into the secondary market. SBA guarantees
the timely payment, as well as a default guarantee, to 7(a) secondary market investors. The payments are
made from the Master Reserve Fund that is administered by the fiscal transfer agent. SBA discloses the
balances in the Master Reserve Fund in the notes to the financial statements. For the 504 program, SBA
uses a financial service provider to support the central servicing agent. The financial service provider
manages the day-to-day operations of the program including funding and servicing loans and managing
associated payouts to third-party investors.

Management’s evaluations of SOC 1 reports over the fiscal transfer agent and the financial service provider
were not sufficient or properly documented to aid in management’s assessment of internal controls over
financial reporting and do not enable the fair presentation of the Liability for Loan Guarantees line item and
related elements in the consolidated financial statements. Specifically, management did not:

1. Determine the potential impact of control deficiencies on internal controls over financial reporting and
implement compensating mitigating controls for such deficiencies.

2. Evaluate and address the complementary user entity controls identified within the SOC 1 reports.

3. Evaluate relevant subservice organizations such as the fiscal transfer agent’s information technology
infrastructure support provider.

4. Obtain bridge letters that cover the appropriate gap period to provide sufficient coverage to assess
impacts on SBA’s internal controls over financial reporting.

The deficiencies were caused by inadequate policies and procedures in place to evaluate SOC 1 reports.
Specifically, management did not sufficiently review the fiscal transfer agent and financial service provider
SOC 1 reports because management did not consider and document all relevant aspects of the SOC 1 reports
and its impact on the consolidated financial statements.

The following criteria were considered with respect to the matters described in the preceding paragraphs:

• GAO’s Green Book, Section 4, Additional Considerations: Service Organizations

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

The deficiencies noted above increased the risk that management does not make key observations
regarding the sufficiency of coverage provided by SOC 1 reports and the results that are relevant to SBA’s
internal controls over financial reporting. This in turn could result in a failure to identify and obtain an
understanding of relevant service organization controls and weaknesses that increase risks of
misstatements in the Liability for Loan Guarantees and related elements in the consolidated financial
statements.

Recommendations – Service Organizations Used for SBA Loan Guarantee Programs

We recommend the Administrator coordinate with the Associate Administrator of Office of Capital Access
to enhance management’s review and evaluation of SOC 1 reports for the fiscal transfer agent and
financial service provider to include their performance and documentation of the following:

21. Consideration of all exceptions noted in the SOC 1 reports and determination of the
applicability to SBA’s internal controls over financial reporting. Management should determine
the potential impact on internal controls over financial reporting and if mitigating controls exist.

22. Evaluation of each complementary user entity control identified within the SOC 1 reports.
Management should determine that complementary user entity controls have been appropriately
designed and implemented and are operating effectively.

15
23. Evaluation of the SOC 1 reports for all relevant subservice organizations to include an
understanding of its role, their controls, and its effect on SBA’s processes.

24. Assessment of SOC 1 reports to determine whether coverage was provided for the entire
fiscal year. Management should determine the time period covered by the report, assess the
significance of the gap, and obtain bridge letters for reports that do not extend through
September 30 to provide sufficient coverage to assess impacts on SBA’s internal controls over
financial reporting.

C. Entity Level Controls

The urgent need to implement the CARES Act and related legislation presented a number of challenges for
management which resulted in a deficiency in entity level controls.

7. Entity Level Controls

Management did not properly design and implement entity level controls to establish an internal control system
that produces reliable and accurate financial reporting. The significance of the internal control matters indicated
several entity level control categories. We noted the following conditions.

Control Environment: Management did not fully design and implement an effective control environment. For
example, the following matters were noted:

1. There was not sufficient prioritization for individuals to fulfill their internal control responsibilities. The
rapid response and execution of the CARES Act and related legislation was the primary objective, and
not the implementation or maintenance of an effective internal control system.
2. Management did not assess control considerations over significant service organizations and their
impact on financial reporting.
3. There was not adequate training of disaster assistance staff involved in the review of COVID-19 EIDL
transactions resulting in inadequate documentation of how fraud alerts raised by the new custom-built
portal were addressed prior to loan approval.
4. There was not sufficient training of the lenders that have delegated authority to originate, approve,
disburse, and service PPP loans.
5. There was not adequate documentation of the internal control system and processes related to the
implementation of the CARES Act and related legislation.

Risk Assessment: Management did not design and implement an effective risk assessment process. For
example, the following matters were noted:

6. The initial risk assessment prepared was not properly amended after the enactment of the CARES Act
and related legislation.

7. Management did not identify risks from the implementation of new and expanded programs under the
CARES Act and related legislation that could significantly impact SBA’s internal control system and the
ability to achieve financial reporting objectives.

Control Activities: Management did not have effective control activities. For example, the following matters were
noted:

8. Established processes and control protocols were not followed due to the volume of new users or
required urgency leading to general information technology control deficiencies.

9. Existing systems did not have the capability to implement the PPP and COVID-19 EIDLs and grants in
accordance with the CARES Act and related legislation.

16
10. To allow PPP loans to process in the loan repository system, certain edit checks were changed without
evidence of testing or review and approval of such changes.

Information and Communication: Management did not have effective information and communication
processes. For example, the following matters were noted:

11. There was not timely communication of necessary, quality information to achieve reporting objectives
internally within the agency.

12. External information received was not evaluated against the characteristics of quality information.

Monitoring: Management did not design and implement effective monitoring processes. Specifically, the
following matters were noted:

13. There was not an adequate monitoring plan developed and implemented for lenders participating in the
PPP program.

14. There was not effective monitoring of the effectiveness of internal control over processes performed by
service organizations.

The deficiencies were primarily caused by the prioritization and the urgent need to implement the provisions of
the CARES Act and related legislation as quickly and efficiently as possible over internal control processes.
Further, these deficiencies were primarily caused by the inherent challenges with the implementation of a new
program that does not have any historical precedence. In the case of PPP, the challenges included
implementing a program with evolving and complex guidance, inadequate systems to implement such large-
scale programs, and an insufficient number of personnel to assist in the implementation of the CARES Act and
related legislation. Finally, these deficiencies were primarily caused by the lack of prioritization to achieve
internal control responsibilities, such as in the areas of information technology and monitoring of service
organizations.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; Principle 4,
Demonstrate Commitment to Competence; Principle 5, Enforce Accountability; Principle 6, Define
Objectives and Risk Tolerances; Principle 7, Identify, Analyze, and Respond to Risks; Principle 9,
Identify, Analyze, and Respond to Change; Principle 10, Design Control Activities; Principle 11,
Design Activities for the Information System; Principle 12, Implement Control Activities; Principle
13, Use of Quality Information; Principle 14, Communicate Internally; Principle 15, Communicate
Externally; and Principle 16, Perform Monitoring Activities

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

As a result of the deficiencies noted above, PPP loans were approved that were not in conformance with the
CARES Act and related legislation, risks that impacted the materially significant financial statement line items
were not considered, the Office of Chief Financial Officer did not adequately consider the impact of the flagged
PPP loans and the 1502 report errors on the relevant financial reporting processes, and PPP and COVID-19
EIDL transactions were approved and in certain cases disbursed to potentially ineligible entities. Without the
proper level of entity level controls in place and operating effectively, there is an increased risk that a material
misstatement in the consolidated financial statements and noncompliance with the relevant laws and
regulations would not be prevented or detected and timely corrected.

Recommendations – Entity Level Controls

We recommend the Administrator to coordinate with the Chief Financial Officer to:

25. Assign and hold accountable individuals responsible for overseeing management’s design,

17
implementation, and operation of SBA’s internal control system.

26. Document the internal control system and processes related to the implementation of the
CARES Act and related legislation.

27. Perform and document a thorough risk assessment at the financial statement assertion level
to identify process level risks and assess the effectiveness of key process level controls to
respond to the risks.

28. Develop and implement monitoring controls to ensure implementation of an effective internal
control environment.

29. Recruit additional qualified personnel, implement a formal training program, and train
appropriate SBA personnel and contractors on internal control matters that affect financial
reporting and compliance with relevant laws and regulations.

18
Attachment II

U.S. Small Business Administration

Significant Deficiencies

The following deficiencies are considered to be significant deficiencies in internal controls over financial
reporting.

1. Payments for Covered Loans under Section 1112 of the CARES Act

2. General Information Technology Controls

1. Payments for Covered Loans under Section 1112 of the CARES Act

Section 1112 of the CARES Act appropriated $17 billion for SBA to make 6 months of payments on loans
in good standing on behalf of borrowers in existing 7(a), 504, or Microloan programs. These loans in good
standing are referred to as covered loans. For the 7(a) and 504 programs, the minimum payments of
these loans were made directly to lenders and applied to the borrower’s outstanding balance. Covered
loans that were already under deferment would receive 6 months of paym ent beginning with the first
payment due after the deferral period. Loans initiated within 6 months after the enactment of the
legislation (by September 27, 2020) will also receive a full 6 months of loan payments by SBA.

Management did not adequately design and implement controls to determine that payments made to lenders
for covered loans under Section 1112 of the CARES Act were accurate, reviewed, and approved prior to
payment to enable the fair presentation of the Liability for Loan Guarantees. Specifically, management did
not have a documented process and sufficient controls in place to substantiate the accuracy of the
payments made to lenders.

The deficiency was caused by an inadequate entity wide control environment to implement processes, and
procedures to account for new and expanded programs under the CARES Act and related legislation with
sufficiently designed, implemented, and effectively operating controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• GAO’s Green Book, Principle 3, Establish Structure, Responsibility, and Authority; and Principle 10,
Design Control Activities

• Section 1112 of the CARES Act

The deficiency noted above may result in misstatements of the Liability for Loan Guarantees line item and
related elements in the consolidated financial statements. In addition, the deficiency noted above may result
in a potential noncompliance with the CARES Act.

Recommendations – Payments for Covered Loans under Section 1112 of the CARES Act

We recommend the Administrator coordinate with the Associate Administrator of Office of Capital Access
to:

30. Update and enforce the existing Procedural Notice 5000-20049 to require the adequate review
and approval of Section 1112 payments made to lenders and to determine that the necessary
documentation is maintained to substantiate the payment amount.

19
2. General Information Technology Controls

Management had several control deficiencies that limited SBA’s ability to effectively manage its information
system risks. Collectively, these conditions increase the risk of unauthorized use, modification, or destruction of
financial data, which may impact the integrity of information used to prepare the financial statements.

In the sections below, we have omitted some technical details from the conditions and recommendations due to
the sensitivity of the information. These details were communicated to management in notices of findings and
recommendations.

The following criteria were considered with respect to the matter described in the preceding paragraph:

• GAO’s Green Book, Principle 5, Enforce Accountability; Principle 11, Design Activities for the
Information System; Principle 12, Implement Control Activities; and Principle 16, Perform
Monitoring Activities

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4,
Security and Privacy Controls for Federal Information Systems and Organizations

• Federal Information Processing Standards Publication (FIPS) 200, Minimum Security Requirements
for Federal Information and Information Systems

• SBA Standard Operating Procedure (SOP) 90 47 5, Cybersecurity and Privacy Policy

• SBA System Configuration Management Plan

• SBA System Access Management Plan

We have summarized the information technology control deficiencies by the following general information
technology control objectives: logical access controls and system configuration management.

Logical Access Controls

An integral part of the effectiveness of an organization’s security program management efforts should be to
determine that logical access controls provide reasonable assurance that information technology resources,
such as data files, application programs, and information technology-related facilities and equipment, are
protected against unauthorized modification, disclosure, loss, or impairment. Management did not always follow
established policy and procedures for the account management, authorization, and recertification processes.

Recommendations – Logical Access Controls

We recommend the Administrator coordinate with the Chief Information Officer to:

31. Review the automated portion of their account management process to determine what
caused the process to create multiple accounts for individual users.

32. Update and test the account management process to ensure that multiple accounts will not be
created when changes are applied to the production environment.

We also recommend the Administrator coordinate with the Associate Administrator of Office of Capital Access
to:

33. Validate that new users identified in the notification of findings and recommendations are
assigned appropriate access to SBA’s information system and the supporting environment.

34. Periodically train personnel who are responsible for the approval and provisioning of accounts
to emphasize the importance of documenting and approving user access requests prior to and

20
provisioning access to SBA’s information systems and their supporting environments.

In addition, we recommend the Administrator coordinate with the Associate Administrator of Office of Disaster
Assistance to:

35. Analyze and validate the users identified in the notification of findings and recommendations
were granted appropriate access.

36. Periodically train personnel who are responsible for the approval and provisioning of accounts
to emphasize the importance of documenting and approving user access requests prior to and
provisioning access to SBA’s information systems and their supporting environments.

37. Validate the accounts that are to be reviewed and recertified are performed by the appropriate
or designated personnel before performing the existing recertification process.

System Configuration Management

An integral part of the effectiveness of an organization’s security program management efforts should be to
determine that application change management controls provide reasonable assurance that program changes
implemented to the applications are appropriate and authorized. Management did not maintain supporting
evidence to show patches to a database and an operating system were tested before being pushed to the
production environment. In addition, management migrated application changes into the production
environment without appropriate approval.

Recommendations – System Configuration Management

We recommend the Administrator coordinate with the Associate Administrator of Office of Capital Access to:

38. Validate that the patches applied to the database and operating system are appropriately
implemented and do not negatively affect the performance of the application.

39. Periodically train personnel involved with the implementation of database and operating
system patches to follow the requirements of the patch management process in accordance
with existing policies.

40. Design and implement a quality check process to ensure that approvals for application
changes are timely and accurate prior to migrating changes into the production environment.

41. Periodically train personnel involved with the review and approval of application changes to
follow the requirements of the application change management process in accordance with
existing policy.

21
Attachment III

U.S. Small Business Administration

Compliance and Other Matters

A. Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

Management performed an internal control assessment as required under the FMFIA; however, management’s
assessment did not substantially comply with FMFIA and the related OMB Circular No. A-123 requirements.
Specifically, management did not:

1. Sufficiently identify or define risks related to new programs established by the CARES Act and related
legislation.

2. Perform, document, or demonstrate that they completed an internal control over financial reporting
evaluation regarding these new programs.

3. Fully evaluate and consider the risks and controls of significant service organizations.

4. Report the material weaknesses identified in Attachment I – Material Weaknesses.

Management did not substantially meet FMFIA requirements due to the urgent need to implement the
provisions of the CARES Act and related legislation as quickly and efficiently as possible, the lack of historical
precedence, and other inherent challenges faced in implementing and expanding programs. In addition,
management did not consider all FMFIA and OMB Circular No. A-123 requirements when performing their
evaluation over internal controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• Section 2 of FMFIA

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and
Internal Control

Management did not substantially comply with FMFIA and the related OMB Circular No. A-123
requirements, which may lead to not identifying the appropriate risks and key controls, and not detecting
internal control or compliance deficiencies. The risk of not detecting and correcting control deficiencies could
result in misstatements to the consolidated financial statements.

Recommendations – FMFIA

We recommend the Administrator coordinate with the Chief Financial Officer to:

42. Update the enterprise risk management approach over the evaluation of internal controls to ensure
it includes all significant programs, key processes, and other material line items on the
consolidated financial statements.

43. Perform and document the internal control evaluation performed over all programs. This should
include entity level controls, manual controls, general information technology controls, and system
application controls covering key financial statement line items and risks.

44. Work with service providers to assess service organization risks and controls and monitor the
service providers to determine that they properly design, implement and effectively operate controls
impacting SBA’s control environment.

22
B. Federal Financial Management Improvement Act of 1996 (FFMIA)

Management did not establish and maintain financial management systems that substantially comply with the
following FFMIA requirements:

1. Federal Financial Management Systems Requirements. As discussed in Attachment I – Material
Weaknesses, control deficiencies over transactions arising from the implementation of the CARES Act
and related legislation do not enable reliable and accurate financial reporting and do not ensure
budgetary resources are safeguarded against waste, loss, and misuse. In addition, the deficiencies
may not support compliance objectives related to ensuring financial transactions are in conformance
with the CARES Act and related legislation are achieved.

In addition, as discussed in Attachment II – Significant Deficiencies, management did not implement
sufficient general information technology controls for SBA systems critical to financial reporting.
Sufficient and effective general information technology controls were not implemented to protect the
financial accounting and reporting data.

2. Federal Accounting Standards. The deficiencies identified and reported in Attachment I – Material
Weaknesses, provide an indication that SBA’s financial management systems were substantially non-
compliant with Federal accounting standards.

Management did not substantially meet FFMIA requirements because of the reasons discussed in Attachment I
– Material Weaknesses and Attachment II – Significant Deficiencies and due to an inadequate entity wide
control environment to implement the provisions of the CARES Act and related legislation with sufficiently
designed and implemented controls.

The following criteria were considered with respect to the matter described in the preceding paragraphs:

• Section 803(a) of FFMIA

• GAO’s Green Book, Section 2, Establishing an Effective Internal Control System

• Appendix D to OMB Circular No. A-123, Compliance with the Federal Financial Management
Improvement Act of 1996

Management did not substantially comply with FFMIA increasing the risk that transactions are incorrectly
recorded to the general ledger, impacting the completeness, existence, and accuracy of the balances in
the consolidated financial statements.

Recommendations – FFMIA

We recommend the Administrator coordinate with the Chief Financial Officer to:

45. Address the control deficiencies over transactions arising from the implementation of the
CARES Act and related legislation by working with the Office of Capital Access and the Office
of Disaster Assistance to implement the recommendations in Attachment I – Material
Weaknesses.

We also recommend the Administrator coordinate with the Chief Information Officer to:

46. Address the deficiencies in general information technology controls for SBA systems critical to
financial reporting by working with the relevant system owners to implement the
recommendations in Attachment II – Significant Deficiencies.

23
Attachment IV

CFO Response to Audit Report on
FY 2020 Financial Statements

DATE: December 18, 2020
TO: Hannibal M. Ware, Inspector General
FROM: Tami Perriello, Associate Administrator for Performance and Planning
and Chief Financial Officer
SUBJECT: FY 2020 Financial Statement Audit

The Small Business Administration has reviewed the Independent Auditors’ Report from KPMG that includes the
auditors’ disclaimer of opinion on the financial statements and its review of the Agency’s internal control over
financial reporting and compliance with laws and regulations. The independent audit of the Agency’s financial
statements and related processes is a core component of SBA’s financial management program, and we are
disappointed by this outcome.
The FY 2020 Agency Financial Report includes the programs funded under the CARES Act and subsequent
legislation, which provided funding for new and expanded loan programs. The scope and scale of these programs
and the speed with which the SBA responded were unprecedented in its history. The largest CARES Act loan
programs executed by the SBA are governed by the Federal Credit Reform Act (FCRA), which requires estimation
of lifetime expected subsidy costs at program implementation and does provide for annual adjustment to original
subsidy cost estimates in future periods. The SBA believes the FY 2020 presentation of financial information is
materially correct.
We recognize that documentation of the processes and controls over two CARES Act programs, the Paycheck
Protection Program (PPP) and EIDL-COVID Program, was not sufficiently detailed to support the financial
statement audit. The SBA fully supports the requirements for auditability of its financial statements and
understands its obligations for providing accountability and transparency. The SBA is working diligently to
complete its reviews and to correct these shortcomings for future audits.
The auditors identified material weaknesses related to the internal controls over seven areas related to the execution
and reporting for the PPP and EIDL-COVID programs. The SBA has reviewed the identified material weaknesses
and does not agree with five weaknesses included in the report under Accounting and Reporting for Programs Implemented
under the CARES Act and Related Legislation and Entity Level Controls. The SBA partially agrees with two others,
grouped in the audit report under Evaluation and Monitoring of Service Organization Controls. Our responses, as
communicated to KPMG during the audit, detail our concerns with the analysis and conclusions drawn by the
auditors.
We appreciate your efforts and those of your colleagues in the Office of the Inspector General, as well as those of
KPMG. The independent audit process continues to provide us with new insights and valuable recommendations
that directly support our efforts to further enhance the SBA's financial management practices. We remain
committed to excellence in financial management and look forward to making more progress in the coming year.

24
Attachment V

Auditors’ Response to Management’s Response

We acknowledge SBA management’s response to our Independent Auditors’ Report, presented in Attachment
IV, and commend their commitment to financial management and the accountability for and transparency of
their programs. SBA management did not agree with the five material weaknesses included in our report under
Accounting and Reporting for Programs Implemented under the CARES Act and Related Legislation and Entity
Level Controls. We evaluated the validity of management’s responses communicated to us during the
engagement and have determined that the material weaknesses in internal control over financial reporting are
appropriate.

File and source

File: OIG-Final-Report-21-04-Consolidated-Financial-Statement-Audit.pdf
Size: 894,956 bytes
SHA-256: 5f8a1e4a58e322634c703ef4dd1b1b70577c35153875bc045de0de76e7fc2f8e
Our copy: OIG-Final-Report-21-04-Consolidated-Financial-Statement-Audit.pdf
Original: legacy.sba.gov