Top Management and Performance Challenges Facing the SBA in Fiscal Year 2025 (OIG Report 25-01)
Summary
SBA OIG Report 25-01, dated October 15, 2024, sets out the top management and performance challenges facing SBA in Fiscal Year 2025, with a message from Inspector General Hannibal "Mike" Ware. It names five challenges: protecting the integrity of SBA programs, managing the loan portfolio and participating lenders, measuring performance and monitoring programs, managing data, and managing risks in information technology systems and cybersecurity. The report states that SBA's pandemic relief delivered 22.1 million loans and grants totaling $1.2 trillion, and cites OIG's June 2023 estimate of over $200 billion in potentially fraudulent PPP loans and COVID-19 EIDLs. As of September 30, 2024, OIG had issued 47 reports and made 127 recommendations on pandemic program controls.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Top Management and Performance Challenges Facing the SBA in Fiscal Year 2025 (OIG Report 25-01).”
Original at www.oversight.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/sba-oig-report-25-01-70c586b83f/
, SHA-256 90b4a22a4679e451c951505ecd42d1566cc5724f1716a230d9c5bd1c20dcb2b5.Full text
U.S. Small Business Administration
Office of Inspector General
Top Management and
Performance Challenges
Facing the Small Business Administration
in Fiscal Year 2025
Report 25-01 | October 15, 2024
2025 Top Management and Performance Challenges | 1
Contents
Message From the Inspector General ............................................................................................................. ii
Introduction ................................................................................................................................................... iii
Table 1: Top Management and Performance Challenges Facing SBA in Fiscal Year 2025 ........................ iii
Challenge 1: Protecting the Integrity of SBA Programs .................................................................................. 1
Managing Fraud Risk ................................................................................................................................... 1
Figure 1: Disbursed Pandemic Assistance Funds ........................................................................... 1
Figure 2: Current and Ongoing Actions Related to the PPP and COVID-19 EIDL ........................... 2
Figure 3: Potentially Fraudulent Pandemic Assistance Loans and Grants ..................................... 3
Improving Verification of Eligibility ............................................................................................................. 4
Mitigating Improper Payments ................................................................................................................... 5
Seizure and Return of Funds ....................................................................................................................... 6
Challenge 2: Managing SBA’s Loan Portfolio and Participating Lenders ........................................................ 8
Servicing Disaster Loans .............................................................................................................................. 8
Figure 4: The Increased Burden of COVID-19 EIDL Servicing on SBA ............................................ 9
Overseeing Lenders ..................................................................................................................................... 9
Ensuring Retention of Pandemic-Related Loan and Award Records ........................................... 10
Challenge 3: Measuring Performance and Monitoring SBA Programs ......................................................... 13
Measuring Program Performance ............................................................................................................ 13
Monitoring Program Performance Results ............................................................................................... 14
Ensuring Funds Are Used for Intended Purposes ..................................................................................... 15
Figure 5: Total Number of RRF and SVOG Awards that SBA Must Review Manually .................. 15
Challenge 4: Managing Data ........................................................................................................................ 17
Storing, Monitoring, and Analyzing Program Data ................................................................................... 17
Sharing Authorized Data Between Government Agencies....................................................................... 18
Evaluating and Improving Data Reliability ................................................................................................ 19
Challenge 5: Managing Risks in Information Technology Systems and Cybersecurity ................................. 21
Figure 6: Risk Management Best Practices Strategy .................................................................... 21
Improving Information Technology Systems Management ..................................................................... 21
Preparing for Artificial Intelligence Challenges......................................................................................... 22
Deploying and Monitoring New Third-Party Systems .............................................................................. 23
Complying with Federal Information Security Modernization Act Management Requirements............ 24
Make a Difference ........................................................................................................................................ 26
2025 Top Management and Performance Challenges | i
U.S. Small Business Administration | Office of Inspector General
Message From the
Inspector General
Each year, as required by the Reports Consolidation Act of 2000, the U.S. Small
Business Administration (SBA) Office of Inspector General (OIG) reports on the
top management and performance challenges facing the agency.
This year, we reframed our approach to elevate this discussion in a more holistic
manner, specifying challenges that are systemic and cross-cutting in nature, as
opposed to the highlighting of specific programs. Our new approach no longer
uses color-coded challenge areas; however, we continue to base our report on
audit and investigative oversight work, dialogue with agency program officials,
and assessments of programs and activities that rise to the level of a top
challenge. In so doing, we believe we can better and more systematically
Hannibal “Mike” Ware
promote programmatic change, resulting in direct benefit to small business
owners who depend on SBA services.
Although the Coronavirus Disease 2019 pandemic economic crisis is behind us, SBA continues to face
challenges related to it and protecting the integrity of SBA programs, while managing large loan portfolios and
a burgeoning number of lenders. The systemic challenges overlap SBA services, affecting the agency’s flagship
capital, contracting, and counseling programs. We identified several underlying issues: mitigating improper
payments, ensuring only eligible entities gain access to programs, reducing or eliminating self-certification as a
practice, and strengthening internal controls.
Additionally, technology must be integrated within programs in a manner that assures eligibility criteria are
met, and that robust verification and validation are inherent in the internal control framework. Further, SBA
must meet its lender oversight responsibilities to avoid missteps that occurred in its pandemic response. These
issues continue to be at the forefront of our recommended corrective actions.
The nation can depend on OIG to provide independent, objective, and timely oversight of SBA. We will
continue to focus our resources on systems and processes that present serious management and performance
challenges within SBA programs with a goal of improving the integrity, accountability, and performance of
those programs for the benefit of the American people.
Hannibal “Mike” Ware
SBA Inspector General
2025 Top Management and Performance Challenges | ii
U.S. Small Business Administration | Office of Inspector General
Introduction
The management challenges report is an important tool to help the agency prioritize its work to
improve program performance and enhance operations. OIG remains committed to protecting the
interests of American taxpayers by promoting positive change within SBA and across government,
ensuring taxpayer dollars are spent efficiently according to intent.
Identification of an issue as a top challenge does not necessarily denote significant deficiencies or
lack of attention on SBA’s part. Many of the challenges are longstanding, inherently difficult, and will
likely continue to be challenges in the coming years. Addressing the challenges will require consistent
attention from agency management and ongoing engagement with Congress, the public, and other
stakeholders. We continue to collaborate with SBA program officials in identifying and mitigating the
top challenges and associated issues facing the agency.
Table 1: Top Management and Performance Challenges
Facing SBA in Fiscal Year 2025
Challenge Issues
Managing Fraud Risk
Challenge 1 Improving Verification of Eligibility
Protecting the Integrity of SBA Programs Mitigating Improper Payments
Seizure and Return of Funds
Challenge 2 Servicing Disaster Loans
Managing SBA’s Loan Portfolio and
Participating Lenders Overseeing Lenders
Measuring Program Performance
Challenge 3
Measuring Performance and Monitoring Monitoring Program Performance Results
SBA Programs
Ensuring Funds Are Used for Intended Purposes
Storing, Monitoring, and Analyzing Program Data
Challenge 4
Sharing Authorized Data Between Government Agencies
Managing Data
Evaluating and Improving Data Reliability
2025 Top Management and Performance Challenges | iii
U.S. Small Business Administration | Office of Inspector General
Improving Information Technology Systems Management
Challenge 5 Preparing for Artificial Intelligence Challenges
Managing Risks in Information Deploying and Monitoring New Third-Party Systems
Technology Systems and Cybersecurity
Complying with Federal Information Security Modernization
Act Management Requirements
2025 Top Management and Performance Challenges | iv
Challenge 1: Protecting the
Integrity of SBA Programs
The U.S. Small Business Administration (SBA) provides loan guaranties, direct disaster assistance
loans, contracting certifications, and business development programs to qualifying small business
owners and entrepreneurs. SBA’s challenge is to fulfill its mission by balancing the priority of
delivering prompt assistance while also protecting the integrity of its programs. We see this in the
fundamental tension that exists between quickly delivering capital to qualifying small businesses
while minimizing potential fraud. A strong internal control environment helps meet the need for
prompt service that benefits eligible small businesses, which should be in place before funds are
awarded. We see a need for this strong internal control environment in SBA’s contracting
certification programs to ensure only deserving and eligible small business owners benefit from
contracting opportunities associated with these programs.
Managing Fraud Risk
In the wake of the Coronavirus Disease 2019 (COVID-19) pandemic, action was needed to avert an
economic crisis caused by lockdowns, business closures, and other impediments. More than
30 million small businesses in the nation were adversely affected by the economic crisis. In March
2020, the Coronavirus Aid, Relief, and Economic Security (CARES) Act authorized SBA to administer
an unprecedented amount of disaster assistance and guaranteed loan funds to help eligible small
business owners and entrepreneurs adversely affected by the crisis. Over the course of 18 months,
the agency’s pandemic relief expanded to four main programs and delivered 22.1 million loans and
grants, totaling $1.2 trillion (Figure 1). SBA has progressed to reviewing, forgiving, and servicing the
pandemic assistance loans (Figure 2).
Figure 1: Disbursed Pandemic Assistance Funds
Source: OIG generated
2025 Top Management and Performance Challenges | 1
U.S. Small Business Administration | Office of Inspector General
At the start of the pandemic in
Figure 2: Current and Ongoing Actions
2020, SBA reduced or eliminated
Related to the PPP and COVID-19 EIDL
key internal controls as it sought
to follow legislative
requirements intended to
expedite aid during the crisis.
Many existing controls and design
features in SBA’s longstanding
flagship disaster lending and loan
guaranty programs were replaced
with less effective controls. 1
These internal controls could
have mitigated fraud and ensured
only eligible entities received
taxpayer funds.
The pandemic exacerbated risks
Source: OIG generated from SBA data
we have already found in SBA’s
flagship loan guaranty programs
(see Overseeing Lenders). Our previous and ongoing audit work has found SBA did not always
adequately recognize or manage significant lender weaknesses. OIG audits and investigations have
shown SBA previously could not effectively identify and track loan agent involvement in its 7(a) and
504 loan portfolios. Our investigative work has found SBA’s guaranteed loan programs susceptible to
borrower fraud in regard to false statements and documentation, misrepresentation of equity
injections, as well as misuse of proceeds. Investigations have also revealed a pattern of fraud by loan
packagers and other fee-based agents in the 7(a) loan program.
The pandemic also magnified the long-standing control weaknesses of self-certification of eligibility
(see Improving Verification of Eligibility) and the limited use of the U.S. Department of the Treasury’s
Do Not Pay system to verify eligibility. 2 The Do Not Pay system is a series of databases designed to
prevent and detect improper payments to those not eligible for government payments because of
past fraudulent activity or other high-risk factors.
SBA eventually started using the Do Not Pay system for pandemic programs, but the challenge
remains to better integrate the use of the system in all its programs and not rely on self-certification.
We will continue to keep watch over SBA’s burgeoning flagship loan guaranty programs, particularly
with SBA increasing Small Business Lending Company participation (see Overseeing Lenders).
2025 Top Management and Performance Challenges | 2
U.S. Small Business Administration | Office of Inspector General
In our fraud landscape report issued in
Figure 3: Potentially Fraudulent
June 2023, we estimated SBA’s missing
Pandemic Assistance Loans and Grants
or weakened internal controls resulted
in the disbursement of over $200 billion
in potentially fraudulent Paycheck
Protection Program (PPP) loans and
COVID-19 Economic Injury Disaster
Loans (EIDL) to those who exploited
control vulnerabilities (Figure 3). 3 We
estimated potential fraud and misuse of
proceeds in the EIDL program at
approximately $136 billion and
Source: OIG generated
$64 billion in the PPP. Using investigative
casework, prior OIG reporting, and
advanced data analytics, we identified various schemes used to steal from American taxpayers.
Fraudsters stole identity information, created synthetic identities, and duplicated information to
exploit programs meant to help those in need.
As of September 30, 2024, we have issued 47 reports and made 127 recommendations related to
identified weaknesses in SBA’s pandemic programs control environment (73 recommendations have
been closed). Key recommendations for strengthening internal controls to mitigate fraud in the
pandemic relief programs, include:
• Issuing clear requirements and communicating with lending partners in a timely manner;
• Establishing and monitoring performance measures and proper internal controls;
• Establishing a quality assurance plan to prevent and detect improper payments;
• Tracking program data to support accurate measurement and reporting;
• Establishing the organizational structure to manage and handle potentially fraudulent PPP
loans and EIDLs.
SBA also faces the challenge of ensuring federal agencies award small business contracts only to
eligible entities. OIG investigators currently have 23 cases involving allegations of firms not meeting
contracting program requirements, including in the 8(a) Business Development, Women-Owned
Small Business (WOSB), service-disabled veteran-owned small business, and the Historically
Underutilized Business Zone (HUBZone) programs.
The agency has developed and implemented a fraud risk management policy and framework,
developed aggregate review processes to identify different types of fraud, increased antifraud
2025 Top Management and Performance Challenges | 3
U.S. Small Business Administration | Office of Inspector General
controls for 2020 loans, established a Fraud Risk Management Board in 2022, and hired a new Chief
Risk Officer to lead its Office of Enterprise Integrity. SBA also developed a webpage raising awareness
of preventing fraud and identity theft that includes a section for lenders.
SBA continues to take actions to address identified fraud risks in its programs. Implementing
corrective actions and strengthening internal controls are imperative in sustaining an effective risk
management program that will reduce fraud and enhance program integrity for current and future
programs.
Improving Verification of Eligibility
Strong internal controls must be in place prior to issuing loans, grants, or conferring certifications.
OIG believes SBA should obtain documented evidence to verify an applicant’s compliance with the
program’s eligibility requirements for all of its programs, ensuring that only eligible applicants receive
program benefits.
The CARES Act required SBA to rely on borrower self-certification for eligibility in the PPP and
required acceptance of self-certification from applicants under penalty of perjury for the COVID-19
EIDL program. For the COVID-19 EIDL program, the Act allowed self-certification for business size and
type, such as for a sole proprietorship or a cooperative under 500 employees. Self-certification made
the program vulnerable to noncompliance and opened the door wider to fraudsters and those who
misused program funds, thus facilitating a pay and chase environment. Many applicants in the
pandemic loan programs falsified their operating status and provided false information to qualify.
SBA also has relied on self-certifications for its contracting certification programs. These programs
were intended by Congress to help diversify and improve the U.S. economy, fulfilling needed public
services while also helping small businesses gain experience in the federal contracting arena. The
goal is for these small businesses to then better compete in the open marketplace without
government assistance. The U.S. government is the largest single purchaser of goods and services in
the world, awarding over $760 billion in prime contracts annually. SBA works to maximize
opportunities for small businesses to receive these contract awards. As mandated by the Small
Business Act, the government-wide goal is to award at least 23 percent of contract dollars to small
businesses.
Business owners have been able to attest they qualify as “small” based on the number of employees
and revenue, according to industry classification. Although the Agency’s Audit Follow-up Official
adjudicated on the permissibility of self-certification in these programs, we continue to believe
Congress intended for SBA to certify these businesses eligibility for set-aside contracts. Relying on
self-certification without any verification sets up a system that enables ineligible businesses and
unscrupulous business owners to obtain funds for which they are not entitled. OIG has identified
2025 Top Management and Performance Challenges | 4
U.S. Small Business Administration | Office of Inspector General
instances where SBA did not consistently detect ineligible firms in its small business contracting
certification programs. In our recent reviews of the WOSB and HUBZone certification programs, we
recommended SBA implement procedures and guidance for eligibility and size determinations and
strengthen controls over the annual certification process. 4
We also found SBA’s Dynamic Small Business Search database did not consistently update when SBA
made decisions on applicants’ WOSB certifications. Contracting officers throughout the government
rely on the certification status reported in the database, the system of record for SBA’s small
business contracting programs. The Dynamic Small Business Search database integrates with
SAM.gov. Without reliable information, contracting officers may award contracts set aside for
disadvantaged small businesses to ineligible firms.
SBA is developing a standardized fraud risk framework within its administration platform to evaluate
available data to ensure the applicants are eligible for the program. If SBA implements a robust
framework and reviews its effects, it will help mitigate this challenge.
Mitigating Improper Payments
An improper payment is a payment that should not have been made or was made in an incorrect
amount, including an overpayment or underpayment, under a statutory, contractual, administrative,
or other legally applicable requirement. SBA has been unable to provide accurate estimates of
improper payment rates for some programs during the last 2 fiscal years, and OIG has identified
multiple issues of noncompliance with the Payment Integrity Information Act (PIIA) of 2019 for fiscal
years 2022 and 2023, raising concerns regarding the accurate measurement of the rate of improper
payments. 5
Prior and ongoing OIG audit work has identified 7(a) and PPP loans given to borrowers who were
ineligible, resulting in improper payments. In addition, OIG’s external independent accounting firm
found SBA did not publish improper and unknown payment estimates for multiple programs under
the debt relief program, according to Report 24-16. Also, sampling and estimation methodology plans
for disaster assistance loans, COVID-19 EIDLs, and EIDL Targeted Advance program activities were not
fully compliant with the Payment Integrity Information Act of 2019.
Specifically, SBA did not design and implement adequate sample review procedures to produce
reliable sample results that could be used to develop accurate improper payment estimates. In
addition, SBA did not always publish corrective action plans as required or publish reduction targets
for those over the allowable thresholds. SBA’s assessment methodology for some programs did not
consider certain identified risk factors for determining the likelihood of improper payments.
Payment integrity actions, such as the accurate measurement and reporting of an agency’s improper
payment rate and efforts to reduce those rates, aid in reducing fraud, waste, abuse, and
2025 Top Management and Performance Challenges | 5
U.S. Small Business Administration | Office of Inspector General
mismanagement in government programs. These actions enhance program missions, efforts to
advance equity, efficiency, and customer experience.
By adhering to its plan to address improper payments, the agency will decrease risk to SBA programs.
SBA has initiated several corrective actions to enhance and develop additional controls to address
loan reviews, loan forgiveness, and fraud, including establishing guidelines for loan and forgiveness
reviews and implementing SBA and contractor fraud risk management policy and framework. SBA has
also developed machine learning models to focus on areas of higher risks. Although many of its
efforts related to pandemic assistance programs, learning from past mistakes will help the agency
mitigate improper payments in future programs.
Seizure and Return of Funds
SBA, SBA OIG, and our external law enforcement partners are continuing to work together to seize or
return pandemic-related program funds that remain frozen at financial institutions. SBA is also
working to claw back funds the agency has determined to be improper payments.
As of August 2024, SBA and OIG have played a key role in the return of more than $30 billion in funds
through working with law enforcement partners and financial institutions. This includes $1.1 billion in
seized or forfeited assets and over $900 million in restitution orders. In addition, OIG’s collaboration
with SBA, the U.S. Secret Service, and other federal agencies and financial institutions has resulted in
nearly $9 billion in COVID-19 EIDL funds being seized or returned to SBA and $20 billion paid from
borrowers prior to the deferment period ending. Borrowers can make a voluntary payment or return
funds because of concerns they do not meet certain program eligibility requirements, such as the
economic need criteria or that the deposits are suspected to be fraudulent. SBA first issued guidance
on how borrowers can return funds in December 2023.
OIG’s audit work recommended and SBA agreed to conduct a cost-benefit analysis that led to SBA
reversing its decision to end collections and referring to Treasury the delinquent unsecured
purchased PPP loans with an outstanding principal balance of $100,000 or less, and delinquent
COVID-19 EIDLs with an original loan balance amount of $100,000 or less.
Our independent auditor found in the 2023 financial statements audit a material weakness in the
agency’s accounting for the PPP, COVID-19 EIDLs, Restaurant Revitalization Fund (RRF), and
Shuttered Venue Operators Grant (SVOG) programs. Because these programs are either in the
servicing or post-payment review phases, SBA needs to improve the process to recover funds or
identify funds that need to be recovered. Management did not adequately design and implement
controls to account for the recovery of funds related to these programs.
Also, management did not have adequate documentation about the financial reporting
considerations related to the recovery of funds for the RRF and SVOG programs including the
2025 Top Management and Performance Challenges | 6
U.S. Small Business Administration | Office of Inspector General
respective accounting entries. Management did not provide sufficient evidence of documented
accounting policies for the recovery of funds related to the COVID-19 EIDLs and PPP loan programs.
Further, management did not have adequate documentation about the appropriate accounting
treatment and the respective accounting entries throughout each step of the recovery life cycle in
accordance with generally accepted accounting principles.
The loss of taxpayer funds could be mitigated if SBA establishes clear, detailed guidance and tracking
on returned funds. SBA’s challenges are enforcing its current guidance for returning loan funds and
standardizing procedures on clawing back funds. Of particular concern is how SBA is going to claw
back PPP loans that were found to be ineligible after forgiveness. We recommended SBA establish
clearly defined and detailed roles, responsibilities, and processes for returning PPP funds. 6 As a
result, SBA developed a procedural notice to provide guidance to borrowers, lenders, and other
financial intermediaries on the return of PPP loan funds to SBA. OIG will continue to evaluate the
effectiveness of the established processes.
OIG Highlighted Work
1
Inspection of Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus
Pandemic (Report 21-02)
2
SBA’s Eligibility and Forgiveness Review of PPP Loans Made to Borrowers with Treasury’s Do Not Pay
Data Matches (Report 24-06)
3
COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Report 23-09)
4
SBA’s Implementation of the Women-Owned Small Business Certification Program (Report 22-20);
SBA’s Oversight of HUBZone Program Participants’ Continuing Eligibility (Report 24-23)
5
Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the Payment Integrity
Information Act of 2019 (Report 23-07); Independent Auditors’ Report on SBA’s Fiscal Year 2023
Compliance with the Payment Integrity Information Act of 2019 (Report 24-16)
6
Serious Concerns Regarding the Return of Paycheck Protection Program Funds (Report 23-08); SBA’s
Handling of Potentially Fraudulent Paycheck Protection Program Loans (Report 22-13)
2025 Top Management and Performance Challenges | 7
Challenge 2: Managing SBA’s Loan
Portfolio and Participating
Lenders
SBA provides entrepreneurs looking to start, grow, or
expand their small businesses access to financial assistance
through several business loan programs. The 7(a) loan
program is SBA’s principal vehicle for providing small
businesses with access to credit that cannot be obtained
elsewhere. Recipients may use proceeds from a 7(a) loan to
establish a new business or assist in acquiring, operating, or
expanding an existing business. This program relies on
numerous outside parties (such as loan agents and lenders)
to originate loans, and the agency has recently expanded non-bank lender participation. SBA also
provides long-term, low-interest direct disaster assistance loans to businesses of all sizes, private
nonprofits, homeowners, and renters following a declared disaster.
Even though the agency has disbursed and serviced billions in loans since its inception in 1953, the
COVID-19 pandemic presented a significant challenge because of the unprecedented demand in
funds and services from small business owners. SBA systems were never intended to handle such a
crisis, and OIG will continue to monitor how the agency handles long-term loan servicing that is
ninefold over what it handled before the pandemic. To protect taxpayer dollars, the challenge is for
SBA to increase its capacity to effectively service disaster loans, recover delinquent loans, and
maintain adequate oversight of financial institutions participating in its loan programs.
Servicing Disaster Loans
Prior to the pandemic, SBA typically serviced about 263,000 disaster loans totaling approximately
$9.4 billion. After the pandemic, SBA has the challenge of servicing approximately 2.5 million
outstanding disaster loans totaling approximately $283 billion — a ninefold increase in the amount
the agency was managing previously (Figure 4).
2025 Top Management and Performance Challenges | 8
U.S. Small Business Administration | Office of Inspector General
SBA typically services a disaster
Figure 4: The Increased Burden of COVID-19
loan until it is paid in full or up until
EIDL Servicing on SBA
default at 180 days. Treasury and
SBA have agreed that the agency
will service even defaulted loans
and attempt recovery on these
loans for up to 2 years, or until
SBA’s recovery efforts are
exhausted. This will further stress
SBA’s ability to fully and
completely service current loans
and perform full-spectrum
collection efforts on past-due and
defaulted loans. 1 SBA’s challenge is
to be responsive to recipients of
these loans and perform its due
diligence to mitigate loss to the
Source: OIG generated based on SBA data
taxpayer.
In response to the exponential increase in servicing responsibility, SBA has taken actions, such as
establishing the standalone COVID-19 EIDL Servicing Center in Fort Worth, Texas with more than
1,500 employees servicing over 2.2 million loans with a total value of $284 billion (as of August 2024).
Overseeing Lenders
SBA’s Office of Credit Risk Management manages program credit risk on financial assistance
portfolios of guaranteed loans that totaled about $153 billion as of March 2024. The office monitors
lender performance and enforces lending program requirements.
SBA made significant policy changes to its traditional 7(a) loan program with the goal of helping
expand access to capital, including increasing non-bank lender participation, such as Community
Advantage and Small Business Lending Companies. Lenders that participated in SBA’s mission-lending
Community Advantage Pilot Program and over 30 additional lenders were granted access to the 7(a)
loan program as Community Advantage Small Business Lending Companies, bringing the total to over
140. Additionally, for over 40 years, traditional SBA Small Business Lending Companies licenses were
limited to 14, but SBA granted 3 additional licenses in fiscal year (FY) 2024.
SBA’s challenge is to reach more entrepreneurs while mitigating increased risk to its 7(a) loan
program. Many non-bank lenders are not regulated by other federal entities, which means they are
2025 Top Management and Performance Challenges | 9
U.S. Small Business Administration | Office of Inspector General
primarily regulated and examined by SBA. These lenders are
considered by SBA to be higher risk than those lenders with Our Investigative Actions
federal regulators and require more oversight by SBA’s Office Involving PPP Lenders
of Credit Risk Management. 2 OIG has conducted prior audit “When the nation was
work related to third-party service providers in the 7(a) facing a pandemic-
program, and we are currently assessing the risk associated induced crisis, Kabbage
with non-bank lenders in PPP. In addition, we have received tens of millions
investigative cases that reflect some of the effects non-bank of dollars through the PPP
lenders have had on the PPP. to help lend taxpayer
For the PPP, third-party service providers could perform a funds to businesses in
variety of services in either the loan origination or need. Instead of
forgiveness processes, including assisting lenders with certain safeguarding those funds,
lender functions (e.g., determining eligibility), technology Kabbage doled out
services, and referral services. inflated and fraudulent
loans, in an effort to
Related to prior work OIG has conducted in this area, SBA has
maximize its profits.”
significantly improved its tracking and monitoring of third-
U.S. Attorney’s Office
party providers in the traditional loan programs and the
District of Massachusetts
inherent risks associated with delegated lending require
effective oversight to monitor compliance with SBA policies
and procedures as well as timely corrective actions to
address noncompliance. With this in mind, it is vital that SBA
CEO of PPP lender MBE
continue to
Capital “lied to get money
• Enhance the oversight of program lenders; that was supposed to help
• Enhance the oversight of third-party service people through the
providers, including loan agents who lenders place challenges of COVID-19.
significant reliance on; and He lied so that he could
fund a lavish lifestyle of
• Address emerging issues in a timely manner to reduce
cars, jets, and fancy
risks.
homes.”
Ensuring Retention of Pandemic-Related U.S. Attorney’s Office
Southern District of New
Loan and Award Records
York
SBA guarantees a certain percentage of a business loan made
by a participating lender to the small business borrower.
Lenders maintain the loan files and service the loan until
either the loan is paid in full or SBA purchases the guaranty
2025 Top Management and Performance Challenges | 10
U.S. Small Business Administration | Office of Inspector General
and charges off any uncollectible balance. 3 That means most loan documents and data reside only
with the participating lender.
For the PPP, SBA only required the lenders to enter applicant information into data fields in the SBA
system. SBA did not obtain borrower bank account details associated with the disbursement or
internet protocol addresses and web log data associated with the electronic signature on the
applications. This means SBA was not able to fully capitalize on data analytics technology, such as
artificial intelligence and machine learning, to identify noncompliance with program requirements
and likely fraud. Future programs could be designed to capture this data.
For example, two PPP lenders are no longer in business and not all data and documentation were
maintained; therefore, the agency has been challenged in conducting oversight of PPP loans issued
by those lenders.
Retaining documentation and sufficient evidence to support loan decisions is consistent with federal
standards for internal controls. These controls require managers to support their decisions and
determinations with supporting documentation, which includes the rationale of how loan decisions
were made. For this reason, it is important that all loan records are properly managed, maintained,
and available. 4
The challenge is for SBA to continuously monitor and communicate with participating lenders to
safeguard loan information and documents related to lending decisions, which is imperative in cases
where the lender dissolves or ceases to service the loan. We recommended SBA conduct reviews of
PPP lenders to ensure they complied with their communication, servicing, and debt collection activity
requirements. We also recommended SBA require lenders to submit evidence of these activities with
the borrower prior to guaranty purchase.
If the agency does not take these steps, SBA will not have adequate information to make loan
decisions, and law enforcement personnel will not have access to the information needed to
prosecute parties that fraudulently obtained the loans guaranteed by taxpayer dollars.
Congress and the Administration took swift action to extend the statutes of limitations for
prosecution of PPP and COVID-19 EIDLs from 5 to 10 years, to end in 2032, but it will be difficult to
prosecute bad actors if loan documents and data are not available. To correspond to the 10-year PPP
fraud statute of limitations, SBA extended the records retention requirement for all PPP lenders to
10 years from the date of final disposition of each PPP loan. i
i
89 F.R. 68090 Business Loan Program Temporary Changes; PPP-Extension of Lender Records Retention Requirements,
(August 2024).
2025 Top Management and Performance Challenges | 11
U.S. Small Business Administration | Office of Inspector General
This increase in the statute of limitations does not apply to the Restaurant Revitalization Fund and
Shuttered Venue Operators Grant programs, which remains at 5 years from application or reporting
date. SBA only requires Restaurant Revitalization Fund recipients to retain their grant records for 3
years. If program officials do not conduct reviews in a timely manner, or extend the record retention
period, SBA could miss the opportunity to prosecute bad actors and recover funds incorrectly or
fraudulently obtained.
OIG Highlighted Work
1
Ending Active Collections on Delinquent COVID-19 Economic Injury Disaster Loans (Report 23-16)
2
Audit of SBA’s Oversight of High-Risk Lenders (Report 20-03)
3
SBA’s Guaranty Purchases for Paycheck Protection Program Loans (Report 22-25)
4
SBA’s Eligibility and Forgiveness Review of PPP Loans Made to Borrowers with Treasury’s Do Not Pay
Data Matches (Report 24-06)
2025 Top Management and Performance Challenges | 12
Challenge 3: Measuring
Performance and Monitoring SBA
Programs
SBA manages programs to help support American entrepreneurs access funds, federal contracts, and
business counseling. Integral to this is measuring performance and monitoring these programs to
help small businesses, directly affecting the strength of the American economy. SBA’s challenge is to
improve the measures it uses to assess its’ programs effects and improve grantee oversight, better
serving entrepreneurs and ensuring that every dollar spent delivers results. OIG audits and reviews
have consistently identified opportunities for SBA to enhance and improve its performance data,
measures, and goals to assess its programs and better inform Congress and taxpayers about program
effectiveness. We have also raised concerns about SBA’s practices used to oversee grant recipients’
use of funds to ensure effective support of agency initiatives to help start and grow small businesses.
Measuring Program Performance
Federal guidance requires management to establish meaningful performance goals and measure
progress, i which provides proof of success and helps improve future programs. With over 33 million
small businesses supporting the economy, having clearly defined program goals and targets are
essential to achieving program objectives.
However, our reviews, including of the SCORE mentorship network, an SBA Resource Partner, and of
the State Trade Expansion Program, the Boots to Business program, and the 8(a) Business
Development program, consistently found opportunities for SBA to improve its measures used to
assess program goal accomplishments. 1
For example, when SBA initially established the Shuttered Venue Operators Grant (SVOG), we issued
a management alert suggesting the agency establish performance goals and measures before
disbursing $14.6 billion in funds to shuttered venues. 2 In response to this alert, SBA established
performance measures to assess whether the program successfully aided small businesses in the live
i
2 C.F.R. §200.202.
2025 Top Management and Performance Challenges | 13
U.S. Small Business Administration | Office of Inspector General
arts and entertainment industry. We are in the process of assessing SBA’s oversight of program
performance.
Monitoring Program Performance Results
Federal standards for internal controls require managers to use quality information to achieve their
objectives. This requires that program officials ensure information is complete, accurate, accessible,
and provided on a timely basis so that leaders can make informed decisions and evaluate
performance. Without accurate and complete performance reporting and comprehensive reviews of
performance reports, SBA grant programs may not achieve their intended results.
In a recent review of SBA’s oversight of Small Business Innovation Research (SBIR) and Small Business
Technology Transfer (STTR) programs, we found there was limited assurance that small businesses
met minimum performance standards. 3 The programs also relied on self-certifications. Small
businesses must meet minimum performance standards to compete for SBIR and STTR awards. These
programs help entrepreneurs explore their technological potential and provide an incentive to profit
from commercialization. Changes to the Small Business Act could improve SBA’s ability to monitor
performance standards, reducing risks because the small businesses may not have the ability to
achieve program goals for commercialization as intended by the Act.
Our review of the SBA Mentor-Protege Program found program officials established program
outcomes and a process to measure results, but they did not collect sufficient data to accurately
assess whether the program had its intended effect. 4
SBA’s challenge is to monitor grantee performance in such areas as the estimated number of jobs
saved or created, tax revenue generated, and entity operational status.
2025 Top Management and Performance Challenges | 14
U.S. Small Business Administration | Office of Inspector General
Ensuring Funds Are Used for Intended Purposes
We have identified systemic issues with SBA’s oversight Figure 5: Total Number of RRF
of grant recipients’ use of federal funds. These issues and SVOG Awards that SBA
included not enforcing financial reporting requirements, Must Review Manually
not detecting grant recipient budget reallocations, using
weak financial review procedures, and missing supporting
documentation. SBA’s challenge is to improve its grant
management processes and procedures to ensure funds
are used for allocable, allowable, and reasonable
expenditures.
In our review of Women’s Business Centers and their use
of award funds, we found monitoring practices could’ve
been improved in recipients’ accounting for federal
expenses, matching funds, and program income. 5 SBA has
developed guidance that, once fully implemented, will
more effectively monitor if funds are used for their
intended purpose.
Federal funds can greatly assist struggling small businesses
during an economic crisis. For example, SVOG and
Restaurant Revitalization Fund (RRF) awards were Source: OIG generated based on SBA data
intended to help businesses in the restaurant industry and
venues struggling to stay in business during the pandemic. SBA has transitioned from quickly
disbursing SVOG and RRF awards to monitoring and closing them out.
In a recent audit of SBA’s oversight of RRF recipients, we found program officials needed to obtain
sufficient information to monitor the recipients to ensure funds were used as intended. 6 RRF
recipients were required to submit their final use of funds report to SBA by April 30, 2023. As of
August 2024, 9.7 percent of all recipients, with awards totaling $1.6 billion, had not yet filed the
required report.
To oversee the RRF and SVOG programs, SBA selected samples of the award recipients to manually
confirm eligibility, award calculation, and use of funds (Figure 5). We found the reviews for both
programs were being conducted at a rate that would extend beyond the required timeframe for
grantees to retain award records and the statute of limitations for prosecution of fraud or misuse.
Program officials’ challenge is to prioritize the RRF and SVOG reviews to increase the opportunity to
2025 Top Management and Performance Challenges | 15
U.S. Small Business Administration | Office of Inspector General
save taxpayer funds. 7 SBA managers stated they have increased staff allocated to these reviews and
are working to manage resources to complete the reviews within the critical timeframes.
In addition, we found program officials did not review all awards made to potentially fraudulent or
ineligible recipients, as the agency had originally planned to do. 8 We also found SBA needed to
implement procedures for recipients to return unused or improperly awarded funds to Treasury.
SBA’s challenge is to effectively manage its resources to meet the demands of monitoring awardee
compliance with award requirements. Improving awardee oversight will better position the agency to
effectively measure and accurately report performance results and assess whether the federal
assistance programs were effective and funds were used appropriately.
OIG Highlighted Work
1
Audit of SBA’s Oversight of the SCORE Association (Report 19-12); Audit of SBA’s State Trade
Expansion Program (Report 18-11); The Small Business Administration’s Boots to Business Program
(Report 18-20); SBA’s Business Development Assistance to 8(a) Program Participants (Report 22-08)
2
Serious Concerns about SBA’s Control Environment and the Tracking of Performance Results in the
Shuttered Venue Operators Grant Program (Report 21-13)
3
SBA’s Implementation of the SBIR and STTR Extension Act of 2022 (Report 24-14)
4
Evaluation of SBA's All Small Mentor-Protege Program (Report 19-17)
5
Audit of SBA’s Oversight of Women’s Business Centers’ Compliance with Cooperative Agreement
Financial Requirements (Report 21-14)
6
SBA’s Oversight of Restaurant Revitalization Fund Recipients (Report 23-15)
7
Improvements Needed in SBA’s Shuttered Venue Operators Grant Post-Award Review Process
(Report 24-21)
8
SBA’s Administrative Process to Address Potentially Fraudulent Restaurant Revitalization Fund
Awards (Report 23-10)
2025 Top Management and Performance Challenges | 16
Challenge 4: Managing Data
SBA’s data systems are a primary
method for customer service and interaction, helping
disburse vital assistance and meet program goals. But
during the pandemic economic crisis, the lack of data
standards and the data environment, which did not
include a centralized data warehouse, limited SBA’s ability
to respond to risks. Data standards and data reliability
improves analytical decision making and fraud
identification. By implementing best practices in data
management, the agency will have a stronger foundation for identifying and preventing fraud
schemes.
SBA’s challenge is to mitigate the risk of fraud in future crises by enhancing its management of both
internal data and data from other federal agencies. By enhancing data handling and sharing practices,
SBA can efficiently exchange relevant information with other government entities and leverage data
from federal partners to make more informed decisions, ultimately benefiting the American people.
Storing, Monitoring, and Analyzing Program Data
During the pandemic economic crisis, SBA’s internal controls and processes were insufficient to
address fraud risks because there was no centralized database of applicant information. For example,
PPP loans were made by two institutions that subsequently failed. Some borrower information was
lost, making it more difficult for the government to detect fraud, investigate, and prosecute
wrongdoers (see Ensuring Retention of Pandemic-Related Loan and Award Records).
The agency would be better positioned to fight fraud by consistently collecting key data attributes,
such as applicant contact information, deposit bank accounts, and web log data across all its
programs, and then storing it in a centralized database. 1 This database would be key in fraud
prevention analysis across all programs. 2 i
i
GAO, GAO-15-593SP, A Framework for Managing Fraud Risks in Federal Programs, (2015).
2025 Top Management and Performance Challenges | 17
U.S. Small Business Administration | Office of Inspector General
SBA’s challenge is to minimize fraud risk and manage funding to eligible applicants by implementing
consistent data standards, data storage, and data collection requirements. ii iii This starts with a
strong internal effort to require the consistent collection of relevant data across all loan and grant
programs.
For 4 consecutive years, the independent public accounting firm that performed SBA’s annual
financial statement audit has found material weaknesses in the agency’s design and monitoring
processes. These areas include data management controls in the PPP, COVID-19 EIDL, RRF, and SVOG
programs. 3 This means the agency’s financial reports do not meet federal criteria for a complete and
accurate population of loans disbursed to eligible recipients as of the end of fiscal year (FY) 2024,
according to the FY 2023 Financial Statements audit.
For example, SVOG data is maintained in a separate database. If integrated in a centralized
warehouse enforcing data standards, SBA could analyze fraud indicators across its programs and
prevent additional disbursements to fraudulent actors in current and future programs. iv
SBA programs with different eligibility requirements can still collect and maintain much of the same
data, including verified applicant names, contact information, deposit bank accounts, and web log
data. The consolidation can be accomplished even with credit programs that use third-party lenders.
Consistent data standards, collection, and storage are foundational elements of an analytics strategy.
SBA could use data analytic tools to systematically validate all applicants against fraud indicators
detected across data from all its loan and grant programs. Using data analytics across all programs, as
permitted by law, will help SBA better identify cases of fraud before the loan or grant is disbursed.
Sharing Authorized Data Between Government Agencies
As recommended by the Pandemic Response Accountability Committee, expanding government data
sharing is a critical component for effective fraud prevention in federal agencies. v SBA’s challenge is
to secure sufficient and complete data sharing agreements with other federal agencies and ensuring
ii
Office of Management and Budget, M-19-18, “Federal Data Strategy – A Framework for Consistency” (June 4, 2019).
iii
GAO, GAO-24-106565, Fraud Risk Management: Agencies Should Continue Efforts to Implement Leading Practices,
(2024).
iv
GAO, GAO-24-107395, Small Business Administration: Progress and Work Remaining to Implement Key Management
Improvements, (2024).
v
Pandemic Response Accountability Committee, Blueprint for Enhanced Program Integrity, Chapter 2: Opportunities for
Policymakers to Improve Program Integrity, (August 2024).
2025 Top Management and Performance Challenges | 18
U.S. Small Business Administration | Office of Inspector General
expired agreements are reestablished. These agreements can better help federal agencies verify
applicant information and detect fraud.
SBA has effectively used data sharing in the past, such as with the Department of Housing and Urban
Development, pursuant to the Stafford Act, to prevent duplication of benefits with community
development block grants. 4 Also, we have ongoing audit work to identify opportunities for data
sharing with the U.S. Department of Labor.
A key component of this issue is SBA efficiently sharing relevant data with other government agencies
and, in turn, analyzing the information it receives to better serve the American people. Prior to
initiating new programs, the agency should undertake rigorous risk assessments to protect data and
mitigate the inherent risks of fraud, vi such as matching against Do Not Pay data before deploying new
loan or grant programs.
Another example of effective data sharing between agencies would be if SBA pursues a legal
framework to establish Social Security Number verification data. Given the volume of identity theft
associated with SBA pandemic loan fraud, Social Security Number verification could have helped
mitigate the fraud. If statutory limitations prevent SBA from accessing this or other critical data
assets, there are other opportunities for responsible data sharing that could strengthen fraud
detection efforts as outlined by GAO and OMB. As was done with Do Not Pay data sharing
agreements with Treasury, the agency could undertake additional collaborative efforts to uncover
fraud, waste, and abuse. The most effective programs would start with the agreements and systems
in place to mitigate fraud, rather than chasing after fraudsters after the funds have been disbursed.
Evaluating and Improving Data Reliability
Our 2023 financial statements audit found another challenge to SBA’s internal controls that are
integral for financial data reliability and accuracy. OIG’s independent auditors were unable to find
reliable financial reporting evidence to provide a basis for an audit opinion in the agency’s financial
reports. As a result, the auditors were unable to provide an opinion on the reliability and integrity of
financial information reported by the agency.
vi
OMB, M-18-16, “Appendix A to OMB Circular No. A-123, Management of Reporting and Data Integrity Risk” (June 6,
2018).
2025 Top Management and Performance Challenges | 19
U.S. Small Business Administration | Office of Inspector General
The Standards for Internal Control in the Federal Government and SBA’s 2023 Agency Financial Report
highlight proper procedures for evaluating and improving data reliability. vii viii OMB also gives priority
to data reliability. ix
The agency should improve the design and implementation of monitoring processes to allow for
transparent and accurate financial reporting.
We believe if SBA conducts a comprehensive data quality evaluation, it can then complete a full
evaluation of current infrastructure, program data quality, and IT processes. SBA’s data quality
evaluation should monitor consistent data standards, data completeness, and data accuracy. A data
quality assessment is particularly relevant as the agency starts to investigate and integrate artificial
intelligence into its programs and services.
OIG Highlighted Work
1
SBA’s Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan Program (Report 21-
15); COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Report 23-09)
2
SBA’s COVID-19 EIDL Program Data Migration Challenges (Report 22-16)
3
Independent Auditors’ Report on SBA’s Fiscal Year 2022 Compliance with the Payment Integrity
Information Act of 2019 (Report 23-07); Independent Auditors’ Report on SBA’s Fiscal Year 2023
Financial Statements (Report 24-03)
4
SBA’s Controls to Prevent Duplication of Benefits with Community Development Block Grants (Report
15-14)
vii
SBA, Agency Financial Report Fiscal Year 2023, at 53 (2024).
viii
GAO, GAO-14-704G, Standards for Internal Control in the Federal Government, principles 10 and 13, Design Control
Activities and Use Quality Information, (2014).
ix
OMB, M-18-16, “Appendix A to OMB Circular No. A-123, Management of Reporting and Data Integrity Risk”
(June 6, 2018).
2025 Top Management and Performance Challenges | 20
Challenge 5: Managing Risks in
Information Technology Systems
and Cybersecurity
OIG and GAO have reported on
Figure 6: Risk Management Best Practices
significant SBA information technology
Strategy
(IT) systems internal control and
cybersecurity issues, which the agency
has also identified. This remains a
challenge for SBA because a strong IT
governance framework enables the
agency to achieve mission goals and
objectives while safeguarding taxpayer
funds. A governance framework in this
challenge area is an integrated
strategy that identifies, measures, and
controls risk in IT investments, fraud,
and artificial intelligence (AI) (Figure
6). These processes will help the Source: OIG generated from NIST data
agency better deliver SBA programs
and services, particularly in times of
crisis.
Improving Information Technology Systems Management
In March 2024, OIG determined SBA has not had effective IT management policies and procedures
for several years, and the new IT systems framework is not scheduled to be implemented until FY
2025. The agency has had issues related to IT software investment governance that include:
• Lack of oversight from the governance board;
• Not identifying the intended purpose of software investments and their expected benefits;
• Lack of monitoring against performance measurement baselines. 1
2025 Top Management and Performance Challenges | 21
U.S. Small Business Administration | Office of Inspector General
An IT system is essential to mission delivery and
enhances organizational performance. IT system
management is on GAO’s high-risk list because these
purchases are often a large investment of taxpayer
funds for mission critical functions. For example, SBA
plans to spend more than $328 million on IT
investments for FY 2025. i
Preparing for Artificial
Intelligence Challenges
OIG’s preliminary review of the agency’s charter and minutes of the AI Governance Council indicates
the agency has taken preliminary measures to meet the requirements of OMB M-24-10, “Advancing
Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence.” The agency
established an AI Governance Council in May 2024 to identify, measure, and control AI risks. In
addition, the AI Governance Council has established criteria to assess AI use cases, and it has
reviewed several AI use cases to date.
SBA is using a machine-based system to predict loan guaranty default rate. This machine-based
modeling would be considered AI under 15 U.S.C. § 9401(3), which is why this is a top issue for 2025.
SBA is using an updated machine-based model to predict the probability that a 7(a) loan or a 504
Certified Development Company loan will default within a year. Projected defaults are predicated
based off data variables such as loan payment behavior, loan characteristics (like loan amount, term,
interest type), and borrower data types (like number of delinquent accounts, credit history, payment
experience, and age of oldest account).
We have found no evidence, as of September 2024, that the predictive risk machine-based modeling
system was vetted through SBA’s Business Technology Investment Council, although it was a major
investment of more than $500,000. The council should be reviewing all IT investments to ensure best
use of taxpayer dollars and value to the agency.
We also determined that an AI risk assessment was not conducted, as of June 2024. OMB states that
while agencies can capitalize on AI to boost agency performance, they must also manage a range of
risks. ii The memorandum requires several key actions, such as:
i
SBA, FY 2025 Congressional Budget Justification FY 2023 Annual Performance Report, (March 11, 2024).
ii
OMB, M-24-10, “Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence”
(March 28, 2024).
2025 Top Management and Performance Challenges | 22
U.S. Small Business Administration | Office of Inspector General
• Designating a Chief AI Officer who is responsible for developing best practices that
correspond with the National Institute of Standards and Technology Artificial Intelligence Risk
Management Framework 1.0;
• Assessing risks with all AI applications to ensure compliance with the OMB memo;
• Identifying AI purposes and its expected benefits to the agency;
• Testing the AI for performance in a real-world environment before launching it;
• Independently evaluating and monitoring AI, regularly evaluating risks;
• Promoting competition in AI software purchases from contractors or vendors.
SBA’s challenge is to take a proactive stance to risk management in IT system development. So far,
we have been unable to review tools and controls that show SBA is prepared for AI risks. This
challenge includes enacting appropriate safeguards against fraud, privacy infringements, and
unintended bias and discrimination. 2 This means the AI could learn from its past decisions to
unintentionally categorize certain borrowers as more likely to default. Effective risk management will
also reduce the likelihood that fraudsters will be able to steal from taxpayers and exploit programs
meant to help eligible small business owners and entrepreneurs.
Deploying and Monitoring New Third-Party Systems
The agency relies on external vendors or third-party service providers for software and IT services.
While these outside solutions are expedient, SBA’s challenge is to implement robust due diligence
and continuous monitoring to ensure data integrity is maintained throughout the processing cycle.
Shortfalls in these processes have contributed to SBA having material weaknesses and disclaimers of
financial reporting reliability going back to FY 2020. iii 3
We also found SBA’s work to address this challenge is stymied by an outdated system development
policy for the purchase, launching, and management of software and related application
development activities. Updated system guidance is crucial for monitoring third-party systems used
to process transactions integral to the mission of SBA.
Proper guidance on monitoring third-party systems can be found though System and Organization
Controls 1 reviews. iv Our independent financial statement auditors also identified material
weaknesses related to insufficient technical support and inadequate system controls, possibly leading
iii
SBA, Agency Financial Report Fiscal Year 2020, (2021).
iv
OMB, A-123, “Management’s Responsibility for Enterprise Risk Management and Internal Control” (July 2016).
2025 Top Management and Performance Challenges | 23
U.S. Small Business Administration | Office of Inspector General
to operational inefficiencies and increased risk of errors. These reviews allow agencies to evaluate
the effectiveness of their internal controls over financial reporting.
SBA’s development guidance requires that systems are designed with adequate controls to prevent
unauthorized access and data breaches. It is also a challenge for the agency to establish clear
guidelines for system use, including collaboration with program end users, ensuring that ongoing
technical support is readily available. New platforms must be configured to provide OIG statutory
access to its data and systems access for oversight needs and to detect fraud, waste, and abuse. As
new systems are developed, the importance of robust technical support and continuous system
monitoring is integral to data quality. 4
Complying with Federal Information Security
Modernization Act Management Requirements
Our evaluations of SBA’s systems, policies, and procedures regarding the Federal Information
Security Modernization Act (FISMA) show this area continues to be a challenge for the agency. The
agency’s overall security program continues to be rated as “not effective” in accordance with federal
guidance. v 5 Because of SBA’s mission and the personal identifiable information it is required to
collect to carry out that mission, the agency is susceptible to privacy and data breaches.
Cyberattacks and related threats could imperil critical SBA operations and programs, potentially
compromising service. Improving the agency’s readiness for cybersecurity threats requires an
adaptation of mindset and organizational change across SBA. The agency is working on several
significant investments to withstand the potential risk, to align with its policy, including employing a
risk-based approach to identifying and implementing information system security solutions to protect
technology and data, and requiring contractors, loan servicers, and other external entities to
implement these comprehensive cybersecurity solutions. 6
v
Council of the Inspectors General on Integrity and Efficiency, FY 2023 – 2024 Inspector General Federal Information
Security Modernization Act of 2014 Reporting Metrics, (February 10, 2023).
2025 Top Management and Performance Challenges | 24
U.S. Small Business Administration | Office of Inspector General
OIG Highlighted Work
1
SBA’s IT Investment Governance Framework (Report 24-10)
2
COVID-19 and Disaster Assistance Information Systems Security Controls (Report 22-19)
3
Independent Auditors’ Report on SBA’s FY 2020 Financial Statements (Report 21-04)
4
SBA’s Eligibility and Forgiveness Review of PPP Loans Made to Borrowers with Treasury’s Do Not Pay
Data Matches (Report 24-06)
5
Fiscal Year 2023 Federal Information Security Modernization Act (Report 24-07)
6
Independent Auditors’ Report on SBA’s Fiscal Year 2023 Financial Statements (Report 24-03)
2025 Top Management and Performance Challenges | 25
Make a Difference
To promote integrity, economy, and efficiency, we encourage you to report instances of fraud, waste,
or mismanagement to the OIG Hotline.*
Visit our OIG Hotline website.
Write or visit:
U.S. Small Business Administration
Office of Inspector General
Investigations Division
409 Third Street SW (5th Floor)
Washington, D.C. 20416
* In accordance with Sections 7 and 8L(b)(2)(B) of the Inspector General’s Act, confidentiality of a complainant’s
personally identifying information is mandatory, absent express consent by the complainant authorizing the release of
such information.
2025 Top Management and Performance Challenges | 26
File and source
- File
- SBA-OIG-Report-25-01.pdf
- Size
- 2,316,921 bytes
- SHA-256
- 90b4a22a4679e451c951505ecd42d1566cc5724f1716a230d9c5bd1c20dcb2b5
- Our copy
- SBA-OIG-Report-25-01.pdf
- Original
- www.oversight.gov