SBA's Restaurant Revitalization Fund Program Award Practices (SBA OIG Audit Report, Report 24-09, March 26, 2024)
Summary
SBA OIG Audit Report 24-09, dated March 26, 2024, reviews the controls SBA used to award Restaurant Revitalization Fund grants. From May 2021 SBA received 278,300 applications requesting $72.2 billion, approved approximately 101,000 and disbursed all $28.6 billion authorized. OIG found that SBA paid nearly $6.7 billion to applicants without sufficiently verifying eligibility, including $6.0 billion to 47,565 applicants whose historical sales were not verified, $552 million to 901 applications despite PPP fraud indicators, $377 million to self-described inns and breweries approved automatically, and $55 million to affiliated groups above the statutory limit. Of five recommendations, management agreed or partially agreed with all five; OIG reached no resolution on recommendations 2, 3 and 5.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
U.S. SMALL BUSINESS ADMINISTRATION OFFICE OF INSPECTOR GENERAL
SBA’s Restaurant Revitalization Fund
Program Award Practices
Audit Report
Report 24-09
March 26, 2024
Make a Difference
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s
Office of Inspector General Hotline at https://www.sba.gov/oig/hotline. You can also write to the
U.S. Small Business Administration, Office of Inspector General, 409 Third Street, SW (5th Floor),
Washington, DC 20416. In accordance with the Inspector General Act of 1978, codified as
amended at 5 U.S.C. §§ 407(b) and 420(b)(2)(B), confidentiality of a complainant’s personally
identifying information is mandatory, absent express consent by the complainant authorizing the
release of such information.
NOTICE:
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023,
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities
identified in this report have the opportunity to submit a written response for the purpose of
clarifying or providing additional context as it relates to any specific reference contained herein.
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date.
We request that any comments be no longer than two pages, Section 508 compliant, and free
from any proprietary or otherwise sensitive information. The comments may be appended to
this report and posted on our public website.
U.S. Small Business Administration
Office of Inspector General
EXECUTIVE SUMMARY
SBA’s Revitalization Fund Program Award Practices
(Report 24-09)
What OIG Reviewed • $6.0 billion to applicants without verifying
We reviewed the U.S. Small Business historical data as planned;
Administration’s (SBA) Restaurant Revitalization • $377 million to applicants that claimed to
Fund (RRF) application review and approval operate as an inn or brewery, through
process. The American Rescue Plan Act of 2021 automated approval and without program
established the RRF to help small businesses in eligibility review; and
the food service industry adversely affected by • $55 million to affiliate groups that
the Coronavirus Disease 2019 pandemic. collectively received amounts in excess of
Beginning in May 2021, SBA received 278,300 the statutory limit.
RRF applications requesting $72.2 billion in relief
After accounting for award amounts that we
payments. SBA approved approximately 101,000
questioned for more than one eligibility
applications and disbursed all $28.6 billion
requirement, we determined that SBA disbursed
authorized for the program.
nearly $6.7 billion to applicants without
The objective of this review was to determine sufficiently verifying they were eligible for
whether the controls SBA implemented to award.
award RRF program funds in accordance with
What OIG Recommended
the Act and other applicable guidance were
effective. We made five recommendations for SBA to
improve the use of data to reduce risks of
What OIG Found
making improper payments, and to review and
SBA developed an implementation plan recover funds awarded to applicants that did not
including a risk framework that was intended to meet eligibility requirements or received funds
reduce the risk of making improper payments that exceeded statutory limits.
and awarding RRF funds to ineligible recipients.
Agency Response
However, the plan did not include all program
requirements and SBA did not always adhere to SBA management agreed or partially agreed
the plan or have sufficient controls to ensure with all five recommendations. Management’s
program and statutory requirements were met planned actions resolve recommendations 1 and
by RRF applicants. As a result, we determined 4. Management plans to develop a fraud risk
SBA awarded: framework to reduce improper payment risks in
SBA programs and recover funds paid to
• $552 million of improper payments to
affiliated business groups that exceed statutory
applicants with a history of “likely fraud” by
limits. We did not reach resolution on
not effectively leveraging fraud indicators
recommendations 2, 3, and 5. OIG will seek
available in Paycheck Protection Program
resolution in accordance with our audit
(PPP) loan data as planned;
resolution policies and procedures.
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
Date: March 26, 2024
To: Isabella Casillas Guzman
Administrator
From: Hannibal “Mike” Ware
Inspector General
Subject: Audit of SBA’s Restaurant Revitalization Fund Award Practices (Report 24-09)
This report presents the results of our audit of SBA’s Restaurant Revitalization Fund Award
Practices. We considered management comments on the draft of this report when preparing the
final report. SBA management agreed with two recommendations and partially agreed with
three recommendations. Three recommendations are pending resolution.
We appreciate the cooperation and courtesies provided by your staff. If you have any questions
or need additional information, please contact Christina Sweet, Director, Business Development
Programs Group, or Andrea Deadwyler, Assistant Inspector General for Audits, at (202)
205-6586.
Cc: Dilawar Syed, Deputy Administrator
Arthur Plews, Chief of Staff
Isabelle James, Deputy Chief of Staff
Therese Meers, General Counsel, Office of General Counsel
Kathryn Frost, Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and the Chief
Financial Officer
Jihoon Kim, Director, Office of Financial Program Operations, Office of Capital Access
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls
Anna Maria Calcagno, Director, Office of Program Performance, Analysis, and Evaluation
Walter Hill, Chief Risk Officer, Office of Enterprise Integrity
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
Contents
Introduction .................................................................................................................................... 1
Eligibility Requirements ................................................................................................................... 1
Program Design ............................................................................................................................... 2
RRF Application Risk Framework ..................................................................................................... 2
Prior Audit Work.............................................................................................................................. 4
Objective ......................................................................................................................................... 4
Results ............................................................................................................................................. 4
Finding 1: Critical Data Not Used as Planned to Prevent Awarding Funds to Ineligible Recipients . 5
Recommendation ............................................................................................................................ 6
Finding 2: Historical Sales for All RRF Applicants Not Validated as Planned When Determining
Eligibility ......................................................................................................................................... 6
Recommendation ............................................................................................................................ 8
Finding 3: Verification that Certain Types of Businesses Met Eligibility Requirements................... 8
Recommendation ............................................................................................................................ 9
Finding 4: Controls to Ensure Affiliated Businesses Complied with the Act’s Requirements .......... 9
Recommendations ........................................................................................................................ 10
Other Matters: SBA Paid Out Remaining and Unused RRF Funds ..................................... 11
Evaluation of Agency Response..................................................................................................... 11
Summary of Actions Necessary to Close the Recommendations .................................................. 12
Tables
1: Risk Framework SBA Used to Process RRF Applications .............................................................. 3
Figures
1: SBA’s System Design Flaw on Validating Historical Sales Against IRS Data for Tier 2 Applications
......................................................................................................................................................... 7
i
Appendices
1: Scope and Methodology .......................................................................................................... 1-1
Use of Computer-Processed Data .................................................................................... 1-2
Assessment of Internal Controls....................................................................................... 1-2
Prior Audit Coverage ........................................................................................................ 1-3
2: Monetary Impact...................................................................................................................... 2-1
3: Agency Response...................................................................................................................... 3-1
ii
Introduction
The American Rescue Plan Act of 2021 (the Act) established the Restaurant Revitalization Fund
(RRF) program with $28.6 billion to help small businesses in the food service industry adversely
affected by the Coronavirus Disease 2019 (COVID-19) pandemic. 1
The program opened for applications in May 2021. The U.S. Small Business Administration (SBA)
received 278,000 RRF applications requesting $72.2 billion in relief payments. SBA approved
approximately 101,000 applications and disbursed $28.6 billion in funds authorized for the
program. These included awards made in November 2022 using $83.4 million of remaining funds
from awards returned from RRF applicants, unused funds set-aside for RRF litigation purposes,
and other sources of funds not previously disbursed.
This report presents the results of our audit of SBA’s procedures for ensuring that RRF program
funds were properly awarded to eligible businesses.
Eligibility Requirements
Eligible entities are businesses that were not permanently closed at the time of application, and
include those where the public or patrons assemble for the primary purpose of being served
food or drink, such as restaurants, bars, caterers, and food trucks. 2 Establishments such as inns,
bakeries, wineries, distilleries, and breweries (hereafter referred to as “breweries or inns”) were
required to provide proof that at least 33 percent of gross receipts were derived from onsite
food or beverage sales to the public. State or local government-operated entities, entities that
owned over twenty business locations (with affiliates), and publicly traded companies were not
eligible.
The Act permitted applicants to self-certify that they (1) needed the funds to support operations
due to current economic uncertainty; and (2) did not have a pending application for or receive
funds from the Shuttered Venue Operators Grant program.
1
American Rescue Plan Act of 2021. Pub. L. No. 117-2, § 5003(a)(4) and § 5003(c)(6) (March 11, 2021).
2 American Rescue Plan Act of 2021. Pub. L. No. 117-2, § 5003(a)(4) (March 11, 2021).
1
Program Design
In accordance with the Office of Management Budget guidance, SBA submitted an RRF program
implementation plan for approval. 3 The RRF implementation plan was designed primarily in
response to shortcomings in internal controls identified in the implementation of the Paycheck
Protection Program (PPP). 4 To address those concerns, SBA followed the Government
Accountability Office’s (GAO) guidance on fraud risk management to better prevent, respond,
and detect fraud for the RRF program. 5 SBA designed a process for approving applications based
on high or low risks associated with the applications’ type and traits prior to submission for
automated or manual review. To assess some of these traits, all applications were screened
against six pre-award controls:
• Validate address;
• Verify bank account info;
• Cross-check franchise info;
• Verify signatures;
• Platform data evaluation for fraud and anomalies such as an applicant’s IP address, bank
account changes, etc.; and
• Documents were scanned for viruses and flagged for empty documents.
SBA also planned to validate applications against private and public data sources, including SBA’s
PPP loan data, the Department of Treasury’s Do Not Pay list, Internal Revenue Service (IRS) tax
data, and fee-based data analytic providers as part of the automated and manual review
process.
RRF Application Risk Framework
To implement the RRF program plan, SBA designed a framework to assign applications into four
different risk tiers. SBA planned for the framework to have four tiers, starting with Tier 1 for
applicants with the lowest risk and increasing through Tier 4 for applicants with the highest risk.
3
Office of Management and Budget, Circular M-21-20, “Promoting Public Trust in the Federal Government
through Effective Implementation of the American Rescue Plan Act and Stewardship of the Taxpayer Resources”
(March 19, 2021).
4
SBA, 2 CFR Implementation Plan Template for New Programs Authorized by the American Rescue Plan
(April 2021).
5
U.S. Government Accountability Office, GAO-15-593SP, A Framework for Managing Fraud Risks in Federal
Programs (July 2022).
2
Program officials informed us they later added a tier to escalate applications flagged for
unanticipated issues that emerged during the payment disbursement process. The review was
limited to address the reason why the award failed to be disbursed after approval.
SBA assigned applications to different risk tiers based on dollar amount of award and existing
data known about the applicant. For example, if an RRF applicant also received a PPP loan, SBA
attributed the applicant to be of lower risk because SBA now had the applicant’s loan data from
the agency’s systems.
Table 1: Risk Framework SBA Used to Process RRF Applications
Tier Risk Review Requirement for Tier Application Awards Disbursed
Type Distribution (in billions)
Tier 1 Low Automated Submitted through Point- 7% $1.1
of-Sale (POS) Partner
Tier 2* Low Automated PPP data validated. 63% $8.0
No PPP Flags or Holds
Award < $360,000
Tier 3 High Manual PPP data validated. 8% $7.8
No PPP Flags or Holds
Award> $360,000
Tier 4 High Manual No PPP history available 18% $9.8
Award in any amount
Escalated Varied Manual Escalated applications 5% $1.8
Tier flagged after approval but
before disbursement
- - - $28.5
Total 100%
*Note: Tier 2 application count includes applications that met the Tier 2 requirements but did not have a tier
assignment in the RRF platform (see Finding 2 for additional details).
Source: OIG analysis based on RRF program plan, application data, and awards disbursed as of May 23, 2022.
According to the risk framework, SBA assessed risk as low for applications assigned to Tier 1, and
designated Tier 1 for applications that were in partnership with point-of-sale partners whose key
controls SBA relied on for verifying gross sales. Tier 2 was for all applications requesting less than
$360,000. Applications processed through Tiers 1 and 2 went through an automated review
process. By contrast, applicants assigned to Tiers 3 and 4 went through a manual review process
by SBA personnel. In a manual review for Tiers 3 and 4, the reviewer’s primary task was to
perform a cursory review of the required documentation to verify the award calculation.
3
Prior Audit Work
In FY 2023, OIG also performed reviews of SBA’s oversight of RRF award recipients and of SBA’s
inaction on reviewing potentially fraudulent RRF awards referred to SBA by a point-of-sale
partner. 6 The OIG’s concerns were consistent with SBA’s independent auditor reporting that SBA
could not demonstrate that its treatment of RRF transactions were consistent with sound
accounting practices. 7
GAO issued a report in FY 2022 year on how SBA established a process to detect fraudulent or
ineligible applicants but raised concerns about the effectiveness of the procedures. 8
Objective
To determine whether the controls SBA implemented to award RRF program funds in
accordance with the American Rescue Plan Act of 2021 and other applicable guidance were
effective.
Results
Program officials used lessons learned from other SBA COVID-19 pandemic relief programs to
develop an implementation plan designed to reduce the risk of making improper payments and
awarding RRF funds to ineligible recipients. However, SBA did not consider all eligibility
requirements established in the authorizing legislation as a measure for the risk framework. SBA
implemented the RRF application process by automating most of the verification procedures to
expedite making awards but did not have sufficient controls to reduce risks of making improper
payments or distributing money to ineligible applicants.
SBA disbursed nearly $6.7 billion to potentially ineligible recipients due to not following planned
review procedures, system design flaws, human intervention, and reliance on self-certification.
6
SBA Office of Inspector General, 23-10, SBA’s Administrative Process to Address Potentially Fraudulent
Restaurant Revitalization Funds Award (July 5, 2023) and 23-15, SBA’s Oversight of Restaurant Revitalization Fund
Recipients (September 29, 2023).
7
SBA Office of Inspector General, 23-02, Independent Auditor’s Report on SBA’s FY 2021 Financial Statements
(November 15, 2022).
8
U.S. Government Accountability Office, GAO-22-105442, Restaurant Revitalization Fund, Opportunities Exist to
Improve Oversight (July 2022).
4
Specifically, despite plans to verify PPP loan hold codes for RRF applications, SBA did not
establish procedures to detect the flagged files. We identified 901 applications that had active
hold codes on their PPP loan files as of May 3, 2021, that SBA did not take into consideration
before awarding $552 million in RRF funds to applicants. We also found SBA did not evaluate PPP
data or the results of the IRS validation to confirm historical sales data as planned for 47,565
applicants awarded $6 billion in RRF funds.
In addition, SBA did not align RRF automated processes to enable verification that recipients met
key eligibility requirements. Of the 4,724 applicants that self-certified that their breweries or
inns had at least 33 percent of gross receipts from onsite sales to the public, 73 percent of them
were processed automatically without any review of supporting documentation. These entities
were required to provide documentation that at least 33 percent of gross receipts were
comprised of onsite food or beverage sales to the public. As such, SBA did not ensure that it
awarded nearly $377 million in RRF funds to business owners who significantly relied on onsite
food and beverage sales.
We also found that SBA did not have proper controls to ensure RRF applicants, who disclosed
having at least one affiliated business, did not exceed the limit of $10 million to any one group.
We identified 14 business affiliate groups that collectively received $55 million more than the
statutory limit allowed per affiliate group.
Finding 1: Critical Data Not Used as Planned to Prevent
Awarding Funds to Ineligible Recipients
Based on lessons learned from the PPP loan program, SBA developed its risk tier approach for
reviewing RRF applications using GAO’s Fraud Risk Management Framework. A core tenet of the
framework advised agencies to mine the data to identify suspicious activities and transactions,
including any anomalies, outliers, and other red flags. 9
SBA used a variety of public and private data resources to validate the information contained in
the application, which included using the PPP loan data. Nearly 90 percent of the RRF award
recipients had an associated PPP loan. According to the RRF program implementation plan, using
PPP loan data was supposed to allow SBA to leverage a significant amount of information
9
U.S. Government Accountability Office, GAO-15-5935SP, A Framework for Managing Fraud Risks in Federal
Programs (July 2015). https://www.gao.gov/assets/gao-15-593sp.pdf.
5
available to prevent making potentially improper payments. Moreover, SBA’s framework
stipulated that tiers 2 and 3 were only for applicants with clean PPP data.
When SBA launched the RRF program, it only factored in the existence of a PPP loan file to justify
assigning the application to a low-risk tier for the RRF program. SBA did not leverage the
information available in the PPP loan file such as historical sales data, bank accounts, business
addresses, affiliated entities, system generated warnings, or eligibility concerns noted in the
application as planned. According to program officials, SBA did not have access to this
information because the lenders maintained the loan files. SBA merely used the PPP data to
subtract the PPP loan value from the RRF request to reduce the award amount. SBA’s deviation
from its plan to use known and available evidence of potential fraud in the PPP loan portfolio
resulted in awarding 901 applications over $552 million in RRF funds to potentially ineligible
recipients.
SBA will conduct post award reviews of all RRF award recipients currently marked in the PPP loan
data as potentially fraudulent or ineligible to implement a recommendation we made in our
Audit of SBA’s Oversight of Restaurant Revitalization Fund Recipients (Report 23-15). Although
SBA has finished making awards for the RRF program, SBA owns the software license and related
intellectual properties for the PPP and RRF platforms and plans to continue using these platforms
for future programs.
Recommendation
We recommend the Administrator direct the Associate Administrator of the Office of
Performance, Planning, and the Chief Financial Officer to:
Recommendation 1: Develop a plan for future similar programs to leverage applicable existing
SBA data sources when determining eligibility and monitoring awards. The plan should include
requirements to evaluate effectiveness of the use of the data as controls to reduce risk of
improper payments.
Finding 2: Historical Sales for All RRF Applicants Not Validated
as Planned When Determining Eligibility
The Act required that the award amount be equal to the entity’s pandemic-related revenue loss.
All applicants were required to complete IRS Form 4506-T for verification of tax information and
provide documentation of gross receipts in support of their application. SBA’s implementation
6
plan stated that an applicant’s historical sales would be validated against at least one of the
following sources: POS partner data, prior PPP loan submission data, or IRS data.
For Tier 2 applications, SBA planned to use PPP loan data to validate historical sales information.
SBA also included an automated step for Tier 2 applications to route through the IRS for
validation when the RRF platform software was launched.
SBA approved 46,297 Tier 2 applications, and 16,648 applications that were manually adjusted
due to the system not assigning a tier but met the risk framework requirements for a Tier 2
designation.
Although program officials planned to use PPP data to validate sales, upon execution, only the
value of the PPP loan amount was used to reduce the award amount authorized for the RRF
program. PPP data was not used to validate any information within the award application,
including historical sales. Given these facts, the IRS tax validation was the only other control that
could have validated historical sales on Tier 2 applications.
Figure 1: SBA’s System Design Flaw on Validating Historical Sales Against IRS Data
for Tier 2 Applications
Note: The total number of Tier 2 applications includes both Tier 2 and Tier 2-like categories
Source: OIG generated from data provided by SBA
All applications approved using Tier 2 automated process, representing $7.9 billion in awards,
were automatically approved regardless of whether tax information associated with the
applicant was cleared, problematic, or null. Of the 62,945 applications awarded using the Tier 2
automated process, 24 percent passed the IRS validation; 28 percent failed the validation; and
48 percent were not validated at all (see Figure 1).
SBA did not follow its original plan to use PPP data to validate historical sales and the IRS tax
validation results were ignored. We found that 47,565 of Tier 2 awards, or 76 percent, valued at
more than $6.0 billion were unsupported due to unverified historical sales (see Appendix 2).
7
Recommendation
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to:
Recommendation 2: Validate historical sales for 47,565 awards designated or treated as Tier 2
that failed or did not receive IRS validation. Recover any excess funds paid that are attributable
to unverified historical sales data.
Finding 3: Verification that Certain Types of Businesses Met
Eligibility Requirements
Applicants who claimed to operate as a brewery or inn type of business were required to provide
documentation that at least 33 percent of gross receipts were comprised of onsite food or
beverage sales to the public. 10 We found SBA did not have controls to ensure applicants assigned
to Tiers 1 and 2 provided the required documentation and did not have a process to review
submitted documents to assess whether the gross receipts criteria were met. SBA’s automated
process for Tiers 1 and 2 approved 3,443 of the 4,724 RRF award recipients that claimed to
operate as a brewery or inn type of business, or 73 percent. The remaining 1,281 brewery and
inn type of business applicants were processed as Tiers 3 and 4, or 27 percent of the overall
awards for this type of business.
For the awards that were processed through Tiers 3 and 4, program officials manually verified
that the applicants’ sales met the requirement that 33 percent of gross receipts were comprised
of onsite food or beverages to the public.
For Tiers 1 and 2, SBA allowed applicants to self-certify that they conducted business as a
brewery or inn. SBA’s application process also allowed them to self-certify that 33 percent of
sales were from food and drink sales to the public. While program rules required applicants to
provide supporting documents to substantiate the 33 percent assertion, Tiers 1 and 2 were
approved automatically without any review of the supporting documentation provided. In total,
the lack of controls resulted in automatically approving almost $377 million in award funds
without review of required documentation.
The Act authorized SBA to allow applicants to self-certify their priority status. However, program
officials widely accepted self-certification in other areas for eligibility, and in this case, on the
10
SBA, Restaurant Revitalization Fund Program Guide (April 28, 2021).
8
claim that the applicant met the definition of an eligible entity. As a result, program officials did
not ensure that nearly $377 million in RRF funds were awarded to business owners who
significantly relied on onsite food and beverage sales, consistent with the restaurant industry the
program was targeted to help.
Recommendation
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to:
Recommendation 3: Review the 3,443 applicants awarded funds totaling $376,583,100 that self-
certified as a brewery or inn, to determine if they met the 33 percent onsite sales eligibility
requirement and recover any funds from applicants that did not meet the requirement.
Finding 4: Controls to Ensure Affiliated Businesses Complied
with the Act’s Requirements
The Act required that the amount awarded to affiliated businesses shall not exceed $10 million
in total and shall be limited to $5 million per physical location. In addition, businesses were not
eligible if there were more than 20 locations amongst all the affiliates. 11 Program officials
disbursed $7.7 billion (27 percent of all RRF funds) to 16,345 applicants who disclosed having at
least one affiliate without any controls to limit the maximum award amount for affiliated
business groups. For example, one affiliated group was awarded $37.5 million — $27.5 million
more than the maximum award amount authorized.
SBA relied on applicants to:
• Self-disclose affiliated business relationships;
• Self-monitor to ensure that total awards did not exceed the $10 million limit; and
• Self-certify an applicant and its affiliates had no more than 20 locations combined.
Since SBA allowed applicants to self-certify their affiliated status, they were able to request and
receive more than $10 million by submitting applications for multiple affiliates. On the
application form, SBA instructed applicants to adjust award requests to stay below the $10
million total limit. However, as there were no controls in place to monitor or connect the
11
American Rescue Plan Act of 2021. Pub. L. No. 117-2, §5003 (a)(2) and §5003 (c)(4)(A).
9
submissions, we found that applicants submitted applications for multiple affiliated businesses
that, in total, exceeded the limit.
Although SBA asked if an applicant had affiliates, the intake design allowed applicants to answer
“Yes,” without requiring applicants to provide additional information in the following text field
intended to capture affiliate details. We found 1,431 applicants, who received $694 million in
RRF payments, indicated “Yes” but did not provide sufficient information to reliably identify the
affiliated businesses. When applicants did choose to provide affiliate information, the method of
capturing information (such as the Employer Identification Number) was not standardized to
effectively segregate, cross-check and to connect the affiliated groups. Although the 16,345
applicants who indicated they had affiliations provided at least one affiliated business by name
or other identifier, SBA did not establish a process to effectively capture the information
necessary to determine whether affiliated businesses received RRF funds under a separate
application.
We identified 14 affiliated business groups that collectively received $195.1 million, which was
$55.1 million more than the statutory limit of $140 million, with $10 million allowed per group.
Program officials had the duty to implement controls to enforce rules established by the Act.
Consequently, there is no assurance that SBA awarded RRF funds within the statutory limit of
$10 million for affiliated businesses.
Recommendations
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to:
Recommendation 4: In accordance with Public Law 117-2, § 5003(a)(4)(A)(i) take immediate
action to review and recover improper payments from the 14 affiliated business groups disclosed
by RRF applicants for a total of $55,067,326 in excess funds paid, beyond the $10 million limit
per affiliated group.
Recommendation 5: Review the 16,345 applicants that disclosed having an affiliated business to
determine if the amounts collectively awarded to the applicant and affiliates exceeded the $10
million maximum and recover any excess awards.
10
Other Matters: SBA Paid Out Remaining and Unused RRF Funds
During our engagement, we reviewed SBA’s methodology to disburse $83.4 million of remaining
and unused RRF funds in November 2022. Program officials disbursed these funds to 169
applicants who had been previously approved for an award but had not received funds due to
the funds authorized for the program being exhausted as of July 2, 2021. We verified SBA
officials disbursed these funds to applications that were “fully approved” in the RRF platform by
order of the date the application was submitted, like a “first in-first out” approach.
Evaluation of Agency Response
SBA management provided formal comments that are included in their entirety in Appendix 3. In
their written response, management agreed with recommendation 1, partially agreed with
recommendations 2, 3, and 5, and did not state a position on recommendation 4. However,
subsequent to receiving management’s written response, we followed up with program officials
to clarify that they agreed with recommendation 4 and obtained final action dates for four of the
five recommendations. We found the agency’s planned actions are sufficient to resolve
recommendations 1 and 4.
However, management’s proposed corrective actions did not address recommendations 2, 3,
and 5; therefore, these recommendations are unresolved. In accordance with our audit follow-
up policy, we will attempt to reach agreement with SBA management on the unresolved
recommendations within 60 days after the date of this final report. If we do not reach
agreement, OIG will notify the audit follow-up official.
SBA management acknowledged the importance of recovering funds awarded to businesses that
did not meet program or statutory eligibility requirements or received funds that exceeded
statutory limits. Management stated the implementation of RRF was expedited per
congressional mandate to quickly provide support to eligible entities that suffered revenue
losses related to the COVID-19 pandemic. Management also stated they used a risk management
framework consisting of automated, pre-award controls, supplemented by manual reviews of
selected applications to expedite program delivery. Notwithstanding, we maintain our position
that SBA’s plan did not include all program requirements, nor did SBA always adhere to the plan
or have sufficient controls to ensure program and statutory requirements were met by RRF
applicants.
11
Summary of Actions Necessary to Close the Recommendations
The following section summarizes the status of our recommendations and the actions necessary
to close them.
Recommendation 1
We recommend the Administrator direct the Associate Administrator of the Office of
Performance, Planning, and the Chief Financial Officer to develop a plan for future similar
programs to leverage applicable and existing SBA data sources when determining eligibility and
monitoring awards. The plan should include requirements to evaluate effectiveness of the use of
the data as controls to reduce risk of improper payments.
Status: Resolved
SBA management agreed with the recommendation and stated that SBA’s Fraud Risk
Management Board is currently developing a standardized fraud risk framework for SBA in
coordination with Office of Performance Systems Management and other SBA programs.
Management plans to leverage the framework for future programs to evaluate available data to
determine effectiveness and applicability to eligibility requirements. We will work with
management to establish a target date for implementing corrective actions through the audit
follow-up process.
This recommendation can be closed when management provides evidence that the program
office adopted the fraud risk framework developed by SBA’s Fraud Risk Management Board that
will reduce risks of making improper payments in future similar programs.
Recommendation 2
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to validate historical sales for 47,565 awards designated or treated as Tier 2 that failed or
did not receive IRS validation. Recover any excess funds paid that are attributable to unverified
historical sales data.
Status: Unresolved
SBA management partially agreed with our recommendation stating SBA is currently reviewing
10 percent of total RRF awards (10,050 awards) for potential fraud or misused program funds,
including funds paid that are attributable to unverified historical sales data. Management plans
to seek recovery of any excess funds paid and complete final action by May 30, 2025.
12
We maintain our position that SBA should specifically validate historical sales for the 47,565
awards we identified and recover any excess funds paid. As stated earlier, SBA calculated the
award amount based on the applicant’s sales data. Managements’ plans to review 10 percent of
the total RRF awards (10,050 awards) will not include all, if any, of the 47,565 applicants that SBA
paid more than $6.0 billion without adequate support for the amount awarded.
This recommendation can be closed when program officials provide evidence that they validated
historical sales for the 47,565 awards we identified and recovered any excess funds paid.
Recommendation 3
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to review the 3,443 applicants awarded funds totaling $376,583,100 who self-certified as
a brewery or inn, to determine if they met the 33 percent onsite sales eligibility requirement and
recover any funds from applicants that did not meet the requirement.
Status: Unresolved
SBA management partially agreed with our recommendation. SBA management stated that the
implementation plan did not require a manual review of all awards to recipients who self-
certified as a brewery or an inn to determine if they met the 33 percent onsite sales
requirement. SBA is currently reviewing 10 percent of the total RRF awards (10,050 awards) to
address potential fraud or misused program funds, including funds paid without determining
whether applicants met the minimum onsite sales requirement. Management plans to seek
recovery of any excess funds paid to ineligible recipients and complete final action by May 30,
2025.
We maintain our position that program officials should specifically review the 3,443 applicants
awarded funds totaling $376,583,100 that self-certified as a brewery or an inn and determine if
they met the 33 percent onsite sales eligibility requirement. Program officials should recover any
funds from applicants that did not meet this requirement. Management’s planned post-award
review of 10 percent of the total award population does not guarantee they will review the
3,443 awards we identified in our audit.
This recommendation can be closed when program officials provide evidence that they
determined whether the 3,443 applicants met the 33 percent onsite sales eligibility requirement
and recovered funds from any ineligible award recipients.
13
Recommendation 4
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to, in accordance with Public Law 117-2, § 5003(a)(4)(A)(i), take immediate action to
recover improper payments from the 14 affiliated business groups disclosed by RRF applicants
for a total of $55,067,326 in excess funds paid, beyond the $10 million limit per affiliated group.
Status: Resolved
SBA management agreed with the recommendation. Management stated they are currently
analyzing the data OIG provided and agreed to seek recovery of any excess funds paid to
affiliated groups beyond the $10 million limit. Management plans to seek recovery of any excess
funds paid to affiliated groups and complete final action by May 30, 2025.
This recommendation can be closed when program officials provide evidence that they reviewed
the 14 RRF applicants with an affiliated business and recovered improper payments for amounts
paid that exceeded the statutory limit.
Recommendation 5
We recommend the Administrator direct the Associate Administrator of the Office of Capital
Access to review the 16,345 applicants that disclosed having an affiliated business to determine
if the amounts collectively awarded to the applicant and affiliates exceeded the $10 million
maximum and recover any excess awards.
Status: Unresolved
SBA management partially agreed with our recommendation stating that SBA is currently
reviewing 10 percent of the total RRF awards (10,050 awards) to address potential fraud or
misused program funds, including excess funds paid to applicants and affiliates that exceeded
the $10 million maximum limit. Management plans to seek recovery of any excess funds paid to
ineligible recipients and complete final action by May 30, 2025.
Management’s proposed actions do not satisfy the intent of this recommendation because SBA’s
planned post-award reviews of 10 percent of the total award population does not guarantee any
review of the 16,345 applicants we identified. This recommendation can be closed when
program officials provide evidence that they determined the 16,345 applicants who disclosed
having an affiliated business were not collectively awarded more than $10 million as an affiliated
group and recovered any excess funds.
14
Appendix 1: Scope and Methodology
The scope of the audit focused on SBA’s Restaurant Revitalization Fund (RRF) award practices
used to review, approve, and fund approximately 101,000 applications totaling $28.6 billion from
May 3, 2021, to December 31, 2022.
To meet our audit objective, we reviewed the American Rescue Plan Act of 2021, SBA’s
Implementation Plan and Application Risk Framework for the RRF program, U.S. Government
Accountability Office’s (GAO) A Framework for Managing Fraud Risks in Federal Programs, and
other applicable public laws, federal regulations, and agency guidance related to SBA’s
implementation of the RRF program and its award practices. We interviewed SBA program
officials and RRF platform contractors to understand award practices and to obtain
documentation that support those practices.
We analyzed the information in the applications for all 101,000 RRF award recipients to identify
the following:
• Number of RRF applicants that had associated Paycheck Protection Program (PPP) loan
hold codes at the time of application;
• Outcomes of Internal Revenue Service (IRS) validation for RRF applications;
• Number of RRF applicants in Tiers 2 and 3 that identified as a business type requiring
proof of onsite sales of at least 33 percent;
• Number of RRF applicants with affiliated businesses; and
• Information collected in the RRF application text boxes and those applicants who
provided at least one Employer Identification Number, to identify affiliate groups that
received RRF funds.
We conducted this performance audit in accordance with GAO’s Generally Accepted Government
Auditing Standards. These standards require that we plan and perform audits to obtain sufficient
and appropriate evidence to provide a reasonable basis for our findings and conclusions based
on our audit objectives. We believe the evidence obtained provides a reasonable basis for our
findings and conclusions.
1-1
Use of Computer-Processed Data
We relied on computer-processed data in SBA’s RRF online application platform and E-Tran,
SBA’s payment disbursement database. We obtained access to the RRF online application
platform and retrieved applications, award information, and SBA’s evaluation record for all RRF
applicants. We generated a report of all RRF applications' information from SBA’s online
application platform and award information as of May 9, 2022. We tested the reliability of
computer-processed data in the RRF online application platform and E-Tran database by
comparing reports generated by program officials of application and award information. We
tested the reliability of the data by comparing data received from the RRF online application
platform and E-Tran to SBA’s PPP loan database and source documents such as IRS tax returns,
income statements and bank statements. We believe the computer-processed information is
reliable for the purposes of this audit.
Assessment of Internal Controls
For this audit, we identified the following internal control components and underlying internal
control principles (Table 2) as being significant to the audit objectives.
Table 2: Internal controls assessed
Internal Control Component Internal Control Principle
Control Environment • Tone at the Top.
• Establish structure, assign responsibility, and
delegate to achieve the entity’s objective.
Risk Assessment • Identify, analyze, and respond to risk.
Control Activities • Management should design control activities
to achieve objectives and respond to risk.
• Management should implement control
activities through policies.
Information and Communication • Management should use quality information
to achieve the entity’s objectives.
1-2
Prior Audit Coverage
The following OIG and GAO previous audit coverage related to the objective of this report:
Report Number Report Title Report Date
SBA OIG Report 23-02 Independent Auditor’s Report on SBA’s Fiscal November 15,
Year 2022 Financial Statements 2022
SBA OIG Report 23-09 COVID-19 Pandemic EIDL and PPP Loan Fraud June 27, 2023
Landscape
SBA OIG Report 23-10 SBA’s Administrative Process to Address July 5, 2023
Potentially Fraudulent Restaurant Revitalization
Fund Awards
GAO-22-105442 Restaurant Revitalization Fund July 14, 2022
Opportunities Exist to Improve Oversight
SBA OIG Report 23-15 SBA’s Oversight of Restaurant Revitalization September 29,
Fund Recipients 2023
1-3
Appendix 2: Monetary Impact
Monetary Impact identified in this report is categorized as “questioned costs”. Questioned costs
are expenses not supported by adequate documentation at the time of the audit, or which
otherwise do not comply with legal, regulatory, or contractual requirements.
Table 2-1. OIG Schedule of Monetary Impact of SBA’s Restaurant Revitalization Fund
Program Award Practices at the Time of Audit
Description Amount Explanation
(Dollars)
Ineligible Costs $552,139,455* Funds paid on 901 applications that were
not reviewed in accordance with SBA
program implementation plans for
consideration of PPP flags and codes.
Unsupported Costs 6,033,837,878 Awards made without historical sales
validated via PPP data or IRS validation.
Unsupported Costs 376,583,100 Awards made without support for meeting
eligibility requirements for 33 percent of
onsite sales.
Ineligible Costs 55,067,326 Funds paid more than the allowable limit for
affiliated business groups in accordance
with Section 5003(A) of the American
Rescue Plan Act of 2021.
Total Questioned Costs $7,017,627,759 -
Less: Duplicate Costs Removed for (339,952,607) Questioned costs removed due to being
Overlap Across Multiple Eligibility questioned based on multiple eligibility
Criteria criteria for the RRF program.
Net Questioned Costs $6,677,675,152 -
*Note: SBA will conduct post award reviews of all RRF award recipients currently marked in the PPP loan data as
potentially fraudulent or ineligible to implement a recommendation we made in our Audit of SBA’s Oversight of
Restaurant Revitalization Fund Recipients (Report 23-15), recommendation 2. We will track questioned costs and
monitor SBA’s actions to review the awards and recover funds to any ineligible recipients through the audit follow-
up process for that report.
Source: OIG analysis of RRF award data.
2-1
Appendix 3: Agency Response
SBA RESPONSE TO THE AUDIT REPORT
3-1
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
To: Hannibal “Mike” Ware
Inspector General
U.S. Small Business Administration
From: Jihoon Kim
Director
Office of Financial Program Operations
Office of Capital Access
Date: March 1, 2024
Subject: Response to OIG Draft Report - SBA’s Restaurant Revitalization Fund Program Award
Practices - Project 23001
We appreciate the role the Office of Inspector General (OIG) plays in working with management in
ensuring that our programs are effectively managed, and for the feedback provided in this draft report.
The SBA team reviewed the OIG Draft Report. SBA acknowledges the importance of recovering funds
awarded to businesses that did not meet program or statutory eligibility requirements or received funds
that exceeded statutory limits.
The implementation of RRF was expedited per congressional mandate to quickly provide support to
eligible entities that suffered revenue losses related to the COVID-19 pandemic. To comply with the
Congressional mandate to expedite delivery of RRF funds while balancing the need to protect against
fraud and ineligibility, SBA implemented a risk management framework consisting of automated, pre-
award controls, supplemented by manual reviews of selected applications, in accordance with leading
practices prescribed in GAO’s fraud risk framework.
1
Additionally, SBA designed its post-award review process to maximize program integrity and optimize
use of SBA’s limited resources and will perform manual post-award reviews of 10 percent of the total
award population for potential fraud or misuse of program funds.
Recommendation 1 – We recommend the Administrator direct the Associate Administrator of the
Office of Performance, Planning, and the Chief Financial Officer (OPPCFO) to develop a plan for future
similar programs to leverage applicable existing SBA data sources when determining eligibility and
monitoring awards. The plan should include requirements to evaluate effectiveness of the use of the data
as controls to reduce risk of improper payments.
SBA Response: SBA agrees. SBA’s Fraud Risk Management Board (FRMB) is currently developing a
standardized fraud risk framework for SBA in coordination with OPSM and other SBA programs. This
framework will be leveraged by future programs to evaluate available data to determine its effectiveness
and applicability to eligibility requirements of SBA programs administered through the platform.
Recommendation 2 – We recommend the Administrator direct the Associate Administrator of the
Office of Capital Access to validate historical sales for 47,565 awards designated or treated as Tier 2
that failed or did not receive IRS validation. Recover any excess funds paid that are attributable to
unverified historical sales data.
SBA Response: SBA partially agrees. SBA is performing manual post-award reviews of 10 percent of
the total award population for potential fraud or misuse of program funds, including funds paid that are
attributable to unverified historical sales data. SBA plans to seek recovery of any excess funds paid to
ineligible recipients.
Recommendation 3 – We recommend the Administrator direct the Associate Administrator of the
Office of Capital Access to review the 3,443 applicants awarded funds totaling $376,583,100 that self-
certified as a brewery or inn, to determine if they met the 33 percent onsite sales eligibility requirement
and recover any funds from applicants that did not meet the requirement.
SBA Response: SBA partially agrees. The implementation plan did not require a manual review of all
awards to recipients that self-certified as a brewery or inn to determine if they met the 33 percent onsite
sales requirement. SBA is performing manual post-award reviews of 10 percent of the total award
population for potential fraud or misuse of program funds, including applicants that self-certified as a
brewery or inn to determine if they met the 33 percent onsite sales requirement. SBA plans to seek
recovery of any excess funds paid to ineligible recipients.
Recommendation 4 – We recommend the Administrator direct the Associate Administrator of the
Office of Capital Access to, in accordance with Public Law 117-2, § 5003(a)(4)(A)(i), take immediate
action to recover improper payments from the 14 affiliated business groups disclosed by RRF applicants
for a total of $55,067,326 in excess funds paid, beyond the $10 million limit per affiliated group.
SBA Response: SBA requested specific data from OIG to assist us in analyzing this finding. We
received that data but are still analyzing OIG’s findings. If our analysis of the data confirms that the
affiliated groups received funds beyond the $10 million limit, we agree to seek recovery of any excess
funds.
Recommendation 5 – We recommend the Administrator direct the Associate Administrator of the
Office of Capital Access to review the 16,345 applicants that disclosed having an affiliated business to
determine if the amounts collectively awarded to the applicant and affiliates exceeded the $10 million
maximum and recover any excess awards.
SBA Response: SBA partially agrees. SBA is performing manual post-award reviews of 10 percent of
the total award population for potential fraud or misuse of program funds, including excess funds paid to
applicants and affiliates that exceeded the $10 million maximum limit. SBA plans to seek recovery of
any excess funds paid to ineligible recipients.
File and source
- File
- 24-09-rrf-program-award-oversight.pdf
- Size
- 753,224 bytes
- SHA-256
- fae560ad5e192fbefce3ca5b27fc0c14ab807c463c05acdef80f342080e56744
- Original
- www.oversight.gov