SMALL BUSINESS ADMINISTRATION

Opportunities to Improve Management of Fraud Risks, Improper Payments, and Contracting Programs

Statement of Courtney LaFountain, Acting Director, Financial Markets and Community Investment

Testimony

Before the Committee on Small Business & Entrepreneurship, U.S. Senate

For Release on Delivery Expected at 2:30 p.m. ET

Wednesday, December 10, 2025

GAO-26-108820

 

United States Government Accountability Office

A testimony before the Committee on Small Business and Entrepreneurship, U.S. Senate

For more information, contact: Courtney LaFountain, lafountainc@gao.gov

What GAO Found

Since June 2020, GAO has made dozens of recommendations to help the Small Business Administration (SBA) better manage fraud risks, improve its estimates of improper payments, and oversee its contracting programs. This testimony discusses SBA’s efforts to address 42 of these, of which SBA has implemented 17.

·      Fraud risks. GAO has found that some SBA programs—particularly its COVID-19 pandemic relief programs—have been susceptible to fraud. SBA established these programs quickly to respond to the adverse economic conditions small businesses faced, but the speed of implementation came at the expense of appropriate safeguards. SBA has implemented most GAO recommendations in this area—for example, by implementing oversight plans, conducting fraud risk assessments, and developing a fraud strategy. GAO has estimated that the additional controls SBA put in place for its pandemic-relief programs collectively had saved the government more than $30 billion as of the end of fiscal year 2025.

However, it is imperative for SBA to advance its fraud prevention and detection efforts, such as by expanding use of data analytics and improving its process for referring potential fraud to SBA’s Office of Inspector General. Furthermore, examining fraudsters and fraud schemes that emerged during the pandemic can help agencies identify fraud mitigation controls that can be implemented both in emergency environments and during normal operations.

·      Improper payments. GAO has also previously identified problems related to SBA’s estimates of improper payments, particularly for its pandemic relief programs. An improper payment occurs when a payment should not have been made or was made in the incorrect amount. SBA has implemented one GAO recommendation in this area but has not implemented three others. These include expanding and documenting its overpayment review procedures and expanding its overpayment tracking process. Developing reliable improper payment estimates is essential for understanding and addressing financial vulnerabilities in SBA’s programs in a timely manner.

·      Contracting assistance programs. SBA has addressed several GAO recommendations related to oversight of its contracting programs, including the 8(a) Business Development Program. For example, the agency has improved its documentation of compliance reviews of small business subcontracting plans. However, SBA has not addressed 14 recommendations intended to address critical risk management and cybersecurity issues associated with its small business certification platform.

In addition, SBA’s independent financial statement auditor issued a disclaimer of opinion on SBA’s fiscal year 2024 financial statements. The auditor reported material weaknesses in SBA’s controls over pandemic relief programs for the fifth consecutive year. For example, the auditor found that SBA did not sufficiently design the review process for Paycheck Protection Program (PPP) loan forgiveness. GAO supports the auditor’s recommendations to address these weaknesses and urges SBA to work toward obtaining a clean financial statement audit opinion.

Why GAO Did This Study

Since spring 2020, SBA has made or guaranteed more than $1 trillion in loans and grants and assisted more than 10 million small businesses adversely affected by the COVID-19 pandemic, primarily through PPP and the COVID-19 Economic Injury Disaster Loan program. SBA also continued to support small businesses through its contracting assistance and small business research programs.

This testimony discusses the status of selected GAO recommendations to SBA related to fraud risks, improper payments, and contracting assistance programs, as well as issues related to SBA’s financial statements.

This testimony is based on prior GAO reports issued from June 2020 through March 2025 that assessed SBA’s implementation of four pandemic relief programs, SBA improper payments, financial statements, and contracting assistance programs. Details on GAO’s methodology can be found in the individual reports cited.

Chair Ernst, Ranking Member Markey, and Members of the Committee:

Thank you for the opportunity to discuss the status of selected recommendations we have made to the Small Business Administration (SBA) and issues related to its financial accounting.

Since spring 2020, SBA has done much to help small businesses adversely affected by the COVID-19 pandemic. SBA made or guaranteed more than $1 trillion in loans and grants and assisted more than 10 million small businesses, primarily through the Paycheck Protection Program (PPP) and COVID-19 Economic Injury Disaster Loan (COVID-19 EIDL) program. SBA also continued to operate programs supporting federal contracting opportunities for small businesses and overseeing agencies’ small business research programs.

Although these efforts helped millions of small businesses, we have identified significant program integrity risks, potential for fraud, and the need for improved management and oversight of SBA’s pandemic relief programs. Our concerns about SBA’s implementation of PPP and COVID-19 EIDL led us to include emergency loans for small businesses on our High-Risk List in March 2021.[1]

Beyond financial impacts, fraud erodes public trust in government and hinders agencies’ efforts to execute their missions and program objectives effectively and efficiently. Investigations, prosecutions, and efforts to recover fraudulently disbursed funds are ongoing. Congress has passed legislation to extend the statute of limitations for fraud for some pandemic-relief programs, which will give law enforcement, investigators, and prosecutors more time to uncover potential fraud and to develop cases.

Furthermore, by examining fraudsters and fraud schemes that emerged during the pandemic, agencies can identify fraud mitigation controls that can be implemented both in emergency environments and during normal operations.

We have also issued reports citing concerns about improper payments and weaknesses in the management of some SBA contracting programs, such as the 8(a) Business Development Program.

In this statement, I will discuss (1) the status of selected fraud-related recommendations for SBA programs, including pandemic relief programs; (2) concerns identified by SBA’s independent financial statement auditor; (3) SBA’s actions to address improper payments; and (4) SBA’s management of its contracting programs.

For this statement, we relied primarily on our body of work issued from June 2020 through March 2025 on SBA’s implementation of four pandemic relief programs.[2] For those reports, we reviewed SBA documentation and analyzed program data. We interviewed officials from SBA and other federal agencies, such as the Department of the Treasury. We also reviewed our recent work on SBA’s improper payments and the opinions of SBA’s independent financial statement auditor.[3] More detailed information on our scope and methodology can be found in the individual reports we cite.

We conducted the work on which this statement is based in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

SBA’s Pandemic Relief Programs

Paycheck Protection Program. Congress established PPP in the CARES Act to help small businesses affected by the COVID-19 pandemic.[4] In total, Congress provided approximately $814 billion in commitment authority.[5] PPP loans were made by lenders and guaranteed 100 percent by SBA. The loans carried a 1 percent interest rate and were fully forgivable if certain conditions were met—for example, at least 60 percent of the loan forgiveness amount had to be for payroll expenses to qualify for full loan forgiveness.

According to SBA, as of May 31, 2021 (when SBA stopped accepting new applications), lenders had made about 11.8 million PPP loans totaling about $800 billion.[6]

COVID-19 Economic Injury Disaster Loan Program. Congress temporarily expanded eligibility for SBA’s EIDL program, which provides low-interest loans of up to $2 million for expenses that cannot be met because of a disaster. Congress also created emergency EIDL advances, a new program component.[7] In total, Congress appropriated $50 billion in loan credit subsidies for the cost of COVID-19 EIDL loans and $55 billion for advances.[8] The $50 billion in credit subsidies would enable SBA to provide about $470 billion in COVID-19 EIDL loans.[9]

As of April 2022, SBA had approved about 3.9 million loans totaling about $378 billion. SBA also approved about 6.8 million advances totaling about $27.5 billion.

Restaurant Revitalization Fund. The Restaurant Revitalization Fund provided awards (which did not need to be repaid) to assist small businesses in the food service industry affected by the pandemic.[10] Recipients could use the awards for eligible expenses such as payroll, business debt, maintenance, or construction of outdoor seating. The program accepted applications from May 3, 2021, through June 30, 2021.

As of June 30, 2021, the Restaurant Revitalization Fund had provided $28.6 billion in awards to assist about 101,000 small businesses.

Shuttered Venue Operators Grants. The Shuttered Venue Operators Grant program provided grants to small businesses in the live performing arts and entertainment sectors affected by the pandemic.[11] Recipients could use the funds for eligible expenses such as payroll, rent or mortgage payments, and utilities. This program accepted applications from April 26, 2021, through August 20, 2021.[12]

As of July 5, 2022, Shuttered Venue Operators Grants had provided about $14.6 billion in grants to about 23,000 small businesses.

Fraud Risk Management

The objective of fraud risk management is to ensure program integrity by continuously and strategically mitigating both the likelihood and effects of fraud, while also facilitating a program’s mission. The Fraud Risk Framework provides a comprehensive set of leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based manner.[13] The framework organizes the leading practices within four components: (1) Commit, (2) Assess, (3) Design and Implement, and (4) Evaluate and Adapt.

In June 2016, the Fraud Reduction and Data Analytics Act of 2015 required the Office of Management and Budget (OMB) to establish guidelines for federal agencies to create controls to identify and assess fraud risks to design and implement antifraud control activities. The act further required OMB to incorporate the leading practices from the Fraud Risk Framework in the guidelines.[14] The Payment Integrity Information Act of 2019 repealed the Fraud Reduction and Data Analytics Act but maintained the requirement for OMB to provide guidelines to agencies in implementing the Fraud Risk Framework.[15]

In its 2016 Circular No. A-123 guidelines, OMB directed agencies to adhere to the Fraud Risk Framework’s leading practices.[16] In October 2022, OMB issued a Controller Alert reminding agencies that they must establish financial and administrative controls to identify and assess fraud risks.[17] In addition, the alert reminded agencies that they should adhere to the leading practices in the Fraud Risk Framework as part of their efforts to effectively design, implement, and operate an internal control system that addresses fraud risks.

Small Business Innovation Research and Small Business Technology Transfer Programs

The Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs were established to enable federal agencies to support research and development (R&D) projects carried out by small businesses.[18] Under the Small Business Act, federal agencies with an extramural budget for R&D exceeding $100 million are required to participate in the SBIR program. Those with such obligations of $1 billion or more are required to participate in the STTR program.[19] According to SBA, which oversees the programs, 11 federal agencies and their components participate in SBIR or in both programs.

Since the inception of the programs, federal agencies have invested over $68 billion in SBIR/STTR awards for R&D and to commercialize technologies.[20]

Payment Integrity Information Act of 2019

The Payment Integrity Information Act of 2019 requires agencies to manage improper payments by identifying risks, taking corrective actions, and estimating and reporting on improper payments in programs they administer. The act also requires each agency’s inspector general to issue an annual report on compliance with applicable criteria from the act.

8(a) Business Development Program

The 8(a) Business Development Program supports small businesses owned and controlled by socially and economically disadvantaged individuals and entities. It is SBA’s largest program to support contracting. The program generally provides up to 9 years of developmental support, such as business counseling and mentoring, contracting guidance, and access to capital and surety bond guarantees.[21] The program also sets aside federal contracting opportunities for participants.

SBA Has Taken Steps to Address Fraud Risk in Some Programs, but Additional Work Remains

We have previously found that some SBA programs—particularly its pandemic relief programs—have been susceptible to fraud risks.[22] SBA established PPP and COVID-19 EIDL quickly to respond to the adverse economic conditions small businesses faced. However, the speed of implementation came at the expense of appropriate financial and other safeguards, which left the programs susceptible to fraud.[23]  

As the programs matured and SBA implemented our recommendations, SBA improved its oversight and incorporated lessons learned from PPP and COVID-19 EIDL into its other relief programs, the Restaurant Revitalization Fund and Shuttered Venue Operators Grants.

SBA still has opportunities to advance its fraud prevention and detection efforts, such as by expanding use of data analytics and providing guidance to agencies participating in certain programs. Addressing material weaknesses in internal controls reported by its financial statement auditor could also help prevent fraud in SBA’s programs.

SBA Has Implemented Most of Our Pandemic-Related Fraud Risk Recommendations

We have made a number of recommendations to SBA to improve oversight and fraud risk management of its pandemic programs, including 13 detailed below.[24] SBA has implemented nine of these recommendations. However, it is still in the process of implementing four others, which are related to responding to potentially fraudulent or ineligible awards, enhancing the use of data analytics to prevent and detect fraud, and improving its process for referring potential fraud cases to SBA’s Office of the Inspector General (OIG).

Incorporating oversight plans—implemented. SBA officials said they initially put limited safeguards in place when launching PPP to expedite the loan approval process. This was consistent with a mandate from Congress, reinforced by Treasury, to provide rapid support for small businesses. In June 2020, we found that SBA had not provided details on how it would review loans of more than $2 million and did not have plans for reviewing loans of less than $2 million.[25] We therefore recommended that SBA develop and implement plans to identify and respond to PPP risks to help ensure program integrity, achieve program effectiveness, and address potential fraud.

Consistent with our recommendation, in December 2020, SBA implemented an oversight plan with multiple layers of review. It also hired a contractor with expertise in fraud detection to help conduct these reviews. SBA incorporated controls from this plan when it launched the Restaurant Revitalization Fund and Shuttered Venue Operators Grant programs.

Similarly, because SBA did not have a plan for responding to COVID-19 EIDL risks, we recommended in March 2021 that SBA implement a comprehensive oversight plan for that program to help ensure program integrity, achieve program effectiveness, and address potential fraud.[26] In August 2022, SBA provided an oversight plan describing controls it had implemented or planned to implement for COVID-19 EIDL loans.

We estimated that SBA’s additional controls it put in place for its pandemic-relief programs collectively had saved the government more than $30 billion as of the end of fiscal year 2025.

Assessing fraud risks—implemented. Conducting a fraud risk assessment is a leading practice in strategically managing fraud risks.[27] Such assessments can, for example, help program officials determine whether certain controls are effectively designed and implemented to reduce the likelihood or impact of a fraud risk to a tolerable level. They also can help agencies prioritize risks and allocate resources. Because SBA moved quickly to establish PPP and COVID-19 EIDL, it did not conduct formal risk assessments for either program. Accordingly, in March 2021, we made two recommendations that SBA conduct a comprehensive fraud risk assessment for each program.[28]

In response, SBA hired a contractor in October 2021 to conduct these assessments. The contractor found that SBA had implemented additional fraud prevention controls since the start of the programs. These controls included cross-referencing applicant information with Treasury’s Do Not Pay list and introducing a set of automated screening rules.[29] However, the assessment also noted that the programs remained susceptible to fraud risks that required further enhancements to the current mitigation strategies. The contractor identified 25 active fraud risks in PPP and 21 in COVID-19 EIDL. It made four recommendations to help SBA establish a fraud governance process and inform its fraud tolerance approach.

In addition, we reported in March 2021 that SBA had not designated a dedicated entity to lead fraud risk management activities, which contributed to the lack of a timely fraud risk assessment of the programs.[30] In February 2022, SBA designated such an entity, which is responsible for the oversight and coordination of SBA’s fraud risk prevention, detection, and response activities.

SBA has since made some changes to its fraud governance structure. According to SBA, the agency created an Office of Enterprise Integrity in January 2024, led by its Chief Risk Officer, that is responsible for overseeing SBA’s enterprise risk management and fraud risk management functions. The Chief Risk Officer is responsible for ensuring that risk management activities across SBA are coordinated, internal controls are designed and implemented to ensure accuracy in SBA’s financial reporting, and SBA is complying with laws and regulations.

Developing a strategy for managing fraud risks—implemented. In March 2021, we recommended that, once SBA had completed a comprehensive fraud risk assessment for PPP and COVID-19 EIDL, it should also document an antifraud strategy for each program.[31]

As discussed in our Fraud Risk Framework, an antifraud strategy describes the agency’s approach for addressing the prioritized fraud risks identified during a fraud risk assessment.[32] The antifraud strategy describes how the agency will prevent, detect, and respond to fraud, as well as monitor risks. Without an antifraud strategy based on the results of a fraud risk assessment, SBA was not positioned to ensure that it was strategically addressing the most significant fraud risks in either program.

In August 2023, SBA finalized a fraud risk management strategy that identified approaches to prevent, detect, and respond to instances of active and potential fraud in PPP and COVID-19 EIDL. For example, the strategy described data analytic methods for reviewing the PPP loan portfolio to manage fraud risks by reducing false positives, prioritizing identified fraud typologies and behaviors, and uncovering areas of fraud risk not previously identified. For COVID-19 EIDL, the strategy described SBA’s efforts to use advanced data analytics, machine learning technologies, and cross-program data analytics to screen for potential fraud and ineligibility.

Analyzing portfolio-level data—implemented. We recommended in January 2021 that SBA develop and implement portfolio-level data analytics across COVID-19 EIDL program loans and advances to detect potentially ineligible and fraudulent applications.[33] SBA fully implemented this recommendation by developing and implementing data analytics. For example, SBA identified applications submitted with foreign telephone area codes, which is an indicator of ineligibility.

In addition, in July 2022, we found that SBA had not proactively used data analytics or information from enforcement entities to identify potentially fraudulent Restaurant Revitalization Fund award recipients.[34] Therefore, we recommended that SBA develop and implement data analytics across these awards. SBA has fully addressed this recommendation. Specifically, it conducted data analytics for the program that included cross-checking recipient identifiers (such as address and tax identification number) against recipients flagged for fraud or identity theft.

Using enforcement data—implemented. We recommended in July 2022 that SBA develop, document, and implement procedures to use enforcement data on suspected fraud in other SBA programs, such as PPP, to identify potential fraud by Restaurant Revitalization Fund recipients.[35] SBA has fully addressed this recommendation. In April 2024, SBA provided us with documentation demonstrating that it uses enforcement data from a variety of sources—including the Department of Justice and SBA’s OIG—to flag potentially fraudulent awards. In addition, SBA ran monthly cross-program analysis to identify all Restaurant Revitalization Fund awards associated with PPP loans that had been flagged because of enforcement activity.

Developing a plan to respond to improper awards—not implemented. In July 2022, we recommended that SBA develop and implement a plan to respond to potentially fraudulent and ineligible Restaurant Revitalization Fund awards in a prompt and consistent manner.[36] SBA disagreed with this recommendation, stating that its planned efforts were sufficient. However, in April 2024, SBA officials said they had prioritized reviewing flagged Restaurant Revitalization Fund awards and had conducted initial reviews of all flagged awards for which recipients had submitted post-award reports. This recommendation will remain unaddressed until SBA provides us with documentation of its procedures for prioritizing flagged awards and evidence of implementing these procedures.

Identifying fraud across multiple programs—not implemented. We found in May 2023 that SBA had used data analytics to facilitate fraud detection for PPP and COVID-19 EIDL.[37] However, it had not fully leveraged information to help prevent fraud and identify applicants who tried to defraud multiple programs. We therefore recommended that SBA (1) develop and use mechanisms to facilitate cross-program data analytics and (2) identify external data sources that can facilitate the verification of applicant information and the detection of potential fraud across its programs. SBA agreed with these two recommendations.

As of November 2024, SBA’s Fraud Risk Management Board—which oversees and coordinates SBA’s fraud risk prevention, detection, and response activities—continued to work on policies related to program office actions for cross-program analysis results, management of inventory, and parameters of operation. One SBA office began performing cross-program data analytics using taxpayer identification numbers for new loan approvals. In addition, SBA reported that it has engaged with other federal agencies regarding data sharing to improve its fraud risk management capabilities. We will continue to monitor SBA's progress in this area, and we have ongoing work examining data sharing efforts between the Internal Revenue Service and SBA.

Improving fraud referrals to SBA’s OIG—not implemented. SBA developed and implemented oversight plans for PPP and COVID-19 EIDL that include automated and manual reviews to help identify and refer potentially fraudulent loans and advances to the SBA OIG. This four-step approach involves (1) initial automated screening that compares each file with several public- and private-sector databases, (2) data analytics to examine anomalies, (3) human-led review of files not cleared through data analytics, and (4) referral of files identified as likely fraudulent to the OIG.

Our March 2025 review found a weakness in step four—SBA’s process for referring cases of likely fraud to its OIG.[38] We recommended that SBA develop a plan for referring potential or likely fraud for the COVID-19 EIDL program. SBA agreed with the recommendation and noted that it has worked with the OIG to put an effective process in place. We will review the evidence of this process once SBA provides it and will continue to monitor SBA's efforts in this area.

SBA Can Take Steps to Manage Fraud Risks in Small Business Research Programs

We reported on fraud risks for the SBIR/STTR programs in September 2024 and found control vulnerabilities and fraud risks with a range of financial and other impacts.[39] We consequently made four recommendations to SBA to address these concerns, none of which have yet been implemented.

Identifying, sharing, and reporting fraud-related convictions—not implemented. SBA uses several tools—including its monthly program manager meetings, annual survey to participating agencies, and listing of fraud convictions and civil liabilities on SBIR.gov—to monitor and support agencies’ fraud, waste, and abuse prevention efforts.[40] However, we identified opportunities for SBA to better leverage these tools. We made two recommendations that SBA expand it methods and sources to identify, share, and report fraud-related convictions and its findings on SBIR.gov. SBA agreed with the recommendations. In March 2025, SBA officials told us that SBA would continue to report final adjudicated fraud-related settlements, convictions, and findings of civil liability on SBIR.gov. SBA also planned to add related information to its program guidance. We will continue to monitor the status of SBA’s updates to its guidance.

Providing guidance on risk assessments—not implemented. Most of the agencies that participate in SBIR/STTR had not conducted fraud risk assessments in alignment with our leading practices. Some of those agencies identified lack of guidance, training, and resources as related challenges with respect to conducting program-specific fraud assessments. We therefore made two recommendations in September 2024 that SBA provide guidance to participating agencies to conduct comprehensive SBIR/STTR program fraud risk assessments that include all key elements.[41] SBA agreed and said it would provide training to program managers and reinforce the information in its program guidance. SBA told us in August 2025 that it had provided the training to program managers. We will continue to monitor the status of SBA’s updates to its guidance.

SBA’s Financial Statement Auditor Has Raised Concerns

In November 2024, SBA’s independent financial statement auditor issued a disclaimer of opinion on SBA’s fiscal year 2024 financial statements.[42] The financial statement auditor reported that material weaknesses existed in SBA’s controls over its pandemic relief programs that contributed to SBA’s inability to support a significant number of transactions and account balances related to these programs. For example, the auditor found that SBA had not sufficiently designed the review process for PPP loan forgiveness. SBA also had not adequately designed and implemented controls to ensure that COVID-19 EIDL loans were issued to eligible borrowers and were accurately recorded.

The auditor also identified concerns about SBA’s controls beyond its pandemic relief programs. For example, the auditor found weaknesses that limited SBA’s ability to effectively manage its information system risks. Collectively, these deficiencies increased the risk of unauthorized use, modification, or destruction of financial data.

According to SBA, it has made efforts to strengthen internal controls. In January 2025, SBA finalized a remediation strategy for its financial statement audit. Among other things, the strategy identifies the highest priority target areas, remediation steps, and target dates to complete those steps.

In September 2025, the SBA OIG reviewed SBA’s new strategy.[43] It found that some elements would substantially address related audit recommendations but that the strategy did not fully prioritize other material weaknesses, such as those related to certain pandemic relief programs. For example, SBA’s OIG reported that SBA had not developed a plan to perform a comprehensive review of all COVID-19 EIDL transactions flagged for eligibility concern. SBA also had not prioritized addressing the auditor’s recommendations related to the material weaknesses for the other pandemic-relief programs. According to SBA’s OIG, although SBA acknowledged the importance of its pandemic relief programs, SBA’s strategy instead concentrated resources on other areas. The OIG made four recommendations to enhance the strategy’s implementation.

We support the recommendations the financial statement auditor provided to address control weaknesses related to SBA’s pandemic relief programs, as well as the OIG’s recommendations to enhance SBA’s financial audit remediation strategy. We encourage SBA to address these recommendations and continue to work toward obtaining a clean financial statement audit opinion.

SBA Has Taken Some Steps to Manage Improper Payments, but Additional Work Remains

An improper payment occurs when a payment should not have been made or was made in the incorrect amount.[44] These payments can stem from various causes, including fraud. Developing reliable improper payment estimates is essential for understanding and addressing financial vulnerabilities.

SBA Reported Improper Payment Estimates, but Work Remains on Overpayments

We have previously identified problems related to SBA’s estimates of improper payments, particularly for its pandemic relief programs. Accordingly, we made four recommendations to address these concerns, one of which has been implemented and three of which have not.

Estimating improper payments in pandemic relief programs—implemented. In November 2020, we reported that the lack of initial safeguards for PPP contributed to the increased risk of improper payments.[45] Because of concerns about the timely reporting of improper payments, we recommended that SBA expeditiously estimate improper payments and report estimates and error rates for PPP. In response to our recommendation, SBA began reporting an estimated improper payment rate and amount for PPP in its fiscal year 2022 agency financial report.

SBA has continued reporting these estimates, but some of the estimates remain high. For example, in March 2025, we reported that SBA’s estimated improper payment rates in fiscal year 2024 for three pandemic relief programs—the Restaurant Revitalization Fund, PPP Loan Forgiveness, and PPP Loan Guaranty Purchases—were at least 24 percent.[46]

Documenting and tracking overpayment reviews—not implemented. In November 2024, we reported on SBA’s efforts to identify and recover overpayments in PPP and COVID-19 EIDL.[47] We found that SBA’s loan review processes for these programs were not effectively identifying overpayments, and that SBA did not have sufficient processes to track identified overpayments and subsequent recoveries. We made three recommendations to SBA, including that it expand and document overpayment review procedures and expand its tracking process. SBA partially agreed with these recommendations, and we will continue to monitor its progress in addressing them.

SBA’s OIG Has Raised Concerns About SBA’s Improper Payment Reporting

SBA’s OIG reported in May 2025 that SBA was not in compliance with the Payment Integrity Information Act of 2019 and related OMB requirements.[48]

The OIG found that SBA did not comply with eight of the act’s 10 criteria for fiscal year 2024. For example, it found that SBA did not report an improper payment estimate for the Shuttered Venue Operators Grant program as required, and did not design and implement adequate review procedures to produce reliable sample results used to develop improper payment estimates for several programs, including PPP Loan Forgiveness and PPP Loan Guaranty Purchases.

We have ongoing work for this committee examining SBA’s improper payment estimation methods and recovery audits for its pandemic relief and standard programs. We will continue to monitor SBA’s actions to address these issues.

SBA Has Taken Steps to Improve Administration of Contracting Programs

We have reported on challenges related to SBA’s oversight of its contracting programs, including the 8(a) program.[49] SBA has addressed seven of the 21 recommendations we have made to address these challenges.

Reporting on procurement center representatives—implemented. SBA’s procurement center representatives advocate for small businesses when agencies are procuring goods and services. In a June 2020 report, we found that SBA did not maintain complete documentation to support data on the activities of these representative; these data are used to oversee the representatives and assess their performance.[50] Storing the complete documentation would help SBA verify the accuracy of the reports. SBA also did not submit required reports to Congress on the agency’s rationale for assigning the representatives to cover buying activities. We made two recommendations that SBA address these issues. In early 2021, SBA began using a central repository to store its data and submitted the required report to Congress.

Documenting reviews of small business subcontracting plans—implemented. Contractors that receive certain federal contracts are required to have small business subcontracting plans. Under these plans, contractors must make a good-faith effort to offer subcontracting opportunities to small businesses. Contracting officers are required to provide SBA staff with an opportunity to review the proposed contract. However, in a May 2020 report, we found that SBA could not provide documentation or information on almost all compliance reviews conducted by SBA in fiscal years 2016 through 2018.[51] We recommended that SBA address these issues. In response, SBA issued two guidance memos in November 2020. These memos instructed SBA staff to use a single electronic repository to store compliance review information and to conduct performance reviews.

Submitting 8(a) Business Development Program annual reports—implemented. In a 2022 report, we found that SBA had not submitted any of its required annual 8(a) program reports to Congress on time for 2016 to 2021.[52] We made two recommendations to SBA related to documenting its report process and developing a plan to address report delays. In response to our recommendations, SBA updated its standard operating procedures for the program to include a chapter on submitting the annual report, including a timeline for completing the report on time. SBA also developed a process map to help streamline report development.

Accurately documenting nonmanufacturer rule waiver reviews—implemented. In December 2023, we reported on issues related to SBA’s oversight of waivers to the nonmanufacturer rule.[53] We found that SBA data on these waivers included inaccurate or incomplete information, and that SBA did not have policies on how management should review analysts’ decisions. We made two recommendations that SBA address these issues. In response to our recommendations, SBA updated its program guidelines in July 2025 to address these concerns.

Identifying and addressing risks associated with the small business certification platform—not implemented. In a November 2024 report, we found problems with SBA’s management of the Unified Certification Platform project, which is intended to allow small businesses to more efficiently apply for and maintain certifications to SBA’s contracting assistance programs, including the 8(a) program.[54] We identified critical management gaps in the project. For example, SBA did not have a project-level risk management strategy or a risk mitigation plan, and did not fully identify and document risks. These issues increased the likelihood of a successful cyberattack. Consequently, we made 14 recommendations, including that SBA expeditiously address critical risk management and cybersecurity issues. SBA agreed with three, partially agreed with three, and disagreed with the other eight recommendations. We are monitoring SBA’s efforts to address our recommendations.

Chair Ernst, Ranking Member Markey, and Members of the Committee, this concludes my statement. I would be pleased to respond to any questions you may have.

GAO Contact and Staff Acknowledgments

If you or your staff have any questions about this testimony, please contact Courtney LaFountain, Acting Director, Financial Markets and Community Investment, at lafountainc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Marshall Hamlett (Assistant Director), Daniel Newman (Analyst in Charge), Seto Bagdoyan, Marcia Carlsen, Dan Flavin, Hannah Padilla, Jennifer Schwartz, and Jessica Sandler. Key contributors to the previous work discussed in this statement are listed in each of the cited reports.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

A. Nicole Clowers, Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us