SMALL BUSINESS ADMINISTRATION:

Report to Senate Committee on Small Business and Entrepreneurship

October 2026

GAO-27-107701

United States Government Accountability Office

A report to the Chair of the Committee on Small Business and Entrepreneurship, U.S. Senate

For more information, contact: lafountainc@gao.gov

What GAO Found

GAO analyzed the Small Business Administration’s (SBA) methods for estimating improper payments for fiscal years 2020 through 2024 for the Paycheck Protection Program (PPP) and the COVID-19 Economic Injury Disaster Loan (EIDL), 7(a) loan guaranty, and standard EIDL programs. SBA’s estimates met the Office of Management and Budget’s basic statistical requirements. However, SBA did not document the basis for key decisions it made to develop those estimates. This includes the basis for assuming that small and large loans are equally likely to be improper. SBA also did not consider whether estimates for PPP and COVID-19 EIDL appropriately reflected known fraud risks. As a result, SBA cannot be sure that its estimates accurately reflect improper payment risks, limiting its ability to use those estimates for decision-making on where to focus future corrective actions to help mitigate improper payment risks.

For 7(a) and standard EIDL, SBA does not currently conduct recovery audits—reviews of accounting and financial records to identify and recover overpayments—and had not reevaluated these decisions for 10 years and 15 years, respectively. However, interest rates, collateral requirements, and other factors that may affect the cost-effectiveness of recovery audits have changed over the past 10 to 15 years. SBA said it recovers overpayments using other methods. For example, on loans with an overpayment, SBA recovers a portion of the overpayment with each regular loan payment. However, SBA recovered less than 1 percent of the $616.2 million in overpayments it identified across its programs in fiscal year 2025, compared to 62 percent government-wide. Developing a process that triggers reevaluations of its approach to recovering overpayments in 7(a) and standard EIDL could help ensure that SBA’s approach reflects the current environment, which could potentially improve recoveries.

GAO identified key factors SBA could use when designing overpayment recovery audits and activities (see figure), which could help SBA more fully and systematically assess its recovery options. These factors incorporate and build on existing federal guidance.

Why GAO Did This Study

The Payment Integrity Information Act of 2019 requires federal agencies to estimate improper payments for risk-susceptible programs and to conduct recovery audits if doing so is cost-effective. In 2025, SBA estimated about $2 billion in improper payments for programs GAO reviewed. However, its Office of Inspector General reported that SBA was not compliant with the act, in part because of issues affecting the reliability of its estimates.

GAO was asked to review SBA’s improper payment estimates and recovery audits. This report examines (1) SBA’s methods for estimating improper payments, (2) SBA’s evaluation of the cost-effectiveness of recovery audits for its programs, and (3) key factors SBA could consider when identifying recovery options.

GAO reviewed SBA’s methods for estimating improper payments and evaluating recovery audit cost-effectiveness. GAO interviewed six federal agencies, all selected for demonstrating comparably high recovery rates, and developed a list of key factors for identifying recovery options.

What GAO Recommends

GAO recommends that SBA (1) document the basis for key sampling and estimation decisions; (2) ensure estimates reflect known fraud risk; (3) establish a process to trigger reevaluations of the cost-effectiveness of recovery audits for standard EIDL and 7(a) recovery options; and (4) apply relevant federal guidance and consider the key factors when identifying recovery options. SBA disagreed with the first two recommendations and agreed or partially agreed with the others. GAO maintains the recommendations are valid, as discussed in the report.

 

 

 

 

 

EIDL	Economic Injury Disaster Loan
EIN	employer identification number
OIG	Office of Inspector General
OMB	Office of Management and Budget
PIIA	Payment Integrity Information Act of 201
PPP	Paycheck Protection Program
SBA	Small Business Administration

October 7, 2026

The Honorable Joni Ernst
Chair
Committee on Small Business and Entrepreneurship
United States Senate

Dear Madam Chair:

Improper payments—payments that should not have been made or that were made in the wrong amount—are a long-standing and significant problem in the federal government.[1] Since fiscal year 2003, cumulative improper payment estimates reported by executive branch agencies have totaled about $3 trillion. For fiscal year 2025, agencies reported improper payment estimates totaling about $186 billion, including about $2 billion for the Small Business Administration (SBA) programs examined in this report.[2] It is important for agencies to have cost-effective means to both identify and recover improper payments when they occur. For fiscal year 2025, SBA reported an agencywide recovery rate of less than 1 percent.[3]

Federal agencies’ inspectors general have reported that improper payment estimates are unreliable for some programs.[4] For example, the SBA Office of Inspector General (OIG) reported that SBA was not compliant with the Payment Integrity Information Act of 2019 (PIIA) for both fiscal years 2024 and 2025, in part because of issues affecting the reliability of the agency’s estimates.[5] In addition, auditors have noted high levels of potential fraud in SBA’s pandemic programs. For example, in 2023, we reported that 3.7 million recipients of SBA funds had discrepancies associated with potential fraud.[6] The Pandemic Response Accountability Committee tied $5.4 billion in disbursements to loan applications using unissued or mismatched Social Security numbers.[7] SBA’s OIG reported in 2023 that approximately 17 percent of all COVID-19 Economic Injury Disaster Loan (EIDL) and Paycheck Protection Program (PPP) funds were disbursed to potentially fraudulent actors.[8]

PIIA requires federal executive branch agencies to develop improper payment estimates for programs considered susceptible to significant improper payments.[9] PIIA also requires agencies to conduct recovery audits, if cost-effective and not otherwise prohibited, on programs with annual expenditures of $1 million or more.[10] The Office of Management and Budget (OMB) plays a key role in developing guidance for executive branch agencies on estimating and reporting improper payments. OMB guidance states that while it is preferable that agencies focus their efforts on preventing overpayments, it is also important for them to have cost-effective means to identify and recover overpayments if they do occur.[11]

You asked us to review issues related to SBA’s improper payment estimates and recovery audits. This report examines (1) the extent to which SBA used methodologies for estimating improper payments from fiscal years 2020 through 2024 that aligned with PIIA and OMB requirements and documented support for key methodological decisions, (2) the extent to which SBA evaluated the cost-effectiveness of its overpayment recovery programs, and (3) key factors SBA could consider when identifying recovery options.

We selected a mix of recurring business lending programs and temporary COVID-19-era programs for review. We selected these programs because their improper payment amounts represented a large portion of SBA’s total estimate. We also sought a mix of program characteristics, including outlays, program maturity, whether a program was pandemic related, and improper payment rates. For recurring programs, we selected the 7(a) and standard EIDL programs, which represent SBA’s flagship lending program and a long-standing SBA disaster loan program, respectively. For temporary programs, we selected PPP and the COVID-19 EIDL program, which represent two of SBA’s largest pandemic-era programs. While these pandemic programs no longer accept new applications, SBA continues to make PPP outlays through loan forgiveness and loan guaranty purchase activities.

To address our first objective, we reviewed SBA’s improper payment estimation methodologies for each selected program for fiscal years 2020 through 2024.[12] We identified estimated improper payment rates and other program characteristics using PaymentAccuracy.gov data.[13] We reviewed improper payment information included in SBA’s annual financial reports, SBA OIG’s annual PIIA compliance reports, other SBA OIG reports, Pandemic Response Accountability Committee reports, and GAO reports. We also interviewed SBA and SBA OIG officials and reviewed their written responses to our questions. Additionally, we reviewed PIIA and OMB guidance to identify key requirements for developing improper payment estimation methodologies. Further, we examined whether SBA included support for methodological choices made in its sampling and estimation methodology plans.

To address our second objective, we evaluated SBA’s recovery audit cost-effectiveness determinations and supporting materials. We also interviewed program staff on overpayment identification and recovery processes for our selected programs.

To address our third objective, we developed a list of key factors and subfactors SBA could consider when designing its overpayment recovery audits and activities programs. We built this list using PIIA requirements and current and prior OMB guidance. We consulted with GAO specialists in cost-effectiveness analysis, internal control, fraud risk management, and improper payments.

We also obtained external expertise from six federal agencies and a recovery audit contractor.[14] To select the agencies, we analyzed relevant recovery information from PaymentAccuracy.gov for fiscal years 2020 through 2024, including each agency’s overpayment identification and recovery rates. We also considered additional program information, such as whether the agency conducts primarily recovery audits, recovery activities, or both, and whether those efforts are conducted primarily internally, by contractors, or both. We selected the Departments of Agriculture, Defense, Education, Health and Human Services, Transportation, and the Treasury because they had high recovery rates compared to other government agencies reporting to PaymentAccuracy.gov, among other factors.

We conducted this performance audit from July 2024 to October 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Small Business Administration Programs

SBA oversees programs that provide small businesses and entrepreneurs with counseling and training, access to capital and federal contracts, and disaster assistance. Some small business loans are made by approved lenders and partially guaranteed by the government, which reduces lender risk and helps small businesses qualify for financing. These loans can be used for purposes like starting or expanding a business, purchasing equipment or real estate, and providing working capital. In some cases, SBA offers loan programs to help businesses affected by disasters, such as hurricanes and COVID-19.

Early in the COVID-19 pandemic, agencies prioritized swiftly distributing funds and implementing new programs. We have previously reported that this urgency involved trade-offs that put billions of taxpayer dollars at increased risk for improper payments.[15] SBA, in particular, has provided extensive assistance to help small businesses affected by the COVID-19 pandemic since spring of 2020. SBA made or guaranteed more than $1 trillion in loans and grants and assisted more than 10 million small businesses, primarily through pandemic programs including PPP and the COVID-19 EIDL program. SBA’s pandemic programs differed in structure, outlays, and duration from its long-standing programs, including the 7(a) program and standard EIDL. SBA also continued to operate programs providing small businesses with access to capital, help with federal contracting opportunities, and aid in disaster recoveries.

Pandemic Relief Programs

PPP. The CARES Act, signed into law on March 27, 2020, established PPP to provide forgivable loans to small businesses and nonprofit organizations (referred to collectively as small businesses).[16] PPP loans were fully SBA guaranteed and made to borrowers through a network of participating lenders under program rules set by Treasury and SBA’s Office of Capital Access.[17] Under the law, qualifying businesses could obtain loans in amounts calculated using their payroll costs, not to exceed $10 million, and were required to self-certify their need for the loan.[18]

The loans carried a 1 percent interest rate and were fully forgivable if certain conditions were met—for example, at least 60 percent of the loan forgiveness amount had to be for payroll expenses to qualify for full loan forgiveness. The CARES Act set a maximum loan term of 10 years from the date of the forgiveness application.[19] Although SBA stopped accepting PPP loan applications in May 2021, borrowers can apply for forgiveness through the end of their loans’ terms or continue to make payments on those loans.

COVID-19 EIDL. The CARES Act also provided funds for the COVID-19 EIDL program, which provided loans to small businesses from March 2020 through May 2022 to recover from the economic effects of the pandemic. SBA managed the COVID-19 EIDL program directly. The maximum repayment term for COVID-19 EIDLs was 30 years.[20] Although SBA stopped accepting applications for COVID-19 EIDLs in January 2022, it continues to service the loans. COVID-19 EIDLs are not eligible for forgiveness, so borrowers are required to repay the full loan amount.

Shuttered Venue Operators Grant Program. This program was established in December 2020 as part of the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act.[21] The program awarded grants totaling $16.25 billion to eligible businesses in the live arts and entertainment industry. Recipients could receive initial and supplemental awards in amounts calculated based on various factors, not to exceed $10 million in total.

Ongoing Programs

7(a). The 7(a) program is SBA’s largest loan guarantee program for small businesses, with about $123 billion in outstanding loan principal as of the end of fiscal year 2025.[22] The program generally provides guarantees of up to 85 percent for loans made to small businesses that are unable to obtain credit on reasonable terms in the private credit markets.[23] Like PPP loans, 7(a) loans are guaranteed by SBA and made to borrowers through a network of participating lenders. The maximum loan terms for the 7(a) loans are typically 10 years but can be up to 25 years in certain circumstances.[24]

Standard EIDL. The standard EIDL program was established as part of the Small Business Act of 1953 to provide federal assistance to small businesses, small agricultural cooperatives, and most private nonprofit organizations located in a declared disaster area that have suffered substantial economic injury.[25] As part of SBA’s Disaster Loan program, standard EIDLs provide working capital and support ordinary operating expenses necessary to alleviate the economic injury caused by a declared disaster and enable eligible businesses to continue operations.[26] These loans are made to borrowers directly by SBA. Standard EIDLs have a maximum loan term of 30 years.

Developing an Improper Payment Estimate

Relevant laws and guidance require agencies to develop and report improper payment estimates for certain programs but provide some flexibility in developing these estimates.[27] Federal programs are diverse in their type, size, and complexity. As a result, improper payment sampling and estimation plans vary across programs. However, we have identified that development of an improper payment estimate generally involves three key components: sample selection, identification of improper payments, and calculation of the estimate.

 

Common Statistical Terminology for Improper Payment Sampling and Estimation Population. The specific data group being analyzed for estimating improper payments. For example, in a lending program, the population may be all loans approved by an agency over a specified period, such as a fiscal year. Sample unit. One of the individual data elements within the population being sampled for improper payment estimation. For example, in a lending program, a sampling unit may be an individual loan approved by the agency. Strata. The groups into which the population is divided, where each sample unit belongs to one group. For example, in a lending program, strata may include loan amount, borrower type, and industry sector. Point estimate. A single, specific value calculated from sample data to estimate an unknown population parameter, such as a mean or proportion. Level of confidence. The degree of certainty associated with an estimate. For example, for a lending program with a 95 percent confidence level, if the agency were to conduct a sample 100 times on the same population, it would expect 95 of those samples to have a similar result. Confidence interval. A range of numbers that a sample suggests, where the true value for the whole population is likely to fall for a given level of confidence. For example, if the sample estimate for the average loan amount of a lending program is $42,000 and the 95 percent confidence interval for this estimate is $39,500 to $44,500, then the agency can be 95 percent confident that the true average loan amount for all borrowers falls within this range. Source: GAO.  |  GAO‑27‑107701

Sample Selection

To estimate improper payments, an agency first selects a sample of data to test from a larger specified population of data. The agency identifies the data element or object that will be selected, known as the sampling unit. For example, in a lending program, the sampling unit may be an individual loan. The agency then defines the population for the sampling unit. For example, if the sampling unit is an individual loan, the population could be all loans made in a given time period, such as a fiscal year.

Once the agency has identified the population, it can select a sample. However, before doing so, the agency may decide to subdivide the population into two or more mutually exclusive groups. This process is called stratification, and the resulting subdivisions are known as strata. The agency may collect independent samples from each subdivision, or stratum. Stratification may help the agency to obtain a more precise estimate or emphasize certain portions of the population, such as items with high dollar values or greater potential for error.

Identification of Improper Payments

After the agency selects its sample, it reviews, or tests, the sampled items to identify improper payments. PIIA defines “improper payment,” and an agency must apply that definition in the context of the program for which it is developing an estimate.[28] If an agency identifies an improper payment, it records the amount associated with the sampled item in the testing results. The agency then uses the testing results to calculate the improper payment estimate for the program.

Testing processes vary depending on program rules and regulations. However, they typically include steps to address aspects of eligibility, which is a key component of determining appropriateness of a payment. For example, in a lending program, an agency would likely review a sampled loan to verify that the borrower was eligible to receive the loan and that the loan amount was correct.

Calculation of the Estimate

Once testing is complete and the agency has identified the improper payments associated with the sampled items, the agency can calculate the improper payment estimate for the program. If the agency used sample stratification, it first determines an estimate for each stratum and then combines those estimates to develop an improper payment estimate for the entire program. In doing so, the agency may weight the results for each stratum to help ensure that the overall program estimate is accurate.

An agency can employ various statistical techniques to calculate improper payment estimates. These techniques vary in sophistication. A simple technique is to calculate the mean, or average, improper payment amount for the sample, based on testing results, and then multiply this amount by the total number of sample units in the population. This will yield an estimated improper payment amount for the population. The estimated amount can then be divided by the total outlays associated with the population to calculate an estimated improper payment rate.

An agency may choose to use more sophisticated techniques to help improve an estimate’s accuracy or precision. For example, if an agency suspects that there is a correlation between two variables, such as sample unit dollar amount and likelihood of improper payment, it may consider a technique known as ratio estimation. This technique assumes the ratio between two variables holds true for an entire population. For example, in a lending program, an agency may scrutinize high-dollar loan applications more thoroughly than small-dollar loan applications. As a result, the agency may deduce that small-dollar loans have higher incidence of improper payments, and vice versa. The agency can use this variable correlation to inform sample stratification and estimation calculations, such that the resulting estimate may be more accurate or precise than one produced by a simpler technique, such as multiplying the average improper payment amount by the total number of sample units.

PIIA requires that agencies produce a statistically valid improper payment estimate, or an otherwise appropriate estimate, using a methodology approved by the Director of OMB.[29] OMB guidance states an improper payment sampling and estimation plan is considered “statistically valid” if it produces a point estimate and confidence interval around that estimate.[30]

In the context of a program’s improper payment estimate, a point estimate can be thought of as the “best guess” of the program’s true improper payment amount or rate for the reporting period. The associated confidence interval specifies a range of values, sometimes called the margin of error, that is likely to contain the true improper payment amount , along with a specified level of confidence. For example, imagine an agency reports that a program’s estimated improper payment rate for the prior fiscal year was 10 percent, with 95 percent confidence and a margin of error of 2 percent. This means the agency can be 95 percent confident that the interval from 8 to 12 percent contains the true improper payment rate for the program for the prior fiscal year. Conversely, there is a 5 percent chance that this interval does not contain the true improper payment rate.

Improper Payment Estimates and Fraud

Fraud is the act of obtaining something of value through willful misrepresentation. Whether an act is fraudulent is determined through the judicial or other adjudicative system. While improper payments could suggest that a program may be vulnerable to fraud, and fraudulent payments are considered improper, not all improper payments are due to fraud. The improper payment estimates required under PIIA are not required or intended to reflect the extent of fraud in a program.

As discussed above, improper payment estimates are based on reviews of a statistically valid sample of payments or an otherwise appropriate method approved by OMB. These reviews can be rigorous; however, they are not designed to identify fraud, particularly schemes that cannot be easily detected. For example, improper payment reviews include checking whether certain documentation is present, but they are not designed to identify falsified documentation.

OMB guidance identifies two distinct categories of improper payments: intentional and unintentional. Intentional improper payments are more commonly referred to as financial fraud and are overpayments that occur based on willful misrepresentation. Conversely, unintentional improper payments are overpayments that are accidental and not based on purposefully falsified information. OMB guidance states that agencies may classify improper payments as intentional only after the amount is determined to be fraudulent through the adjudication process.[31]

Overpayment Recovery

Agencies should generally attempt to recover overpayments and do so in a manner that provides the greatest financial benefit for the government. Agencies can use recovery audits and recovery activities to identify and recover overpayments. Regardless of whether an agency uses recovery audits or activities, it may recover overpayments by sending demand letters; reducing future payments; or garnishing other payments, such as tax refunds.

·       Recovery audits. Reviews and analyses of an agency’s or program’s accounting and financial records that are specifically designed to identify and recover overpayments. According to PIIA, agencies shall consider conducting recovery audits for all programs that expend $1 million or more annually if conducting the audits would be cost-effective and not otherwise prohibited by law.[32]

·       Recovery activities. Activities other than recovery audits that are conducted by an agency to identify and recover overpayments. OMB guidance notes that recovery activities include reviews of grantee audits, self-reported overpayments, statistical sampling results, and agency postpayment reviews.

OMB guidance states that agency efforts to identify and recover overpayments must be cost-effective, regardless of whether the agency uses a recovery audit, recovery activities, or both. OMB guidance also states that each agency should determine the most cost-effective combination of these options.

SBA Used Methodologies Aligned with Requirements but Did Not Sufficiently Document the Basis for Certain Key Decisions

SBA’s Estimation Methodologies Aligned with Requirements

Key Terms for Improper Payment Sampling and Estimation Probability proportional to size sampling. A sampling technique in which the probability of selecting an item is proportional to the fraction of the dollars it represents in the sample frame. Sampling with replacement. A sampling technique in which an item selected for the sample is returned to the population and can be selected again. Equal probability sampling. A sampling technique in which each item in the population has the same probability of being selected. Sampling without replacement. A sampling technique in which the sampled item is removed from the sampling frame before making the next selection. Thus, each item in the sample frame can be selected only once. Point estimate. A statistically valid estimate of a population value derived from a generalizable sample. Source: GAO.  |  GAO‑27‑107701

SBA’s methodologies for estimating improper payments in selected programs generally aligned with PIIA requirements to produce a statistically valid estimate and OMB guidance.[33] Specifically, SBA’s sampling and estimation plans for each program produced statistically valid estimates, as required by PIIA.[34] Appendix I lists SBA’s estimated improper payment rates for the programs and fiscal years we reviewed.

PIIA and OMB guidance provide SBA with some flexibility in developing improper payment estimates. SBA was not required to use consistent methods across programs or years, and its statistical sample designs varied across the programs and fiscal years we reviewed. Key features of SBA’s methodologies for each program are described below.

·       PPP. SBA used equal probability sampling without replacement for its first PPP improper payment estimate, reported for fiscal year 2022. This estimate covered PPP loan approval activity, and SBA stratified its sample by sector, loan size, and lender type.[35] For fiscal years 2023 and 2024, SBA used probability proportional to size sampling with replacement. These estimates covered loan forgiveness and loan guaranty purchase activity, and SBA stratified its samples by lender type and month.[36]

·       COVID-19 EIDL. SBA did not report a COVID-19 EIDL program improper payment estimate for fiscal year 2021, but it calculated an estimate as part of its assessment that the program was susceptible to significant improper payments. SBA reported estimates for fiscal years 2022 and 2023 using a stratified random sample based on dollar value and disbursement quarter, with equal probability of selection within each stratum and sampling without replacement.[37] SBA did not report an estimate for fiscal year 2024, citing the absence of new program funding.

·       7(a). SBA reported improper payment estimates for its 7(a) program using probability proportional to size sampling with replacement for all fiscal years in our review. SBA’s estimates covered loan approval and loan guaranty purchase activity. For loan approvals, SBA stratified its sample by loan delivery method and month. For guaranty purchases, SBA stratified its sample by service center and month. It used a stratified sample design based on dollar value.

·       Standard EIDL. SBA used different sampling designs across the review period for the standard EIDL program: probability proportional to size sampling without replacement for fiscal year 2021, equal probability sampling without replacement for fiscal years 2022 and 2023, and probability proportional to size with replacement for fiscal year 2024. For each year, SBA sampled from loan disbursements within a specified time range and stratified by loan type, which included business loans for economic injury for large and small disasters.

For each of these four programs, SBA used a variation of the Hansen-Hurwitz ratio estimation method to derive estimated improper payment rates for all years in which it reported estimates.[38]

SBA Did Not Sufficiently Support Certain Key Methodological Decisions

SBA documented a rationale for the sampling and estimation approaches it used for its programs, but the documentation did not include key information needed to justify and validate the approaches. Specifically, SBA did not sufficiently support key decisions related to its choice of sampling methodology or its consideration of fraud risks in improper payment sampling and estimation plans.

Sampling Methodology

SBA’s sampling documentation did not include sample testing results with sufficient detail to determine whether results supported SBA’s choice of sampling methodology. SBA’s sampling methodology aligned with PIIA requirements, which requires the agency to produce a statistically valid estimate as defined by OMB guidance. However, SBA did not provide us with documentation that included details necessary to provide assurance that its sample selection and stratum allocation decisions aligned with the improper payment risks within each program. Without this documentation, we cannot confirm if SBA’s analysis appropriately aligned with its improper payment risk.

In addition, according to SBA OIG, the sampling and estimation methodologies for PPP and the COVID-19 EIDL and standard EIDL programs were not appropriate or statistically acceptable to produce accurate improper payment estimates.[39]

SBA’s methods varied across programs and over time, but it used probability proportional to size sampling with replacement for all programs with estimates for fiscal year 2024. In addition, SBA stratified payments by characteristics such as loan size and lender type, depending on the program. However, SBA allocated sample sizes to each sampling stratum in proportion to the total dollar amount of payments within each program.

In using this approach, SBA assumed that the improper payment risk was constant for each program dollar, meaning that characteristics such as loan size or lender type were not correlated with the improper payment risk. However, for the COVID-19 EIDL program in fiscal year 2021, SBA found evidence from its improper payment sample that improper payment risk was inversely correlated with loan dollar size. Specifically, SBA’s analysis found that larger loans in the program had lower improper payment risk because they received enhanced scrutiny during the underwriting process. External entities, such as SBA OIG and the Pandemic Response Accountability Committee, also reported instances of improper payments concentrated among low-dollar-value loans.[40]

In addition, while SBA initially used stratification to subdivide its populations based on loan characteristics correlated with heightened improper payment risk, it moved toward using less stratification over the years we reviewed. For example, in both PPP and the Disaster Loan Program, which includes the standard EIDL program, SBA did not stratify by loan size for fiscal year 2024, even though it had done so in prior years and had previously discussed loan size as a relevant characteristic for improper payment risk.

Finally, SBA used a 10 percent expected improper payment rate to calculate minimum sample sizes for the PPP and the COVID-19 EIDL programs. SBA’s sampling documents stated a 10 percent expected improper payment rate was appropriate given a lack of sufficient historical data. However, the documentation did not address why SBA did not use prior-year improper payment rates to calculate sample sizes for current-year improper payment estimates.[41]

OMB guidance states that agencies are responsible for producing estimates that are accurate and appropriate given program characteristics, and that agencies should have a structured and systematic approach to identify where improper payments may arise within the programs they administer.[42] OMB guidance further notes that improper payment sampling and estimation plans can help agencies identify points within a program’s payment process that may be vulnerable to improper payments.[43]

PIIA requires each agency’s OIG to conduct an annual compliance review that includes evaluating the adequacy of the agency’s improper payment estimates and methodology.[44] OMB guidance states that, in doing so, the OIG will evaluate whether the sampling and estimation methodology plans, and provided program explanations used, are adequate and appropriate given program characteristics.[45] As noted above, SBA OIG reported that SBA’s sampling and estimation methodologies for several programs were not appropriate or statistically acceptable to produce accurate improper payment estimates in fiscal years 2023 and 2024. In addition, federal internal control standards state that management should implement control activities through policies and procedures. Management is to establish control activities that reduce risks, including improper payments and fraud, to acceptable levels. It does so by documenting expectations in policies and documenting the specific actions that implement those policies in procedures.[46]

In selecting sampling methodologies, SBA focused on ensuring baseline statistical validity requirements were met. However, it did not document and validate whether its methodologies reflected program-specific risk patterns. As a result, SBA did not document the analysis needed to validate that its sample selection and stratification decisions reflected the actual distribution of improper payment risks in the programs we reviewed.

While SBA used methodologies that met OMB’s definition of statistical validity, it did not provide sufficient documentation to support sample selection using probability proportional to loan dollar size. Without that documentation, we cannot assess whether this improper payment risk pattern still holds or has changed over time. This type of sample selection methodology is not appropriate when the payment risk is inversely correlated with dollar size.[47] Without assurance that this risk pattern no longer holds, the agency may have used a methodology that produced a statistically biased estimate that underestimated the true improper payment error rate.

Documenting sufficient analysis—such as analysis confirming whether improper payment risk is proportional to loan dollar size—and including it in SBA’s sampling and estimation plans would help ensure that SBA has support to justify and validate its estimation approaches and that the resulting estimates provide useful information for program management.

Decisions Related to Fraud Risks

SBA did not consider fraud risks in its improper payment sampling and estimation plans for its pandemic programs. According to SBA officials, the agency took actions to ensure that fraudulent payments were investigated. For example, SBA officials stated that when quality control staff identified potential fraud, they referred the cases to SBA OIG for review. However, SBA officials told us that the agency did not consider fraud risk when selecting samples for improper payment testing. Fraudulent payments are a type of improper payment, and certain loans within SBA’s samples may have been more susceptible to fraud. However, because SBA did not consider fraud risk when selecting samples, SBA’s sampling and estimation plans may not have appropriately reflected the uneven risk of improper payments across loans.

SBA’s first improper payment estimates for PPP and the COVID-19 EIDL program were reported for fiscal year 2022. Prior SBA reporting described the programs as susceptible to significant fraud risks and vulnerabilities. For example, SBA’s fiscal year 2020 agency financial report included statements from SBA OIG that there were strong indicators of widespread potential abuse and fraud in PPP and the COVID-19 EIDL program.[48] We also testified in March 2021 that these programs were susceptible to fraud.[49] Subsequent reports on the extent of potential fraud further underscored this susceptibility. For example:

·       The Pandemic Response Accountability Committee identified $5.4 billion in potentially fraudulent pandemic loans disbursed by SBA from fiscal years 2020 through 2022.[50]

·       SBA OIG reported that $36 billion in SBA pandemic loans from fiscal years 2020 through 2023 were likely obtained fraudulently.[51]

·       SBA OIG estimated that, as of June 2023, SBA had disbursed more than $200 billion in potentially fraudulent loans through the COVID-19 EIDL program.[52]

OMB guidance states that while agencies should track and report improper payments resulting from fraud, agencies’ improper payment sampling and estimation methods do not need to be designed such that the resulting estimates are a measure of financial fraud.[53] However, OMB guidance also notes that agencies are responsible for producing estimates that are accurate and appropriate given program characteristics.[54] Given the information available at the time SBA developed its improper payment estimates, SBA’s sampling and estimation plans for PPP and the COVID-19 EIDL program would have been strengthened by including the consideration of known risks of fraudulent payments, a type of improper payment.

In addition, as noted earlier, federal internal control standards state that management should implement control activities through policies and procedures. Management is to establish control activities that reduce risks, including improper payments and fraud, to acceptable levels. It does so by documenting expectations in policies and documenting the specific actions that implement those policies in procedures.[55]

SBA officials told us that SBA focused on selecting improper payment samples based on criteria established in the sampling and estimation plans, and those criteria did not include fraud or suspected fraud. As a result, SBA did not consider whether the estimates would appropriately reflect known fraud risks and the scale of potential fraud in PPP and the COVID-19 EIDL program. Known fraud risks in PPP and the COVID-19 EIDL program were documented in OIG reports, GAO reports, and adjudicated fraud cases.[56] Including such considerations in future plans would help ensure that SBA’s estimation approaches are well supported and aligned with known program risks.

SBA Evaluated Recovery Audit Cost-Effectiveness but Has Not Kept Its Recovery Approach Current

SBA Did Not Periodically Reassess Recovery Audit Cost-Effectiveness for the Standard EIDL or 7(a) Programs

SBA has evaluated the cost-effectiveness of recovery audits across the programs in our review—PPP, COVID-19 EIDL, standard EIDL, and 7(a)—but has not periodically reevaluated these determinations for the standard EIDL or 7(a) programs. SBA does not currently conduct recovery audits for any of the programs in our review. According to agency officials, SBA has determined that recovery audits are not cost-effective and instead relies on other recovery activities to identify and recover overpayments.

Under PIIA and OMB guidance, SBA is not required to perform recovery audits if the audits would not be cost-effective.[57] SBA’s reasons for determining such audits would not be cost-effective varied across programs:

·       PPP and COVID-19 EIDL. In November 2023, SBA determined that recovery audits would not be cost-effective for its pandemic programs because it was already conducting other recovery activities.[58]

·       Standard EIDL. In 2011, SBA determined that recovery audits were not cost-effective because overpayments would be recovered through borrower repayment. In addition, according to SBA, most standard EIDLs are collateralized, which promotes recovery. SBA has not reevaluated this determination since 2011.

·       7(a). In March 2026, SBA stated that it had recently determined that recovery audits would not be cost-effective for the 7(a) program.[59] SBA stated that existing controls effectively prevent or detect improper payments and that the cost of conducting recovery audits would exceed expected recoveries. However, prior to this determination, SBA had not reevaluated the cost-effectiveness of recovery audits for this program since 2015. At that time, SBA officials said that a new quality control review process had prompted them to conduct a recovery audit, which they found was not cost-effective because the cost of the audit exceeded the return.

The long period of time between reevaluations for the standard EIDL and 7(a) programs is notable because improper payment risks in these programs have increased since the early 2010s, including during and after the COVID-19 pandemic. For example, although the estimated overpayment rate for 7(a) loan guarantee purchases was 0.81 percent in 2025, it rose after the pandemic, from 2.29 percent in 2019 to 4.65 percent in 2024. In 2023, SBA OIG identified factors—such as higher loan amounts and rising interest rates—that could affect the cost-effectiveness of 7(a) recovery options.[60]

For the standard EIDL program, in 2024, SBA increased the maximum amount borrowers could receive without collateral from $25,000 to $50,000, a change it said responds to inflation, increases program efficiency, and improves access to credit in underserved communities. If this change resulted in a larger overall dollar amount of overpayments for the program, SBA would be responsible for higher value recoveries, and the cost-effectiveness of recovery audits could change.

SBA’s prior determination that recovery audits are not cost-effective in its loan programs, including 7(a) and standard EIDL, was based in part on the assumption that overpayments are recovered when the borrower repays the loan. In cases of fraud, borrowers may not intend to repay loans, making recoveries more difficult.[61] Overpayments may also have broader effects, even if repaid, such as reducing funds available to other eligible applicants.

SBA’s experience with its pandemic loan programs demonstrates that reevaluating recovery-related cost-effectiveness determinations can result in financial benefits. For example, in 2022, SBA determined not to pursue collection on certain defaulted PPP loans and COVID-19 EIDLs, or to refer them to Treasury for collection, based on a cost-benefit analysis. After a subsequent analysis in December 2023, SBA found that such collections would be cost-effective and reversed this policy. Following this change, delinquent debt referrals to Treasury increased from about $4 million to more than $35 billion, resulting in about $159 million in collections as of February 2026 (see appendix II for additional details). This example highlights the importance of periodic reassessment.

According to OMB guidance, if an agency determines it would be unable to conduct a cost-effective recovery audit for a program, the analysis only needs to be repeated if circumstances change that might make a recovery audit cost-effective.[62] Circumstances such as the COVID-19 pandemic and the existence of related programs or a large increase in program outlays would likely merit such a reconsideration. Additionally, federal internal control standards state that management should identify, analyze, and respond to significant changes that could affect risks to achieving its defined objectives, such as risks related to improper payments and fraud. Under these standards, management assesses internal and external risks and performs risk assessments on a periodic and ongoing basis.[63] As part of these assessments, management identifies, on a timely basis, significant changes that could affect the entity’s internal control system, such as changes to the entity’s program or activities, economic instability or crises, public health emergencies, and other catastrophic events.[64]

Officials told us that the agency plans to periodically reevaluate the cost-effectiveness of recovery audits for the 7(a) program as risks evolve. Risks also may have changed for the standard EIDL program. However, SBA has not described how it will monitor changes in program risks on a periodic and ongoing basis or determine when such changes warrant reevaluation. As a result, it is unclear how the agency will ensure that such reevaluations occur in practice. During a period when risks had increased—including during and after the COVID-19 pandemic—SBA did not reevaluate the cost-effectiveness of recovery audits for about a decade before our review.

Without a mechanism to monitor changes in program risks on a periodic and ongoing basis and determine when reevaluation is warranted, SBA risks relying on outdated determinations and may miss opportunities to identify more cost-effective recovery approaches. As risks increase, periodic reevaluation of recovery options could help ensure SBA can respond to changes that affect recoveries. Without such a mechanism, millions of dollars in overpayments may go unrecovered. In fiscal year 2025, SBA recovered less than 1 percent of the $616.2 million in overpayments it identified for recovery across its programs, compared with a total of 62 percent recovered government-wide.[65] SBA’s rate suggests opportunities to improve recovery outcomes and achieve significant financial benefits.

A Robust Approach Could Strengthen SBA’s Evaluation and Design of Recovery Efforts

As discussed above, SBA has not periodically reevaluated its cost-effectiveness determinations for recovery audits and has, at times, reversed earlier decisions after reassessing its recovery approach. These findings indicate that determining whether and how to pursue recovery audits and activities would benefit from a robust, periodic review that accounts for changing program risks, available data, and operational constraints. While SBA has made certain cost-effectiveness determinations, it has not established a clear process for reevaluating those determinations or identifying alternative recovery approaches as conditions change. In addition, the current recovery audit cost-effectiveness determination SBA provided for the 7(a) program was missing key elements of a cost-effectiveness analysis outlined in OMB Circular A-94, such as quantified costs and benefits.[66] Without quantifying the costs and benefits of its recovery efforts, SBA cannot effectively evaluate the cost-effectiveness of recovery audits and activities.

Applying relevant federal guidance that helps agencies assess benefits and costs of various alternatives, along with the key factors presented in the next section, could help SBA more fully and systematically assess its recovery options. It could also better position the agency to identify and implement cost-effective approaches over time.

Key Factors for SBA to Consider in Identifying Recovery Options

Identifying Recovery Options

To help SBA identify recovery options, we identified key factors for assessing cost-effectiveness and informing recovery program design.[67] These factors are organized into five categories and 18 subfactors. Current OMB guidance identifies broad factors for assessing the cost-effectiveness of recovery audits and states that agencies are to determine the most cost-effective combination of recovery audits and recovery activities. Our factors and subfactors incorporate and build on that guidance.[68] We also consulted internal specialists, knowledgeable officials from six federal agencies, and a recovery audit contractor. These factors and subfactors are intended to help inform SBA’s consideration of recovery approaches and may be useful to other agencies as well.

The five factors are

1.     current activities and past experience,

2.     program characteristics,

3.     data and systems,

4.     payment or recipient characteristics, and

5.     public perception.

Thirteen of the 18 subfactors are based on compliance criteria in PIIA or current or prior OMB guidance. The remaining five subfactors reflect key practices identified by agencies we interviewed and GAO’s Fraud Risk Framework.[69]

Several points are important when applying these factors and subfactors.

·       The factors can inform, but do not replace, cost-benefit analysis. OMB Circular A-94 and Circular A-4 provide guidance that can help agencies assess the benefits and costs of various alternatives.[70] The factors and subfactors provide additional considerations that may inform SBA’s assessment of cost-effectiveness.[71] Even if SBA determines that its current recovery efforts are cost-effective, these considerations may help identify opportunities for more cost-effective recovery options.

·       Cost-effectiveness may involve a government-wide perspective. OMB guidance directs agencies to conduct their recovery audits and activities in a manner that will ensure the greatest financial benefit to the government.[72] Accordingly, SBA could consider whether recovered funds benefit the government overall, not just the agency.

·       The factors are complex and interrelated. Our organization of the factors reflects our informed judgment on how best to present them. Taken as a whole, they are intended to capture key considerations that may inform the design of overpayment recovery audits and activities.

·       Applying the factors may involve collaboration across areas of expertise. Relevant expertise may include that in legal, data analytics, and operational areas, as well as collaboration among relevant offices and staff.

·       The factors may be used to inform decisions at different levels. SBA could consider these factors at the program or subprogram level.[73] What is cost-effective for one part of a program may not be cost-effective for another. Recovery audits and activities can be tailored accordingly, and SBA may choose to use both approaches, depending on the situation.

·       Not all subfactors may apply in every case. It is important to consider all the subfactors, but SBA may ultimately decide that some are not applicable or that there are additional subfactors unique to them.

Description of the Factors and Subfactors

Figure 1 shows key factors and subfactors SBA could consider when designing overpayment recovery audits and activities.

Current Activities and Past Experience

To help estimate future performance of recovery options, this factor includes current and past actions to recover overpayments, as well as past results and the accumulated experience of SBA and its personnel.

Overpayment identification methodology. This subfactor addresses how overpayments are identified, including the methodologies and review processes used. Officials from one agency we consulted noted the following technical considerations:

·       How far back in time overpayment identification efforts extend, taking into account record retention requirements and statutes of limitation (discussed below).

·       Whether to review a random sample of payments or use a more targeted approach, such as focusing on payments associated with certain overpayment scenarios or those most likely to be recovered.

·       Whether to examine the full universe of transactions for overpayments or extrapolate from a sample. For example, through the Risk Adjustment Data Validation process in the Medicare Advantage program, auditors review a sample of payments made to participating insurance companies.[74] Based on the prevalence of overpayments in the sample, an estimate can be made of total overpayments made to the insurer. The insurer may then be required to repay that amount to the government, but this approach has been a topic of litigation, according to a Department of Health and Human Services official.

SBA could also consider overpayment-related findings identified internally or by external audit entities, such as the agency’s OIG or GAO.

Personnel experience with recoveries. Experience with recoveries—including the use of recovery contractors and potential operational disruptions—can influence how recovery efforts are implemented.

If SBA staff lack experience or capacity, SBA may consider whether to develop or enhance agency personnel resources or hire contractors. Each option may present trade-offs. For example, hiring contractors may conserve agency resources, but SBA would need to pay for their services and thus might not retain the full amount recovered.[75] Officials from one agency told us that different contract types might also be considered, such as whether contingency fee-based arrangements are available.

Potential operational disruptions are another consideration. For example, recovery efforts for one program may affect resources available to others if budgets are shared. Further, staff may need to reallocate time from routine duties if dedicated recovery staff are not available.

Historical overpayment rate of the program. Historical actual or prior estimated overpayment rates may indicate which recovery audits and activities are likely to be cost-effective. Programs with lower overpayment rates may not yield significant recoveries, while those with higher rates may present greater recovery opportunities. Historical or estimated overpayment rates for similar programs may also inform expectations about recovery performance. In addition, understanding overpayment rates may help SBA assess whether process improvements are warranted within a program, such as strengthening prepayment controls.

 

 

 

 

Program Characteristics

This factor considers the circumstances of a program.

Changes in program circumstances. This subfactor addresses whether fundamental changes have occurred in the program. According to OMB guidance, if an agency had previously determined that recovery audits were not cost-effective, but circumstances have changed so a recovery audit might be cost-effective, the agency will need to reconsider that determination.[76] For example, a program’s payments may initially be too small to make recovery audits cost-effective but later increase in size, potentially making them cost-effective.

Complexity of program payments. The complexity of program payments—including the involvement of related parties or associated payments—may affect the feasibility and cost of recovery efforts.[77]

More complex financial situations may require more rigorous analysis and increase the resources needed to identify and recover overpayments. Reliance on multiple state or local entities to administer a federally funded program can also increase program complexity.

Results of fraud risk assessments. This subfactor addresses whether SBA has identified significant fraud risks or estimated significant amounts of fraud. Such information may help indicate which recovery audits and activities are likely to be cost-effective.

The extent of potential fraud, as well as the estimated costs of identifying and recovering fraudulent payments, may affect cost-effectiveness. Fraud estimates can be more challenging to develop than improper payment estimates. In addition, the cost of identifying potentially fraudulent payments may differ from identifying other types of improper payments.

Legal considerations. Legal requirements and authorities governing recoveries may affect the design and cost-effectiveness of recovery efforts.

·       Agency recovery obligations. Federal agencies are required to refer eligible delinquent debts to Treasury for collection.[78] Agencies must also comply with other applicable laws and guidance. For example, for certain types of debt, OMB guidance requires agencies to submit a written demand to a debtor as soon as reasonably possible after identifying the debt.[79] In addition, program-specific laws or policies may govern recovery. For example, officials of one agency cited a federal program where recovery is the responsibility of state entities, and the recovery-related considerations are established in nonfederal statutes and regulations.

·       Ability to collect penalties or damages.[80] Program statutes sometimes authorize agencies to assess penalties or damages for confirmed fraud, in addition to collecting the amount paid improperly.[81] For example, the Social Security Act authorizes civil monetary penalties for certain wrongful activities, including those that result in overpayment due to certain omissions or false material statements.[82] Absent specific agency authority, the Department of Justice may pursue a variety of remedies through civil cases or criminal charges. The collection authorities available may affect the cost-effectiveness of recovery audits and activities.

·       Statutes of limitation. The time available to pursue recovery—set by statutes of limitation—may affect cost-effectiveness. Longer time frames provide more time to recover monetary penalties or other damages associated with adjudicated fraud. For example, Congress extended the statute of limitations from 5 years to 10 years for criminal and civil enforcement of PPP and COVID-19 EIDL program fraud, increasing the time available for enforcement.[83]

Data and Systems

This factor considers how data are collected, used, stored, and shared, as well as the technologies and processes used to analyze the data.

Data technology. Access to technology that can process and analyze data—such as a central electronic database and automated systems—may affect recovery efforts. OMB guidance explains that recovery audits that use central electronic databases are generally more efficient and effective.[84] It also notes that sophisticated software can be used to identify significant overpayments that are recoverable at a low cost.

Officials from one agency noted that the effectiveness of recovery is directly tied to a system’s ability to flag, track, and report overpayments. They also noted that system limitations—particularly in legacy financial systems—can restrict an agency’s ability to automate recovery workflows, track overpayments in real time, and coordinate with Treasury on recovery.

Robustness and documentation of internal controls. The extent to which internal controls are robust and documented may help indicate a program’s overpayment rate. Standards for Internal Control in the Federal Government, known as the Green Book, sets internal control standards for federal entities.[85] Programs with weaker controls—identified, for example, by internal or external audits—may have higher overpayment rates than currently identified.

Data access. Easy access to high-quality, relevant information on recipients of program payments may affect SBA’s ability to identify overpayments. If such data are not available, SBA could invest in collecting them or obtain access in some other way.

In some cases, data may exist but be difficult to access, such as data used to verify income. Officials from one agency noted that data in federal systems may also be limited when programs are administered by state or local entities. Recovery audit contractors may also face challenges accessing agency databases. In such cases, SBA may need to establish data-sharing agreements with entities that own the data.

 

Payment or Recipient Characteristics

This factor considers the characteristics of program payments, recipients, and other circumstances.

Age of payments. More recent payments may be easier to recover. Data associated with recent payments are less likely to be out of date, recipients may be easier to contact, and funds may be easier to collect. In implementing recovery audits, OMB guidance states that agencies are to give priority to the most recent payments and payments made in a program reporting an improper payment estimate above the statutory threshold.[86] Officials from one agency stated that although agencies attempt to recover overpayments regardless of age, the recovery method may vary based on the age of the payment and the expected difficulty of recovery.

Potential payment anomalies. Potential payment anomalies include unusual payments, such as duplicate or similar payments. Such payments may indicate potential overpayments, and identifying these anomalies can support recovery efforts. As previously noted, SBA may benefit from data systems that can flag these types of potential anomalies.

Recipient ability to repay. A recipient’s ability to repay may affect the cost-effectiveness of recovery efforts. For a program involving loans, the presence of collateral or cosigners may facilitate recovery.

Conversely, recovery may not be cost-effective if the recipient lacks the ability to repay. For example, if a recipient is unemployed, certain collection methods available through Treasury, such as wage garnishment, would not be effective.

Treasury Tools to Support Recovery Agencies may use tools offered by the Department of the Treasury to support recovery of overpayments. These tools include submitting delinquent debts for offset (withholding money from a payment to satisfy a debt) under the Debt Collection Improvement Act, garnishing wages, reporting debts to credit bureaus, and referring debts to private collection agencies. The Treasury Offset Program is an automated matching system that cross-references planned payments from federal programs against individuals who have state and federal debt. If there is no match, the recipient receives the entire payment. If there is a match, the program reduces the payment, in whole or in part, to satisfy the debt. Any remaining amount is paid to the recipient, and any remaining debt stays in the system and may be offset by future payments. Cross-servicing. Under cross-servicing, Treasury services debt on behalf of the referring agency, subject to the parameters established by that agency. Treasury typically administers the debt, reports to credit bureaus and collection agencies, contacts employers for wage garnishment, and manages payment installments. According to Treasury officials, cross-servicing is a more manual and costly process than the Treasury Offset Program. Source: GAO.  |  GAO‑27‑107701

SBA could also tailor recovery approaches to the characteristics of the recipient population, such as low-income individuals or educational institutions. For example, Department of Education officials noted that the selection of recovery mechanisms should account for recipient characteristics, applicable statutory and program requirements, and potential consequences for program delivery.

Agency’s supporting documentation on recipients. The quality and quantity of supporting documentation on recipients and disbursements may affect SBA’s ability to identify overpayments. More comprehensive documentation can help determine whether payments are improper but also can require more time to review.

Contestability. The strength of SBA’s evidence that an overpayment has occurred may affect recovery outcomes, particularly when legal challenges arise. Stronger evidence may support higher recoveries and faster resolution, while weaker evidence may result in reduced recoveries or unsuccessful recovery efforts.

In addition, potential adjudication or other legal costs may affect the cost-effectiveness of recovery audits and activities. Relevant factors include the likelihood and potential terms of settlement, length of the potential appeal process, stage at which recovery is pursued, and SBA’s capacity to manage the volume of contested cases and appeals.

Ability to impose constraints on payments. Imposing constraints on recipients or payments—such as reducing payment amounts, requiring faster repayment, or reducing future payments—may improve recovery outcomes and help prevent improper payments.

Such constraints may provide additional leverage to recover overpayments or limit future improper payments. For example, Internal Revenue Service officials described pre-refund audits, which allow the agency to review claims before issuing tax refunds. By adjusting questionable claims in advance, the agency can adjust refund amounts and increase the likelihood of recipient cooperation, as recipients have an incentive to resolve any issues so they can receive their refunds. In addition, SBA may use Treasury tools to support recovery and impose constraints on payments.

Public Perception

This factor includes considerations related to deterring fraud, public trust, and agency reputation.

Deterrence of future fraud. Recovery audits and activities may deter future fraud, particularly when recoveries are pursued visibly. Public recovery efforts may discourage potential applicants from committing fraud. Over time, they may also contribute to lower overpayment rates, even if the short-term costs and benefits are roughly equal.

However, officials from one agency noted that an agency may be prohibited from announcing that it is pursuing recovery from a company if its contract includes a nondisclosure agreement.

Public trust and reputational effects. Recovery efforts can affect public trust or an agency’s reputation, which in turn can hinder the agency’s ability to carry out its mission effectively. Public trust may be negatively affected if the public observes a low rate of recovery without adequate justification.

Conversely, recovery efforts may harm an agency’s reputation if they are not appropriately supported or tailored to the circumstances. For example, this could occur if an agency pursues recovery without sufficient evidence of an overpayment or after previously informing the recipient that the payment was proper.

Conclusions

Comprehensive improper payment estimation helps management understand financial vulnerabilities and assess the validity of its sampling and estimation plans. We identified opportunities for SBA to strengthen its improper payment estimation and overpayment recovery efforts:

·       SBA did not provide sufficient documentation to support certain key methodological decisions, limiting our ability to assess whether SBA could make improvements to its improper payments estimates. Including in its plans analysis used to validate that sampling and estimation decisions reflect the distribution of improper payment risks would help SBA justify its estimation approaches and produce estimates useful for program management.

·       SBA’s improper payment sampling and estimation plans for its pandemic programs did not consider whether the resulting estimates would appropriately reflect known fraud risks and the scale of potential fraud. Including such consideration in future plans would help ensure that SBA’s estimation approaches are well supported and aligned with known program risks.

·       SBA has not established a process to monitor changes in 7(a) and standard EIDL program risks on a periodic and ongoing basis and to reevaluate the cost-effectiveness of recovery audits and activities based on those risks. Establishing such mechanisms would help improve recoveries and ensure that SBA’s recovery approach is responsive to changes.

·       Applying relevant federal guidance, along with the key factors discussed in this report, when identifying recovery options could help SBA assess its recovery options and identify more cost-effective approaches over time.

Recommendations for Executive Action

We are making the following four recommendations to SBA:

The Administrator of SBA should ensure that improper payment sampling and estimation plans include analysis to validate that the agency’s sampling and estimation decisions reflect the distribution of improper payment risks in the programs. (Recommendation 1)

The Administrator of SBA should ensure that improper payment sampling and estimation plans include consideration of whether the resulting estimates will appropriately reflect known fraud risks and the scale of potential fraud in programs. (Recommendation 2)

The Administrator of SBA should establish a process to monitor standard EIDL and 7(a) program risks on a periodic and ongoing basis and reevaluate the cost-effectiveness of recovery audits and activities based on those risks. (Recommendation 3)

The Administrator of SBA should apply relevant federal guidance and consider the key factors identified in this report when identifying recovery options. (Recommendation 4)

Agency Comments and Our Evaluation

We provided a draft of this report to SBA; the Departments of Agriculture, Defense, Education, Health and Human Services, Transportation, and the Treasury; and OMB.

In its written comments, reproduced in appendix III, SBA disagreed with two of our recommendations, partially agreed with one, and agreed with one. We received technical comments from Education and Health and Human Services, which we incorporated as appropriate. Agriculture, Defense, Transportation, and Treasury informed us that they had no comments, and OMB did not respond to our request for comments.

SBA did not agree with our recommendation to ensure that improper payment sampling and estimation plans include analysis to validate that the agency’s sampling and estimation decisions reflect the distribution of improper payment risks in the programs. SBA stated that it reviews its sampling and estimation methodology plans annually and submits them to OMB for approval when changed. SBA also stated that the independent auditor used by SBA OIG conducts annual audits and has not cited findings related to methodology choices related to improper payment risks.

We maintain that SBA should document sufficient analysis to validate key decisions used to develop improper payment estimates. SBA could document such analysis as part of its annual reviews of the plans. Including this analysis would help SBA support and validate its estimation approaches and, in turn, help ensure that the estimates provide useful information for program management.

We recognize that SBA submits revised sampling and estimation plans to OMB for approval. However, OMB’s approval of SBA’s sampling and estimation plans does not address the concern underlying our recommendation. OMB generally approves such plans based on whether the agency’s methodology results in a point estimate (a single value) within a confidence interval (a range of possible values). However, agencies—not OMB—are responsible for ensuring their estimates are accurate and appropriate given program characteristics.^[87] Without the analysis needed to justify and validate its estimation approaches, SBA is missing useful information for its program management.

In addition, while the independent auditor used by SBA OIG has not cited specific findings regarding SBA’s methodological choices related to improper payment risks, the auditor has found SBA not compliant with PIIA for programs we reviewed. For fiscal years 2022 and 2023, the auditor found that SBA’s sampling and estimation methodologies for pandemic programs were not appropriate or statistically acceptable for producing accurate improper payment estimates. For fiscal years 2024 and 2025, the auditor found SBA did not design and implement adequate review procedures over sample results used to produce the estimates to ensure they could be reperformed and that the results could be independently validated.

SBA also did not agree with our recommendation to ensure that improper payment sampling and estimation plans include consideration of whether the resulting estimates will appropriately reflect known fraud risks and the scale of potential fraud in programs. SBA noted that the pandemic relief programs cited in this report were abnormal given the speed with which they were enacted and funds were approved and disbursed. According to SBA, this forced the agency to administer these programs without the upfront fraud risk controls in place for non-pandemic programs. SBA also stated that improper payment sampling for its pandemic programs may be discontinued depending on the volume of remaining activity.

Further, SBA stated that, in addition to fraud risk controls already in place for its non-pandemic programs, it has established additional controls to identify potential or confirmed links to fraudulent COVID-19 loans before approving or disbursing loans. SBA stated that it will include language in its sampling and estimation methodology plan to spell out this consideration.

We maintain that considering the risk of fraud, which involves intentional misrepresentation, in future improper payment sampling and estimation plans would help ensure SBA’s estimation approaches are well supported and aligned with program risks. We acknowledge and have previously reported that SBA moved quickly under challenging circumstances to develop and launch its pandemic relief programs.^[88] We also recognize that these programs are temporary and that SBA may discontinue including them in its PIIA submissions. However, neither circumstance precludes SBA from addressing fraud risks—risks of intentional misrepresentations, unlike risks of other improper payments—in the sampling and estimation plans for programs for which it continues to report estimates. Doing so may also help SBA be better prepared to address fraud risks in future emergency programs, should the need arise.

We also acknowledge that SBA plans to include language regarding consideration of fraud risk related to COVID-19 loans in future sampling and estimation methodology plans. However, SBA should consider fraud risks for any of its programs, not just those related to pandemic relief. Doing so would help ensure that improper payment risks, particularly those associated with fraud, are appropriately reflected in SBA’s improper payment estimates.

SBA agreed with our third recommendation to establish a process to periodically monitor risks in the standard EIDL and 7(a) programs and reevaluate the cost-effectiveness of recovery audits and activities based on those risks. SBA stated that it will document this process and formalize how existing controls and program risk information are periodically evaluated to determine the cost-effectiveness of any additional recovery activities.

SBA partially agreed with our fourth recommendation to apply relevant federal guidance and consider the key factors identified in our report when identifying recovery options. SBA stated it will continue to consider relevant federal guidance and factors, as appropriate. As described in our report, doing so could help SBA more fully assess its recovery options and identify more cost-effective approaches over time.

In its general comments, SBA also noted that the $12.5 billion referenced in the draft report represented improper and unknown payments across six programs, not just the four in our review. We revised the report to clarify the composition of SBA’s fiscal year 2025 improper payment estimate.

We are sending copies of this report to the appropriate congressional committees; the Administrator of the Small Business Administration; the Secretaries of Agriculture, Defense, Education, Health and Human Services, Transportation, and the Treasury; and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact Courtney LaFountain at lafountainc@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Sincerely,

Courtney LaFountain
Director, Financial Markets and Community Investment

Table 1 provides additional information on the Small Business Administration’s (SBA) improper payment estimates for the selected programs and fiscal years we reviewed, including reported improper payment amounts and rates, confidence levels, and margins of error.

Dollars in millions

Paycheck Protection Program (PPP) Loan Approvalsa
Data element	2020		2021		2022		2023		2024
Improper amount	n/a		n/a		$29,027.0		n/a		n/a
Improper rate	n/a		n/a		4.2%		n/a		n/a
Confidence level	n/a		n/a		95%		n/a		n/a
Margin of error	n/a		n/a		3.0		n/a		n/a
PPP Loan Forgivenessa
Data element	2020		2021		2022		2023		2024
Improper amount	n/a		n/a		n/a		$18,738.3		$379.1
Improper rate	n/a		n/a		n/a		40.5%		25.2%
Confidence level	n/a		n/a		n/a		95%		95%
Margin of error		n/a		n/a		n/a		3.0                            4.1
PPP Loan Guaranty Purchasesa
Data element	2020		2021		2022		2023		2024
Improper amount	n/a		n/a		n/a		$4,066.5		$1,679.0
Improper rate	n/a		n/a		n/a		49.1%		24.7%
Confidence level	n/a		n/a		n/a		95%		95%
Margin of error	n/a		n/a		n/a		3.0		3.5
COVID-19 Economic Injury Disaster Loans (EIDL)b
Data element	2020		2021		2022		2023		2024
Improper amount	n/a		n/a		$6,916.7		$3,171.8		n/a
Improper rate	n/a		n/a		4.5%		8.1%		n/a
Confidence level	n/a		n/a		97%		97%		n/a
Margin of error	n/a		n/a		3.0		3.0		n/a
7(a) Loan Guaranty Approvalsc
Data element	2020		2021		2022		2023		2024
Improper amount	$323.2		$352.6		$298.1		$262.7		$1,103.3
Improper rate	2.1%		2.0%		1.0%		1.3%		5.4%
Confidence level	95%		95%		95%		95%		95%
Margin of error	3.0		3.0		3.0		3.0		2.7
7(a) Loan Guaranty Purchasesc
Data element	2020		2021		2022		2023		2024
Improper amount	$69.8		$19.0		$29.8		$48.8		$74.5
Improper rate	5.5%		3.3%		4.2%		6.1%		5.3%
Confidence level	95%		95%		95%		95%		95%
Margin of error	3.0		3.0		3.0		3.0		2.5
Disaster Loan Program (includes standard EIDL)d
Data element	2020		2021		2022		2023		2024
Improper amount	$94.8		$72.8		$34.7		$34.3		$42.5
Improper rate	12.0%		13.4%		3.1%		3.9%		3.6%
Confidence level	95%		95%		97%		97%		95%
Margin of error	2.6		3.0		3.0		3.0		1.7

Legend: n/a = not applicable.

Source: Office of Management and Budget PaymentAccuracy.gov. | GAO‑27‑107701

Note: The estimated improper payment amount is the total estimated improper and unknown payments for the program in a given fiscal year. The estimated improper payment rate is the estimated improper payment amount divided by program outlays for that fiscal year. The confidence level represents how often the confidence interval is expected to contain the population quantity. The margins of error shown in this table are for symmetric confidence intervals. For symmetric confidence intervals, the margin of error is the difference between the estimate and the upper or lower bound of the confidence interval.

^aSBA did not report PPP improper payment estimates for years prior to fiscal year 2022. SBA’s fiscal year 2022 PPP improper payment estimate covered improper payments associated with loan approval activity only. SBA’s fiscal year 2023 and 2024 PPP improper payment estimates covered PPP forgiveness activity and PPP loan purchase activity.

^bSBA reported COVID-19 improper payment estimates for fiscal years 2022 and 2023. SBA did not report a COVID-19 EIDL program estimate for fiscal year 2024 because there was no new funding for the program.

^cSBA’s 7(a) program improper payment estimates covered 7(a) loan approval activity and 7(a) loan purchase activity.

^dSBA’s Disaster Loan Program estimates cover improper payments associated with SBA disaster assistance loans made to individuals and businesses in response to physical damage or economic hardship resulting from presidentially declared disasters. The estimates include business loans for physical damage, economic injury, or a combination, as well as home loans.

In April 2022, the Small Business Administration (SBA) adopted a policy to end collection on defaulted Paycheck Protection Program (PPP) and COVID-19 Economic Injury Disaster Loan (EIDL) program loans that had outstanding balances of $100,000 or less and not refer those loans to the Department of the Treasury for collection.[89] SBA based this decision on a cost-benefit analysis.

However, in September 2022, SBA’s Office of Inspector General found that this analysis was not comprehensive enough to support the decision and recommended that SBA conduct a new cost-benefit analysis.[90] SBA subsequently conducted a new analysis using an independent third party, which in December 2023 found that collection attempts for such defaulted loans, including referrals to Treasury, would be cost-beneficial.

As a result, in January 2024, SBA reversed its policy and stated that it would begin referring loans with outstanding balances of $100,000 or less to Treasury for collection beginning in March 2024, including loans previously written off without referral. After this change, delinquent debt referrals to Treasury increased from about $4 million to more than $35 billion, resulting in about $159 million in collections as of February 2026 (see table 2).

SBA is generally required to refer delinquent debts to Treasury for collection through Cross-Servicing, a program in which Treasury services debts on behalf of federal agencies. However, SBA is exempt from this requirement for delinquent PPP debt from March 8, 2024, through October 1, 2027, and for delinquent COVID-19 EIDL program debt from the program’s inception through March 31, 2027. According to SBA officials, these exemptions permit SBA to make regular referrals at an agreed-upon volume and cadence, mitigating the risk of bottlenecks in SBA and Treasury processes.

Dollars in millions

Program (collection method)	Referred prior to Jan. 1, 2024		Referred after Jan. 1, 2024			Total referred		Total collected
	Referrals	Amount		Referrals	Amount	Referrals	Amount	Amount
PPP (Treasury Offset Program)	-	$-		445,769	$7,269	445,769	$7,269	$38
PPP (Cross-Servicing)	37	$3		35,942	$639	35,979	$642	$18
COVID-19 EIDL (Treasury Offset Program)	-	$-		1,058,370	$21,398	1,058,370	$21,398	$84
COVID-19 EIDL (Cross-Servicing)	18	$0		210,472	$6,378	210,490	$6,378	$19
Total	55	$4		1,750,553	$35,684	1,750,608	$35,687	$159

Source: GAO analysis of data from the Department of the Treasury, Bureau of the Fiscal Service. | GAO‑27‑107701

Note: The data presented show delinquent debt referrals before and after January 1, 2024, when the Small Business Administration resumed referring delinquent PPP loans and COVID-19 EIDLs to Treasury for collection. Under the Treasury Offset Program, Treasury collects delinquent debt by offsetting federal payments owed to the borrower, such as tax refunds, federal salary payments, or payments to government contractors. Under Cross-Servicing, Treasury collects delinquent debt using a variety of methods, such as wage garnishment, negotiated repayment, and private collection agencies.

SBA referrals to Treasury of delinquent PPP loans and COVID-19 EIDLs with outstanding balances of $100,000 or more have resulted in about $287 million in collections as of February 2026 (see table 3).

Dollars in millions

Program (collection method)	Referred prior to Jan. 1, 2024		Referred after Jan. 1, 2024			Total referred				Total collected
	Referrals	Amount	Referrals	Amount	Referrals			Amount	Amount
PPP (Treasury Offset Program )	-	$-	2,670	$690	2,670			$690	$1
PPP (Cross-Servicing)	5,292	$1,478	2,656	$762	7,948			$2,240	$42
COVID-19 EIDL (Treasury Offset Program)	-	$-	211,646	$49,490	211,646			$49,490	$135
COVID-19 EIDL (Cross-Servicing)	10,816	$5,483	156,200	$41,822	167,016			$47,306	$108
Total	16,108	$6,961	373,172	$92,765		389,280	$99,726			$287

Source: GAO analysis of data from the Department of the Treasury, Bureau of the Fiscal Service. | GAO‑27‑107701

Note: The data presented show delinquent debt referrals before and after January 1, 2024, when the Small Business Administration resumed referring delinquent PPP loans and COVID-19 EIDLs to Treasury for collection. Under the Treasury Offset Program, Treasury collects delinquent debt by offsetting federal payments owed to the borrower, such as tax refunds, federal salary payments, or payments to government contractors. Under Cross-Servicing, Treasury collects delinquent debt using a variety of methods, such as wage garnishment, negotiated repayment, and private collection agencies.

SBA referrals to Treasury of delinquent PPP loans and COVID-19 EIDLs with outstanding balances of any amount have resulted in about $445 million in collections as of February 2026 (see table 4).

Dollars in millions

Program (collection method)	Referred prior to Jan. 1, 2024		Referred after Jan. 1, 2024		Total referred		Total collected
	Referrals	Amount	Referrals	Amount	Referrals	Amount		Amount
PPP (Treasury Offset Program)	-	$-	448,417	$7,957	448,417	$7,957		$40
PPP (Cross-Servicing)	5,305	$1,479	38,586	$1,400	43,891	$2,878		$60
COVID-19 EIDL (Treasury Offset Program)	-	$-	1,270,016	$70,888	1,270,016	$70,888		$218
COVID-19 EIDL (Cross-Servicing)	10,834	$5,484	366,572	$48,190	377,406	$53,674		$128
Total	16,139	$6,963	2,123,591	$128,435	2,139,730	$135,398		$445

Source: GAO analysis of data from the Department of the Treasury, Bureau of the Fiscal Service. | GAO‑27‑107701

Note: The data presented show delinquent debt referrals before and after January 1, 2024, when the Small Business Administration resumed referring delinquent PPP loans and COVID-19 EIDLs to Treasury for collection. Under the Treasury Offset Program, Treasury collects delinquent debt by offsetting federal payments owed to the borrower, such as tax refunds, federal salary payments, or payments to government contractors. Under Cross-Servicing, Treasury collects delinquent debt using a variety of methods, such as wage garnishment, negotiated repayment, and private collection agencies.

This appendix contains source information for images in the product when such information was not listed adjacent to the image.

     GAO.

      GAO.

   GAO.

     GAO.

  GAO.

GAO Contact

Courtney LaFountain, (202) 512-5463 or lafountainc@gao.gov

Staff Acknowledgments

In addition to the contact named above, Daniel Flavin (Assistant Director), Andrew Pauline (Assistant Director), Cole Haase (Analyst in Charge), Seto Bagdoyan, Carl Barden, Seth Brewington, Jason Bromberg, Danielle Curet, Robert Dacey, Patrick Frey, Daniel Garcia-Diaz, Jason Kelly, Jason Kirwan, Abigail Loxton-Daun, Nana Ama Osei-Gyamfi, Zachary Pergrossi, Jared Smith, Justin Snover, and Amanda Stogsdill made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us