This is the accessible text file for GAO report number GAO-12-697 
entitled 'Service-Disabled Veteran-Owned Small Business Program: 
Vulnerability to Fraud and Abuse Remains' which was released on August 
1, 2012. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Report to Congressional Committees: 

August 2012: 

Service-Disabled Veteran-Owned Small Business Program: 

Vulnerability to Fraud and Abuse Remains: 

GAO-12-697: 

GAO Highlights: 

Highlights of GAO-12-697, a report to congressional committees. 

Why GAO Did This Study: 

The SDVOSB program provides federal contracting opportunities to 
business-owning veterans who incurred or aggravated disabilities in 
the line of duty. SBA administers the government-wide program, while 
VA maintains databases of veterans and SDVOSBs and oversees its own 
contracts. GAO has reported several times since 2009 that both 
programs were vulnerable to fraud and abuse and recommended 
improvements. In October 2010, Congress passed the Veterans Small 
Business Verification Act (2010 Act), part of the Veterans’ Benefits 
Act of 2010, to provide tools to VA to more-thoroughly validate firms’ 
eligibility before listing them in VetBiz, the database used by VA 
contracting officials to award SDVOSB contracts. 

GAO was asked to assess (1) VA’s progress in addressing remaining 
vulnerabilities to fraud and abuse in its SDVOSB program and (2) 
actions taken by SBA or other federal agencies to improve government-
wide SDVOSB fraud-prevention controls. GAO reviewed agency 
documentation and interviewed agency officials. GAO also investigated 
cases of alleged fraud and abuse. GAO did not project the extent of 
fraud and abuse in the program. 

What GAO Found: 

The Department of Veterans Affairs (VA) Service-Disabled Veteran-Owned 
Small Business (SDVOSB) program remains vulnerable to fraud and abuse. 
VA has made inconsistent statements about its progress verifying firms 
listed in VetBiz using the more-thorough process the agency 
implemented in response to the Veterans Small Business Verification 
Act (2010 Act). In one communication, VA stated that as of February 
2011, all new verifications would use the 2010 Act process going 
forward. However, as of April 1, 2012, 3,717 of the 6,178 SDVOSB firms 
(60 percent) listed as eligible in VetBiz had not been verified under 
the 2010 Act process. Of these 3,717 firms, 134 received $90 million 
in new VA SDVOSB set-aside or sole-source contract obligations from 
November 30, 2011, to April 1, 2012. While the 2010 Act did not 
include a deadline for verification using the more-thorough process, 
the presence of firms that have only been subjected to the less-
stringent process that VA previously used represents a continuing 
vulnerability. VA’s Office of Inspector General (OIG) reported that 
the less-stringent process was in many cases insufficient to establish 
control and ownership and in effect allowed businesses to self-certify 
as SDVOSBs with little supporting documentation. VA has taken some 
positive action to enhance its fraud prevention efforts by 
establishing processes in response to 6 of 13 recommendations GAO 
issued in October 2011, including conducting unannounced site visits 
to high-risk firms and developing procedures for referring suspicious 
SDVOSB applications to the OIG. VA has also begun action on some 
remaining recommendations, such as providing fraud awareness training 
and removing contracts from ineligible firms, though these procedures 
need to be finalized. 

Regarding the government-wide SDVOSB program, no action has been taken 
by agencies to improve fraud-prevention controls. Relying almost 
solely on firms’ self-certification, the program continues to lack 
controls to prevent fraud and abuse. The Small Business Administration 
(SBA) does not verify firms’ eligibility status, nor does it require 
that they submit supporting documentation. While SBA is under no 
statutory obligation to create a verification process, five new cases 
of potentially ineligible firms highlight the danger of taking no 
action. These firms received approximately $190 million in SDVOSB 
contract obligations. In one case, a firm found ineligible by VA 
continued to self-certify as an SDVOSB and received about $860,000 
from the General Services Administration and the Department of 
Interior. Further, the Department of Defense (DOD) OIG reported in 
2012 that DOD provided $340 million to firms that potentially 
misstated their SDVOSB status. To address these vulnerabilities, GAO 
previously suggested that Congress consider providing VA with the 
authority necessary to expand its SDVOSB eligibility verification 
process government-wide. Such an action is supported by the fact that 
VA maintains the database identifying which individuals are service-
disabled veterans and is consistent with VA’s mission of service to 
veterans. However, the problems GAO identified with VA’s verification 
process indicate that an expansion of VA’s authority to address 
government-wide program problems should not be undertaken until VA 
demonstrates that its process is successful in reducing its own SDVOSB 
program’s vulnerability to fraud and abuse. 

What GAO Recommends: 

GAO recommends that VA take steps to ensure that all firms within 
VetBiz have undergone the 2010 Act verification process. VA generally 
concurred with the recommendation but expressed concern about how 
specific report language characterized its program. GAO made some 
changes to the report but continues to believe that the program 
remains vulnerable to fraud and abuse. 

View [hyperlink, http://www.gao.gov/products/GAO-12-697]. For more 
information, contact Richard J. Hillman at (202) 512-6722 or 
hillmanr@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

VA's Program Remains Vulnerable to Fraud and Abuse as a Result of a 
Lack of Inventory Control and Potentially Ineligible Firms Listed in 
VetBiz: 

No Action Has Been Taken to Improve Government-wide SDVOSB Fraud-
Prevention Controls: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Comments from the Department of Veterans Affairs: 

Related GAO Products: 

Figures: 

Figure 1: Federal Contracts Awarded to SDVOSBs in Fiscal Year 2010: 

Figure 2: GAO's Fraud-Prevention Framework: 

Figure 3: Status of GAO's Previous Recommendations: 

Abbreviations: 

2006 Act: Veterans Benefits, Health Care, and Information Technology 
Act of 2006: 

2010 Act: Veterans Small Business Verification Act: 

CCR: Central Contractor Registration: 

CVE: Center for Veterans Enterprise: 

DOD: Department of Defense: 

DOI: Department of Interior: 

EPLS: Excluded Parties List System: 

FAR: Federal Acquisition Regulation: 

FPDS-NG: Federal Procurement Data System-Next Generation: 

GSA: General Services Administration: 

HUBZone: Historically Underutilized Business Zone: 

NAICS: North American Industry Classification System: 

OIG: Office of Inspector General: 

ORCA: Online Representations and Certifications Application: 

SBA: Small Business Administration: 

SDVOSB: Service-Disabled Veteran-Owned Small Business: 

VA: Department of Veterans Affairs: 

VOSB: Veteran-Owned Small Business: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

August 1, 2012: 

The Honorable Marlin A. Stutzman: 
Chairman: 
The Honorable Bruce L. Braley: 
Ranking Member: 
Subcommittee on Economic Opportunity: 
Committee on Veterans' Affairs: 
House of Representatives: 

The Honorable Bill Johnson: 
Chairman: 
The Honorable Joe Donnelly: 
Ranking Member: 
Subcommittee on Oversight and Investigations: 
Committee on Veterans' Affairs: 
House of Representatives: 

In fiscal year 2010, federal agencies awarded $10.8 billion in small-
business obligations to firms in the Service-Disabled Veteran-Owned 
Small Business (SDVOSB) program, according to the Small Business 
Administration (SBA). The SDVOSB program is intended to honor business-
owning veterans who incurred or aggravated disabilities in the line of 
duty by providing their firms with sole-source and set-aside 
contracting opportunities.[Footnote 1] Firms must meet several 
requirements to be eligible to participate in the program, such as 
being majority-owned by one or more service-disabled veterans who 
manage and control daily business operations.[Footnote 2] 

SBA, which administers the government-wide SDVOSB program, does not 
verify firms' eligibility for the program, and has stated that its 
only statutory obligation is to report on other agencies' success in 
meeting SDVOSB contracting goals. In 2009, we investigated 10 cases in 
which ineligible firms that self-certified their service-disabled 
veteran-owned business status received about $100 million in SDVOSB 
contracts.[Footnote 3] Since 2009, we have issued nine reports and 
testimonies detailing how the SDVOSB program is vulnerable to fraud 
and abuse.[Footnote 4] 

Accounting for about 30 percent of government-wide awards, the 
Department of Veterans Affairs (VA) awarded $3.2 billion in SDVOSB 
contracts in fiscal year 2010. Unlike SBA, VA is bound by law to 
verify firms' eligibility; the Veterans Benefits, Health Care, and 
Information Technology Act of 2006 (2006 Act) requires VA to maintain 
a database of SDVOSBs and Veteran-Owned Small Businesses (VOSB), known 
as VetBiz.[Footnote 5] The 2006 Act also requires that VA verify the 
ownership, control, and veteran or service-disabled status of firms 
listed in VetBiz to confirm that they are eligible to receive VA 
SDVOSB set-aside and sole-source contracts. In response to the 2006 
Act, VA chose to implement a verification process consisting of 
checking whether a firm's owner was listed in VA's database of service-
disabled veterans and conducting searches on publicly available 
websites such as the Excluded Parties List System (EPLS), which lists 
firms that have been debarred from doing business with the federal 
government. Nonetheless, we reported in 2009 and 2010 that this 
verification process allowed ineligible firms to be wrongly certified. 
In 2011, VA's Office of Inspector General (OIG) also reported on the 
basis of a random selection of 42 firms that 32 of 42 SDVOSBs and 
VOSBs listed in the VetBiz database were ineligible for the VA SDVOSB 
program.[Footnote 6] 

As part of our past work, we made recommendations to strengthen both 
government-wide and VA fraud-prevention controls. Further, in response 
to the Veterans Small Business Verification Act (2010 Act), part of 
the Veterans' Benefits Act of 2010,[Footnote 7] VA implemented a more-
thorough verification process that includes unannounced and announced 
site visits, and review and analysis of company documentation to 
validate a firm's eligibility as owned and controlled by serviced-
disabled veterans before listing the firm in VetBiz. In July 2011, we 
reported that both SBA and VA had taken positive steps in response to 
our findings and recommendations, but that both the government-wide 
and VA programs remained vulnerable to fraud and abuse.[Footnote 8] To 
determine whether the program remains vulnerable to fraud and abuse, 
you requested that we update our prior work and report the status of 
our recommendations. Therefore, we assessed (1) VA's progress in 
addressing remaining vulnerabilities to fraud and abuse in its SDVOSB 
program and (2) actions taken by SBA or other federal agencies since 
our previous reports to improve government-wide SDVOSB fraud-
prevention controls. 

To assess vulnerabilities in VA's verification process, we reviewed 
prior findings and recommendations from GAO audits and investigations 
of VA's VetBiz verification program, including the status of 
recommendations we issued to VA in October 2011.[Footnote 9] We also 
reviewed VA's standard operating procedures, internal control 
policies, a VA OIG report, and other related documents.[Footnote 10] 
We interviewed various agency officials about the status of VA's 
verification efforts. To assess VA's progress toward verifying all 
firms in VetBiz under the 2010 Act, we reviewed relevant statutes and 
regulations governing the program, VA guidance, VA statements provided 
to Congress, and related documents. We also interviewed various agency 
officials. 

To assess actions taken to improve government-wide SDVOSB fraud-
prevention controls since our previous reports, we reviewed prior 
findings and recommendations from our audits and investigations of the 
SDVOSB program. We reviewed applicable guidance on internal control 
standards from our Standards for Internal Control in the Federal 
Government,[Footnote 11] the fraud-prevention framework,[Footnote 12] 
and a Department of Defense (DOD) OIG report.[Footnote 13] We 
requested information from SBA on any actions that it has taken in 
response to our recommendations. We also requested information from 
SBA and VA on any actions taken related to the 10 cases of ineligible 
firms identified in our previous work.[Footnote 14] In addition, we 
contacted agency OIGs who received our fraud referrals pertaining to 
these 10 cases to learn of any action taken against the firms. We also 
searched the Central Contractor Registration (CCR)[Footnote 15] to 
determine whether original case-study firms were self-certified as 
SDVOSBs and searched VA's VetBiz online database to determine whether 
original case-study firms were listed in the system as verified SDVOSB 
firms. In addition, we searched EPLS to determine if any agencies had 
suspended or debarred[Footnote 16] the original case-study firms or 
related individuals we investigated. 

To further assess vulnerabilities in both the government-wide and VA 
SDVOSB fraud-prevention controls, we investigated new allegations from 
informants regarding firms that received SDVOSB contracts through 
fraudulent or abusive eligibility misrepresentations. We did not 
design our work to identify all firms that misrepresent themselves as 
SDVOSBs or commit fraudulent or abusive activity in the SDVOSB 
program, nor did we attempt to identify fraud and abuse in SDVOSB 
subcontracts. In addition, our case examples cannot be projected to 
the overall population of SDVOSB firms. To identify potential cases, 
we reviewed SDVOSB contract awards and protests filed with SBA since 
2008 and VA since 2010. We also analyzed the CCR database and VA's 
VetBiz database of applicants for fraudulent activity and reviewed 
over 100 allegations of fraud and abuse we received from informants 
between 2009 through 2011. From these sources, we selected 10 
potential cases[Footnote 17] for further investigation on the basis of 
a variety of factors, including the credibility and specificity of 
facts and evidence provided in protests and allegations and whether a 
firm received multiple SDVOSB contracts since fiscal year 2010. We 
attempted to select case studies from two categories: SDVOSBs verified 
in VetBiz and firms listed in CCR as SDVOSBs that were not verified by 
VA. In addition, these 10 cases were not under investigation by the 
SBA or VA OIGs at the time of selection. 

To validate the facts in these cases, we interviewed some firm owners 
and managers and reviewed relevant documentation, such as business 
filings and tax returns, to determine if SDVOSB eligibility 
requirements had been met. We reviewed certifications made by firms, 
such as certifications about a firm's size, SDVOSB status, and line of 
business, in the federal government's Online Representations and 
Certifications Application (ORCA)[Footnote 18] and CCR. We also 
analyzed data from Federal Procurement Data System-Next Generation 
(FPDS-NG)[Footnote 19] from October 2009 through December 2011 to 
identify SDVOSB contract obligations received by the firms, and 
confirmed the contract information with awarding agencies. We also 
reviewed Accurint[Footnote 20] reports to identify whether owners and 
firms had any criminal records and federal tax liens and validated 
this information if necessary. Ultimately, through a combination of 
data matching, a review of public records, and interviews, we were 
able to substantiate the informants' allegations in 4 of the 10 cases 
and have gathered enough evidence to indicate firms in a fifth case 
may be ineligible. We have highlighted examples from these 5 cases 
throughout this report and will refer them to SBA and VA and other 
appropriate agencies for further review. We were unable to 
conclusively determine eligibility in the remaining 5 cases. 

To assess the reliability of the data sources used for this report, 
including EPLS, FPDS-NG, and VetBiz, we interviewed agency officials 
and traced information to source documents when possible. We verified 
the suspension and debarment information with SBA and the appropriate 
agencies. We verified the contract obligations with the awarding 
agencies. We also verified the firms' VetBiz SDVOSB verification 
status with VA. We determined that the data were sufficiently reliable 
for the purpose of our audit. We conducted this performance audit from 
January 2011 to July 2012 in accordance with generally accepted 
government auditing standards.[Footnote 21] Those standards require 
that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. We performed our 
investigative work from January 2011 to July 2012 in accordance with 
the standards prescribed by the Council of the Inspectors General on 
Integrity and Efficiency. 

Background: 

Federal regulations set requirements for a small business to qualify 
as an SDVOSB. SDVOSB eligibility regulations mandate that a firm must 
be a small business and at least 51 percent-owned by one or more 
service-disabled veterans who control the management and daily 
business operations of the firm. Federal statutes and the Federal 
Acquisition Regulations (FAR) require all prospective contractors to 
update the ORCA to state whether their firm qualifies as an SDVOSB. 
[Footnote 22] Additionally, the SDVOSB, as a contractor, is required 
to register in CCR. Contracting officials are required to check CCR, 
which includes information such as a firm's status as an SDVOSB, prior 
to awarding most federal contracts, including an SDVOSB set-aside or 
sole-source contract. Once an SDVOSB receives a contract, SDVOSB 
regulations also place restrictions on the amount of work that can be 
subcontracted. 

With regard to VA's program, VA's Center for Veterans Enterprise (CVE) 
is responsible for maintaining VetBiz and implementing VA's 
verification program. The 2010 Act requires that no new small-business 
applicant may appear in VA's SDVOSB and VOSB VetBiz database unless it 
has been verified by VA as owned and controlled by a veteran or 
service-disabled veteran. Further, within 60 days after enactment, VA 
was required to notify all unverified businesses in its VetBiz 
database about the need to provide supporting documents to establish 
veteran ownership and control. Firms were required to do so within 90 
days of receipt of the notification in order to avoid removal of the 
firm from VetBiz.[Footnote 23] To check veteran status, CVE relies in 
part on VA's Beneficiary Identification Records Locator Subsystem, 
which confirms that owners are documented as having left service with 
other than a dishonorable discharge and that disability results from a 
service-connected condition. In response to the 2010 Act, VA also 
implemented a verification process that included unannounced and 
announced site visits, and review and analysis of company 
documentation. The 2010 Act does not include a date by which VA must 
complete the verification of firms. Firms that misrepresent SDVOSB 
status are required by law to be debarred from contracting with VA for 
a reasonable period of time, as determined by VA.[Footnote 24] 
Additionally, VA regulations state that if a firm or owner is 
currently debarred or suspended, or is delinquent or in default on 
significant financial obligations owed to the federal government, then 
the firm or owner is ineligible for VA's VetBiz verification program. 
[Footnote 25] 

Federal law has established government-wide goals for specific types 
of small businesses to receive a percentage of the total value of all 
prime-contract and subcontract awards for each fiscal year. The 
statutorily-mandated goal for SDVOSB participation is not less than 3 
percent[Footnote 26] of all federal contract dollars awarded each 
fiscal year.[Footnote 27] SBA stated in its most recent report that, 
in fiscal year 2010, $10.8 billion in small-business obligations were 
awarded to firms that self-certified themselves in the CCR as SDVOSBs. 
[Footnote 28] DOD SDVOSB contracts accounted for $5.3 billion or 49 
percent of government-wide SDVOSB contracts during fiscal year 2010, 
[Footnote 29] and VA SDVOSB contracts accounted for $3.2 billion, or 
30 percent during the same period.[Footnote 30] Figure 1 summarizes 
the federal contracts awarded in fiscal year 2010 by federal agencies. 

Figure 1: Federal Contracts Awarded to SDVOSBs in Fiscal Year 2010: 

[Refer to PDF for image: pie-chart] 

$10.8 billion in federal contracts were awarded to firms that self-
certified themselves in CCR as service-disabled veteran-owned business: 

DOD: 49%; $5.3 billion; 
VA: 30%; $3.2 billion; 
Other Federal Agencies: 21%; $2.3 billion. 

Source: GAO analysis of SBA Goaling Report Data. 

[End of figure] 

Since 2009, GAO has issued nine reports or testimonies on the SDVOSB 
program, focusing on its vulnerability to fraud and abuse, and 
agencies' actions to prevent contracts from going to firms that 
misrepresent themselves as SDVOSBs.[Footnote 31] When discussing the 
SDVOSB program, we have shown that a well-designed fraud-prevention 
system should consist of three crucial elements: (1) up-front 
preventive controls, (2) detection and monitoring, and (3) 
investigations and prosecutions. Figure 2 below outlines the key 
aspects of an effective fraud-prevention framework. 

Figure 2: GAO's Fraud-Prevention Framework: 

[Refer to PDF for image: illustration] 

Potential fraud, waste, and abuse: 

Implementation of prevention controls: leads to: 

Smaller amount of potential fraud, waste, and abuse: 

Implementation of detection and monitoring: leads to: 

Smaller amount of Potential fraud, waste, and abuse: 

Implementation of investigations and prosecutions. 

Lessons learned at each step influence future use of prevention 
controls. 

Source: GAO. 

[End of figure] 

The most effective and most efficient part of a fraud-prevention 
framework involves the institution of rigorous controls at the 
beginning of the process. At a minimum, preventive controls for the 
SDVOSB program should be designed to verify that a firm seeking SDVOSB 
status is eligible for the program. Even with effective prevention 
controls, there is residual risk that firms that appeared to meet 
SDVOSB program requirements initially will violate program rules once 
they obtain contracts. This fact makes effective monitoring and 
detection controls essential in a robust fraud-prevention framework. 
Detection and monitoring efforts include activities such as periodic 
reviews of suspicious firms and evaluating firms to provide reasonable 
assurance that they continue to meet program requirements. Finally, 
fraud-prevention controls are not fully effective unless identified 
fraud is aggressively prosecuted or companies are suspended, debarred, 
or otherwise held accountable, or both. 

VA's Program Remains Vulnerable to Fraud and Abuse as a Result of a 
Lack of Inventory Control and Potentially Ineligible Firms Listed in 
VetBiz: 

VA has made numerous conflicting statements about its progress 
verifying firms listed in VetBiz under the more-thorough process the 
agency implemented in response to the 2010 Act. These statements 
indicate that VA has taken an inconsistent approach to prioritizing 
the verification of firms and has been unable to accurately track the 
status of its efforts. Specifically, at the close of our audit work, 
documentation provided by VA indicated that thousands of SDVOSBs 
listed as eligible in VetBiz received millions of dollars in SDVOSB 
sole-source and set-aside contract obligations even though they had 
not been verified under the more-thorough process implemented in 
response to the 2010 Act. At that time, VA told us it planned to 
remove all firms that had their 1-year verification period expired and 
had not provided documentation for reverification under the 2010 Act 
process. Since then, on June 27, 2012, VA implemented an interim final 
rule that extends the eligibility of verified firms to 2 years, 
including firms for which the eligibility period had expired but that 
had not yet been reverified. Extending the eligibility period may 
allow VA to focus its efforts on more thoroughly verifying firms that 
were previously verified under VA's less-stringent 2006 Act process. 
However, the extension also allows thousands of firms to continue to 
be eligible for contracts even though they have not undergone the more-
thorough process. With regard to our previous work, VA has taken some 
positive action to enhance its fraud prevention efforts by 
establishing processes in response to 6 of 13 recommendations we 
issued in October 2011. VA has also begun action on some remaining 
recommendations. 

VA Has Difficulty Tracking Its Inventory of Firms: 

VA has provided a number of conflicting statements and explanations 
related to the status of its verification program, indicating that it 
is having difficulty tracking its inventory of firms and whether they 
were verified under the process implemented to carry out the 2010 Act. 
As we previously stated, the process VA implemented to review firms 
under the 2006 Act consisted of checking whether a firm's owner was 
listed in VA's database of service-disabled veterans and conducting 
searches on publicly available websites such as the EPLS, which lists 
firms that have been debarred from doing business with the federal 
government. In contrast, VA stated that it implemented a more-thorough 
verification process under the 2010 Act that included unannounced and 
announced site visits and a review and analysis of company 
documentation. 

Although the 2010 Act did not include a date by which VA must complete 
the verification of firms, within 60 days of the law's enactment VA 
was required to notify all unverified firms listed in its VetBiz 
database about the need to apply for verification by submitting 
documents to establish veteran ownership and control. Firms were 
required to do so within 90 days of receipt of the notification in 
order to avoid removal of the firm from VetBiz. VA officials told us 
that the agency prioritized its verification under the process 
implemented in response to the 2010 Act by reviewing (1) new 
applications for firms that had previously only self-certified in 
VetBiz (i.e., firms that had not been reviewed under the processes VA 
created for the 2006 Act or 2010 Act); (2) new firms that had 
initially applied for verification after the 2010 Act, to include 
reprocessing any firms that were denied through the new requirements 
and subsequently requested reconsideration; and (3) applications for 
firms initially verified in VetBiz under the process VA chose to 
implement for the 2006 Act. 

However, our review of information provided by VA raises concerns 
about the status of this process and whether VA knows how many of its 
firms have actually been verified under the processes implemented in 
response to the 2010 Act. In one communication, VA stated that as of 
February 2011, VA's 2006 Act verification process had been 
discontinued, and all new verifications would use the process 
implemented in response to the 2010 Act going forward. Because firms 
would need to reverify 1 year later, this meant that only firms 
verified under the 2010 Act process should have been in VetBiz as of 
February 2012. In November 2011, VA reported that it had removed all 
unverified firms from its database on September 4, 2011. Subsequently, 
while reviewing new cases involving firms that had received VA SDVOSB 
contracts, we found instances where firms were not verified under VA's 
2010 Act process, but rather were verified under its 2006 Act process. 
[Footnote 32] 

When we met with VA in February 2012 to discuss our new cases, 
officials confirmed that there were still firms in VetBiz that had not 
been through the processes implemented in response to the 2010 Act, 
but did not explain how many firms still had not gone through the new 
process. Then, on April 23, 2012, officials told us that they had 
recently removed thousands of firms from VetBiz because these firms 
had not supplied the supporting documentation that VA decided was 
required for verification under the process implemented in response to 
the 2010 Act; VA indicated that it planned to remove hundreds of 
additional firms for the same reason. VA has provided conflicting 
statements about whether these firms received the December 2010 
request to supply documentation. Further, over the next month, VA 
officials provided us with at least seven differing accounts of the 
number of SDVOSBs verified under the processes implemented for the 
2006 Act and 2010 Act, the number of SDVOSBs they planned to remove, 
and the timing of the removals. VA's conflicting statements create 
uncertainty about the status of the agency's efforts to verify firms 
under the process implemented for the 2010 Act. Without a clear 
inventory and methods designed to track the verification process firms 
have undergone, VA cannot provide reasonable assurance that all firms 
appearing in VetBiz have been verified as owned and controlled by a 
veteran or service-disabled veteran. 

In its agency comments, VA explained these inventory issues by noting 
(1) the lack of a comprehensive case-management system has created the 
need for aggregate workarounds and resulted in inconsistent aggregate 
reporting; (2) the limitations of its current case-management system 
make it difficult to track the inventory of firms; and (3) as the 
limitations of the case-management system increase over time, the 
potential of CVE to lose track of how many firms have been verified 
also increases. VA also noted that its verification priorities have 
evolved over time. 

As of the close of our audit work, the information provided by VA 
indicated that thousands of potentially ineligible firms remain listed 
in VetBiz because they have not been verified under the more thorough 
process implemented for the 2010 Act. Our analysis shows that as of 
April 1, 2012, 3,717 of the 6,178 SDVOSBs (60 percent) listed as 
eligible in VetBiz had yet to be verified using the more-thorough 
verification process. Of these 3,717 firms listed as eligible on April 
1, 2012, 134 received a total of $90 million in new VA SDVOSB sole-
source or set-aside contract obligations during the 4-month period 
from November 30, 2011, to April 1, 2012.[Footnote 33] On May 14, 
2012, VA told us that it removed 1,857 of these 3,717 SDVOSBs from 
April 2 to April 10, 2012, so that they are no longer eligible for VA 
SDVOSB sole-source and set-aside contracts. According to VA, the 
remaining 1,860 firms that had not received a review under the 2010 
Act process were projected to be removed in July 2012 unless the firms 
provided adequate documentation supporting their eligibility. VA also 
stated that these firms were identified as being in "reverification" 
and no such expired firm was eligible for an actual contract award 
until the reverification decision had been completed. 

Since then, on June 27, VA implemented an interim final rule that 
extends the eligibility of verified firms to 2 years. VA told us it 
interprets "verified" to include any firm that has been verified under 
either its 2006 or 2010 Act processes. Therefore, according to the 
interim rule, as long as a firm is verified under either process and 
is in its 2-year eligibility period, VA is only authorized to initiate 
a verification examination if it receives credible evidence calling 
into question a participant's eligibility. Furthermore, VA considered 
firms whose prior 1-year eligibility period had recently expired, but 
who had not yet been through reverification, to be within the scope of 
the new rule, thus extending their eligibility another year. Extending 
the eligibility period may allow VA to focus its efforts on more 
thoroughly verifying firms that were previously verified under its 
less-stringent 2006 Act process. However, the extension also allows 
thousands of firms to continue to be eligible for contracts even 
though they have not undergone the more-thorough process. For example, 
according to information provided by VA in its comments, as of July 
13, 2012, there are 6,079 SDVOSBs and VOSBs listed in VetBiz. Of 
these, 3,724 were verified under the more-through process implemented 
under the 2010 Act and 2,355--over 38 percent--were verified under 
VA's less-rigorous 2006 Act process. As VA acknowledges in its agency 
comments, "the retention of firms verified prior to the 2010 Act 
[process] increases the possibility awards will go to firms that will 
not be verified when the more rigorous process is applied." 

Moreover, past audits show the risk of providing SDVOSB contracts to 
firms reviewed under VA's 2006 Act process. For example, in 2011, VA's 
own OIG issued a report that reviewed both SDVOSBs and VOSBs listed in 
VetBiz and found that 10 of 14 SDVOSBs and VOSBs verified under VA's 
2006 Act process and listed as eligible were in fact ineligible for 
these respective programs. The report identified several reasons for 
why these firms were ineligible, including improper subcontracting 
practices, lack of control and ownership, and improper use of SDVOSB 
status, among others. Further, the report noted VA's document-review 
process under the 2006 Act "in many cases was insufficient to 
establish control and ownership... [and] in effect allowed businesses 
to self-certify as a veteran-owned or service-disabled veteran-owned 
small business with little supporting documentation." The report goes 
on to state that VA's failure to maintain "accurate and current" 
information in the VetBiz database also exacerbated problems in the 
verification process. VA's OIG also used statistical sampling methods 
to project that (1) $500 million of VA SDVOSB and VOSB contracts were 
awarded annually to ineligible firms and (2) VA will award about $2.5 
billion in SDVOSB and VOSB contracts to ineligible firms over the next 
5 years if it does not strengthen its oversight and verification 
procedures. 

VA Has Made Some Progress in Addressing Our Prior Recommendations: 

In October 2011, we issued 13 recommendations to VA related to 
vulnerabilities in the verification process implemented by VA after 
the 2010 Act; VA generally concurred with our recommendations. As of 
June 2012, VA has provided us with documentation demonstrating that it 
has established procedures in response to 6 of these recommendations. 
Figure 3 shows the status of the recommendations; more specific 
information on each recommendation follows the figure. We have not 
assessed the effectiveness of any of the procedures that VA has 
established thus far as this is beyond the scope of this report. 

Figure 3: Status of GAO's Previous Recommendations: 

[Refer to PDF for image: illustrated table] 

Fraud-prevention controls: Preventive; 

GAO recommendation: 
Provide regular fraud-awareness training to CVE and VA contracting 
personnel; 
Status as of June 2012: Process not established. 

GAO recommendation: 
Provide additional guidance and training to the VA contracting 
personnel on the use of the VetBiz website so that SDVOSB contracts 
are only awarded to verified firms; 
Status as of June 2012: Process established. 

GAO recommendation: 
Establish formal procedures for VA staff to refer suspicious 
applications to the OIG and provide guidance on what type of cases to 
refer to the OIG; 
Status as of June 2012: Process established. 

GAO recommendation: 
Explore the feasibility of validating applicants' information with 
third parties, for example, requesting consent from SDVOSB applicants 
to validate tax information with the IRS to assess the accuracy of the 
information provided; 
Status as of June 2012: Process established. 

GAO recommendation: 
Formalize a process for conducting unannounced site visits to firms 
identified as high risk during the verification process; 
Status as of June 2012: Process established. 

Fraud-prevention controls: Detection and Monitoring; 

GAO recommendation: 
Develop and implement procedures for conducting unannounced site 
visits to contract performance locations and interviews with 
contracting officials to better assess whether verified companies 
comply with program rules after verification; 
Status as of June 2012: Process not established. 

GAO recommendation: 
Develop and implement a process for unannounced site visits to 
verified companies' offices to obtain greater effectiveness and 
consistency in the verification program; 
Status as of June 2012: Process established. 

GAO recommendation: 
Develop procedures for risk-based periodic reviews of verified firms 
receiving contracts to assess compliance with NAICS size standards 
and SDVOSB program rules; 
Status as of June 2012: Process not established. 

Fraud-prevention controls: Investigations and Prosecutions; 

GAO recommendation: 
Develop and implement specific processes and criteria for the 
Debarment Committee on compliance with the requirement in the 2006 
Act to debar, for a reasonable period of time, firms and related 
parties that misrepresent their SDVOSB status; 
Status as of June 2012: Process not established. 

GAO recommendation: 
Develop and implement specific procedures and criteria for staff to 
make referrals to VA's Debarment Committee and VA's OIG as a result of 
misrepresentations identified during initial verification and periodic 
reviews; 
Status as of June 2012: Process established. 

GAO recommendation: 
Develop specific guidelines outlining the Debarment Committee's 
decision process to debar firms that misrepresent their SDVOSB status; 
Status as of June 2012: Process not established. 

GAO recommendation: 
Develop procedures on removing SDVOSB contracts from ineligible firms; 
Status as of June 2012: Process not established. 

GAO recommendation: 
Formalize procedures to advertise debarments and prosecutions; 
Status as of June 2012: Process not established. 

Source: GAO and analysis of VA data. 

[End of figure] 

Process Established: 

* VA has provided additional guidance and training to the VA 
contracting personnel on the use of the VetBiz website. In December 
2011, VA issued a guidance memo requiring VA contracting personnel to 
check VetBiz to ensure that a firm is verified both upon receipt of an 
offer and prior to award. In November 2011, VA also provided training 
to the contracting personnel on the use of VetBiz. Providing guidance 
and training to current and new contracting personnel will help to 
ensure that these staff are aware of the need to check VetBiz prior to 
awarding a contract. 

* VA has established formal procedures for VA staff to refer 
suspicious applications to the OIG and provided guidance on what type 
of cases to refer to the OIG. In April 2012, VA issued procedures for 
VA staff to use if they identify suspicious information or possible 
misrepresentations on an application for eligibility during their 
initial review process. These procedures contain step-by-step 
instructions for how to notify the OIG about suspicious applications. 
Specifically, CVE's "risk team" makes a determination as to whether or 
not an applicant has intentionally misrepresented its status in an 
apparent attempt to defraud the government. If the information is 
credible, the applicant is referred to the VA OIG. If VA OIG accepts 
the referral, it conducts preliminary inquiries to determine whether a 
full investigation into criminal activity is warranted. If the OIG 
declines the investigation, VA can refer the matter to VA's Debarment 
Committee, which VA instituted in September 2010 specifically to debar 
firms that had violated SDVOSB regulations. In addition to these 
procedures, from November 2011 through January 2012, VA provided three 
training sessions to the VA staff on the type of red flags to note 
during the application review. 

* VA has explored the feasibility of validating applicants' 
information with third parties. In 2012, VA met with Dun and 
Bradstreet[Footnote 34] to explore the feasibility of utilizing their 
services to validate applicants' information, such as names and titles 
of business owners. Validating applicants' information with third 
parties may help enhance VA's ability to assess the accuracy of self-
reported information. 

* VA has formalized a process for conducting unannounced site visits 
to firms identified as high-risk during the verification process. In 
June 2012, VA issued procedures for VA to conduct unannounced site 
visits on a sample of 50 percent of high-risk firms identified during 
the verification process. Formalizing this process with a focus on 
high-risk firms may help provide reasonable assurance that only 
eligible firms gained access to the VetBiz database. 

* VA has developed and implemented a process for unannounced site 
visits to verified companies to obtain greater effectiveness and 
consistency in the verification process. VA's aforementioned June 2012 
procedures also apply to verified companies. VA developed a process to 
select on a weekly basis, based on a combination of random and risk-
based factors, verified firms to receive an unannounced site visit. In 
addition, according to VA it has started making these unannounced site 
visits. Conducting these site visits may help provide reasonable 
assurance to VA that the verification process is effective. 

* VA has developed and implemented specific procedures and criteria 
for staff to make referrals to the Debarment Committee and VA OIG as a 
result of misrepresentations identified during initial verification 
and periodic reviews. VA's aforementioned April 2012 procedures also 
apply to false information or misrepresentations identified after VA's 
initial review of the application, during the firm's eligibility 
period. These procedures may increase VA's success in pursuing firms 
that have misrepresented their eligibility for the program. 

Process Not Established: 

* VA has not provided regular fraud-awareness training to CVE and VA 
contracting personnel. One of the most significant challenges to an 
effective verification program is to have sufficient human capital 
with proper training and experience. Although VA has not established 
regular fraud-awareness training, it has made progress in this area. 
For example, VA told us that its OIG recently provided training on 
procurement fraud and that its General Counsel provides weekly 
training on examination procedures and policies in order to educate 
staff on fraud prevention. In addition, VA said that it has plans to 
require all CVE staff to attend a fraud examiners course; several CVE 
staff were already scheduled to attend fraud training in July 2012. 
Having sufficient human capital with the proper training and 
experience would enhance the effectiveness of the verification program. 

* VA has not developed and implemented procedures for conducting 
unannounced site visits to contract performance locations and 
interviews with contracting officials to better assess whether 
verified companies comply with program rules after verification. VA 
has started conducting announced site visits as part of its 
subcontracting compliance review program. This program is used to 
determine if a firm is performing in accordance with percentage of 
work performance requirements and other subcontracting commitments. 
However, VA has not developed and implemented procedures for 
conducting unannounced site visits to contract performance locations 
and interviews with contracting officials. The unannounced site visits 
and interviews with contracting officials would allow VA to better 
assess whether verified firms comply with program rules after 
verification. 

* VA has not developed procedures for risk-based periodic reviews of 
verified firms receiving contracts to assess compliance with North 
American Industry Classification System (NAICS)[Footnote 35] size 
standards and SDVOSB program rules. In order to be eligible for SDVOSB 
set-aside and sole-source contracts, a firm must qualify as a small 
business under NAICS size standards. In draft guidelines, VA included 
supplemental information for VA staff to review the firm's NAICS codes 
size standards, but these guidelines have yet to be finalized. 
Moreover, the draft guidelines do not include procedures for periodic 
reviews of verified firms' compliance with these standards. Such 
procedures would help improve continued compliance with SDVOSB program 
rules. 

* VA has not developed and implemented specific processes and criteria 
for the Debarment Committee on compliance with the requirement in the 
2006 Act to debar, for a reasonable period, firms and related parties 
that misrepresent their SDVOSB status. According to VA, its Debarment 
Committee relies on procedures outlined in the FAR and the VA 
Acquisition Regulations to determine the length of debarments. 

* VA has not developed specific guidelines outlining the Debarment 
Committee's decision process to debar firms that misrepresent their 
SDVOSB status. VA should provide the Debarment Committee with 
guidelines to aid its decision-making process in determining what 
constitutes a "misrepresentation" deserving of debarment, as that term 
is used in the 2006 Act. 

* VA has not developed procedures on removing SDVOSB contracts from 
ineligible firms. According to the VA Acquisition Regulations, the 
Deputy Senior Procurement Executive has the authority to determine 
whether VA should terminate a contract with a debarred firm. However, 
VA has not developed procedures to remove SDVOSB contracts from 
ineligible firms. According to VA, it is in the process of developing 
a policy on removing SDVOSB contracts from ineligible firms as 
determined by status protests. In addition, VA is in the process of 
providing guidance to the acquisition workforce on removing SDVOSB 
contracts from ineligible firms. Until VA develops procedures on 
removing SDVOSB contracts from ineligible firms, the SDVOSB program is 
at risk for ineligible firms to abuse the program and retain contracts 
obtained through fraud and abuse. 

* VA has not formalized procedures to advertise debarments and 
prosecutions. VA has not formalized procedures for advertising 
debarments and prosecutions, though the Debarment Committee, the OIG, 
and CVE have listed these actions on their websites. 

No Action Has Been Taken to Improve Government-wide SDVOSB Fraud-
Prevention Controls: 

No action has been taken to improve government-wide SDVOSB fraud-
prevention controls as the program continues to remain a self-
certification program. Because federal law does not require it, SBA 
does not verify firms' eligibility status, nor does it require that 
firms submit supporting documentation. According to SBA, it is only 
authorized to perform eligibility reviews in a protest situation, 
including those cases where SBA itself has reason to believe that a 
firm misrepresented its SDVOSB status. However, without basic checks 
on firms' eligibility claims, SBA cannot provide reasonable assurance 
that legitimate SDVOSBs are receiving government contracts. In fact, 
five of our new case-study firms received SDVOSB set-aside and sole-
source contract obligations, totaling approximately $190 million, of 
which $75 million were new SDVOSB set-aside and sole-source contract 
obligations, from October 1, 2009, to December 31, 2011, despite 
evidence indicating they are ineligible for the program.[Footnote 36] 
With regard to our original 10 case-study firms reported in October 
2009, some are under investigation by SBA OIG and punitive actions 
have been taken against others. To address vulnerabilities in the 
government-wide program, we previously suggested that Congress 
consider providing VA with the authority necessary to expand its 
SDVOSB eligibility verification process government-wide. Such an 
action is supported by the fact that VA maintains the database 
identifying which individuals are service-disabled veterans and is 
consistent with VA's mission of service to veterans. However, such 
action should not be undertaken until VA demonstrates that its 
verification process is successful in reducing the SDVOSB program's 
vulnerability to fraud and abuse. 

Self-Certification Allows Ineligible Firms to Win and Perform SDVOSB 
Contracts: 

In our previous work, we found that the SDVOSB program did not have 
effective government-wide fraud-prevention controls in place and was 
vulnerable to fraud and abuse.[Footnote 37] Outside of VA, there was 
no verification in place for SDVOSB contracting. Because federal law 
does not require it, SBA and agencies awarding contracts--other than 
VA--do not have a process in place to validate a firm's eligibility 
for the program, and rely on the firms self-certifying as a service-
disabled veteran-owned business in CCR. We found the only process in 
place to detect fraud in the government-wide SDVSOB program involved a 
formal bid-protest process at SBA, whereby interested parties to a 
contract award could protest another firm's SDVOSB eligibility or 
small-business size. However, we reported that this self-policing 
process did not prevent ineligible firms from receiving SDVOSB 
contracts. SBA officials have told us that they have limited 
responsibility over the SDVOSB program, and that the agency's only 
statutory obligation is to report on other agencies' success in 
meeting SDVOSB contracting goals. 

Our new case studies highlight instances of the fraud and abuse that 
resulted from the lack of verification of firms' SDVOSB status. In 
fact, five of our new case-study firms received SDVOSB set-aside and 
sole-source contract obligations, totaling approximately $190 million 
from October 1, 2009, to December 31, 2011, despite evidence 
indicating they are ineligible for the program. Of this $190 million, 
$75 million were new SDVOSB set-aside and sole-source contract 
obligations. In four of the cases we examined, we were able to 
substantiate informants' allegations of ineligibility as follows: 

* Non-SDVOSB joint venture. An SDVOSB entered a joint venture with a 
non-SDVOSB firm and received about $16 million in new government-wide 
SDVOSB set-aside contract obligations. Such joint ventures are 
eligible if the SDVOSB firm manages the joint venture and the contract 
work. However, the owner, a service-disabled veteran, admitted to our 
investigators that his SDVOSB firm did not manage the joint venture. 
Therefore, the joint venture is ineligible. This firm is currently 
listed as a SDVOSB in CCR, which allows the firm to compete for 
government-wide SDVOSB contracts. 

* VA-denied firm. Though VA denied a firm SDVOSB status in 2010 
because the firm was not controlled by a service-disabled veteran 
owner, the firm continued to self-certify in CCR. A VA site visit 
found the service-disabled veteran worked mostly at another company, 
and the non-service-disabled veteran vice president controlled the 
firm. In 2011, when the firm applied for VA verification again, the 
size of the firm was also questioned as it shared ownership or 
management with at least four different entities, including companies 
owned by a non-service-disabled veteran minority owner. The company 
withdrew its application to be a VA verified SDVOSB. In total, the 
firm received about $21 million in SDVOSB set-aside and sole-source 
contracts from DOD, the General Services Administration (GSA), the 
Department of the Interior (DOI), the U.S. Department of Agriculture 
and the VA, $16 million of which were new SDVOSB set-aside and sole-
source contract obligations. After VA denied the firm, the firm 
continued to self-certify as a SDVOSB in CCR and GSA, and DOI awarded 
the firm about $860,000 in new SDVOSB set-aside contracts obligations. 
This firm is currently listed as a SDVOSB in CCR, which allows the 
firm to compete for government-wide SDVOSB contracts. 

* Multiple firms not veteran-controlled. A service-disabled veteran 
and two non-service disabled veteran co-owners owned two firms and a 
joint venture at the same location. VA found one of the firms 
ineligible. The operating agreements of two of the firms allowed the 
two minority owners to control the firms, rather than the service-
disabled veteran. Additionally, the joint venture, created by one of 
the firms, was also ineligible because the service-disabled veteran's 
firm did not manage the joint venture and the contract work. 
Therefore, none of the three firms were eligible for the SDVOSB 
program. The three firms received over $91 million in SDVOSB set-aside 
and sole-source contract obligations, about $18 million of which were 
new SDVOSB set-aside and sole-source contract obligations, from VA and 
the Department of Health and Human Services. The three firms have been 
removed from VA VetBiz. However, these firms are currently listed as 
SDVOSBs in CCR, which allows the firms to compete for government-wide 
SDVOSB contracts. 

* Not service-disabled veteran-controlled. This firm is ineligible for 
the SDVOSB program because the veteran does not control the daily 
operations. The service-disabled veteran was not the Chief Executive 
Officer, and the firm's operating agreement did not give the service-
disabled veteran the exclusivity to make decisions for the company. In 
addition, the service-disabled veteran owner lived 500 miles away from 
the firm, received only $12,000 compared to the non-service-disabled 
veteran minority owner's $88,000 salary, and failed to meet or 
communicate with subcontractors. This firm received about $37 million 
in SDVOSB set-aside contract obligations, $446,000 of which were new 
SDVOSB set-aside contract obligations, from DOD and DOI. During the 
course of our work, SBA and VA found this company ineligible for the 
SDVOSB program. This firm no longer self-certifies as a SDVOSB in CCR. 
On May 25, 2012, SBA debarred the non-service-disabled veteran and the 
firm, making them ineligible for further contracts with the federal 
government. 

We were unable to substantiate allegations in a fifth case, but found 
evidence that the firm in question may be ineligible for the SDVOSB 
program because the service-disabled veteran owner may not spend 
sufficient time at the SDVOSB. The service-disabled veteran owner 
worked as an attorney at a legal services organization Monday through 
Friday about 40 hours a week, which could prevent the veteran from 
managing the day-to-day proceedings of the SDVOSB. This firm received 
about $25 million in new SDVOSB set-aside and sole-source contract 
obligations from VA and the Department of Transportation. This firm is 
now listed as verified in VetBiz and is currently listed as a SDVOSB 
in CCR, which allows the firm to compete for government-wide SDVOSB 
contracts. 

The DOD OIG likewise reported that DOD, which awarded about half of 
government-wide SDVOSB contracts in 2010, did not require adequate 
verification of contractor status before awarding contracts. After its 
review of DOD contracts awarded from October 2009 to July 2010, the 
OIG reported that $1.9 million in SDVOSB contracts went to firms that 
were not registered in CCR as SDVOSBs and $340.3 million went to 
contractors that potentially misstated their SDVOSB status.[Footnote 
38] The OIG also found that DOD awarded 12 SDVOSB set-aside and sole-
source contracts for a total of $11.5 million to six firms that VA 
rejected. The OIG went on to recommend that DOD create an SDVOSB 
verification program, but the agency disagreed, citing an absence of 
evidence indicating that such a program would produce a net benefit to 
eligible SDVOSBs, and that Congress had not provided DOD with either 
the resources or authority to establish such a system. 

To address the vulnerabilities within the government-wide program 
caused by reliance on a self-certification process, we suggested in 
2009 that Congress consider providing VA with the authority and 
resources necessary to expand its SDVOSB eligibility verification 
process to all contractors seeking to bid on SDVOSB contracts 
government-wide. Such an action is supported by the fact that VA 
maintains the database identifying which individuals are service-
disabled veterans and is consistent with VA's mission of service to 
veterans. In 2011, legislation was also introduced and passed in the 
Senate requiring all agencies to use VA's VetBiz for SDVOSB contract 
awards; this legislation has not become law. However, as shown by our 
current work, VA's program remains vulnerable to fraud and abuse 
because the agency has been unable to accurately track the status of 
its efforts and because potentially ineligible firms remain listed in 
VetBiz. Consequently, VA's ability to show that its process is 
successful in reducing the SDVOSBs program's vulnerability to fraud 
and abuse remains an important factor in any consideration about the 
potential expansion of VA's eligibility verification process 
government-wide. GAO has ongoing work that will, in part, examine some 
of the key issues that need to be addressed if VA's verification 
program were to be implemented government-wide. 

Actions Taken against Ineligible Firms: 

In 2009, we found that ineligible firms in 10 cases received $100 
million in SDVOSB contracts and $300 million in other federal 
contracts.[Footnote 39] We referred all 10 of these cases to the 
appropriate agency OIGs. As of April 2012, while none of the firms are 
currently suspended or debarred by the agencies that received our 
referrals,[Footnote 40] some actions have been taken: 

* The SBA OIG is proceeding with six open investigations. In addition, 
the SBA OIG has joined forces with other agency OIGs to pursue several 
cases. Specific details cannot be provided until the cases have been 
fully adjudicated. 

* One individual related to a case is being prosecuted by the U.S. 
Attorney for wire fraud and fraud against the United States involving 
a contract valued at $1 million or more related to its 
misrepresentation as an SDVOSB. In addition, this individual and a 
related firm were suspended by the Department of Transportation for 
procurement fraud. 

* One individual related to a case-study is being charged by the U.S. 
Attorney with conspiracy to commit wire fraud and forfeiture of his 
assets up to $400,000. This individual allegedly conspired to defraud 
the SBA and other government contractors by falsely representing his 
business as a service-disabled veteran-owned and operated business. 

* Another case-study firm pled guilty to wire fraud in relation to 
fraudulently receiving Historically Underutilized Business Zone 
(HUBZone) federal contracts.[Footnote 41] Our previous finding that 
the case was ineligible for the SDVOSB program, in conjunction with 
the firm's admitting defrauding the HUBZone program, raises the 
concern of ineligible firms applying for multiple procurement programs. 

Actions taken against firms that violate the SDVOSB program 
requirements should help protect the government's interest and help 
discourage ineligible firms from abusing the SDVOSB program. As 
previously discussed, providing more emphasis on debarments and 
investigations could further help the government deter firms from 
attempting to fraudulently gain access to the SDVOSB program. 

Conclusions: 

The SDVOSB program has provided billions of dollars in contracting 
opportunities to deserving service-disabled veterans. However, our 
body of work, along with work by the DOD OIG and VA OIG, has found 
that the program is vulnerable to fraud and abuse, which has allowed 
millions of dollars to be awarded to ineligible firms. The government-
wide program remains particularly vulnerable since it relies on an 
honor-system-like process whereby firms self-certify their 
eligibility. VA has the only program within the government dedicated 
to verifying SDVOSB firms' eligibility; VA also has responsibility for 
maintaining a database of service-disabled veterans and a listing of 
firms that are eligible for the SDVOSB program. Given VA's mission of 
service to veterans, we previously suggested that Congress consider 
expanding VA's program government-wide to employ more effective fraud-
prevention controls over the billions of dollars awarded to SDVOSBs 
outside of VA. However, such action should not be undertaken until VA 
demonstrates that its verification process is successful in reducing 
the SDVOSB program's vulnerability to fraud and abuse. 

Furthermore, while the results of this most-recent assessment show 
that VA has made some progress in improving its verification process 
in response to the 2010 Act, it has made conflicting statements 
regarding the verification of firms and has been unable to accurately 
track the status of its efforts. These problems have resulted in 
thousands of potentially ineligible SDVOSBs receiving millions of 
dollars in sole-source and set-aside contract obligations. By better 
managing its inventory of firms, maintaining the accuracy of firms' 
status in VetBiz, and applying the 2010 Act verification process to 
all firms, VA can be more confident that the billions of dollars meant 
to provide VA contracting opportunities to our nation's service-
disabled veteran entrepreneurs make it to the intended beneficiaries. 

Recommendations for Executive Action: 

To minimize potential fraud and abuse in VA's SDVOSB program and 
provide reasonable assurance that legitimate SDVOSB firms obtain the 
benefits of this program, we recommend that the Secretary of Veterans 
Affairs ensure that all firms within VetBiz have undergone its 2010 
Act verification process. Specifically, this should include 
consideration of the following three actions: (1) inventory firms 
listed in VetBiz to establish a reliable beginning point for the 
verification status of each firm; (2) establish procedures to maintain 
the accuracy of the status of all firms listed in VetBiz, including 
which verification process they have undergone; and (3) expeditiously 
verify all current VetBiz firms and new applicants under the 2010 Act 
verification procedures. 

Agency Comments and Our Evaluation: 

We provided a draft of our report to VA and SBA for comment. In its 
written comments, reproduced in appendix I, VA stated that it 
concurred with our first two recommendations. It concurred "in 
principle" with the third, to verify all current VetBiz firms and new 
applicants under the processes implemented under the 2010 Act. With 
respect to this recommendation, VA noted that it implemented an 
interim rule on June 27, 2012, that extends the eligibility of 
verified firms to 2 years. VA told us it interprets "verified" to 
include any firm that has been verified under either its 2006 or 2010 
Act processes. Therefore, according to the interim final rule, as long 
as a firm is verified under either process and is in its 2-year 
eligibility period, VA is only authorized to initiate a verification 
examination if it receives credible evidence calling into question a 
participant's eligibility. Extending the eligibility period may allow 
VA to focus its efforts on more thoroughly verifying firms that were 
previously verified under its less-stringent 2006 Act process. 
However, the extension also allows thousands of firms to continue to 
be eligible for contracts even though they have not undergone the more 
thorough process. We acknowledge that VA has latitude under the law to 
modify its own regulations as necessary. However, the interim final 
rule in effect removes a backlog of firms and appears to be a self-
created impediment delaying verification under the 2010 Act process. 
We remain convinced that the verification process utilized by VA prior 
to the 2010 Act process does not provide reasonable assurance that 
only eligible SDVOSBs participate in the program. Given this ongoing 
vulnerability to fraud and abuse, we continue to believe that VA 
should expeditiously verify current VetBiz firms and new applicants 
under the 2010 Act verification process. 

Despite these concurrences, VA commented that our report was 
misleading and inaccurate with respect to (1) our characterizations of 
a 2011 VA OIG report, (2) conflicting statements made by VA, and (3) 
VA's implementation of our previously issued recommendations. We 
disagree. First, VA stated that our use of the VA OIG's 2011 report 
was misleading because the report examined a period when the VetBiz 
database included self-certified firms in addition to firms verified 
under the processes implemented under the 2006 Act. VA also claims the 
VA OIG report contains excessive extrapolations because it examined 
eligibility requirements beyond ownership and control. Specifically, 
VA notes that 14 of the 42 firms reviewed for the OIG report had been 
through the verification process VA used in response to the 2006 Act 
and claims that only 3 were determined to be ineligible based on 
ownership and control. VA's statement is incomplete and misleading. 
According to the OIG, an additional 7 were determined to be ineligible 
for reasons that could be identified during a robust verification 
process. As a result, the OIG found 10 of 14 firms verified under VA's 
2006 Act process to be ineligible--an eligibility failure rate 
comparable to the overall eligibility failure rate cited in the report. 

With regard to the aforementioned 7 firms, the OIG determined they 
were ineligible because they were engaged in improper subcontracting 
practices, such as "pass-through" contracts. Pass-through contracts 
occur when businesses or joint venture/partnerships list veterans or 
service disabled veterans as majority owners of the business but, 
contrary to programs requirements, the non-veteran owned business 
either performed or managed the majority of the work and received a 
majority of the contracts' funds. Given that the firms being reviewed 
by the OIG already had existing contracts in place, the OIG was able 
to identify the pass-through contracts by conducting site visits and 
reviewing business documentation, the same steps that VA claims are 
taken during the verification process it implemented in response to 
the 2010 Act. While we acknowledge that it is difficult to identify 
pass-through contracts for applicants to the program who don't have 
any preexisting contracts, VA should be conducting such a review for 
those firms that have contracts in place. As we have noted in past 
reports, VA's fraud prevention controls should include detection and 
monitoring measures to assure that firms are completing the work 
required of an SDVOSB contract. 

Second, VA disagrees that it provided numerous conflicting statements 
to us regarding its verification efforts, stating that the 
verification process has evolved and that VA faces technical 
limitations related to its case-management system. While we 
acknowledge these concerns, it is important to note that VA did not 
provide us with any explanation as to its evolving priorities during 
the course of our audit and instead repeatedly sent us contradictory 
information without any clarification. Moreover, not all of the 
conflicting statements VA made can be attributed to inadequacies in 
its case-management system or to evolving priorities. Specifically, 
the information we received during the course of our audit work 
changed so significantly over such a short period of time that the 
evidence GAO collected does not support VA's assertion that it "knows 
how many firms have been verified" and can "track individual firms," 
as VA claims in its agency comment letter. Examples of the conflicting 
statements we received include the following: 

* Removal of firms: On April 23, 2012, VA told us that about 900 
SDVOSBs and VOSBs listed in VetBiz were targeted for removal because 
they had not been verified under the 2010 Act process. By April 27, 
2012, this number increased to approximately 3,500 SDVOSBs and VOSBs. 
On May 2, 2012, we received two more differing accounts of SDVOSBs and 
VOSBs targeted for removal--2,660 firms and 2,646 firms--in the same 
email. 

* Implementation of the 2010 Act process: On February 16, 2012, VA 
told us that it continued to verify firms under the process 
implemented under the 2006 Act between January and May 2011. Then, on 
April 23, 2012, VA told us that it stopped verifying firms under its 
2006 Act process in February 2011 and began verification under its 
2010 Act process at the same time. Next, on May 12, 2012, VA told us 
that it stopped verifying firms under the 2006 Act process in January 
2011 and began verifying under the 2010 Act at the end of December 
2010. In the same communication, VA told us that no firm was approved 
under its 2006 Act process after February 2011. But on May 21, 2012, 
VA sent us a list of firms and verification dates showing that 
multiple firms were last verified under its 2006 Act process past 
February 2011, with at least two firms verified under its 2006 Act 
process as late as May 2011. 

Finally, VA stated it believed all previous GAO recommendations issued 
in October 2011 should be closed. For GAO to close a recommendation, 
it must be implemented or actions must have been taken that 
essentially meet the recommendation's intent. Further, the responsible 
agency must provide evidence, with sufficient supporting 
documentation, that the actions are being implemented adequately. By 
the end of our audit work, we were able to close 6 of the 13 
recommendations that we issued to VA in October 2011 based on 
documentation VA provided demonstrating that the agency had taken 
specific actions in response to our recommendations. Although VA 
indicated that it would like to close out the remaining 
recommendations, it either did not demonstrate that it had taken an 
action to implement a recommendation or did not provide the supporting 
documentation needed to show that the recommendation was in fact 
implemented. We had several discussions with VA staff about our 
requirements for closing recommendations, the last occurring on June 
22, 2012. Moreover, we noted in our report any progress VA has made 
with respect to each recommendation; the information VA provided in 
this letter had previously been acknowledged in our report. For the 7 
recommendations that remain open after the issuance of this report, we 
will continue to seek from VA additional documentation necessary to 
demonstrate that implementation has occurred. At such time, we will 
close each recommendation, as appropriate. 

In addition, VA provided technical comments, which we addressed as 
appropriate. We provide annotated responses to VA's more detailed 
comments in appendix I. 

In written comments received through e-mail, SBA stated that it is 
committed to eliminating fraud, waste, and abuse in all of its 
programs including the government-wide SDVOSB program. In addition, 
SBA stated that it maintains a "robust and thorough" protest and 
appeal process. However, as noted in our report, SBA's bid-protest 
process alone--that is, without upfront eligibility verification and 
other related measures--cannot provide reasonable assurance that only 
legitimate firms are awarded SDVOSB contracts. In addition, five new 
case studies developed for this report highlight instances of fraud 
and abuse. SBA disagreed with the draft report's portrayal of actions 
taken against the firms that were the subject of the 10 case studies 
developed as part of our October 2009 report. We revised our report 
where appropriate. SBA also stated that it had taken actions against 
firms in addition to those cited in our case studies, but did not 
provide specific examples. Finally, SBA stated that it was 
implementing training to help its staff identify fraud and abuse and 
working to improve its referral process and collaboration with other 
agencies. Such efforts could help reduce the SDVOSB program's 
vulnerability. However, these efforts would affect only SBA's 
investigation and prosecution efforts, and not prevention, detection, 
and monitoring. If the government-wide program included measures to 
prevent, detect, and monitor fraud in the SDVOSB program, SBA could be 
more confident that the billions of dollars meant to provide 
contracting opportunities to our service-disabled veteran 
entrepreneurs make it to the intended beneficiaries. 

We are sending copies of this report to interested congressional 
committees, the Administrator of SBA, the Secretary of Veterans 
Affairs, and other interested parties. The report is also available at 
no charge on the GAO website at [hyperlink, http://www.gao.gov]. 

If you have any questions concerning this report, please contact 
Richard J. Hillman at (202) 512-6722 or hillmanr@gao.gov. Contact 
points for our Offices of Congressional Relations and Public Affairs 
may be found on the last page of this report. 

Signed by: 

Richard J. Hillman: 
Managing Director: 
Forensic Audits and Investigative Service: 

[End of section] 

Appendix I: Comments from the Department of Veterans Affairs: 

Note: GAO comments supplementing those in the report text appear at 
the end of this appendix. Page numbers in the draft report may differ 
from those in this report. 

Department of Veterans Affairs: 
Washington, DC 20420: 

July 19, 2012: 

Mr. Gregory D. Kutz: 
Director, Forensic Audits and Investigative Service: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Kutz: 

The Department of Veterans Affairs (VA) has reviewed the Government 
Accountability Office's (GAO) draft report, "Service-D1sabled Veteran-
Owned Small Business Program: Vulnerability to Fraud and Abuse 
Remains" (GAO-12-697). VA concurs with GAO's recommendations 1 and 2 
and concurs in principle with recommendation 3 to the Department.
Despite these concurrences, VA has serious concerns with specific 
language in this draft report. VA believes the inaccurate portrayal of 
information in a number of areas either misleads the reader or 
misrepresents the status of the Center for Veterans Enterprise 
verification program. The enclosures specifically address each of GAO's
recommendations and provide extensive technical comments on the draft 
report. 

VA urges full incorporation of the recommended technical changes in 
order to ensure an accurate and reliable report. VA representatives 
are available to assist in further clarification of these issues upon 
request. Please contact Ms. Denese Canedo, at denese.caned@va.gov or 
by telephone at 202-461-5684, should you have any further questions or 
desire to discuss these recommended technical changes. 

VA appreciates the opportunity to comment on your draft report. 

Sincerely, 

Signed by: 

John R. Gingrich: 
Chief of Staff: 

Enclosures: 

[End of letter] 

Enclosure: 

Department of Veterans Affairs (VA) Comments to Government 
Accountability Office (GAO) Draft Report: "Service-Disabled Veteran-
Owned Small Business Program — Vulnerability to Fraud and Abuse Remains"
(GA0-12-697): 

GAO Recommendation: To minimize potential fraud and abuse in VA's SDVOSB
program and provide reasonable assurance that legitimate SDVOSB firms 
obtain the benefits of this program, we recommend that the Secretary 
of Veterans Affairs ensure that all firms within VetBiz have undergone 
its verification process. This should include consideration of the 
following three actions: 

Recommendation 1: Inventory firms listed in VetBiz to establish a 
reliable beginning point for the verification status of each firm. 

VA Response: Concur. The Center for Veterans Enterprise (CVE) has a 
complete inventory of all firms listed in its Vendor Information Pages 
(VIP), located at the VetBiz Web site that identifies the status of 
each firm, its eligibility date, and whether it was verified under the 
processes established as a result of the 2010 P.L. 111-275. Please see 
Attachment A (Verification Master Inventory List (VMIL) for a complete 
inventory of firms, including verification status. VA is furnishing a 
CD as the list is more than 300 pages. 

Recommendation 2: Establish procedures to maintain the accuracy of the 
status of all firms listed in VetBiz, including which verification 
process they have undergone. 

VA Response: Concur. CVE has established procedures to maintain the 
accuracy of the status of all firms listed in VIP; however, due to 
limitations in the Verification Case Management System (VCMS) - the 
VA's information management system - the status of firms is maintained 
separately in the VMIL. The VMIL is updated as changes occur. CVE has 
initiated action to upgrade VCMS so that it can support current and 
future business processes. 

Recommendation 3: Expeditiously verify all current VetBiz firms and 
new applicants under the 2010 Act verification procedures. 

VA Response: Concur in Principle. All firms listed as verified in the 
VIP have been verified in accordance with P.L. 109-461 and 38 CFR §74. 
VA seeks to verify all firms using the process established as a result 
of 111-275; however, 38 CFR 74.15 (c) only authorizes CVE to initiate 
a verification examination "whenever it receives credible information 
calling into question a participant's eligibility as a Veterans-owned 
small business (VOSB)." As a result, CVE did not require firms who 
were verified under the process before enactment of P.L. 111-275 in 
October 2010 and whose period of eligibility has not expired, to 
initiate reverification prior to the expiration of their eligibility.
All new applicants and all reverification applicants are processed 
under the post-2010 Act verification procedures. All companies whose 
verification has expired (verification approval more than two years 
old) are ineligible for contract awards and must go through 
reverification under the process established after P.L. 111-275 in 
order to become eligible for a VA Veterans First award. 

Technical Comments: 

Page 2, Paragraph 2, Line 13: "In 2011, VA's Office of Inspector 
General also found on the basis of a random sample of 42 firms that 32 
of 42 firms listed in VetBiz database under the 2006 Act were 
ineligible for the VA SDVOSB program." 

Page 14, Paragraph 2, Line 2: "However, even if VA had verified these 
firms under the 2006 act, past audits show the risk of providing 
SDVOSB contracts to firms reviewed under this process...VA's own OIG 
reviewed both SDVOSBs and VOSBs in VetBiz and found 32 of 42 SDVOSBs 
and VOSBS as verified under the 2006 Act process were in fact 
ineligible for their respective programs." 

VA Comment: These statements are inaccurate and misleading. The period 
of OIG examination was from June 1, 2009, to May 31, 2010. This period 
was prior to the passage of P.L. 111-275. OIG reported that 32 of the 
42 companies were "either ineligible to participate in the programs or 
ineligible for the awarded contracts." Prior to the 2010 Act, 
companies could legally continue to self-represent in the VIP database 
and the vast majority of the firms in VIP were self-certified. Of the 
42 companies selected for the report, only 14 had been through VA's 
verification program. The rest were self-represented. Only three (3) 
verified firms out of 42 were determined to be ineligible based on 
ownership and control of the firm. As of December 2010, only firms 
that had been verified in VIP were eligible to receive awards. All 
others listed in VIP had to be verified prior to an award being made. 

VA recommended change: Replace the Report language cited above with 
the following: "In 2010, VA's Office of Inspector General found that 
most of the firms in the VIP database were self-represented and on the 
basis of a random sample of 42 firms, that 32 of 42 firms listed in 
VIP were ineligible for the VA SDVOSB program. Further, on September 
4, 2011, VA eliminated all self-represented firms from VIP, making 
them ineligible to receive awards. [See comment 1] 

Page 14, Paragraph 2, Line 8: "VA's OIG also used statistical sampling 
methods to project that (1) $500 million of VA SDVOSB and VOSB 
contracts were awarded annually to ineligible firms.... if it does not 
strengthen its oversight and verification procedures." 

VA Comment: This statement is inaccurate and misleading in the context 
of CVE verification policies and process. Only three firms out of 42 
were verified yet ineligible for awards; therefore the extrapolation 
is excessive. [See comment 1] 

VA recommended change: Delete this statement. 

Page 7, Paragraph 3, Line 1: "VA's Center for Veterans Enterprise 
(CVE) seeks to help Veterans interested in forming or expanding their 
own small business...technical assistance needs. CVE is also 
responsible for maintaining VetBiz and implementing
VA's verification program." 

VA Comment: This statement is inaccurate. CVE no longer counsels 
Veterans interested in forming or expanding their own small business. 
Since April 2011, CVE's sole function has been to verify eligibility 
of firms for VA Veterans First Program. 

VA recommended change: Replace the segment in question with the 
following language: "Prior to April 2011, VA's Center for Veterans 
Enterprise (CVE) sought to help Veterans interested in forming or 
expanding their own small business...technical assistance needs. CVE 
was also responsible for maintaining VetBiz.gov and the VIP database 
and implementing VA's verification program. Beginning in April 2011, 
CVE has focused solely on implementing VA's verification program. The 
former coaching mission is now accomplished by referrals to our 
Verification Education Partners in order to eliminate the possibility 
of conflict of interest. [See comment 2] 

Page 7, Paragraph 3, Line 7: "VA was required to notify all unverified 
businesses in its VetBiZ database...to establish veteran ownership and 
control." 

VA Comment: VA notified all unverified firms in VIP in accordance with 
Section 104 (b)(2) P.L. 111-275, which states: 

"In the case of a small business concern included in the database as 
of the date of the enactment of this Act for which, as of such date, 
the Secretary of Veterans Affairs has not verified the status of such 
concern in accordance with paragraph (4) of subsection (f) of section 
8127 of title 38, United States Code, as amended by paragraph (1), not 
later than 60 days after the date of the enactment of this Act, the 
Secretary shall notify the person who owns and control the concern 
that..." 

VA complied with the law and notified approximately 13,000 firms on 
December 10, 2010. At the time the notifications went out, there were 
approximately 17,000 firms in the Vendor Information Pages (VIP). The 
notices went to those companies who were self-represented and had 
never submitted an application for verification, and to firms that had 
previously been verified, but whose verification had expired prior to 
the notification. Firms with a current VA verification were not 
notified, in accordance with the provisions of the law. 

In late March 2011, approximately 8,000 firms were removed from VIP 
for failure to respond to the notice. CVE only removed from VIP firms 
that had never undergone VA verification. Firms that had been verified 
using the P.L. 109-461 process that was in place at the time were 
allowed to remain in VIP. 

VA recommended change: Replace the aforementioned segment with the 
following language: "In accordance with Section 104 (b)(2) P.L. 111-
275, VA notified all unverified companies, firms that self-
represented, or firms that had expired eligibility periods, listed in 
VIP on December 10, 2010, that they must submit a complete application 
with all documentation for verification." [See comment 3] 

Page 8, Paragraph 2, Line 1: "SDVOSBs are required to receive a 
portion of government-wide contractual dollars annually." 

VA Comment: This statement is not correct. Agencies have goals for 
socioeconomic categories such as SDVOSBs, not requirements. 

VA recommended change: Replace this statement with the following: The 
Federal Government has a 3 percent goal for procurement with SDVOSBs 
annually. [See comment 4] 

Page 11, Paragraph 1, Line 1: "VA has made numerous conflicting 
statements about its progress... in response to the 2010 Act. These 
statements indicate that VA has taken an inconsistent approach to 
prioritizing the verification of firms and has been unable to 
accurately track the status of its efforts." 

VA Comment: This statement is not accurate. VA has utilized a 
consistent approach to prioritization that is based on the regulation, 
fundamental principles of fairness, and availability of resources. 
However, VA's approach has evolved as appropriate in response to 
changes in regulation or legislation and/or resources. 

In May 2011, the priorities were as follows: 

(1) Verification of new applications for firms that had previously 
only self-represented in VIP (i.e., firms that had not been reviewed 
under processes created for the 2006 Act or 2010 Act); 

(2) Verification of new firms that had initially applied for 
verification after the enactment of the 2010 Act; 

(3) Requests for reconsideration from firms denied verification; and; 

(4) Reverification of applications for firms initially verified in VIP 
under the process implemented for the 2006 Act. 

"Unverified" firms were listed in VIP as "pending" but were not 
eligible for an award of contracts. They were eligible to submit 
proposals and those that were pending award received top priority for 
verification as part of "fast track" program. 

VA removed or verified all unverified firms from VIP by September 4, 
2011. Once that was accomplished, CVE initiated an active outreach to 
promote reverification of firms verified prior to implementation of 
P.L. 111-275. 

In October 2011, the priority was: 

(1) Verification of new firms that had initially applied for 
verification after the 2010 Act; 

(2) Requests for Reconsideration from firms denied verification; and; 

(3) Reverification of applications for firms initially verified in VIP 
under the process implemented for the 2006 Act. 

Based on available resources, CVE determined that it was not able to 
complete reverification in as timely a way as might be desired and 
therefore, beginning on June 6, 2012, CVE executed a Class Deviation 
process that placed all firms whose eligibility had expired in a 
special category "reverification." In accordance with the published 
Class Deviation, firms in this category are not eligible to receive 
awards until reverification is completed. To avoid damaging these 
firms, a "Fast Track" process was initiated for firms pending award 
that gives them top priority. Since June 6, 2012, the priority has 
been: 

(1) Fast Track for firms in "reverification" status that are pending 
award; 

(2) Simplified reverification of firms verified using P.L. 111-275 
process; 

(3) Verification of new firms using the 2010 Act procedures; 

(4) Requests for Reconsideration from firms denied verification; and; 

(5) Reverification of applications for firms initially verified in VIP 
under the process implemented for the 2006 Act. 

CVE has reported to GAO its progress on eliminating "unverified firms" 
and tracks those firms that were verified pre-P.L. 111-275 and post-
P.L. 111-275. The VetBiz Case Management System (VCMS) does not 
contain historical data and does not provide the capability to track 
the status of all firms in VIP. As a result, information is stored in 
several secure locations and the lack of a comprehensive case 
management information system has created the need for manual 
workarounds and generated inconsistent aggregate reporting. In order 
to track overall status, CVE has established the VIP Master Inventory 
List (See Attachment A) outside of VCMS. 

VA recommended change: Replace the aforementioned language with the 
following: "VA verification priorities have evolved over time. 
Progress has enabled VA to verify all firms in VIP, but VA has not 
completed verification of all firms using the process applied after 
the 2010 Act. Lack of a comprehensive management information system in 
VCMS has made it difficult for CVE to track the status of firms in the 
aggregate. CVE has had to establish and maintain the VIP Master 
Inventory outside of VCMS to in order to track overall status. The 
lack of a comprehensive case management system has created the need 
for manual workarounds and resulted in inconsistent aggregate 
reporting." 

Page 11, Paragraph 1, Line 4: "VA's most-recent numbers indicate that 
thousands of SDVOSBs listed as eligible in VetBiz received millions of 
dollars in SDVOSB sole-source and set-aside contract obligations even 
though they had not been verified under the new requirements of the 
2010 Act." [See comment 5] 

VA Comment: This statement is incorrect and misleading as it does not 
provide the full picture. No firms were listed in VIP as verified that 
had not been verified under the requirements of P.L. 109-461. Those 
that were not verified, were listed as "Pending" and were verified 
prior to an award being made. 

P.L. 109-461 as amended and the Regulation 38 CFR Part 74 requires all 
firms in VIP to be verified. It does not specify verified under the 
process established in the wake of P.L. 111-275. All firms in VIP have 
been verified. All firms verified under the new process have been 
verified with full document reviews. P.L. 111-275 was primarily 
enacted to address those firms listed on VIP but not yet verified. It 
did not invalidate prior verification determinations. 

CVE has initiated reverification for those firms whose eligibility has 
expired, but it has only initiated reverification of firms verified 
prior to 111-275 in accordance with 38 CFR § 74.15 (c) that only 
authorizes CVE to initiate a verification examination "whenever it 
receives credible information calling into question a participant's 
eligibility as a VOSB." 

CVE initiated a more robust review process as a result of P.L.111-275 
(which was only made possible via a large infusion of people and 
resources). The older process met the requirements of P.L. 109-461. 
When additional resources became available, CVE expanded the scope of 
its evaluations and adopted a strategy designed to reverify firms 
verified under the older process as their eligibility expired, but in 
accordance with our priorities, reverification was the lowest priority. 

VA recommended change: Replace the aforementioned language with the 
following: "VA's most recent numbers indicate thousands of SDVOSBs 
listed as eligible in VetBiz received millions of dollars in SDVOSB 
sole source and set-aside contract obligations were verified under the 
P.L. 109-461 process, rather than the more robust process initiated by 
the 2010 act. Limitations imposed by the regulation at 38 CFR §74.15 
and the VA verification priorities have impeded CVE from immediately 
completing verification of all firms using the process established by 
the 2010 Act." [See comment 6] 

Page 11, Paragraph 2, Line 1: "VA has provided a number of conflicting 
statements and explanations related to the status of its verification 
program, indicating that it is having difficulty tracking its 
inventory of firms and whether they were verified under the process 
implemented to carry out the 2010 Act." 

Page 13, Paragraph 1, Line 8: "Over the next month, VA officials 
provided us with at least seven differing accounts of the number of 
SDVOSBs verified under the processes for the 2006 Act and 2010 Act... 
Without a clear inventory and methods designed to track the 
verification process firms have undergone, VA cannot provide 
reasonable assurance that all firms appearing in VetBiz have been 
verified as owned and controlled by a veteran or service-disabled 
veteran." 

Page 12, Paragraph 2, Line 2: "However, our review ... raises concerns 
...whether VA knows how many of its firms have actually been verified 
pursuant to the requirements of the 2010 Act." 

VA Comment: These statements are inaccurate and misleading. CVE knows 
how many firms have been verified, and is able to track its inventory 
of firms using VMIL. No firm appears in VIP as eligible for an award 
unless it is verified as owned and controlled by a Veteran or service-
disabled Veteran. Those listed as "reverification" are not eligible to 
receive awards without undergoing verification using the 2010 Act 
process. CVE staff provided a variety of responses over time based on 
their best understanding of the parameters of the particular questions 
and the situation at the time of the question. The limitations of VCMS 
preclude obtaining comprehensive information easily. Unfortunately, 
VCMS does not distinguish between firms verified under the older 
process and those verified under the newer process. It only tracks the 
initial verification date of a firm after May 2011, so tracking and 
inventory are done manually, outside of VCMS, the VA's information 
management system. These limitations require CVE to manually manage 
its inventory of businesses in VIP including last verified date and 
the process under which they were verified outside VCMS using VMIL. 

Since September 4, 2011, all firms appearing in VIP have been verified 
either under the older process or by the current process established 
after P.L. 111-275 was enacted. VA has a clear inventory (See 
Attachment A) and can track the verification process of firms so that 
we can ensure that we only verify those firms who are indeed, 
eligible. While our ability to provide aggregate reporting has been 
hampered by VCMS, it has not precluded us from tracking individual 
firms. 

While we seek to have all firms verified under the post-P.L.111-275 
process and have initiated action to that end, as noted above, 38 CFR 
Part 74 does not provide authority to initiate that process prior to 
the expiration of eligibility for firms that are currently verified 
without a specific rational basis for the action. Those firms whose 
eligibility period has expired and resource limitations have precluded 
CVE from completing their reverification are listed in VIP but are 
annotated as "reverification" and they are not eligible to receive an 
award without being verified under the process established by the
2010 Act. Of the 6,079 firms currently in VIP as of 13 Jul 2012, 3,733 
were verified under P.L. 111-275 the new process and 2,346 were 
verified under P.L. 109-461, the old process. 

VA recommended change: Page 11, Paragraph 2, Line 1: Replace the 
aforementioned language with the following: "CVE has had difficulty 
providing consistent aggregate reporting due to limitations of its 
VCMS system. Although CVE reports that it is able to track its 
inventory outside of VCMS, limitations of the VCMS hamper reporting 
and make it difficult to track the inventory of firms." [See comment 5] 

VA recommended change Page 13, Paragraph 1, Line 8: Replace the 
aforementioned language with the following: "Over the next month, VA 
officials were unable to provide consistent information from VCMS that 
clearly differentiated between SVOSBs verified under the processes for 
the 2006 Act and those verified under the 2010 Act. Although CVE 
reports that all firms listed in VIP as eligible for the SDVOSB
program have been verified as owned and controlled by a Veteran or 
service-disabled Veteran, the limitations of the VCMS hamper reporting 
and management." [See comment 5] 

VA recommended change, Page 12, Paragraph 2: Our review of information 
provided by VA raises concerns that the retention of firms verified 
prior to the 2010 Act increases the possibility awards will go to 
firms that will not be verified when the more rigorous process is 
applied. We are also concerned that as the limitations of the VCMS 
system increase, the potential for CVE to lose track of how many firms 
have actually been verified also increases. [See comment 5] 

Page 12, Paragraph 1, Line 2: "...within 60 days of the law's 
enactment VA was required to notify all firms listed in its VetBiz 
database about the need to apply for reverification...." 

VA Comment: This statement is not correct. Section 104 (b)(2) of P.L. 
111-275 stipulated: In the case of a small business concern included 
in the database as of the date of the enactment of this Act for which, 
as of such date, the Secretary of Veterans Affairs has not verified 
the status of such concern in accordance with paragraph (4) of 
subsection (f) of section 8127 of title 38, United States Code, as 
amended by paragraph (1), not later than 60 days after the date of the 
enactment of this Act, the Secretary shall notify the person who owns 
and controls the concern." 

VA met the mandate in the law to notify unverified firms in VIP that 
they must submit documentation for verification. At that time, VIP had 
approximately 17,000 companies, about 6,000 of whom were verified. VA 
sent out 13,000 notifications in December 2010 to firms who had never 
been verified or whose verification term had expired. 

VA recommended change: "within 60 days of the law's enactment VA was 
required to notify all unverified firms listed in its VetBiz database 
about the need to apply for verification in accordance with Section 
104 (b)(2) P.L. 111-275. VA notified all unverified companies in VIP 
on December 10, 2010, that they must submit a complete application 
with all documentation for verification. Those unverified firms that 
failed to comply, were removed from VIP." [See comment 7] 

Page 12, Paragraph 1, Line 5: "VA Officials told us that the agency 
prioritized its verification under 2010 Act by... and 3) applications 
for firms initially verified in VetBiz under the process implemented 
for the 2006 Act." 

VA Comment: This statement is not correct. Since an analysis of 
verification denials revealed that most were a result of ignorance of 
the details of 38 CFR Part 74, rather than any attempt to defraud, the 
Request for Reconsideration process gave a firm a "second chance" if 
it modified its business model to fit the requirements of 38 CFR Part
74. As a result, firms that were denied were allowed to make legal 
changes to their official corporate or company documentation and then 
request reconsideration. It then enters a completely separate queue 
and since such firms are designated higher risk than an initial 
application, they received a new, comprehensive examination of all 
documentation and a review by VA's Office of General Counsel in many 
cases. 

VA recommended change: Replace the sentence with the following: "VA 
Officials told us that the agency prioritized its verification under 
the 2010 Act by reviewing (1) new applications for firms that had 
previously only self-certified in VetBiz (i.e., firms that had not 
been reviewed under processes created for the 2006 Act or 2010 Act); 
(2) new firms that had initially applied for verification after the 
2010 Act; (3) Requests for Reconsideration from firms denied 
verification; and 4) applications for firms initially verified in VIP 
under the process implemented for the 2006 Act." [See comment 8] 

Page 12, Paragraph 2, Line 3: "First, in July 2011, VA stated that it 
removed 8,000 of the 13,000 SDVOSBs and VOSBs listed in VetBiz because 
these firms had not complied with VA's December 2010 letter 
requesting..." 

VA Comment: This statement is misleading. The only firms removed in 
March 2011 were those 'pending' firms that did not respond to VA's 
December 2010 notification of CVE's new review process, elimination of 
inclusion in VIP based upon self-certification, and the requirement 
that all applicant firms submit documentation for the examination in 
order to participate in the VA Veterans First Program. The 8,000 non-
responsive firms were removed in March 2011. 

VA recommended change: Replace the aforementioned with the following 
language: "In July 2011, VA stated that it removed 8,100 unverified 
firms in March 2011 of the 13,000 SDVOSBs and VOSBs listed in VIP 
because these firms had not complied with the December 2010 
notification." [See comment 9] 

Page 12, Paragraph 2, Line 6: "On November 30, 2011, VA reported that 
it had removed all "unverified" firms from its database by September 
4, 2011." 

VA Comment: This statement is accurate. No firm appears in VIP unless 
it has been verified. For purposes of P.L. 109-461, VA has always 
interpreted 'verified' as any company that has been verified under 
either the P.L. 109-461 process of primarily public records review or 
under the full documentation review implemented upon passage of P.L. 
111-275. VA has never deviated from that position and all statements 
by VA leaders are consistent with that position. 

Page 12, Footnote 32, "...firms that were in fact ineligible for the 
program received approximately $16 million in VA SDVOSB set-aside and 
sole source contract obligations..." 

VA Comment: VA does not believe this to be a true statement. All firms 
receiving awards were listed in VIP based on verification of their 
eligibility under P.L. 109-461. 

VA recommended change: "...firms that were not verified under the 2010 
Act process received approximately $16 million in VA SDVOSB set-aside 
and sole source contract obligations..." [See comment 10] 

Page 13, Paragraph 1, Line 1: "... in February 2012, ... did not 
explain how many firms still needed to be verified." 

VA Comment: In February 2012, all firms in VIP had been verified, as 
reported by CVE. 

VA recommended change: Replace the end of the statement starting at 
"...did not explain how..." with "did not report how many firms were 
verified under the older process." [See comment 11] 

Page 13, Paragraph 1, Line 3: "Then, on April 23, 2012, officials told 
us that they had recently removed thousands of firms from VetBiz 
because these firms had not supplied the supporting documentation 
required for verification under the requirements of the 2010 Act... 
not clear whether these firms received the December 2010 request..." 

VA Comment: This statement is not correct. CVE removed 3,019 firms 
that had not supplied documentation to support reverification. To 
avoid overwhelming the system, CVE did not reach out to all firms 
needing to be reverified at once. None of the firms had received the 
December 2010 letter because they were all verified as eligible to 
participate in Veterans First at that time of the notification. 

As of May 6, 2012, all firms whose eligibility had expired had their 
status in VIP changed to "reverification." In this status, firms may 
bid on solicitations, but are not eligible to receive awards. They may 
be Fast Tracked through the verification process if they are the 
apparently successful offer or on a Veterans First contract 
solicitation. 

VA recommended change: Replace the section beginning at "...removed 
thousands ..." with "removed thousands of firms from VIP because they 
had not supplied supporting documentation required for reverification 
under the requirements of the 2010 Act... none of these firms received 
the December 2010 request." [See comment 12] 

Page 13, Paragraph 2, Line 1: "The most recent information we have 
from VA indicates that thousands of potentially ineligible firms 
remain listed in VetBiz because they have not been verified under the 
requirements of the 2010 Act." 

VA Comment: This statement is not accurate and is misleading. All 
firms in VIP have been verified and are eligible to receive a contract 
award with the exception of firms listed as "reverification." 
Verification is based on an evaluation at a particular point in time. 
All firms in VIP, regardless of when they were verified, have the 
potential to be ineligible. 

VA recommended change: Replace the sentence with the following: "The 
most recent information we have from VA indicates that thousands of 
firms verified under the old process remain listed in VetBiz." [See 
comment 13] 

Page 13, Paragraph 2, Line 4: "Of these 3,717 firms listed as eligible 
on April 1, 2012, 134 received a total of $90 million ... from 
November 30, 2011, to April 1, 2012. On May 14, 2012, VA told us that 
it removed 1,857 of these 3,717 SDVOSBs..." 

VA Comment: This statement is misleading. All the firms listed in VIP 
on April 1, 2012, were eligible to receive awards on that date. CVE 
removed 1,857 firms on May 14, 2012, because they did not respond to 
requests to undergo reverification. Since GAO did not investigate any 
of the 134 firms mentioned, VA has no basis to reverify them prior to 
expiration of their eligibility. 

VA recommended change: As all firms in VIP during that time period 
were eligible, this statement should be removed. [See comment 13] 

Page 14, Paragraph 1, Line 2: "According to VA, the remaining 1,860 
firms that require a review under the 2010 Act process are projected 
to be removed in July 2012 unless the firms provide adequate 
documentation supporting their eligibility. VA also stated that these 
firms are identified as being in "reverification" and no such expired 
firm is eligible for an actual contract award until reverification has 
been completed." 

VA Comment: This statement is not accurate due to the rule change in 
effect June 27, 2012. Specifically, the number 1,860 is no longer 
accurate. All firms whose two year eligibility period has expired are 
removed from VIP. If they have initiated reverification, they are 
listed as in "reverification" and are ineligible to receive a contract 
award. No expired firms are eligible to receive a contract award. [See 
comment 13] 

VA recommended change: Remove "1,860", as this number is no longer 
accurate based upon the rule change. 

Page 15, Figure 3: 

VA Comment: This figure is misleading. VA has provided documentation 
that VA considers it sufficient to close all of these recommendations. 
GAO has not provided any information to VA concerning what additional 
action is required for GAO to consider the recommendations to be 
closed. If GAO does not believe VA actions to be sufficient, VA 
requests that GAO provide VA information on what additional action is 
needed to close each recommendation. 

VA recommended change to Figure 3: VA recommends that GAO adjust the 
table to reflect VA action on each GAO recommendation. If VA action is 
not sufficient, include information in the table that shows progress 
VA has made on implementing each recommendation and information as to 
what VA needs to additionally provide in order for GAO to close each 
recommendation. [See comment 14] 

Page 18, Bullet one: "VA has not provided regular Fraud Awareness 
Training" 

VA Comment: This statement is not correct. As the report notes, the 
Office of General Counsel provides periodic training on verification 
criteria which includes discussion of fraud risk. 

VA recommended change: Close recommendation. [See comment 15] 

Page 19, Bullet one: "VA has not developed and implemented specific 
processes and criteria for the Debarment Committee on compliance with 
the requirement in the 2006 Act to debar, for a reasonable period, 
firms and related parties that misrepresent their SDVOSB status. 
According to VA, its Debarment Committee relies on procedures outlined 
in the FAR and the VA Acquisition Regulations to determine the length 
of debarments." 

VA Comment: Since each case must be adjudicated on its specific 
circumstances, developing a standardized chart for the length of 
debarment is implausible. The debarring official will base the period 
of debarment on the circumstances surrounding the cause for debarment. 
Specific procedures are contained in the VAAR. Subpart 809.406-3 
provides procedures for debarment and subpart 809.407-3 provides 
procedures for suspensions. VAAR subpart 809.406-2 (a) identifies 
causes for debarment and states; "misrepresentation of Veteran Owned 
Small Business (VOSB) or SDVOSB eligibility may result in action taken 
by VA officials to debar the business concern for a period not to 
exceed 5 years from contracting with VA as a prime contractor or a 
subcontractor." VAAR subpart 809.406-4 provides further guidance on 
the period of debarment by stating, "Except in an unusual 
circumstance, the period of debarment will not exceed 3 years." 

VA recommended change: Close recommendation. [See comment 16] 

Page 19, Bullet two: "VA has not developed specific guidelines 
outlining the Debarment Committee's decision process to debar firms 
that misrepresent their SDVOSB status. VA should provide the Debarment 
Committee with guidelines to aid its decision-making process in 
determining what constitutes a "misrepresentation" deserving of 
debarment, as that term is used in the 2006 Act." 

VA Comment: VA has provided guidance on the type of information needed 
and identified the standard being used (subpart 819.70) by the 
committee to initiate the process. Once received, VA evaluates each 
action on a case-by-case basis. A copy of the referral guidance can be 
found at [hyperlink, 
http://www.va.gov/oal/business/8127debarments.asp]. 

The 8127 Debarment Committee will only accept referrals from VA 
officials. All referrals must include sufficient supporting 
information to warrant review by the Committee, such as: 

* The allegation of misrepresentation as a VOSB or SDVOSB and/or the 
violation of the limitations on subcontracting requirements of actions 
awarded under VAAR Subpart 819.70; 

* The identity of business concerns involved in the allegations; 

* The identifying information for any solicitations or contractual 
actions relating to the allegations; 

* Copies of relevant documents that support the allegations; 

* Whether anyone else has reviewed the allegations, and if so, copies 
of those complaints or recommendations for debarment; and; 

* Contact information for the VA official making the recommendation. 

The 8127 Debarment Committee will not review unsupported allegations. 
The serious nature of debarment and suspension requires that these 
sanctions be imposed only in the public interest for the government's 
protection and not for purposes of punishment. 

The 8127 Debarment Committee uses as the guide to determine 
misrepresentation the following information from 38 U.S.C. Section 
8127(g): "Any business concern that is determined by the Secretary to 
have misrepresented the status of that concern as a small concern 
owned and controlled by Veterans or as a small business concern owned 
and controlled by service-disabled veterans for purposes of this 
subsection shall be debarred from contracting with the Department for 
a reasonable period of time, as determined by the Secretary." VAAR 
Subpart 809.406-2 (b) provides additional information on the causes of 
debarment; "any deliberate violation of the limitation on 
subcontracting clause requirements for acquisitions under VAAR subpart 
819.70 (Service-Disabled Veteran-Owned and Veteran-Owned Small 
Business Acquisition Program) may result in action taken by VA 
officials to debar any service-disabled veteran-owned, veteran-owned 
small business concern or any large business concern involved in such 
action." 

VA recommended change: Close recommendation. [See comment 17] 

Page 19, Bullet 3: "VA has not developed procedures on removing SDVOSB 
contracts from ineligible firms. According to the VA Acquisition 
Regulations, the Deputy Senior Procurement Executive has the authority 
to determine whether VA should terminate a contract with a debarred 
firm. However, VA has not developed procedures to remove SDVOSB 
contracts from ineligible firms. According to VA, it is in the process 
of developing a policy on removing SDVOSB contracts from ineligible 
firms as determined by status protests. In addition, VA is in the 
process of providing guidance to the acquisition workforce on removing 
SDVOSB contracts from ineligible firms. Until VA develops procedures 
on removing SDVOSB contracts from ineligible firms, the
SDVOSB program is at risk for ineligible firms to abuse the program 
and retain contracts obtained through fraud and abuse." 

VA Comment: VA has determined that contracting officers will follow 
the guidance for continuation of current contracts found in FAR 9.405-
1 and VAAR 809.405-1. No additional policy is required at this time. 

VA recommended change: Close recommendation. [See comment 18] 

Page 20, Bullet 1: "VA has not formalized procedures to advertise 
debarments and prosecutions. VA has not formalized procedures for 
advertising debarments and prosecutions, though the Debarment 
Committee, the OIG, and CVE have listed these actions on their 
websites." 

VA Comment: VA follows the procedures required in FAR 9.404 to 
advertise all suspensions and debarments in the Excluded Parties List 
System (EPLS), which is operated by the General Service Administration 
and is consulted by, and used by, all Federal agencies. In addition to 
EPLS, VA has developed its own Web site to specifically advertise (and 
emphasize) SDVOSB suspensions and debarments. Debarment actions can be 
found at [hyperlink, 
http://wvvw.va.gov/oal/business/8127debarmentActions.asp]. Further, as 
was previously provided, VA advertises debarments and prosecutions on 
the Web sites of the Debarment Committee, OIG, and CVE also formally 
posts debarments and prosecutions on VetBiz. 

VA recommended change: Close the recommendation. [See comment 19] 

GAO Comments: 

1. We clarified the report to indicate what the Department of Veterans 
Affairs (VA) Office of Inspector General (OIG) reported on its 
findings in 2011 and also to indicate that the report includes all 
firms in VetBiz, not just those verified under the Veterans Benefits, 
Health Care, and Information Technology Act of 2006 (2006 Act) 
process. The remainder of VA's comments related to the OIG report are 
inaccurate, based on our review of the report and discussions with 
VA's OIG staff. See the Agency Comments and Our Evaluation section of 
this report for more detail. 

2. In the final report, we deleted the draft report's discussion of 
information about the Center for Veterans Enterprise (CVE) being 
responsible for helping veterans who are interested in forming or 
expanding their own small businesses. 

3. Our report's characterization of the Veterans Small Business 
Verification Act (2010 Act), part of the Veterans' Benefits Act of 
2010, is correct and we did not make associated changes to the report. 
While VA's recommended change points out that VA removed firms that 
self-represented or had expired eligibility periods, these categories 
of firms are included by the "all unverified businesses" language in 
the existing report language. 

4. We deleted the sentence stating that SDVOSBs are required to 
receive a portion of government-wide contractual dollars annually. 

5. We have revised our draft report to note that according to VA, (1) 
the lack of a comprehensive case-management system has created the 
need for aggregate workarounds and resulted in inconsistent aggregate 
reporting, (2) the limitations of the case-management system make it 
difficult to track the inventory of firms, and (3) as the limitations 
of the case-management system increase over time, the potential of CVE 
to lose track of how many firms have been verified also increases. We 
also acknowledge VA's assertion that its verification priorities have 
evolved over time. However, not all of the conflicting statements VA 
made can be attributed to inadequacies in its case-management system 
or to evolving priorities. One of the many examples relates to the 
December 2010 request for documentation mentioned in the 2010 Act. 
Specifically, on April 23, 2012, VA told us that between late March 
2012 and early April 2012 it had removed over 3,000 SDVOSBs and VOSBs 
because these firms had failed to provide requested business 
documentation. We asked whether the firms removed in April 2012 had 
been sent this request. In response, VA told us that the firms removed 
in April 2012 did not receive the December 2010 document. Then on May 
12, 2012, VA told us the firms had in fact been sent the December 2010 
letter. Later, on June 20, 2012, VA told us that it did not send the 
December 2010 letter to all firms listed in VetBiz at the time to 
avoid a flood of applications. In its agency comments, VA states that 
the 2010 Act did not require it to send all firms listed in VetBiz in 
December 2010 a request for documentation if the firms had been 
verified under the 2006 Act and this verification had not yet expired. 

6. We revised the text in our draft report to more-clearly reflect 
that thousands of SDVOSBs listed as eligible in VetBiz received 
millions of dollars in contract obligations even though they had not 
been verified under the more-thorough process that VA implemented in 
response to the 2010 Act. VA's recommended changes also suggest that 
firms that were verified under the 2006 Act process could not be 
immediately reverified under the more-thorough 2010 Act process 
because, in addition to resource-allocation priorities, VA was limited 
by the requirements of 38 C.F.R. § 74.15(c). However, we note that VA 
has latitude under the law to modify its own regulations as necessary 
to ensure that only valid SDVOSBs are included in VetBiz. Furthermore, 
VA's recent decision to amend 38 C.F.R. § 74.15 and extend the VetBiz 
eligibility term from 1 year to 2 years appears to be a self-created 
impediment to ensuring all firms expeditiously undergo the more-
thorough 2010 Act process. 

7. We revised the text in our report to reflect that the 2010 Act 
required VA to notify all unverified firms about the need to apply for 
verification. 

8. The language VA objects to concerning VA's prioritization of 
verifications under the 2010 Act process is taken directly from 
documentation provided by VA during the course of our audit. 
Accordingly, we made no changes to the report. 

9. The language VA objects to concerning removal of firms is taken 
directly from oral and written statements made by VA during the course 
of our audit. Accordingly, we made no changes to the report. 

10. The firms mentioned in this footnote are related to one of the new 
cases we reviewed as a result of allegations we received from 
confidential informants. These firms were not verified under the 
process implemented under the 2010 Act and we determined that they 
were in fact ineligible for the SDVOSB program because the firms' 
operating agreements allowed the two minority owners to control the 
firms, rather than the service-disabled veteran. These firms received 
approximately $16 million in VA SDVOSB set-aside and sole-source 
contract obligations from October 2010 to December 2011. Accordingly, 
we made no changes to the report. 

11. We revised our report to make clear that we were referring to 
verification using the processes implemented under the 2010 Act. 

12. We received conflicting statements from VA as to which firms 
received the December 2010 notification later and have revised the 
text to clearly reflect this fact. 

13. We revised the text in our report to more-clearly reflect that 
thousands of potentially ineligible firms remain listed in VetBiz 
because they have not been verified under the more-thorough process 
implemented for the 2010 Act. While these firms have been verified 
under the 2006 Act process, past audits show the potential risk of 
providing SDVOSB contracts to firms reviewed under this process. VA's 
recommended change does not acknowledge this risk and is therefore 
incomplete. Moreover, our statements that were related to the number 
of firms not verified under the requirements of the 2010 Act, the 
dollar amounts those firms received, and the number of firms VA 
planned to remove were all supported by evidence and were accurate at 
the close of our audit work. We have clarified the report to indicate 
that fact and included information on the requirements of the interim 
final rule VA implemented on June 27, 2012. Specifically, in our final 
report we have noted that the rule extends a firm's eligibility period 
for 2 years. We also note that VA interprets "verified" to include any 
firm that has been verified under either the 2006 Act or 2010 Act 
processes, meaning that this rule will allow thousands of firms to 
remain eligible for contracts even though they have not undergone the 
more-thorough process implemented under the 2010 Act process. See the 
Agency Comments and Our Evaluation section of this report for a more-
thorough discussion of this issue. 

14. To this point, VA has not provided sufficient documentation to 
close the 7 recommendations that remain open. GAO will continue to 
work with VA to confirm the status of its efforts to address our 
recommendations and will close recommendations, as long as necessary 
supporting evidence is provided. 

15. Our report states that VA has made progress in the area of fraud-
awareness training. However, VA has not provided any documentation to 
show that fraud-awareness training is being provided on a regular 
basis, as we recommended. Our recommendation will remain open until 
necessary evidence to close it is provided. Accordingly, we have not 
changed the language in our report. 

16. The FAR and the VA Acquisition Regulations do not provide specific 
processes and criteria for the Debarment Committee on compliance with 
the requirement in the 2006 Act to debar, for a reasonable period of 
time, firms and related parties that misrepresented their SDVOSB 
status. VA should provide additional guidance to the Debarment 
Committee on the specific process and criteria to use to debar firms 
as required by the 2006 Act. Accordingly we have not changed the 
language in our report. 

17. The recommendation requested that VA develop specific guidelines 
outlining the Debarment Committee's decision process to debar firms 
that misrepresent their SDVOSB status. VA needs to provide supporting 
documentation demonstrating that VA provided the Debarment Committee 
with the guidance outlining the decision process to debar firms that 
misrepresent their SDVOSB status. Accordingly, we have not changed the 
language in our report. 

18. VA cites provisions of the FAR and the VA Acquisition Regulations 
containing guidance for continuing current contracts to firms that 
were found ineligible through the debarment process. However, our 
recommendation asked VA to develop procedures to remove SDVOSB 
contracts from ineligible firms. Accordingly, we have not changed the 
language in our report. 

19. Our report acknowledges that VA advertises the debarments and 
prosecutions on the Debarment Committee, VA OIG, and CVE websites. 
However, our recommendation specifically asked for VA to formalize 
procedures to advertise debarments and prosecutions, and we have not 
received any documentation related to such procedures. Accordingly, we 
have not changed the language in our report. 

[End of section] 

Related GAO Products: 

Service-Disabled Veteran-Owned Small Business Program: Governmentwide 
Fraud Prevention Control Weaknesses Leave Program Vulnerable to Fraud 
and Abuse, but VA Has Made Progress in Improving Its Verification 
Process. [hyperlink, http://www.gao.gov/products/GAO-12-443T]. 
Washington, D.C.: February 7, 2012. 

Service-Disabled Veteran-Owned Small Business Program: Additional 
Improvements to Fraud Prevention Controls Are Needed. [hyperlink, 
http://www.gao.gov/products/GAO-12-205T]. Washington, D.C.: November 
30, 2011. 

Service-Disabled Veteran-Owned Small Business Program: Additional 
Improvements to Fraud Prevention Controls Are Needed. [hyperlink, 
http://www.gao.gov/products/GAO-12-152R]. Washington, D.C.: October 
26, 2011. 

Service-Disabled Veteran-Owned Small Business Program: Preliminary 
Information on Actions Taken by Agencies to Address Fraud and Abuse 
and Remaining Vulnerabilities. [hyperlink, 
http://www.gao.gov/products/GAO-11-589T]. Washington, D.C.: July 28, 
2011. 

Department of Veterans Affairs: Agency Has Exceeded Contracting Goals 
for Veteran-Owned Small Businesses, but It Faces Challenges with Its 
Verification Program. [hyperlink, 
http://www.gao.gov/products/GAO-10-458]. Washington, D.C.: May 28, 
2010. 

Service-Disabled Veteran-Owned Small Business Program: Fraud 
Prevention Controls Needed to Improve Program Integrity. [hyperlink, 
http://www.gao.gov/products/GAO-10-740T]. Washington, D.C.: May 24, 
2010. 

Service-Disabled Veteran-Owned Small Business Program: Case Studies 
Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of 
Dollars in Contracts. [hyperlink, 
http://www.gao.gov/products/GAO-10-306T]. Washington, D.C.: December 
16, 2009. 

Service-Disabled Veteran-Owned Small Business Program: Case Studies 
Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of 
Dollars in Contracts. [hyperlink, 
http://www.gao.gov/products/GAO-10-255T]. Washington, D.C.: November 
19, 2009. 

Service-Disabled Veteran-Owned Small Business Program: Case Studies 
Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of 
Dollars in Contracts. [hyperlink, 
http://www.gao.gov/products/GAO-10-108]. Washington, D.C.: October 23, 
2009. 

[End of section] 

Footnotes: 

[1] Veterans Benefits Act of 2003, Pub. L. No. 108-183, § 308, 117 
Stat. 2651, 2662 (codified at 15 U.S.C. § 657f). 

[2] If the business is publicly owned, at least 51 percent of the 
stock must be held by one or more service-disabled veterans. The 
spouse or permanent caregiver of a veteran with a permanent and severe 
disability may also control the business. See 13 C.F.R. § 125.8(g). 

[3] GAO, Service-Disabled Veteran-Owned Small Business Program: Case 
Studies Show Fraud and Abuse Allowed Ineligible Firms to Obtain 
Millions of Dollars in Contracts, [hyperlink, 
http://www.gao.gov/products/GAO-10-108] (Washington, D.C.: Oct. 23, 
2009). 

[4] See the list of related GAO products at the end of this report. 

[5] Pub. L. No. 109-461, § 502, 120 Stat. 3403, 3431 - 3435 (codified 
as amended at 38 U.S.C. § 8127). 

[6] VA Office of Inspector General (OIG), Department of Veterans 
Affairs: Audit of Veteran-Owned and Service-Disabled Veteran-Owned 
Small Business Programs, 10-02436-234 (July 25, 2011). 

[7] Pub. L. No. 111-275, § 104, 124 Stat. 2864, 2867-2868 (amending 38 
U.S.C. § 8127). 

[8] GAO, Service-Disabled Veteran-Owned Small Business Program: 
Preliminary Information on Actions Taken by Agencies to Address Fraud 
and Abuse and Remaining Vulnerabilities, [hyperlink, 
http://www.gao.gov/products/GAO-11-589T] (Washington, D.C.: July 28, 
2011). 

[9] GAO, Service-Disabled Veteran-Owned Small Business Program: 
Additional Improvements to Fraud Prevention Controls Are Needed, 
[hyperlink, http://www.gao.gov/products/GAO-12-152R] (Washington, 
D.C.: Oct. 26, 2011). 

[10] VA OIG, Department of Veterans Affairs: Audit of Veteran-Owned 
and Service-Disabled Veteran-Owned Small Business Programs. 

[11] GAO, Standards for Internal Control in the Federal Government, 
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
(Washington, D.C.: Nov. 1999). 

[12] GAO, Service-Disabled Veteran-Owned Small Business Program: Fraud 
Prevention Controls Needed to Improve Program Integrity, [hyperlink, 
http://www.gao.gov/products/GAO-10-740T] (Washington, D.C.: May 24, 
2010). 

[13] DOD OIG, Inadequate Controls Over the DOD Service-Disabled 
Veteran-Owned Small Business Set-Aside Program Allow Ineligible 
Contractors to Receive Controls, 2012-059 (Feb. 29, 2012). 

[14] For our prior work, we selected cases on the basis of a variety 
of factors including facts and evidence provided in protests and 
allegations, whether a firm received multiple SDVOSB contracts, and 
whether a firm received other non-SDVOSB contracts. Our prior work was 
not designed to identify all firms that misrepresent themselves as 
SDVOSBs or commit fraudulent or abusive activity, and case examples 
could not be projected to the overall population of SDVOSB firms. 

[15] CCR is the primary registrant database for the U.S. federal 
government. CCR collects, validates, stores, and disseminates data in 
support of agency acquisition missions, including federal agency 
contract and assistance awards. 

[16] Suspension and debarment actions prevent companies and 
individuals from participating in government contracts, subcontracts, 
loans, grants, and other assistance programs. The effect of suspension 
and debarment by a federal agency is government-wide. Suspensions are 
temporary actions, effective immediately, which disqualify a company 
pending the completion of an investigation and generally do not last 
longer than 1 year. Debarments, which are imposed after an 
investigation, result in a set period of disqualification, but 
generally not greater than 3 years. 

[17] For the purposes of our investigation, we defined a case-study as 
one or more affiliated firms or joint ventures that obtained SDVOSB 
set-aside and sole-source contracts. These cases include multiple 
firms owned by an individual or multiple firms affiliated through 
joint ventures and other types of partner agreements. 

[18] ORCA is a Web-based system that centralizes and standardizes the 
collection, storage, and viewing of many Federal Acquisition 
Regulation (FAR) required representations and certifications. 

[19] The FPDS-NG is the central repository for capturing information 
on federal procurement actions. Dollar amounts reported by federal 
agencies to FPDS-NG represent the net amount of funds obligated and 
deobligated as a result of procurement actions. 

[20] LexisNexis' Accurint is a database that can provide information 
on people, businesses, assets and locations, including bankruptcy 
filings, liens and arrest records. 

[21] Some of the work in this report is based on prior GAO products 
issued in 2012, 2011, and 2009. GAO, Service-Disabled Veteran-Owned 
Small Business Program: Governmentwide Fraud Prevention Control 
Weaknesses Leave Program Vulnerable to Fraud and Abuse, but VA Has 
Made Progress in Improving Its Verification Process, [hyperlink, 
http://www.gao.gov/products/GAO-12-443T] (Washington, D.C.: Feb. 7, 
2012); Service-Disabled Veteran-Owned Small Business Program: 
Additional Improvements to Fraud Prevention Controls Are Needed, 
[hyperlink, http://www.gao.gov/products/GAO-12-205T] (Washington, 
D.C.: Nov. 30, 2011); [hyperlink, 
http://www.gao.gov/products/GAO-11-589T]; and [hyperlink, 
http://www.gao.gov/products/GAO-10-108]. 

[22] 15 U.S.C. § 632(x) and 48 C.F.R. § 4.1201. This provision, in 
addition to others in the Small Business Jobs Act of 2010, Pub. L. No. 
111-240, §§ 1341-1342, 124 Stat. 2504, 2543-2544, help facilitate the 
prosecution of firms that willfully seek and receive small-business 
awards through misrepresentation of their status, including SDVOSBs. 

[23] Once CVE verifies a business, it sends an approval letter to the 
firm. Under regulations first promulgated in 2008, firms retained 
their eligibility status for 1 year from the date of the letter. 
However, on June 27, 2012, VA issued updated regulations extending the 
eligibility period to 2 years before reverification is required. 

[24] 38 U.S.C. § 8127(g). 

[25] Government-wide, all prospective federal contractors must certify 
whether they are delinquent on certain federal tax debts. However, 
such delinquency may not result in an automatic disqualification from 
contracting eligibility, as it does in VA's VetBiz eligibility. 

[26] The federal government as a whole failed to reach the 3 percent 
goal in fiscal year 2010. 

[27] Veterans Entrepreneurship and Small Business Development Act of 
1999, Pub. L. No. 106-50, § 502, 113 Stat. 233, 247-248 (codified at 
15 U.S.C § 644 (g)(1)). 

[28] SBA calculates its SDVOSB total by including all small-business 
dollars awarded to SDVOSBs, not just those received through set-aside 
or sole-source contracts. 

[29] In 2012, DOD OIG reported that DOD contracting personnel 
incorrectly coded 137 fiscal year 2010 contracts, valued at 
approximately $1.3 billion, as SDVOSB awards. 

[30] In 2011, VA OIG reported that total fiscal year 2010 SDVOSB and 
VOSB procurement dollars may actually be lower than reported by VA. 

[31] See the list of related GAO products at the end of this report. 

[32] In one of our cases, firms that were in fact ineligible for the 
program received approximately $16 million in VA SDVOSB set-aside and 
sole-source contract obligations, $251,000 of which were new 
obligations, from October 2010 to December 2011. 

[33] We did not investigate these 134 firms to determine if they were 
in fact ineligible. 

[34] Dun and Bradstreet is a public company that licenses information 
on businesses and corporations. 

[35] The NAICS is the standard used by federal statistical agencies in 
classifying business establishments for the purpose of collecting, 
analyzing, and publishing statistical data related to the U.S. 
business economy. 

[36] The SDVOSB contract dollars reported include the four cases for 
which we were able to substantiate allegations of program 
ineligibility and one case for which we gathered enough evidence to 
indicate the case may be ineligible. 

[37] [hyperlink, http://www.gao.gov/products/GAO-10-108]. 

[38] DOD OIG, Inadequate Controls Over the DOD Service-Disabled 
Veteran-Owned Small Business Set-Aside Program Allow Ineligible 
Contractors to Receive Contracts, 2012-059 (Feb. 29, 2012). 

[39] [hyperlink, http://www.gao.gov/products/GAO-10-108]. 

[40] In 2011, GAO reported that SBA suspended four companies and three 
individuals associated with 2 of the 10 case-studies. Since then these 
suspensions have expired. 

[41] The HUBZone program was established to provide federal 
contracting preferences to small businesses operating in economically 
distressed communities. 

[End of section] 

GAO’s Mission: 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the 
performance and accountability of the federal government for the 
American people. GAO examines the use of public funds; evaluates 
federal programs and policies; and provides analyses, recommendations, 
and other assistance to help Congress make informed oversight, policy, 
and funding decisions. GAO’s commitment to good government is 
reflected in its core values of accountability, integrity, and 
reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each 
weekday afternoon, GAO posts on its website newly released reports, 
testimony, and correspondence. To have GAO e-mail you a list of newly 
posted products, go to [hyperlink, http://www.gao.gov] and select 
“E-mail Updates.” 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of 
production and distribution and depends on the number of pages in the 
publication and whether the publication is printed in color or black 
and white. Pricing and ordering information is posted on GAO’s 
website, [hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional 
information. 

Connect with GAO: 

Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov]. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; 
E-mail: fraudnet@gao.gov; 
Automated answering system: (800) 424-5454 or (202) 512-7470. 

Congressional Relations: 

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400
U.S. Government Accountability Office, 441 G Street NW, Room 7125
Washington, DC 20548. 

Public Affairs: 
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, DC 20548.