This is the accessible text file for GAO report number GAO-09-440 
entitled 'HubZone Program: Fraud and Abuse Identified in Four 
Metropolitan Areas' which was released on March 25, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairwoman, Committee on Small Business, House of 
Representatives: 

United States Government Accountability Office: 
GAO: 

March 2009: 

HubZone Program: 

Fraud and Abuse Identified in Four Metropolitan Areas: 

GAO-09-440: 

GAO Highlights: 

Highlights of GAO-09-440, a report to Chairwoman, Committee on Small 
Business, House of Representatives. 

Why GAO Did This Study: 

The Small Business Administration’s (SBA) Historically Underutilized 
Business Zone (HUBZone) program provides federal contracting assistance 
to small firms located in economically distressed areas, with the 
intent of stimulating economic development. In July 2008, GAO 
identified substantial vulnerabilities in SBA’s application and 
monitoring process that demonstrated the HUBZone program is vulnerable 
to fraud and abuse. GAO also investigated 10 case studies of HUBZone 
firms in the Washington, D.C., area that misrepresented their 
eligibility. 

GAO was asked to determine (1) whether additional cases of fraud and 
abuse exist outside of the Washington, D.C., area; (2) what actions, if 
any, SBA has taken to establish an effective fraud prevention program 
for the HUBZone program; and (3) what actions, if any, SBA took against 
the 10 case study firms in GAO’s July 2008 testimony. 

To meet these objectives, GAO identified selected HUBZone firms based 
on certain criteria, such as magnitude of HUBZone contracts and firm 
location. GAO also interviewed SBA officials and reviewed SBA data. 

What GAO Found: 

GAO found that fraud and abuse in the HUBZone program extends beyond 
the Washington, D.C., area. GAO identified 19 firms in Texas, Alabama, 
and California participating in the HUBZone program that clearly do not 
meet program requirements (i.e., principal office location or 
percentage of employees in HUBZone and subcontracting limitations). For 
example, one Alabama firm listed its principal office as “Suite 19,” 
but when GAO investigators performed a site visit they found the office 
was in fact trailer 19 in a residential trailer park. The individual 
living in the trailer had no relationship to the HUBZone firm. In 
fiscal years 2006 and 2007, federal agencies obligated nearly $30 
million to these 19 firms for performance as the prime contractor on 
HUBZone contracts and a total of $187 million on all federal contracts. 
The map below illustrates the geographical locations for the cases we 
examined. 

Figure: GAO Case Study Locations of Fraud and Abuse in the HUBZone 
Program: 

[Refer to PDF for image: maps] 

Locations: 
Huntsville, Alabama; 
San Diego, California; 
Dallas, Texas. 

Source: GAO. 

[End of figure] 

Although SBA has initiated steps in strengthening its internal controls 
as a result of GAO’s 2008 testimonies and report, substantial work 
remains for incorporating a fraud prevention system that includes 
effective fraud controls consisting of (1) front-end controls at the 
application stage, (2) fraud detection and monitoring of firms already 
in the program, and (3) the aggressive pursuit and prosecution of 
individuals committing fraud. In addition, SBA did not adequately field 
test its interim process for processing applications. If it had done 
so, SBA would have known that it did not have the resources to 
effectively carry out its review of applications in a timely manner. As 
a result, SBA had a backlog of about 800 HUBZone applications as of 
January 2009. At that time, SBA’s interim application process was 
taking about 6 months—well over its 1-month goal set forth in SBA 
regulations.  

SBA has taken some enforcement steps on the 10 firms previously 
identified by GAO that knowingly did not meet HUBZone program 
requirements. However, SBA’s failure to promptly remove firms from the 
HUBZone program and examine some of the most egregious cases from GAO’s 
July 2008 testimony has resulted in an additional $7.2 million in 
HUBZone obligations and about $25 million in HUBZone contracts to these 
firms. For example, a construction firm from the July 2008 testimony 
admitted that it did not meet HUBZone requirements and was featured in 
several national publications by name. It has continually represented 
itself as HUBZone certified and has received $2 million in HUBZone 
obligations and a $23 million HUBZone set-aside contract since the July 
2008 testimony. 

What GAO Recommends: 

GAO makes four recommendations to improve SBA’s ability to screen, 
monitor, and investigate fraud and abuse within the HUBZone program. 
SBA agreed with three of them. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.gao.gov/products/GAO-09-440]. For more 
information, contact Greg Kutz at (202) 512-6722 or kutzg@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

Selected Case Studies of Fraud and Abuse Outside the Washington, D.C., 
Metro Area: 

SBA Has Initiated Steps to Address Internal Control Deficiencies but 
Has Not Incorporated Effective Fraud Controls: 

SBA Has Initiated Some Enforcement Actions Against 10 HUBZone Firms 
Previously Investigated by GAO: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Additional Case Studies of HUBZone Firms That Did Not Meet 
Program Eligibility Requirements: 

Appendix II: Comments from the Small Business Administration: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: HUBZone Firms Making Fraudulent or Inaccurate Representations: 

Table 2: SBA Actions on 10 HUBZone Firms Previously Investigated by 
GAO: 

Table 3: HUBZone Firms Making Fraudulent or Inaccurate Representations: 

Figures: 

Figure 1: Locations of Selected HUBZone Firms That Do Not Meet Program 
Requirements: 

Figure 2: Principal Office for Case Study 2 Firm: 

Figure 3: Mailbox of Purported Principal Office for Case Study 2 Firm: 

Figure 4: Fraud Prevention Model: 

Figure 5: Reproduction of Web Site Banner for Firm SBA Has Yet to 
Investigate: 

Abbreviations: 

CCR: Central Contractor Registration: 

FAR: Federal Acquisition Regulation: 

FPDS-NG: Federal Procurement Data System-Next Generation: 

HUBZone: Historically Underutilized Business Zone: 

ORCA: Online Representations and Certifications Application: 

SBA: Small Business Administration: 

SDO: Suspension and Debarment Official: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

March 25, 2009: 

The Honorable Nydia M.Velazquez: 
Chairwoman: 
Committee on Small Business: 
House of Representatives: 

Dear Madam Chairwoman: 

Created in 1997, the Historically Underutilized Business Zone (HUBZone) 
program provides federal contracting assistance to small businesses in 
economically distressed communities, or HUBZone areas, with the intent 
of stimulating economic development in those areas. In fiscal year 
2007, federal agencies awarded contracts valued at about $8 billion to 
HUBZone firms. The Small Business Administration (SBA) administers the 
HUBZone program, one of several contracting assistance programs that 
the agency oversees. Firms that participate in the program must be 
located in a HUBZone and employ residents of HUBZones to facilitate the 
goal of bringing capital and employment opportunities to distressed 
areas. 

On July 17, 2008, we testified before this Committee that SBA's lack of 
controls over the HUBZone program exposed the government to fraud and 
abuse[Footnote 1] and that SBA's mechanisms to certify and monitor 
HUBZone firms provide limited assurance that only eligible firms 
participate in the program.[Footnote 2] In our testimony, we identified 
10 firms from the Washington, D.C., metro area that were participating 
in the HUBZone program even though they clearly did not meet 
eligibility requirements. Of the 10 firms, 6 did not meet both 
principal office and employee residency requirements while 4 met the 
principal office requirements but significantly failed the employee 
residency requirement. We reported in our July 2008 testimony, that 
federal agencies had obligated a total of nearly $26 million in HUBZone 
contract obligations to these 10 firms since 2006. In addition, federal 
agencies obligated more than $105 million to these 10 firms for 
performance as the prime contractor on all federal contracts since 
2006. 

Subsequent to the hearing, you requested that we perform a follow-on 
investigation. Specifically, you asked us to determine (1) whether 
cases of fraud and abuse in the program exist outside of the 
Washington, D.C. metropolitan area; (2) what actions, if any, SBA has 
taken to establish an effective fraud prevention system for the HUBZone 
program; and (3) what actions, if any, SBA has taken on the 10 firms 
that we found misrepresented their HUBZone status in July 2008. 

To determine whether cases of fraud and abuse exist for firms located 
outside of the Washington, D.C. metropolitan area, we first obtained 
and analyzed a list of HUBZone firms from the SBA's Dynamic Small 
Business Search database as of September 2008.[Footnote 3] We then 
obtained federal procurement data from the Federal Procurement Data 
System-Next Generation (FPDS-NG) for fiscal years 2006 and 2007. 
[Footnote 4] We assessed the reliability of the data and determined 
that they were sufficiently reliable for the purposes of our 
investigation. We analyzed the data to identify (1) geographical 
locations that have both small fragments of HUBZone areas within a 
metropolitan area, and (2) high concentrations of HUBZone firms that 
reported obligations on HUBZone prime contracts totaling more than 
$250,000 during fiscal years 2006 and 2007. Using the above criteria, 
we selected four geographical areas for analysis: Dallas, Texas; 
Huntsville, Alabama; San Antonio, Texas; and San Diego, California. 
Within those four geographical areas, there were 36 firms that met our 
criteria for further investigation. The firms selected as case studies 
and the federal obligations associated with those firms did not include 
subcontracts that they may have received. Such information was not 
readily available. We conducted site visits for all 36 selected firms 
and used investigative methods --such as interviewing firm managers, 
analyzing firm payroll documents, and reviewing information from 
investigative databases --to gather information about the firms and to 
determine whether the firms met HUBZone requirements for principal 
office and 35 percent residency. We also reviewed information about 
each firm from the Online Representations and Certifications 
Application (ORCA) Web site.[Footnote 5] In the course of our 
investigations, we found instances of HUBZone firms that did not expend 
at least 50 percent of the personnel costs of a contract on their own 
personnel. Although our review was not designed to evaluate this 
requirement, we did report those instances that we discovered in this 
report. 

To determine what actions, if any, SBA has taken to reduce fraud and 
abuse in the program as well as the actions SBA has taken on the 10 
firms that we found misrepresented their HUBZone status, we interviewed 
SBA officials from the Office of Inspector General, HUBZone Program 
Office, and the SBA General Counsel. We obtained and reviewed 
supporting documentation where appropriate. We also reviewed SBA's 
Dynamic Small Business Web site to determine the current HUBZone status 
of the 10 firms we identified in our July 2008 testimony. 

Our work was not designed to identify all fraud and abuse in the 
HUBZone program or estimate its full extent for the entire population 
of HUBZone firms. In addition, our work was not designed to determine 
whether the selected firms we investigated committed fraud when 
originally applying for HUBZone status or receiving a HUBZone contract 
award, but rather if selected HUBZone firms are currently meeting 
HUBZone requirements. We conducted our investigation from September 
2008 through March 2009 in accordance with quality standards for 
investigations as set forth by the President's Council on Integrity and 
Efficiency. 

Background: 

The HUBZone program was established by the HUBZone Act of 1997 to 
stimulate economic development through increased employment and capital 
investment by providing federal contracting preferences to small 
businesses in economically distressed communities.[Footnote 6] These 
areas, which are designated based on certain economic and census data, 
are known as HUBZones. As of January 2009, there were approximately 
9,300 firms listed in the Central Contractor Registration database as 
participating in the HUBZone program.[Footnote 7] To ensure HUBZone 
areas receive the economic benefit from the program, SBA is responsible 
for determining whether firms meet HUBZone program requirements. To 
participate in the HUBZone program, small business firms generally must 
meet certain criteria established by the SBA, most notably: (1) the 
firm must be at least 51 percent owned and controlled by one or more 
U.S. citizens; (2) at least 35 percent of its employees must live in a 
HUBZone; (3) the principal office (i.e., the location where the 
greatest number of qualifying employees perform their work) must be 
located in a HUBZone; and (4) the firm must qualify as a small business 
under the size standard that corresponds with its primary industry 
classification. In addition, once a firm receives a HUBZone contract, 
the firm is required to abide by certain subcontracting limitations, 
which for most firms is to expend at least 50 percent of the personnel 
costs of a contract on their own employees or employees of other 
qualified HUBZone small business concerns.[Footnote 8] 

The SBA is legally responsible for ensuring that program participants 
meet program requirements.[Footnote 9] If a HUBZone firm does not meet 
program requirements or fails to notify the SBA of material changes 
that affect the firm's HUBZone eligibility, the SBA may use a variety 
of enforcement tools against the firm. Depending on the severity of the 
infraction, SBA can (1) decertify and remove the firm from the list of 
qualified HUBZone firms, (2) suspend and/or debar the firm from all 
federal contracts, and/or (3) refer the firm to the Department of 
Justice for civil and/or criminal prosecution. 

In July 2008, we testified that SBA's lack of controls over the HUBZone 
program exposed the government to fraud and abuse.[Footnote 10] 
Specifically, we identified substantial vulnerabilities in SBA's 
application and monitoring process by demonstrating the ease of 
obtaining HUBZone certification. For example, by using fictitious 
employee information and fabricated documentation, we easily obtained 
HUBZone certification for four bogus firms. In addition, we also 
identified 10 firms from the Washington, D.C., metro area that were 
participating in the HUBZone program even though they clearly did not 
meet eligibility requirements. 

In June 2008, we reported that the Small Business Administration needed 
to take additional actions to certify and monitor HUBZone firms as well 
as to assess the results of the HUBZone program.[Footnote 11] 
Specifically, we found that the map SBA used to publicize qualified 
HUBZone areas was inaccurate. In addition, we found that the mechanisms 
that SBA used to certify and monitor HUBZone firms did not meet federal 
internal control standards and provided limited assurance that only 
eligible firms participated in the program. For example, SBA verified 
the information reported by firms on their application or during 
recertification--its process for monitoring firms--in limited instances 
and did not follow its own policy of recertifying all firms every 3 
years. In the report, we made five recommendations designed to improve 
SBA's administration and oversight of the HUBZone program. We 
recommended that SBA correct and update its HUBZone map, develop and 
implement guidance to ensure more routine verification of application 
data, eliminate its backlog of recertifications, formalize and adhere 
to a specific time frame for decertifying ineligible firms, and further 
assess the effectiveness of the program. In responding to a draft of 
this report, SBA agreed with these recommendations and outlined steps 
that it plans to take to address them. 

Selected Case Studies of Fraud and Abuse Outside the Washington, D.C., 
Metro Area: 

HUBZone program fraud and abuse continues to be problematic for the 
federal government. We identified 19 firms in the states of Texas, 
Alabama, and California participating in the HUBZone program even 
though they clearly do not meet program requirements.[Footnote 12] 
Although we cannot conclude whether this is a systemic problem based on 
these cases, as shown in figure 1 below, the issue of misrepresentation 
clearly extends beyond the Washington, D.C., metropolitan area. In 
fiscal years 2006 and 2007, federal agencies had obligated a total of 
nearly $30 million to these firms for performance as the prime 
contractor on federal HUBZone contracts.[Footnote 13] 

Figure 1: Locations of Selected HUBZone Firms That Do Not Meet Program 
Requirements: 

[Refer to PDF for image: map of the United States] 

Locations: 
Huntsville, Alabama; 
San Diego, California; 
Dallas, Texas. 

Source: GAO. 

[End of figure] 

HUBZone regulations also place restrictions on the amount of work that 
can be subcontracted to non-HUBZone firms. Specifically, HUBZone 
regulations generally require firms to expend at least 50 percent of 
the personnel costs of a contract on its own employees. As part of our 
investigative work, we found examples of service firms that 
subcontracted a substantial majority of HUBZone contract work to other 
non-HUBZone firms and thus did not meet this program requirement. When 
a firm subcontracts the majority of its work to other non-HUBZone firms 
it is undermining the HUBZone program's stated purpose of stimulating 
development in the economically distressed areas, as well as evading 
eligibility requirements for principal office and 35 percent residency 
requirement. 

According to HUBZone regulations, persons or firms are subject to 
criminal penalties for knowingly making false statements or 
misrepresentations in connection with the HUBZone program including 
failure to correct "continuing representations" that are no longer 
true. During the application process, applicants are not only reminded 
of the program eligibility requirements, but are required to agree to 
the statement that anyone failing to correct "continuing 
representations" shall be subject to fines, imprisonment, and 
penalties. Further, the Federal Acquisition Regulation (FAR) requires 
all prospective contractors to update the government's Online 
Representations and Certifications Application (ORCA), which includes a 
statement certifying whether the firm is currently a HUBZone firm and 
that there have been "no material changes in ownership and control, 
principal office, or HUBZone employee percentage since it was certified 
by the SBA." Of the 19 firms that did not meet HUBZone eligibility 
requirements, we found that all of them continued to represent 
themselves as eligible HUBZone interests to SBA. Because the 19 case 
examples clearly are not eligible, we consider each firm's continued 
representation indicative of fraud and/or abuse related to this 
program. 

Table 1 highlights 10 firms that we found to be egregiously out of 
compliance with HUBZone program requirements. Appendix I provides 
details on the other 9 cases that we examined. We will be referring all 
19 firms to SBA for further investigation and consideration for removal 
from the program. 

Table 1: HUBZone Firms Making Fraudulent or Inaccurate Representations: 

Case: 1; 
Location: Fort Worth, TX; 
Primary product or service: Environmental Consulting; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $2,310,000; (Department of the Army); 
Case details: 
* Firm subcontracted the majority of the work to non-HUBZone firms. 
Although HUBZone firms are required to expend at least 50 percent of 
personnel costs performing HUBZone contracts, we determined that this 
firm has performed between 11 percent and 29 percent of the work on its 
various contracts to date; 
* Firm bid on and accepted large HUBZone set-aside contracts even 
though it did not have the capability to perform them without 
significant subcontracting; 
* Owner stated that HUBZone firms are being used as "contract vehicles" 
for large contracts. 

Case: 2; 
Location: Jacksonville, AL; 
Primary product or service: Furniture/Grounds Maintenance; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $920,000; (Department of the Army); 
Case details: 
* Firm did not meet principal office requirement; 
* Site visit to listed principal office found a residential trailer 
located in a trailer park. No employees were present. Utility and mail 
forwarding records indicate that no employees worked or lived at the 
listed principal office for over a year; 
* Firm did not meet 35 percent residency requirement because none of 
the employees live in a HUBZone; 
* Firm president admitted that his firm subcontracted the majority of 
work to other firms or individuals, violating the requirement to expend 
at least 50 percent of personnel costs using its own employees; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
February 2008. 

Case: 3; 
Location: Arlington, TX; 
Primary product or service: General Contractor; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $1,240,000; (Department of Housing and Urban Development); 
Case details: 
* Firm did not meet principal office requirement; 
* Multiple site visits to listed principal office revealed only 1 out 
of the firm's 33 employees were working at that location; 
* Company provided documents confirmed that the majority of employees 
worked at non-HUBZone locations; 
* Firm met 35 percent residency requirement; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
April 2008. 

Case: 4; 
Location: Huntsville, AL; 
Primary product or service: Information Technology; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $5,020,000; (Departments of the Army and Navy); 
Case details: 
* Firm did not meet principal office requirement; 
* Site visit to listed principal office revealed no employees were 
working at the location; 
* The office where the majority of employees worked was not in a 
HUBZone; 
* President of firm admitted that they were not in compliance with the 
principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 18 of the firm's 116 employees (16 percent) 
lived in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 5; 
Location: Huntsville, AL; 
Primary product or service: Information Technology/General Contractor; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $2,450,000; (Department of the Army); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 8 of the firm's 74 employees (11 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 6; 
Location: Dallas, TX; 
Primary product or service: Janitorial; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $560,000; (Department of the Army and General Services 
Administration); 
Case details: 
* Firm did not meet principal office requirement because multiple site 
visits to the listed principal office revealed firm no longer occupied 
this location; 
* Firm met 35 percent residency requirement; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
April 2008. 

Case: 7; 
Location: San Antonio, TX; 
Primary product or service: Medical Laboratories; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $250,000; (Department of the Air Force); 
Case details: 
* Firm did not meet principal office requirement; 
* Visit to the company's listed principal office revealed that the 
location was operated by the principal, but was a study lab operating 
under a different name. Company website indicates this location is a 
"satellite" lab; 
* Company maintains another, larger lab that is not located in a 
HUBZone; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 2 of the firm's 7 employees (29 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
October 2007. 

Case: 8; 
Location: Birmingham, AL; 
Primary product or service: Medical Services and Support; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $2,220,000; (Department of the Air Force); 
Case details: 
* Firm did not meet principal office requirement; 
* Site visit to listed principal office revealed no employees were 
working at the location; 
* The office where the majority of employees worked was not in a 
HUBZone; 
* Manager admitted that listed principal office is only used for 
proposal writing and that the majority of their time is spent in an 
office which is not located in a HUBZone area; 
* Manager admitted that they only keep listed principal office to meet 
HUBZone requirements; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 1 of the firm's 11 employees (9 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
October 2008. 

Case: 9; Location: 
Huntsville, AL; 
Primary product or service: Military Logistics and Maintenance; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $580,000; (Department of the Army); 
Case details: 
* Firm did not meet principal office requirement because the majority 
of company staff worked in an office that was not located in a HUBZone; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 13 of the firm's 53 employees (25 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 10; 
Location: San Antonio, TX; 
Primary product or service: Support Services for Facility; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $350,000; (Departments of the Army and Air Force); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because the firm's 
president, who was the only employee, did not live in a HUBZone. 
President of firm stated that the firm does not have employees to carry 
out its work but instead uses "leased employees." SBA's regulations 
state that leased employees do not count as employees for purposes of 
the HUBZone program[B]; 
* Firm does not have a current ORCA certification. 

Source: GAO analysis of FPDS, ORCA, CCR and contractor data. 

[A] Obligation amounts are rounded to the nearest $10,000. 

[B] 13 C.F.R. § 126.103. 

[End of table] 

The following is a more detailed description of fraud and abuse from 3 
of the cases that we investigated. 

Case Study 1: Our investigation clearly showed that this firm was being 
used as a front company because it was subcontracting the majority of 
its work to other firms. This firm is located in Fort Worth, Texas, and 
violated HUBZone program requirements because it did not expend at 
least 50 percent of personnel costs on its own employees or by using 
the personnel of other HUBZone firms as required by federal 
regulations. [Footnote 14] This firm, which consists of 8 employees, 
has obtained millions of dollars in HUBZone contracts to provide 
environmental consulting services. At the time of our investigation, 
company documents showed that the company was subcontracting between 71 
and 89 percent of its total contract obligations to other non-HUBZone 
firms--in some cases, large firms. The principal admitted that her firm 
was not meeting contract performance requirements required by HUBZone 
regulations. Further, the principal stated that the firm made bids on 
HUBZone contracts knowing that the company would have to subcontract 
work to other firms after the award. The principal added that other 
large firms use HUBZone firms in this manner, referring to these 
HUBZone firms as "contract vehicles." 

By subcontracting the majority of its HUBZone work to non-HUBZone 
firms, this firm is clearly abusing its HUBZone designation and 
undermining the HUBZone program's stated purpose of stimulating small 
business development in economically distressed areas. Likewise, 
because the subcontracting is being conducted by non-HUBZone firms this 
firm is also evading eligibility requirements for principal office and 
the 35 percent residency requirement. This firm has been obligated over 
$2.3 million in HUBZone set-asides during fiscal years 2006 and 2007. 

Case Study 2: Our investigation demonstrated that this firm continued 
to misrepresent itself as HUBZone-eligible while failing to meet 
HUBZone requirements.[Footnote 15] This firm, which is a two-person-- 
father and son--ground maintenance services company located in 
Jacksonville, Alabama, did not meet the principal office requirement, 
failed the 35 percent residency requirement, and served as a front 
company--subcontracting most of its HUBZone work to non-HUBZone firms. 
Our investigation found that the purported principal office was in fact 
a residential trailer in a trailer park. As shown in figure 2 below, 
the "suite number" of the principal office provided to SBA was actually 
the trailer number. 

Figure 2: Principal Office for Case Study 2 Firm: 

[Refer to PDF for image: photograph] 

Photo of trailer number 19. 

Source: GAO. 

[End of figure] 

The president of the company claimed that the trailer is the principal 
office and that an employee lived at that trailer. However, our 
investigation found that the president knowingly misrepresented and 
concealed material facts to a GAO investigator. We found that both 
employees live in non-HUBZone areas that are located about 90 miles 
from the trailer. Additionally, we verified that the trailer is 
occupied by someone not associated with the company. Further, our 
investigation found that neither employee lived in, nor worked at, the 
residential trailer since August 2007.[Footnote 16] Specifically, the 
U.S. Postal Service provided us a copy of the change of address form 
dated August 2007 that instructed the Postal Service to forward all 
mail from the trailer to another office in Birmingham, Alabama, which 
is not located in a HUBZone area. In addition, we obtained utility bill 
information that indicated that the last utility bill was paid by the 
firm in August 2007. According to DSBS, SBA most recently certified the 
firm at this address in April 2008.[Footnote 17] 

During the course of our investigation, this firm provided 
investigators with questionable documents in an attempt to make the 
residential trailer appear to be their actual principal office. As 
figure 3 shows, after our original interview with the president, we 
found that a new mailbox with the company name had been installed next 
to other mailboxes in the trailer park to give the perception that the 
firm resided at this trailer park. 

Figure 3: Mailbox of Purported Principal Office for Case Study 2 Firm: 

[Refer to PDF for image: photograph] 

Line of mailboxes with number 32 highlighted. 

Source: GAO. 

[End of figure] 

Despite the evidence that this firm had not paid utility bills or 
received mail at this location for over a year, the firm president also 
provided us with a "rental agreement" stating that their company was 
renting the trailer until June 2009. The authenticity of this "rental 
agreement" is highly suspicious given the evidence we gathered and our 
confirmation that an individual not related to the company was living 
in the trailer. 

For fiscal years 2006 and 2007, this firm received more than $900,000 
in HUBZone set-aside obligations. 

Case Study 4: We determined that during the period of our investigation 
this firm represented itself as HUBZone certified while failing to meet 
both the 35 percent residency and principal office HUBZone eligibility 
requirements. This firm, which is located in Huntsville, Alabama, and 
provides information technology services, self-certified in ORCA in 
July 2008 that it was a HUBZone firm and that there had been "no 
material changes in ownership and control, principal office, or HUBZone 
employee percentage since it was certified by the SBA." The firm was 
certified by the SBA as a HUBZone firm in June 2002. 

Based on our review of payroll records and written correspondence that 
we received from the firm, we determined that the firm failed the 35 
percent HUBZone residency requirement. These documents indicated that 
only 18 of 116 (16 percent) of the firm's employees who were employed 
in December 2007, lived in HUBZone-designated areas. To have met the 35 
percent residency requirement, the firm would have needed at least 41 
employees residing in HUBZone-designated areas, thus, the firm did not 
meet this requirement by 23 employees. 

In addition, we investigated the location that the firm purported to 
the SBA as its "principal office." Our investigation found that no 
employees were located at this office. Additional investigative work 
revealed that the firm's primary office was not located in a HUBZone. 
During the interview, the firm's president acknowledged that he "had 
recently become aware" that he was not in compliance with HUBZone 
requirements and was taking "corrective actions." However, the firm 
continued to represent itself as a HUBZone firm even after the firm's 
president acknowledged his company did not meet the program 
requirements. 

Based on our analysis of FPDS-NG data, between fiscal years 2006 and 
2007 federal agencies obligated over $5.0 million in HUBZone awards to 
this firm, consisting mainly of 2 HUBZone set-aside contracts by the 
Department of the Navy. 

SBA Has Initiated Steps to Address Internal Control Deficiencies but 
Has Not Incorporated Effective Fraud Controls: 

Our June 2008 report and July 2008 testimony clearly showed that SBA 
did not have effective internal controls related to the HUBZone 
program. In response to our findings and recommendations, SBA initiated 
a process of reengineering the HUBZone program. SBA officials stated 
that this process is intended to make improvements to the program that 
are necessary for making the program more effective while also 
minimizing fraud and abuse. To that end, SBA has hired business 
consultants as well as reached out to GAO in an attempt to identify 
control weaknesses in the HUBZone program and to strengthen its fraud 
prevention controls. 

Although SBA has initiated steps to address internal control 
deficiencies we identified in our June 2008 report, SBA has not yet 
incorporated effective controls for preventing, detecting, and 
investigating fraud and abuse within the HUBZone program. Internal 
controls comprise the plans, methods, and procedures used to meet 
missions, goals, and objectives and also serve as the first line of 
defense in safeguarding assets and preventing and detecting errors and 
fraud.[Footnote 18] Fraud prevention, on the other hand, requires a 
system of rules, which, in their aggregate, minimize the likelihood of 
fraud occurring while maximizing the possibility of detecting any 
fraudulent activity that may transpire. Fraud prevention systems set 
forth what actions constitute fraudulent conduct and specifically spell 
out who in the organization handles fraud matters under varying 
circumstances. The potential of being caught most often persuades 
likely perpetrators not to commit the fraud. Because of this principle, 
the existence of a thorough fraud prevention system is essential to 
fraud prevention and detection.[Footnote 19] 

As of the end of our field work, SBA does not have in place the key 
elements of an effective fraud prevention system. As shown in figure 4 
below, a well-designed fraud prevention system (which can also be used 
to prevent waste and abuse) should consist of three crucial elements: 
(1) upfront preventive controls, (2) detection and monitoring, and (3) 
investigations and prosecutions. For the HUBZone program this would 
mean (1) front-end controls at the application stage, (2) fraud 
detection and monitoring of firms already in the program, and (3) the 
aggressive pursuit and prosecution of individuals committing fraud. In 
addition, as shown in figure 4, the organization should also use 
"lessons learned" from its detection and monitoring controls and 
investigation and prosecutions to design more effective preventive 
controls. 

Figure 4: Fraud Prevention Model: 

[Refer to PDF for image: illustration] 

Fraud Prevention Model: 

Potential fraud, waste, and abuse: 
Preventive controls: 
Potential fraud, waste, and abuse (smaller amount): 
Detection and monitoring (lessons learned influence future use of 
preventive controls): 
Potential fraud (smaller amount): 
Investigations and prosecutions (lessons learned influence future use 
of preventive controls). 

Source: GAO. 

[End of figure] 

We explain the three major fraud prevention elements in this model and 
how SBA is attempting to address them, in further detail below. 

Preventive Controls: 

We have previously reported that fraud prevention is the most efficient 
and effective means to minimize fraud, waste, and abuse.[Footnote 20] 
Thus, controls that prevent fraudulent firms and individuals from 
entering the program in the first place are the most important element 
in an effective fraud prevention program. The most crucial element of 
effective fraud prevention controls is a focus on substantially 
diminishing the opportunity for fraudulent access into the system 
through front-end controls. Preventive controls should be designed to 
include, at a minimum, a requirement for data validation, system edit 
controls, and fraud awareness training. Prior to implementing any new 
preventive controls, agencies must adequately field test the new 
controls to ensure they are operating as intended. 

SBA officials stated that as part of their interim process they are now 
requesting, from all firms that apply to the HUBZone program, 
documentation that demonstrates their eligibility. SBA stated that, in 
the past, it only requested additional information when it encountered 
obvious "red flags." Although requiring additional documentation has 
some value as a deterrent, the most effective preventive controls 
involve the verification of information, such as verifying a principal 
office location through an unannounced site visit. If SBA verified 
purported principal offices by conducting unannounced site visits, such 
as we did for our investigation, SBA would likely find similar 
instances of firms attempting to defraud the HUBZone program. In 
addressing one of our prior recommendations, the SBA issued a Desktop 
Manual for processing HUBZone applications. [Footnote 21] The manual 
provides guidance that alerts SBA staff of circumstances that warrant 
the need for supporting documentation. Although the Desktop Manual 
provides discretion to the analyst about the need to conduct a site 
visit, the Desktop Manual does not provide criteria when such site 
visits are warranted. In addition, SBA does not screen firms or 
individuals to ensure that they are not affiliated with prior firms 
that failed program eligibility reviews. As a result, an owner can 
change the name of a company that was removed from the HUBZone program 
to a new business name and be accepted back into the HUBZone program. 
Further, SBA did not adequately field test its interim process for 
processing applications. If it had done so, SBA would have known that 
it did not have the resources to effectively carry out its review of 
applications in a timely manner. As a result, SBA had a backlog of 
about 800 HUBZone applications as of January 2009. At that time, SBA 
officials stated that it would take about 6 months to process each 
HUBZone application--well over the 1 month goal set forth in SBA 
regulations. 

Detection and Monitoring: 

Although preventive controls are the most effective way to prevent 
fraud, continual monitoring is an important component in detecting and 
deterring fraud. Monitoring and detection within a fraud prevention 
program involve actions such as data-mining for fraudulent and 
suspicious applicants and evaluating firms to provide reasonable 
assurance that they continue to meet program requirements. As 
demonstrated in our July 2008 testimony, SBA's fraud control 
vulnerabilities in its application process make detection and 
monitoring particularly important for the HUBZone program. As a result 
of SBA's control vulnerabilities, there are likely hundreds and 
possibly thousands of firms in the HUBZone program that fail to meet 
program requirements. Although monitoring and detection is an important 
component of a fraud prevention system, we reported in June 2008 that 
the mechanisms SBA used to monitor HUBZone firms provided limited 
assurance that only eligible firms participate in the program.[Footnote 
22] Specifically, we reported that a firm could be in the HUBZone 
program for years without being examined.[Footnote 23] In addition, 
although a HUBZone firm is supposed to be recertified every 3 years, we 
reported that more than 40 percent of the firms in the program for over 
3 years had not been recertified. To address these weaknesses, SBA 
officials stated that during this fiscal year, they will be conducting 
program examinations on all HUBZone firms that received contracts in 
fiscal year 2007 to determine whether they still meet HUBZone 
requirements. In addition, SBA officials stated that as of September 
2008, SBA had eliminated their backlog of recertifications. 

Although SBA has initiated several positive steps, SBA will need to 
make further progress to achieve an effective fraud monitoring program. 
For example, SBA has not found an effective and efficient way to verify 
the validity of a stated principal office during its recertification 
and application processes. In addition, SBA officials stated that 
although they modified their approach for conducting program 
examinations of HUBZone firms this fiscal year, they have not 
established a streamlined and risk-based methodology for selecting 
firms for program examinations going forward. Further, in order to 
determine whether firms meet eligibility requirements, SBA needs to 
incorporate an "element of surprise" into its program examinations such 
as using random, unannounced site visits to verify a stated principal 
office. Finally, SBA does not evaluate all HUBZone program requirements 
during program examinations; specifically, SBA does not review whether 
HUBZone firms are expending at least 50 percent of the personnel costs 
of a contract on their own personnel. As a result, as shown by several 
of our case studies, certain firms are allowed to act as "front" 
companies, whereby they subcontract the large majority of their work to 
non-HUBZone firms. This undermines the program's stated purpose of 
increasing employment opportunities, investment, and economic 
development in HUBZone areas. 

Investigation and Prosecution: 

The final element of an effective fraud prevention system is the 
aggressive investigation and prosecution of individuals who commit 
fraud against the federal government. However, SBA currently does not 
have an effective process for investigating fraud and abuse within the 
HUBZone program. Although SBA's Desktop Manual for Processing HUBZone 
Applications states that an analyst may refer a HUBZone application to 
the Office of Inspector General or the Office of General Counsel, SBA 
has not established specific criteria or a process for referring firms 
that knowingly do not meet program requirements. To date, other than 
the firms identified by our prior investigation, the SBA program office 
has never referred any firms for debarment and/or suspension 
proceedings based on their findings from their program eligibility 
reviews. By failing to hold firms accountable, SBA has sent a message 
to the contracting community that there is no punishment or 
consequences for committing fraud or abusing the intent of the HUBZone 
program. However, as noted below, the SBA has started the debarment 
process on 7 of the 10 firms we found to have fraudulently or 
inaccurately misrepresented its HUBZone status in our earlier work. 

SBA Has Initiated Some Enforcement Actions Against 10 HUBZone Firms 
Previously Investigated by GAO: 

SBA has taken some enforcement steps on the 10 firms that we found did 
not meet HUBZone program requirements as of July 2008. According to 
SBA, as of January 2009, two of the firms have been removed from the 
program and two others are in the process of being removed.[Footnote 
24] However, SBA's failure to examine some of the most egregious cases 
we previously identified[Footnote 25] has resulted in an additional 
$7.2 million in HUBZone obligations and about $25 million in HUBZone 
set-aside or price preference contracts to these firms. For example, a 
construction firm identified in our July 2008 testimony admitted that 
it did not meet HUBZone requirements and was featured in several 
national publications by name. It has continually represented itself as 
HUBZone certified and has received $2 million in HUBZone obligations 
and a $23 million HUBZone set-aside contract since our testimony. See 
figure 5 for a reproduction of the continual representation this firm 
makes on the top banner of its Web site. 

Figure 5: Reproduction of Web Site Banner for Firm SBA Has Yet to 
Investigate: 

[Refer to PDF for image: illustration] 

Banner indicates "8(a) HUBZone Certified." 

Source: Company website. 

[End of figure] 

In the written statement for the July 2008 hearing, the Acting 
Administrator of SBA stated that the SBA would take "immediate steps to 
require site visits for those HUBZone firms that have received HUBZone 
contracts and will be instituting suspension and debarment proceedings 
against firms that have intentionally misrepresented their HUBZone 
status." SBA has referred 7 of these firms to its General Counsel for 
suspension and debarment. However, as of February 2009, according to 
SBA's Dynamic Small Business Web site, 7 of the 10 firms that we 
investigated were still HUBZone certified. Table 2 highlights the 10 
firms that we noted at the July 2008 hearing that clearly did not meet 
the HUBZone program requirements, new HUBZone obligations and contracts 
these firms received, as well as the actions the SBA has taken against 
these firms as of January 2009. 

Table 2: SBA Actions on 10 HUBZone Firms Previously Investigated by 
GAO: 

Previous GAO case[A]: 1; 
Primary product or service: Information technology (IT), engineering, 
logistics, technical support services, and business management 
services; 
Case details: 
* Multiple GAO site visits to listed principal office revealed that no 
employees were working at the location and the only business equipment 
we found was a computer and filing cabinet; 
* Firm maintained its actual principal office in McLean, Virginia, 
which is not in a HUBZone, where most of firm's qualifying employees, 
including the management staff, worked; 
* According to payroll records, only 21 percent of the firm's employees 
lived in a HUBZone as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* Firm has received nearly $3 million in HUBZone obligations since our 
July 2008 testimony; 
* SBA has not yet performed a program examination; 
* SBA program officials referred firm to Suspension and Debarment 
Official (SDO) in January 2009; 
* SDO submitted a notice of proposal to debar to the company in January 
2009.[B] 

Previous GAO case[A]: 2; 
Primary product or service: General construction; 
Case details: 
* GAO site visit to the firm's listed principal office during normal 
business hours revealed it was one-half of a residential duplex 
building with no employees present; 
* Vice president of firm admitted to certifying the firm met HUBZone 
requirements even though no employees worked at their principal office 
location; 
* According to payroll records, only 12 percent of the firm's employees 
lived in a HUBZone as of December 2007; 
* Although the firm admitted to failing to meet the HUBZone 
requirement, as of June 2008 the firm's Web site has a large lettered 
statement that the firm is HUBZone-certified; 
SBA compliance actions and additional contract actions through January 
2009: 
* Firm received HUBZone preference contract in September 2008 worth $23 
million, which includes base and all options; 
* Firm has received over $2 million in HUBZone obligations since our 
July 2008 testimony; 
* SBA has not yet performed a program examination; 
* SBA program officials referred firm to SDO in January 2009; 
* SDO submitted a notice of proposal to debar to the company in January 
2009. 

Previous GAO case[A]: 3; 
Primary product or service: Design and installation of fire alarm 
systems; 
Case details: 
* President admitted that his firm "technically" did not meet HUBZone 
requirements; 
* GAO site visit to the firm's listed principal office during normal 
business hours revealed that it was a virtual office; 
* Firm operated its actual principal office in McLean, Virginia, not in 
a HUBZone, where most of firm's qualifying employees, including the 
management staff, worked; 
* According to payroll records, only 8 percent of the firm's employees 
lived in a HUBZone area as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* SBA removed firm from HUBZone program in November 2008 because firm 
did not respond to SBA's program examination inquiry; 
* SBA program officials referred firm to SDO in December 2008; 
* SDO submitted a notice of proposal to debar to the company in January 
2009. 

Previous GAO case[A]: 4; 
Primary product or service: Engineering and construction management 
services; 
Case details: 
* GAO site visit to the listed principal office during normal business 
hours found no employees present, the door locked, and mail stuffed 
under the door; 
* Firm operated its actual principal office in Beltsville, Maryland, 
which is not in a HUBZone, an indication that its daily operation is 
conducted out of this non-HUBZone office; 
* According to payroll records, only 30 percent of the firm's employees 
lived in a HUBZone as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* Firm received HUBZone set-aside contract in September 2008 worth 
$8,500; 
* SBA has not yet performed a program examination; 
* SBA program officials referred firm to SDO in January 2009; 
* SDO submitted a notice of proposal to debar to the company in January 
2009. 

Previous GAO case[A]: 5; 
Primary product or service: IT consulting; 
Case details: 
* GAO site visit to the firm's listed principal office found the firm's 
president and one employee; 
* According to the president, between 80 to 90 full-time employees 
worked at a non-HUBZone location in Lanham, Maryland. A GAO site visit 
confirmed the existence of this location, indicating that the listed 
principal office does not meet HUBZone requirements; 
* According to payroll records, only 29 percent of the firm's employees 
lived in a HUBZone area as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* Firm received about $1.7 million in HUBZone obligations since our 
July 2008 testimony; 
* SBA completed program examination in November 2008 and notified firm 
that it was scheduled for removal from the HUBZone program; 
* SBA program officials referred firm to SDO in December 2008; 
* SDO submitted a notice of proposal to debar to the company in January 
2009. 

Previous GAO case[A]: 6; 
Primary product or service: Mechanical engineering; 
Case details: 
* Federal agencies obligated more than $27 million on government 
contracts that were not HUBZone contracts for the firm; 
* Multiple GAO site visits revealed no employees present at the 
principal office in Washington, D.C.; 
* Firm operated from an office in Hyattsville, Maryland, not in a 
HUBZone, where most qualifying employees worked; 
* President stated that she believed SBA defined "principal office" as 
"where the principal" (e.g., president) worked; 
* President also stated that she typically worked at the principal 
office, but that investigators happened to find her at the non-HUBZone 
office location; 
* According to payroll records, only 4 of 78 employees (about 5 
percent) lived in a HUBZone as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* SBA completed program examination and notified firm in November 2008 
that it was scheduled for removal from the HUBZone program; 
* SBA program officials referred firm to SDO in January 2009; 
* SDO submitted a notice of proposal to debar to the company in January 
2009; 
* SBA has still not removed firm from the HUBZone program 3 months 
after it found the firm was not eligible for the program. 

Previous GAO case[A]: 7; 
Primary product or service: Acquisition and project management; 
Case details: 
* Firm met principal office requirement; 
* Payroll documents indicate less than 6 percent of the firm's 
employees lived in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
May 2008; 
SBA compliance actions and additional contract actions through January 
2009: 
* SBA removed firm from HUBZone program in November 2008 because firm 
voluntarily withdrew from the program; 
* SBA program officials referred firm to SDO in December 2008; 
* SDO submitted a notice of proposal to debar to the company in January 
2009. 

Previous GAO case[A]: 8; 
Primary product or service: Construction management; 
Case details: 
* Firm met principal office requirement; 
* Payroll documents showed only about 17 percent of the firm's 
employees lived in a HUBZone as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* SBA concluded firm met HUBZone program requirements based on an SBA 
program examination.[C] 

Previous GAO case[A]: 9; 
Primary product or service: IT products and services; 
Case details: 
* Firm met principal office requirement; 
* Payroll documents showed that the firm's only employee did not live 
in a HUBZone as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: 
* Firm received HUBZone set-aside contract in September 2008 worth $1.8 
million; 
* Firm has received over $20,000 in HUBZone obligations since our July 
2008 testimony; 
* SBA concluded firm met HUBZone program requirements based on an SBA 
program examination.[C] 

Previous GAO case[A]: 10; 
Primary product or service: IT and logistics management; 
Case details: Firm met principal office requirement; Payroll documents 
show only about 15 percent of the firm's employees lived in a HUBZone 
as of December 2007; 
SBA compliance actions and additional contract actions through January 
2009: Firm has received over $500,000 in HUBZone obligations since our 
July 2008 testimony; SBA concluded firm met HUBZone program 
requirements based on an SBA program examination.[C] 

Source: GAO analysis of SBA information. 

Note: See: GAO, HUBZone Program: SBA's Control Weaknesses Exposed the 
Government to Fraud and Abuse, [hyperlink, http://GAO-08-964T] 
(Washington, D.C.: July 17, 2008). 

[A] Cases are arranged in the same order as in [hyperlink, 
http://GAO-08-964T]. 

[B] SBA officials stated that they are giving each company 30 days to 
reply to the notice of proposal to debar. Within 30 days after receipt 
of the notice, the contractor may submit information and argument in 
opposition to the proposed debarment. 

[C] We maintain that the three cases SBA examined and determined to 
meet HUBZone program requirements were out of HUBZone compliance at the 
time of our review. In January 2009, we asked the SBA for documentation 
related to its review, but no documentation was provided to us. 

[End of table] 

As noted in the table above, as of January 2009 SBA has conducted 
program evaluations on 7 of the 10 firms to determine whether the firms 
meet the eligibility requirements for the HUBZone program. Based on 
these evaluations, SBA has removed 2 firms from the HUBZone program and 
is in the process of providing due process to 2 additional firms to 
determine whether they should be removed.[Footnote 26] SBA officials 
stated that no action will be taken on 3 firms because SBA's program 
evaluations concluded that these firms met all the eligibility 
requirements of the HUBZone program. We attempted to verify SBA's work, 
but were not provided with the requested documentation to support their 
conclusion that the firms moved into compliance after our July 2008 
testimony. SBA officials said they have not yet performed program 
evaluations for 3 of the most egregious firms because they are 
experiencing technical problems with SBA's caseload system. As such, 
these 3 firms remain eligible to receive HUBZone set-aside contracts. 
SBA is also pursuing suspension and debarment actions for 7 of these 
firms, and the Department of Justice considering civil actions on 5 of 
the 10 cases. 

Conclusions: 

Our work on the HUBZone program to date has shown that numerous 
ineligible firms have taken advantage of the opportunity to commit 
fraud against the federal government. The SBA has initiated steps to 
correct internal control deficiencies, but it still falls short in 
developing measures to prevent, detect, and prosecute fraud within the 
HUBZone program. Our work demonstrates that SBA's fraud controls lack 
important elements needed to screen and monitor firms which has led to 
HUBZone awards to firms that did not meet program requirements. For 
example, SBA's failure to verify principal office locations through 
unannounced site visits has led to firms operating their businesses 
from locations that are far from economically disadvantaged. In 
addition, a lack of oversight for monitoring all of the program 
requirements has allowed HUBZone firms to subcontract large portions of 
HUBZone work to non-HUBZone firms thereby failing to meet the program 
requirement that at least 50 percent of the personnel costs of a 
contract be expended on its own employees. Lastly, SBA's lack of 
enforcement within the HUBZone program has not had the effect of 
deterring fraudulent actors from entering or remaining in the program. 
Going forward, SBA must develop and incorporate effective fraud 
controls into its overall internal control process that will minimize 
fraud and abuse in the HUBZone program. 

Recommendations for Executive Action: 

To establish an effective fraud prevention system for the HUBZone 
program, the Administrator of the Small Business Administration should 
expeditiously implement the recommendations from our June 2008 report 
and take the following four actions: 

* Consider incorporating a risk-based mechanism for conducting 
unannounced site visits as part of the screening and monitoring 
process. 

* Consider incorporating policies and procedures into SBA's program 
examinations for evaluating if a HUBZone firm is expending at least 50 
percent of the personnel costs of a contract using its own employees. 

* Ensure appropriate policies and procedures are in place for the 
prompt reporting and referral of fraud and abuse to SBA's Office of 
Inspector General as well as SBA's Suspension and Debarment Official. 

* Take appropriate enforcement actions on the 19 HUBZone firms we found 
to violate HUBZone program requirements to include, where applicable, 
immediate removal or decertification from the program, and coordination 
with SBA's Office of Inspector General as well as SBA's Suspension and 
Debarment Official. 

Agency Comments and Our Evaluation: 

We received written comments on a draft of this report from SBA's 
Deputy Associate Administrator of the Office of Business Development 
and Government Contracting. In the response, SBA agreed with three of 
our four recommendations. SBA stated that it is in the process of re- 
engineering the entire HUBZone certification and eligibility process, 
and SBA believes that our recommendations are useful in making 
necessary program changes to minimize program risk and ensure that only 
eligible firms received HUBZone program benefits. SBA's written 
comments are provided in appendix II. 

SBA disagreed with our recommendation to consider incorporating 
policies and procedures into SBA's program examinations for evaluating 
if a HUBZone firm is complying with the performance-of-work 
requirements by expending at least 50 percent of the personnel costs of 
a contract using its own employees. SBA stated that although this 
requirement is included in SBA HUBZone regulations, it is not a 
criterion for HUBZone program eligibility but rather a mandatory 
contract term. SBA stated that contracting officers are required by the 
Federal Acquisition Regulations to insert such clauses regarding 
subcontracting limitations. If firms submit bids that indicate that 
they will not meet this requirement or fail to meet this requirement 
during performance of the contract, the contracting officer has the 
authority to reject a firm's bid or terminate the contract for default. 
SBA stated that it will continue to work with contracting officers to 
ensure that this requirement is monitored. 

While we recognize that contracting officers have a responsibility for 
monitoring the subcontracting limitation, SBA also has this 
responsibility. In order to receive HUBZone certification, a firm must 
certify to SBA that it will abide by this performance requirement, and 
SBA is required by statute to establish procedures to verify such 
certifications. In addition, verification that a firm is meeting the 
performance-of-work requirements is one of the subjects that SBA may 
review during its program examinations. Since SBA is not performing 
this review, it is possible that many firms may be receiving the 
benefits of the HUBZone program while evading the program requirements. 
Therefore, we continue to believe that SBA should consider 
incorporating policies and procedures into SBA's program examinations 
for evaluating if a HUBZone firm is meeting the performance-of-work 
requirements. 

As agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from the report date. At that time, we will send copies of this report 
to the Administrator of the Small Business Administration and other 
interested parties. The report will also be available at no charge on 
GAO's Web site at [hyperlink, http://www.gao.gov]. If you or your staff 
have any questions about this report, please contact me at (202) 512-
6722 or kutzg@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. GAO staff who contributed to this report are listed in appendix 
III. 

Sincerely yours, 

Signed by: 

Gregory Kutz: 
Managing Director, Forensic Audits and Special Investigations: 

[End of section] 

Appendix I: Additional Case Studies of HUBZone Firms That Did Not Meet 
Program Eligibility Requirements: 

This appendix presents summary information on 9 of 19 firms that 
clearly did not meet the program eligibility requirements of the 
HUBZone program. Table 3 shows the remaining case studies that we 
investigated. As with the 10 cases discussed in the body of this 
report, these 9 firms continued to represent themselves as eligible 
HUBZone interests to SBA. Because these 9 case examples clearly are not 
eligible, we consider each firm's continued representation indicative 
of fraud and/or abuse related to this program. 

Table 3: HUBZone Firms Making Fraudulent or Inaccurate Representations: 

Case: 11; 
Location: San Antonio, TX; 
Primary product or service: Construction; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $2,770,000; (Department of the Air Force); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 6 of the firm's 31 employees (19 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 12; 
Location: San Diego, CA; 
Primary product or service: Construction; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $3,530,000; (Department of the Navy); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 5 of the firm's 38 employees (13 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 13; 
Location: Huntsville, AL; 
Primary product or service: Engineering; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $920,000; (Department of the Air Force);
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 19 of the firm's 100 employees (19 percent) 
lived in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 14; 
Location: San Diego, CA; 
Primary product or service: Engineering and Information Technology; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $960,000; (Department of the Navy); 
Case details: 
* Firm did not meet principal office requirement because the firm's 
principal office was not located in HUBZone area[B]; 
* Firm met 35 percent residency requirement; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
September 2008. 

Case: 15; 
Location: San Antonio, TX; 
Primary product or service: Facilities Support Services/Construction; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $1,840,000; (multiple agencies); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 8 of the firm's 76 employees (11 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
May 2008. 

Case: 16; 
Location: San Antonio, TX; 
Primary product or service: Food Service Contractors; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $830,000; (Department of the Navy); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 62 of the firm's 239 employees (26 percent) 
lived in a HUBZone as of December 2007; 
* Firm does not have a current ORCA certification. 

Case: 17; 
Location: San Diego, CA; 
Primary product or service: Information Technology; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $2,090,000; (multiple agencies); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 10 of the firm's 43 employees (23 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Case: 18; 
Location: Waco, TX; 
Primary product or service: Janitorial; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $440,000; (Department of Veterans Affairs); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that only 4 of the firm's 16 employees (25 percent) lived 
in a HUBZone as of December 2007; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
November 2008. 

Case: 19; 
Location: San Antonio, TX; 
Primary product or service: Temporary Help Services; 
Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting 
agencies): $350,000; (Departments of the Navy and Army); 
Case details: 
* Firm met principal office requirement; 
* Firm did not meet 35 percent residency requirement because payroll 
records show that this firm's only employee did not live in a HUBZone 
as of December 2007[C]; 
* Firm self-certified that it met the HUBZone requirements in ORCA in 
July 2008. 

Source: GAO analysis of FPDS, ORCA, CCR and contractor data. 

[A] Net obligation amounts are rounded to the nearest $10,000. 

[B] We checked this firm's principal office address using both the 
current HUBZone map located on SBA's Web site as well as a HUBZone map 
as it would have appeared in December 2007 and in both instances the 
firm's principal office was not located in a HUBZone area. 

[C] Earlier in 2007, a total of 16 people were employed by this 
company, however at no time did any of the employees live in a HUBZone. 

[End of table] 

[End of section] 

Appendix II: Comments from the Small Business Administration: 

U.S. Small Business Administration: 
Washington, D.C. 20416: 

March 13, 2009: 

Greg Kutz, Managing Director: 
Forensic Audits and Special Investigations: 
U.S. Government Accountability Office: 
Washington, DC 20548: 

Dear Mr. Kutz: 

Thank you for allowing the U.S. Small Business Administration (SBA) the 
opportunity to comment on your Draft Government Accountability Office 
(GAO) Report Number: GAO 09-440, entitled, "HUBZone Program: Fraud and 
Abuse Identified in Four Metropolitan Areas." 

SBA has reviewed GAO's four recommendations for executive action and is 
submitting the following responses: 

Recommendation #1: 
Consider incorporating a risk-based mechanism for conducting 
unannounced site visits as part of the screening and monitoring 
process. 

Response: SBA agrees with the recommendation. SBA will develop risk-
based procedures for conducting site visits to ensure HUBZone program 
eligibility. 

Recommendation #2: 
Consider incorporating policies and procedures into SBA's program 
examinations for evaluating if a IT HUBZone firm is expending at least 
50 percent of the personnel costs of a contract using its own 
employees. 

Response: SBA disagrees with the recommendation to revise program 
examination polices and procedures for evaluating if a HUBZone firm is 
expending at least 50 percent of the personnel cost of a contract using 
its own employees. Although the 50 percent requirement is included SBA 
HUBZone regulations, it is not a criteria for HUBZone program 
eligibility hut rather a mandatory contract term. When awarding HUBZone 
set-aside contracts, HUBZone sole source contracts, or contracts with a 
HUBZone price evaluation preference, contracting officers are required 
by the Federal Acquisition Regulations to insert such clauses. If firms 
submit bids that indicate that they will not meet this requirement or 
fail to meet this requirement during performance of the contract, the 
contracting officer has the authority to reject a firm's bid or 
terminate the contract for default. SBA will continue to work with 
contracting officers to ensure that this requirement is monitored. 

Recommendation #3: 
Ensure appropriate policies and procedures are in place for the prompt 
reporting and referral of fraud and abuse to SBA's Office of Inspector 
General as well as SBA's Suspension and Debarment Official. 

Response: SBA agrees with the recommendation. SBA is developing 
policies and standard operating procedures for prompt reporting and 
referral of cases of fraud and abuse to SBA's Office of Inspector 
Genera] and Suspension and Debarment Official. 

Recommendation #4: 
Take appropriate enforcement actions on the 19 HUBZone firms we found 
to violate HUBZone program requirements to include, where applicable, 
immediate removal or decertification from the program. and coordination 
with SBA's Office of Inspector General as well as SBA's Suspension and 
Debarment Official. 

Response: SBA agrees with the recommendation. Once GAO provides the 
names of the 19 firms, the HUBZone office will confirm their 
ineligibility and if appropriate initiate decertification action and 
make referral to SBA's Office of Inspector General and SBA's Suspension 
and Debarment Official for action. 

As indicated in the draft report, SBA is in the process of re-
engineering the entire HUBZone certification and eligibility process, 
and we believe that the GAO's recommendations are useful in making 
necessary program changes to minimize program risk and ensure that only 
eligible firms received HUBZone program benefits. Again, thank you for 
the opportunity to comment. If you have any questions or require 
additional information. please contact Ms. Tiffani Cooper, GAO Liaison 
at (202) 205-6700. 

Sincerely, 

Signed by: 

Calvin Jenkins: 
Deputy Associate Administrator: 
Office of Business Development and Government Contracting: 

[End of section] 

Appendix III GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Gregory D. Kutz, Managing Director, (202) 512-6722, kutzg@gao.gov: 

Staff Acknowledgments: 

In addition to the individual named above, Erika Axelson, Gary Bianchi, 
Donald Brown, Bruce Causseaux, Eric Eskew, Dennis Fauber, Craig 
Fischer, Robert Graves, Betsy Isom, Jason Kelly, Julia Kennon, Barbara 
Lewis, Olivia Lopez, Jeff McDermott, Andrew McIntosh, John Mingus, Andy 
O'Connell, Mary Osorno, Chris Rodgers, and Matt Valenta also provided 
assistance on this report. 

[End of section] 

Footnotes: 

[1] GAO, HUBZone Program: SBA's Control Weaknesses Exposed the 
Government to Fraud and Abuse, [hyperlink, 
http://www.gao.gov/products/GAO-08-964T] (Washington, D.C.: July 17, 
2008). 

[2] GAO, Small Business Administration: Additional Actions Are Needed 
to Certify and Monitor HUBZone Businesses and Assess Program Results, 
[hyperlink, http://www.gao.gov/products/GAO-08-975T] (Washington, D.C.: 
July 17, 2008). 

[3] The Dynamic Small Business Search is part of the Central Contractor 
Registration (CCR) database. If a firm indicates it is a small business 
in CCR, its business information will be populated in SBA's database 
and can be accessed through the Dynamic Small Business Search. 

[4] The FPDS-NG is the central repository for capturing information on 
federal procurement actions. Dollar amounts reported by federal 
agencies to FPDS-NG represent the net amount of funds obligated or 
deobligated as a result of procurement actions. Because we did not 
obtain disbursement data, we were unable to identify the actual amounts 
received by firms. 

[5] ORCA was established as part of the Business Partner Network, an 
element of the Integrated Acquisition Environment, which is implemented 
under the auspices of White House Office of Management and Budget, 
Office of Federal Procurement Policy, and the Chief Acquisition 
Officers Council. ORCA is "the primary Government repository for 
contractor submitted representations and certifications required for 
the conduct of business with the Government." 

[6] HUBZone Act of 1997, Pub. L. No. 105-135, Title VI, § 602(a), 111 
Stat. 2592, 2627 (1997). 

[7] We previously reported that, as of February 2008, SBA had about 
13,000 firms in the HUBZone program. SBA officials stated that they did 
not maintain data on the reason why there was a 3,700 decrease in the 
number of firms in the HUBZone program. According to SBA officials, a 
possible cause for this decrease was that SBA eliminated a backlog of 
its HUBZone recertifications. SBA officials said that many of these 
firms were removed from the HUBZone program because the firms either 
voluntarily withdrew or did not respond to SBA's recertification 
inquiry after giving them due process. 

[8] There are different means of fulfilling this requirement, depending 
on the type of contract. 13 C.F.R. § 126.700. 

[9] 15 U.S.C. § 657a. 

[10] GAO, HUBZone Program: SBA's Control Weaknesses Exposed the 
Government to Fraud and Abuse, [hyperlink, 
http://www.gao.gov/products/GAO-08-964T] (Washington, D.C.: July 17, 
2008). 

[11] GAO, Small Business Administration: Additional Actions Are Needed 
to Certify and Monitor HUBZone Businesses and Assess Program Results, 
[hyperlink, http://www.gao.gov/products/GAO-08-643] (Washington, D.C.: 
June, 2008). 

[12] These firms had principal offices in or near 4 metropolitan areas: 
Dallas, Texas; Huntsville, Alabama; San Antonio, Texas; and San Diego, 
California. 

[13] These 19 firms received a total of $187 million in federal 
obligations in fiscal years 2006 and 2007. 

[14] See 13 C.F.R. § 126.700. 

[15] This firm attested in ORCA in February 2008 that it made "no 
material changes in ownership and control, principal office, or HUBZone 
employee percentage since it was certified by SBA." 

[16] We were unable to verify if this trailer was ever used as the 
firm's principal office. 

[17] HUBZone companies must re-certify with SBA every 3 years. 

[18] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
Standards for Internal Control in the Federal Government. 

[19] Association of Certified Fraud Examiners, Fraud Examiners Manual, 
U.S. Edition (2007). 

[20] GAO, Hurricanes Katrina and Rita Disaster Relief: Prevention is 
the Key to Minimizing Fraud, Waste and Abuse in Recovery Efforts, 
[hyperlink, http://www.gao.gov/products/GAO-07-418T] (Washington, D.C.: 
Jan. 29, 2007); and Individual Disaster Assistance Programs: Framework 
for Fraud Prevention, Detection, and Prosecution, [hyperlink, 
http://www.gao.gov/products/GAO-06-954T] (Washington, D.C.: July 12, 
2006). 

[21] We did not test the extent to which SBA personnel are following 
the instruction in the Desktop Manual. 

[22] GAO, Small Business Administration: Additional Actions Are Needed 
to Certify and Monitor HUBZone Businesses and Assess Program Results, 
[hyperlink, http://www.gao.gov/products/GAO-08-643] (Washington, D.C.: 
June, 2008). 

[23] Since fiscal year 2004, SBA's policy was to conduct program 
examinations on 5 percent of firms each year. According to SBA, a 
program examination involves a review of the following criteria: 1) 51 
percent ownership by a U.S. citizen; 2) qualification as a small 
business under the size standard corresponding to primary industry 
classification; 3) the firm's principal office must be located in a 
HUBZone; and 4) at least 35 percent of the firm's employees must reside 
in a HUBZone. 

[24] As of February 2009, 7 of the 10 firms were still HUBZone 
certified according to SBA's Dynamic Small Business Search. One of the 
two firms in the process of being removed was no longer listed as 
HUBZone certified. 

[25] GAO, HUBZone Program: SBA's Control Weaknesses Exposed the 
Government to Fraud and Abuse, [hyperlink, 
http://www.gao.gov/products/GAO-08-964T] (Washington, D.C.: July 17, 
2008). 

[26] A firm that SBA has decertified may seek certification no sooner 
than one year from the date of decertification. If the firm was 
decertified for failure to notify SBA of a material change affecting 
its eligibility, it must include with its application for certification 
a full explanation of why it failed to notify SBA of the material 
change. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: