COVID-19 Loans: SBA Has Begun to Take Steps to Improve Oversight and Fraud Risk Management

What GAO Found

In April 2020, the Small Business Administration (SBA) quickly implemented the Paycheck Protection Program (PPP) and expedited the processing of Economic Injury Disaster Loans (EIDL) and a new EIDL advance program. These important programs have helped businesses survive during the COVID-19 pandemic. In an effort to move quickly on these programs, SBA initially put limited internal controls in place, leaving both susceptible to program integrity issues, improper payments, and fraud. Because of concerns about program integrity, GAO added PPP and the EIDL program onto its High-Risk List in March 2021.

SBA has begun to take steps to address these initial deficiencies:

• PPP oversight. Because ongoing oversight is crucial, GAO recommended in June 2020 that SBA develop plans to respond to PPP risks to ensure program integrity, achieve program effectiveness, and address potential fraud. Since then, SBA has developed a loan review process and added up-front verifications before it approves new loans.

• Improper payments for PPP. GAO recommended in November 2020 that SBA expeditiously estimate improper payments for PPP and report estimates and error rates. SBA has now developed a plan for the testing needed to estimate improper payments.

• Analyzing EIDL data. Based on evidence of widespread potential fraud for EIDL, GAO recommended in January 2021 that SBA conduct portfolio-level analysis to detect potentially ineligible applications. SBA has not announced plans to implement this recommendation.

• EIDL oversight. GAO recommended in March 2021 that SBA implement a comprehensive oversight plan for EIDL to ensure program integrity. SBA agreed to implement such a plan.

• Assessment of fraud risks. SBA has not conducted a formal fraud risk assessment for PPP or the EIDL program. GAO made four recommendations in March 2021, including that SBA conduct a formal assessment and develop a strategy to manage fraud risks for each program. SBA said it would work to complete fraud risk assessments for PPP and EIDL and continually monitor fraud risks.

• Financial statement audit. In December 2020, SBA's independent financial statement auditor issued a disclaimer of opinion on SBA's fiscal year 2020 consolidated financial statements because SBA could not provide adequate documentation to support a significant number of transactions and account balances related to PPP and EIDL.

GAO continues to review information SBA recently provided, including data on PPP loan forgiveness and details on the PPP and EIDL loan review processes. In addition, GAO has obtained additional information from a survey of PPP participating lenders, interviews with SBA's PPP contractors, and written responses to questions provided by SBA's EIDL contractor and subcontractors.

Why GAO Did This Study

SBA has made or guaranteed about 18.7 million loans and grants through PPP and the EIDL program, providing about $968 billion to help small businesses adversely affected by COVID-19. PPP provides potentially forgivable loans to small businesses, and EIDL provides low-interest loans of up to $2 million for operating and other expenses, as well as advances (grants).

This testimony discusses the lack of controls in PPP and the EIDL program and SBA's efforts to improve its oversight of these programs. It is based largely on GAO's June 2020–March 2021 reports on the federal response, including by SBA, to the economic downturn caused by COVID-19 (GAO-20-625, GAO-20-701, GAO-21-191, GAO-21-265, GAO -21-387). For those reports, GAO reviewed SBA documentation and SBA Office of Inspector General (OIG) reports; analyzed SBA data; and interviewed officials from SBA, the SBA OIG, and the Department of the Treasury.