Small Business Research Programs: Opportunities Exist for SBA and Agencies to Reduce Vulnerabilities to Fraud, Waste, and Abuse
Fast Facts
Federal agencies awarded small businesses more than $4.4 billion in FY 2022 for research and development and to commercialize technologies. The Small Business Administration oversees the programs making these awards, which are carried out by 11 agencies.
We analyzed past award data to identify awardees' foreign ownership, business size, and other indicators of fraud, waste, or abuse. We found, for example:
Almost 8% of awardees in our review had four or more indicators
$445 million worth of awards may have funded duplicative work
Our recommendations to SBA and 2 other agencies are to help improve their fraud risk management and more.
Highlights
What GAO Found
GAO's analysis of 37 fraud schemes targeting the Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs demonstrates control vulnerabilities and fraud risks with a range of financial and other impacts. These schemes often involved multiple participating agencies and programs. For example, 25 schemes involved awards from more than one agency, and 14 involved both SBIR and STTR awards. GAO identified approximately $34.7 million in civil settlements associated with these schemes. Fraudsters' diversion of funds affects the programs' economic stimulus goals and makes funds unavailable to eligible businesses. It can also result in prison time, financial penalties, and loss of employment for those involved in the schemes.
In addition to its Policy Directive guidance, the U.S. Small Business Administration (SBA) uses several tools, including its monthly program manager meetings, annual survey to participating agencies, and listing of fraud convictions and civil liabilities on SBIR.gov, to monitor and support agencies' fraud, waste, and abuse prevention efforts. However, GAO identified opportunities for SBA to better leverage these tools. For example, some agencies were unaware of the requirement to report fraud convictions and civil liabilities for listing on SBIR.gov, limiting the site's usefulness as an information source and fraud deterrent.
Most agencies did not conduct SBIR/STTR fraud risk assessments in alignment with GAO's leading practices and identified lack of guidance, training, and resources as related challenges. Through its guidance and other tools, SBA is in a position to reinforce fraud risk assessment requirements for agencies, in support of Policy Directive goals for fraud, waste, and abuse prevention.
GAO's analysis of SBIR.gov award data from fiscal years 2016 through 2021 identified thousands of awardees with one or more fraud, waste, or abuse risk indicator. Among the 10,570 awardees in this period, 842 were associated with four or more such indicators. GAO designed 27 analytic tests for (1) applicant eligibility, including foreign ownership, business size, essentially equivalent work, research facility address; and (2) other fraud, waste, or abuse risks, such as having prior criminal or civil actions. Data quality issues in SBIR.gov, such as incomplete project summaries, may impede agencies' full use of analytics for managing these risks. By improving the data through guidance and verification, SBA can support agencies' risk management activities.
Awardees by Number of Fraud, Waste, or Abuse Risk Indicators Identified in Analytic Tests
Why GAO Did This Study
Since the inception of the programs, federal agencies have invested over $68 billion in SBIR/STTR awards for research and development and to commercialize technologies. SBA oversees the programs, which are carried out by 11 participating agencies. In response to the Small Business Act, as amended, the SBA established 10 minimum requirements for participating agencies to prevent fraud, waste, and abuse. The act also includes a provision that GAO report to Congress every 4 years on agencies' and their Offices of Inspector General (OIG) efforts related to fraud, waste, and abuse in the programs.
This GAO report, its fourth, assesses (1) SBIR/STTR fraud schemes from fiscal years 2016 through 2023 and participants and impacts; (2) SBA and agency antifraud activities against fraud, waste, and abuse requirements; (3) agency fraud risk assessments against leading practices; and (4) applicant and award data to identify fraud, waste, and abuse vulnerabilities.
GAO reviewed documentation from SBA and the 11 participating agencies and OIGs; analyzed criminal, civil, and administrative actions; compared SBA and agencies' processes against leading practices; conducted data matching to identify potentially ineligible awardees for fiscal years 2016 through 2021; and interviewed SBA, agency, and OIG officials.
Recommendations
GAO is making eight recommendations, including six to SBA to provide agencies with guidance to support their fraud risk management. The agencies generally agreed with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Small Business Administration | The Administrator of SBA should ensure that the Associate Administrator for the Office of Investment and Innovation expands the methods and sources used to identify fraud-related convictions and findings of civil liability to list in the SBA's database, such as through alerts from legal research resources. (Recommendation 1) |
SBA concurred with this recommendation. In March 2025, SBA stated it secured a license from a legal research resource for purposes of generating relevant alerts and will continue to assess new services and strategies to resolve this recommendation. To implement this recommendation, the agency needs to apply more comprehensive search terms or legal research tools to identify fraud-related convictions and findings of civil liability to address information gaps, which would improve the database's utility as a deterrent against fraud. We will reassess the status of this recommendation when SBA provides additional information on its implementation.
|
| Small Business Administration | The Administrator of SBA should ensure that the Associate Administrator for the Office of Investment and Innovation leverages its oversight mechanisms to identify, share, and report fraud-related convictions and findings of civil liability to SBIR.gov and address participating agencies' challenges in understanding and meeting the 15-day reporting requirement. (Recommendation 2) |
SBA concurred with this recommendation. In March 2025, SBA stated it continues to report final adjudicated fraud-related settlements, convictions, and findings of civil liability on SBIR.gov. SBA also noted that it intends to address reporting requirement challenges through a future update of the SBIR/STTR Policy Directive. To implement this recommendation, the agency needs to leverage monthly program manager discussions with participating agencies to ensure timely contributions to the website. Taking these steps would better position SBA to address information gaps in detecting potential fraud and meeting the reporting requirement, which would improve the website's utility as a deterrent against fraud. We will reassess the status of this recommendation when SBA provides additional information on its implementation.
|
| Department of Agriculture | The Secretary of the U.S. Department of Agriculture should ensure that the Director of the National Institute of Food and Agriculture ensures that USDA SBIR/STTR applicants receive fraud, waste, and abuse training. (Recommendation 3) |
USDA =concurred with this recommendation. In January 2025, USDA stated the National Institute of Food and Agriculture (NIFA) plans to incorporate fraud, waste, and abuse training into the agency's SBIR/STTR webpage, applicant webinars, and future requests for applications by June 2025. We will reassess the status of this recommendation when NIFA provides additional information on its implementation.
|
| Department of Defense | The Secretary of Defense should ensure that the DOD Office of the Under Secretary of Defense for Research and Engineering SBIR/STTR Program ensures that DOD SBIR/STTR subcomponent program officials receive fraud, waste, and abuse training. (Recommendation 4) |
DOD concurred with this recommendation. In January 2025, DOD stated it plans to develop and provide program administrators SBIR/STTR specific fraud, waste, and abuse training, among other things, by 12/31/25. We will reassess the status of this recommendation when DOD provides additional information on its implementation.
|
| Small Business Administration | The Administrator of SBA should ensure that the Associate Administrator for the Office of Investment and Innovation leverages its existing oversight mechanisms to ensure the accuracy of agencies' survey responses to required fraud, waste, and abuse training and, to the full extent of the SBA's legal authority, shares SBIR/STTR fraud risk information and resources for conducting fraud risk assessments. (Recommendation 5) |
SBA concurred with this recommendation. In March 2025, SBA stated it will assess the accuracy of agency survey responses due by March 15, 2025, as a part of the fiscal year 2024 annual reporting process. Further, SBA stated it will continue to provide fraud risk information within the constraints of our authority and resources. To implement this recommendation, the agency needs to leverage its oversight mechanisms to better ensure accuracy of agency's survey responses as well as share information and resources to prevent fraud, waste, and abuse, as intended by Policy Directive guidance. We will reassess the status of this recommendation when SBA provides additional information on its implementation.
|
| Small Business Administration | The Administrator of SBA should ensure that the Associate Administrator for the Office of Investment and Innovation, to the full extent of the SBA's legal authority, provides guidance to participating agencies to conduct comprehensive SBIR/STTR program fraud risk assessments, including all key elements, in support of the Policy Directive's fraud, waste, and abuse prevention requirements and consistent with Fraud Risk Framework leading practices. (Recommendation 6) |
SBA concurred with this recommendation. In March 2025, SBA stated it would provide this guidance to program managers through training during fiscal year 2025. SBA also noted that it would reinforce the guidance, to the extent of SBA's legal authority, through a subsequent SBIR/STTR Policy Directive update. To implement this recommendation, the agency needs to issue guidance reinforcing participating agencies' fraud risk assessment requirements to ensure that agencies have taken steps to prevent fraud, waste, and abuse in their SBIR/STTR programs. Implementing this recommendation would support agency awareness of the need to conduct fraud risk assessments and use available information on fraud risks for a robust assessment, among other elements of a comprehensive assessment process. We will reassess the status of this recommendation when SBA provides additional information on its implementation.
|
| Small Business Administration | The Administrator of SBA should ensure that the Associate Administrator for the Office of Investment and Innovation improves SBIR.gov data quality by updating guidance to require that abstracts are sufficiently complete and that applicant and awardee addresses are verified to support program eligibility determinations. (Recommendation 7) |
SBA concurred with this recommendation. In March 2025, SBA stated it continues to make system enhancements to SBIR.gov, such as reworking the registration processes to require validation through SAM.gov. SBA also noted that it would work with agencies to ensure mechanisms are in place to verify addresses where work is to be performed. To implement this recommendation, the agency needs to provide guidance to agencies for ensuring that complete and accurate information is collected for abstracts and addresses. Accurate and complete data enable participating agencies to verify applicant and awardee information and is a key control for assuring that ineligible entities do not receive SBIR/STTR awards. Implementing the recommendation would support agencies' use of these data for preventing fraud, waste, and abuse. We will reassess the status of this recommendation when SBA provides additional information on its implementation.
|
| Small Business Administration | The Administrator of SBA should ensure that the Associate Administrator for the Office of Investment and Innovation validates existing information in the SBIR/STTR databases, specifically the Company Registry and SBIR.gov, to identify and correct deficiencies, as appropriate. (Recommendation 8) |
SBA concurred with this recommendation. In March 2025, SBA stated it refined the SBIR.gov award reporting processes to further mitigate the introduction of duplicate or invalid data and is reviewing reported data received through SBIR/STTR annual reporting process. SBA expects the data review to be completed by March 15, 2025. Further, SBA stated it implemented new firm creation restrictions for small business registrants and agency award reporting to reduce new deficiencies. To implement this recommendation, the agency needs to validate and correct data in two of its key fields relevant to SBIR/STTR awards, such as business size and address. Accurate and complete data enable participating agencies to verify applicant and awardee information is a key control for assuring that ineligible entities do not receive SBIR/STTR awards. Implementing the recommendation would support agencies' use of these data for preventing fraud, waste, and abuse. We will reassess the status of this recommendation when SBA provides additional information on its implementation.
|