GAO's High Risk List Puts Spotlight on Emergency Loans For Small Businesses, Reinforcing Audit and Investigation Risk for PPP and EIDL Program Participants

The Government Accountability Office (GAO) has added emergency loans for small businesses to its list of government programs vulnerable to fraud, waste, abuse, and mismanagement. On March 2, 2021, GAO released its latest High Risk List identifying troubled federal government programs in need of significant improvement. The GAO concluded that the Small Business Administration (SBA) must demonstrate more robust integrity controls and better management practices over the PPP and EIDL programs. GAO’s findings put pressure on the SBA to ensure quicker adoption of GAO’s recommendations for improvements and keeps public focus on the need for SBA audits and investigations of Paycheck Protection Program (PPP) and Economic Injury Disaster Loan (EIDL) program participants.

GAO’s report notes that SBA provided roughly $744 billion in emergency funding to help small businesses through the PPP and EIDL programs last year. The emergency nature of the funding, the speed at which SBA implemented and expanded these programs, and the limited controls built into the PPP and EIDL applicant approval process left SBA susceptible to making payments in incorrect amounts or to ineligible recipients. GAO’s High Risk List highlights the SBA’s continued lack of safeguards and finalized plans to oversee the two programs. The report calls attention to SBA’s historic struggles. Specifically, GAO explained that since June 2020 it has recommended that SBA develop and implement plans to identify and respond to risks in PPP to address possible fraud and ensure program effectiveness, including in the smaller loans of $2 million or less. The report reinforced GAO’s prior findings that reliance on self-certifications can leave a program vulnerable to exploitation by those who wish to circumvent eligibility requirements or pursue criminal activities. The Department of Justice has steadfastly demonstrated its commitment to take criminal and civil enforcement actions against companies and individuals for fraudulent conduct under the loan programs, including actions under the False Claims Act (FCA).

But, as GAO explained, SBA has provided few details on its review plans or additional controls, and what little detail it has provided has been inadequate. GAO noted that SBA’s December 2020 draft Master Review Plan for the loan review process did not contain detailed policies and procedures for some loan eligibility or forgiveness reviews. That same month, SBA’s independent financial statement auditor identified several material weaknesses in controls related to SBA’s CARES Act programs. The auditor recommended that SBA perform and document a thorough risk assessment, develop and implement monitoring controls, and document the internal controls associated with the implementation of the CARES Act programs. Nevertheless, GAO’s report finds that these controls have still not been implemented by SBA.

Similarly, in January 2021, GAO recommended that to improve SBA’s oversight of the EIDL approval process, it should leverage and implement portfolio-level data analytics across EIDL loans to detect potentially ineligible and fraudulent applications. While SBA neither agreed nor disagreed with GAO’s recommendation, it did not confirm any plans to conduct such an analysis. Consequently, GAO’s High Risk report reiterates the recommendation that portfolio-level data analytics could improve SBA’s management of fraud risk across the EIDL program. GAO’s report also recommends that SBA implement plans to identify and respond to risks in PPP to ensure program integrity, effectiveness, and address potential fraud regardless of the size of the loan; and that SBA quickly estimate improper payments, identify root causes, and develop corrective actions. GAO’s continued to push to get SBA to demonstrate stronger program integrity controls and better management practices over the PPP and EIDL programs will only serve to provide greater incentive for the SBA to further scrutinize borrowers’ eligibility, loan amount determinations, and forgiveness applications. This heightened scrutiny further reinforces audit, investigation, and civil and criminal enforcement risk for PPP and EIDL program participants.