Emergency Loans for Small Businesses

Image

SBA made or guaranteed billions of dollars in emergency loans and grants quickly to help many small businesses in need. However, we are adding Emergency Loans for Small Businesses as a new high-risk area because of the limited controls built into the PPP and EIDL approval processes. Although this created the risk of hundreds of millions of dollars in improper payments, including those resulting from fraud, SBA lacks finalized plans to oversee the two programs.

Further, as we have reported multiple times, SBA’s failures to provide data and documentation on a timely basis for PPP and EIDL have impeded efforts to ensure transparency and accountability for the programs. This includes delays in obtaining key information from SBA, such as detailed oversight plans and documentation for estimating improper payments.

Lack of safeguards and finalized oversight plans. Given the immediate need for emergency funding, SBA implemented limited safeguards for approving PPP and EIDL loans and lacks finalized plans to oversee the two programs after loan approval, including PPP loan forgiveness.

In June 2020, we reported that SBA’s initial interim final rule for PPP allows lenders to rely on borrower’s certifying their eligibility and the use of loan proceeds. It also requires a limited review of documents provided by the borrower to determine the qualifying loan amount and eligibility for loan forgiveness. We noted that reliance on borrower self-certifications can leave a program vulnerable to exploitation by those who wish to circumvent eligibility requirements or pursue criminal activities.

We also reported that because SBA had limited time to implement safeguards for the PPP loan approval process and assess program risks, ongoing oversight would be crucial. At that time, SBA had announced that it would review loans of more than $2 million to confirm borrower eligibility after the borrower applied for loan forgiveness and that it may review any PPP loan it deemed appropriate.

However, SBA provided few details on these reviews. Therefore, we recommended that SBA develop and implement plans to identify and respond to risks in PPP to ensure program integrity, achieve program effectiveness, and address potential fraud, including in loans of $2 million or less.

In early December 2020, SBA officials said the agency had completed oversight plans and provided a document that SBA characterized as an overview of these plans. At that time, the agency had not yet finalized and provided more comprehensive documentation detailing its oversight plans and how it will implement them.

At the end of December 2020, SBA provided a draft Master Review Plan for the loan review process, but the document we received did not contain detailed policies and procedures for some loan reviews or loan forgiveness reviews as we had previously requested. According to SBA officials, these were in the process of being updated. Until we receive detailed documentation and can review the procedures and checklists that are being used in the review process, we cannot more fully evaluate SBA’s process.

Consistent with our recommendation, in December 2020 Congress passed legislation requiring SBA to submit to the Senate and House Small Business Committees an audit plan detailing the policies and procedures for conducting forgiveness reviews and audits of PPP loans within 45 days of enactment and to provide monthly updates thereafter.

The same legislation also requires SBA to respond to requests from GAO within 15 days (or such later date as the Comptroller General may provide) or report to Congress on the reasons for the delay. In addition, it appropriated about $284 billion for PPP. Borrowers who have already received a loan may obtain a second one if they meet certain conditions, such as having used the full amount of their first PPP loan. New first-time borrowers may also apply for PPP loans under the act.

The CARES Act also relaxed some approval requirements for EIDL, such as requiring the applicant to demonstrate that it could not obtain credit elsewhere, and made certain agricultural businesses eligible. In January 2021, we reported that as of July 14, 2020, SBA had provided about 5,000 advances totaling about $26 million to potentially ineligible businesses in three types of industries—adult entertainment, casino gambling, and marijuana retail.

Additionally, we reported that as of September 30, 2020, SBA approved at least 3,000 loans totaling about $156 million to potentially ineligible businesses that SBA policies state were ineligible for the EIDL program, such as real estate developers and multilevel marketers. SBA officials said that the CARES Act permitted businesses to self-certify their eligibility for EIDL loans and advances.

Therefore, we recommended in January 2021 that to improve SBA’s oversight of its EIDL approval process, SBA should develop and implement portfolio-level data analytics across EIDL loans and advances made in response to Coronavirus Disease 2019 (COVID-19) as a means to detect potentially ineligible and fraudulent applications.

SBA neither agreed nor disagreed with our recommendation. SBA took issue with our finding that potentially ineligible businesses received EIDL advances and loans. SBA stated that CARES Act provisions permitted businesses to self-certify their eligibility and that applicants could not proceed until they certified that they were not engaged in any of the prohibited activities. The agency also stated that a business being in one of the categories we deemed ineligible did not automatically mean the business was ineligible. However, we did not state that the businesses were automatically ineligible.

SBA also referred to actions the agency takes to make sure ineligible businesses do not receive EIDL loans and advances, such as manual review of applications from businesses in prohibited categories, but did not state any plans to conduct data analytics to identify potential ineligible businesses. We maintain that portfolio-level data analytics could help SBA improve its management of fraud risk.

In December 2020, Congress appropriated an additional $20 billion for targeted EIDL advances. The advances are restricted to certain eligible companies that are located in low-income communities, have suffered an economic loss of more than 30 percent, and have no more than 300 employees. Congress also required SBA to perform eligibility verification for advances and permitted SBA to require additional information from applicants, such as tax returns, for loans and advances as part of its verification.

Risk of improper payments and fraud. The limited safeguards when approving PPP and EIDL loans may have increased SBA’s susceptibility to improper payments and fraud.

As we reported in November 2020, it is especially important for agencies with large appropriated amounts, like SBA, to quickly estimate their improper payments, identify root causes, and develop corrective actions when there are concerns about the possibility that improper payments, including those resulting from fraudulent activity, could be widespread.

Because SBA had not done so for PPP, we recommended that SBA expeditiously estimate improper payments and report estimates and error rates for PPP due to concerns about the possibility that improper payments, including those resulting from fraudulent activity, could be widespread. In December 2020, SBA stated that it was planning to estimate improper payments for PPP and that it works to minimize them in its loan programs. However, as of that date the agency had not provided documentation of its plans for testing, including estimates of improper payments and error rates for PPP.

In January 2021, we reported on potentially suspicious activity in the PPP and EIDL programs. Between May and October 2020, financial institutions filed more than 21,000 and 20,000 suspicious activity reports (SAR) related to PPP and EIDL, respectively, with the Financial Crimes Enforcement Network (FinCEN). More than 1,400 institutions had filed SARs related to PPP, and more than 900 institutions had filed SARs related to EIDL.

According to FinCEN officials, these financial transactions involved questionable activity and potential fraud committed by PPP and EIDL loan recipients, such as the rapid movement of funds, and possible identity theft and forgeries. Law enforcement agencies use these reports to help support investigations, such as those related to PPP or EIDL.

In addition to suspicious activity reported by financial institutions, the Department of Justice (DOJ) has publicly announced charges in more than 90 cases related to PPP and EIDL. The charges—filed across the U.S. and investigated by a range of law enforcement agencies—include allegations of making false statements and engaging in identity theft, wire and bank fraud, and money laundering. As of November 2020, DOJ estimated that the defendants in the PPP-related cases sought more than $260 million from PPP.

Moreover, in October 2020, the SBA Office of Inspector General (OIG) reported that its preliminary review revealed strong indicators of widespread potential fraud in the EIDL program. According to the report, the OIG and other law enforcement agencies had seized over $450 million from over 15,000 fraudulent EIDL loans. According to SBA officials, they are working with law enforcement, such as the SBA OIG, to support data requests and make referrals for potential investigation.

Inability to support its accounting and related controls. In December 2020, SBA’s independent financial statement auditor issued a disclaimer of opinion on SBA’s consolidated financial statements as of and for the year ended September 30, 2020, meaning the auditor was unable to express an opinion due to insufficient evidence. As the basis for the disclaimer, the auditor stated that SBA was unable to provide adequate documentation to support a significant number of transactions and account balances related to PPP and EIDL due to inadequate processes and controls.

The auditor identified several material weaknesses in controls related to SBA’s CARES Act programs, including PPP and EIDL. In total, the auditor identified seven material weaknesses related to the following areas: (1) PPP loan approvals, (2) PPP reporting, (3) PPP cost estimates, (4) EIDL loans and advance approvals, (5) EIDL contractor oversight, (6) PPP and other loan guarantee program contractor oversight, (7) overall management controls (e.g., ineffective control environment, risk assessment processes, control activities, information and communication processes, and monitoring processes). Overall, the auditor made 46 recommendations to SBA management. In commenting on the audit, SBA stated it supports the requirements for auditability of its financial statements and is working to correct shortcomings for future audits.

In its discussion of material weaknesses related to PPP, the auditor noted there were over 2 million approved PPP loans (with an approximate total value of $189 billion) flagged by management that are potentially not in conformance with the CARES Act and related legislation. The loans were flagged for one or more of 35 reasons (such as borrower with criminal record or inactive business). In addition, the auditor found that SBA reported approximately $6 billion of PPP loans approved but not disbursed due to unsubmitted or unprocessed reports from lenders. The audit noted there were over 896,000 errors from lender reporting that were identified but not reviewed or processed. The auditor recommended, among other things, that SBA review loans with incomplete or inaccurate reporting and update records as appropriate.

In its discussion of material weaknesses related to EIDL loans and advances, the auditor noted that there were a total of over 6,000 approved and disbursed loans (with a total value of over $212 million) flagged within the loan repository system that were issued to potentially ineligible borrowers. In addition, management noted that adequate controls were not designed and implemented to determine that fraud alerts raised in SBA’s lending portal were sufficiently addressed before loans were approved. The auditor noted SBA management did not have adequate procedures and controls implemented to address certain alerts—such as those triggered when a bank account or routing number could not be verified or when a public records search could not find a business. The auditor recommended, among other things, that SBA perform a thorough review of EIDL loans and advances to identify those not in conformance with the CARES Act and related legislation.

In its discussion of the weaknesses related to overall management controls, the auditor noted deficiencies within all components of internal control. The auditor noted the weaknesses were primarily caused by the prioritization and the urgent need to implement the provisions of the CARES Act and related legislation as quickly and efficiently as possible over internal control processes. The auditor recommended, among other things, that SBA perform and document a thorough risk assessment, develop and implement monitoring controls, and document the internal controls related to implementation of the CARES Act and related legislation.