U.S. Department of Health and Human Services 
Office of Inspector General 
 
Recommendation 
Followup:  
Vulnerabilities 
Continue To Exist 
in the HHS Small 
Business 
Innovation 
Research Program 
 
Suzanne Murrin 
OEI-04-18-00230 
Deputy Inspector General 
March 2019 
for Evaluation and 
 
Inspections 
oig.hhs.gov  Report in Brief  U.S. Department of Health and Human Services 
March 2019 
Office  of Inspector General 
OEI-04-18-00230 
 
 
Recommendation Followup:  Vulnerabilities 
Why OIG Did This Review 
Continue To Exist in the HHS Small Business 
We conducted this review to 
determine whether HHS had 
Innovation Research Program 
addressed known vulnerabilities in its 
oversight of the SBIR program 
What OIG Found 
to ensure that program funds were 
Key Takeaway 
The Office of Inspector General (OIG)  being spent appropriately.  In 2014, 
HHS has taken minimal steps to 
continues to find vulnerabilities in the  we reported vulnerabilities with HHSs 
strengthen program safeguards 
Department of Health and Human  SBIR program and made four 
per OIG recommendations, which 
Services (HHS) Small Business  recommendations to improve HHSs 
is allowing potentially ineligible 
Innovation Research (SBIR) program  awardees to receive funds and  oversight.  HHS implemented two 
regarding awardee eligibility and  potentially duplicative funding to  recommendations from our 
duplicative funding, and OIG has  occur.    2014 report prior to this review.  
concerns about the effectiveness of  However, HHS had not formally 
HHSs oversight.  Specifically, HHS has  notified OIG of any actions to 
taken minimal action to improve policies and procedures for ensuring awardee  implement the two outstanding 
eligibility and has taken no action to improve policies and procedures for  recommendationswith which HHS 
preventing duplicative funding.  We also identified inconsistencies in SBIR  had concurredregarding awardee 
policies and procedures among HHS Operating Divisions (OpDivs); these  eligibility and duplicative funding. 
inconsistencies may indicate that the Office of the Assistant Secretary for 
Since implementation of the SBIR 
Financial Resources is not fulfilling its responsibilities to coordinate compliance 
program in 1982, HHS has obligated 
and ensure consistent implementation of SBIR requirements across HHS 
or awarded nearly $13 billion in 
OpDivs.  
awards to small businesses pursuing 
To better gauge the impact of these continued vulnerabilities, OIG conducted  innovative research ideas.   
a risk assessment, and we identified 32 awardees (out of a total of 
800 awardees that received funds in 2015 or 2016) as high risk.  We conducted  How OIG Did This Review 
further analysis on this small sample of awardees and determined that over  To assess HHSs progress in 
two-thirds of them (22 of the 32 awardees we found to be high risk) were  implementing the two outstanding 
potentially ineligible or potentially receiving duplicative funding.  These  recommendations, we reviewed 
22 awardees have received over $140 million in HHS SBIR funding.  Because of  information from HHS regarding 
the significance of the vulnerabilities we identified, OIG and HHS initiated  actions it had taken specific to these 
investigations or audits of over half (13 of 22) of these awardees.  recommendations.  Approximately 
800 awardees received HHS SBIR 
What OIG Concludes 
funds in 2015 or 2016.  Of these 
The two outstanding OIG recommendationsregarding awardee eligibility and  awardees, we identified 32 as high risk 
duplicative fundingremain unimplemented and HHSs SBIR program  and conducted further analysis to 
continues to have weaknesses in these two areas.  To assist HHS in  determine potential vulnerabilities.  
implementing these recommendations, we suggest a number of actions that  To determine whether the two 
the Department could take to address these weaknesses.    outstanding recommendations should 
be considered implemented, we 
In response to this report, HHS stated that it considers both outstanding 
weighed any improvements that HHS 
recommendations to be implemented because its policies and procedures are 
made to its policies, procedures, 
compliant with applicable requirements.  However, meeting the minimum 
and/or practices against any concerns 
requirements does not fulfill OIGs outstanding recommendations, nor does it 
that we identified in the award files 
appear that it sufficiently prevents fraud, waste, and abuse in the SBIR program.
and the significance of those 
concerns.   
Full report can be found at oig.hhs.gov/oei/reports/oei-04-18-00230.asp   
TABLE OF CONTENTS 
BACKGROUND  1 
Methodology  4 
   
FINDING   
HHS has not implemented OIG recommendations to ensure SBIR awardee eligibility and  6 
prevent duplicative funding  
   
CONCLUSION   10 
   
AGENCY COMMENTS AND OIG RESPONSE  13 
   
APPENDIX:  AGENCY COMMENTS   14 
   
ACKNOWLEDGMENTS  16 
 
   
BACKGROUND 
 
Objective 
 
1.  To assess whether the Department of Health and Human Services 
  (HHS) addressed the unimplemented recommendations from 
a previous Office of Inspector General (OIG) report to ensure that 
awardees of Small Business Innovation Research (SBIR) program 
funds awardees are eligible and to prevent duplicative funding. 
2.  To determine whether HHS funded SBIR awards for ineligible 
awardees or SBIR awards that were duplicative. 
Rationale    Since implementation of the SBIR program in 1982, HHS has consistently 
funded one of the largest amounts of SBIR awards in the Federal 
government to small businesses pursuing innovative research ideas.  
The Small Business Administration (SBA), which aids small businesses and 
coordinates the SBIR program across the Federal government, considers 
SBIR awards to be high-risk funding.1  HHS has obligated or awarded nearly 
$13 billion in awards since the program began.2-3  In 2017 alone, HHS 
allocated approximately $870 million in SBIR awards.4    
In a 2014 OIG report, we raised concerns about vulnerabilities in the HHS 
SBIR program, including the inability to evaluate the programs success and 
the reliance on self-reported information to determine whether awardees 
were eligible and were not receiving duplicative funding from other Federal 
agencies.5  In May 2018, the SBIR awardee MassTechwhich had been 
funded by multiple agencies, including HHSagreed to a $1.9 million 
settlement with the United States to resolve allegations that it had falsely 
stated its eligibility as a small business.6 
OIG made four recommendations in the 2014 report.  HHS implemented 
two of these recommendationsthe ones for it to (1) create a central office 
to oversee the SBIR program and (2) collect information to track and assess 
the commercialization of SBIR-funded projects.  The other two 
recommendationsstill outstanding at the time we began this followup 
reviewwere for HHS to (1) ensure awardee compliance with SBIR eligibility 
requirements and (2) improve procedures to check for duplicative awards.  
HHS concurred with both recommendations, but it has not formally 
reported to OIG any action to implement them.     
Created by the Small Business Innovation Development Act of 1982, the 
Federal SBIR 
SBIR program is a competitive awards program that provides Federal 
Program 
funding to small businesses that pursue research for potential 
commercialization that meets the priorities of the Federal Government.7,8  
Agencies housed within a Federal department and other independent 
Federal agencies (hereinafter referred to as agencies) must participate in 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  1 
OEI-04-18-00230   
the SBIR program if they fund over $100 million in extramural research and 
development.9  Currently, 11 agencies participate in the SBIR program.10 
SBA maintains a public database with SBIR awardee information.11  SBA also 
issues policy directives that contain requirements to guide Federal agencies 
implementation of the SBIR program.  SBA reviews agencies progress and 
reports program results to Congress annually.12 
HHS SBIR  Within HHS, four operating divisions (OpDivs) participate in the SBIR 
program:  the National Institutes of Health (NIH); the Centers for Disease 
Participation  
Control and Prevention (CDC); the Food and Drug Administration (FDA); 
and the Administration for Community Living (ACL).13  NIH funds the vast 
majority of HHS SBIR awards.14  In 2017, NIH obligated approximately 
$825 million in SBIR awards, while CDC, FDA, and ACL together obligated 
approximately $40 million in total awards.15    
Federal law establishes some requirements for the SBIR program but also 
allows agencies flexibility in managing their individual programs.  In HHS, 
each OpDiv is responsible for overseeing its own awards, and since 2016, 
the Office of the Assistant Secretary for Financial Resources (ASFR) has been 
responsible for coordinating compliance and ensuring consistency in 
implementation of the OpDivs SBIR programs.  NIH also provides some 
coordination among the other OpDivsfor example, it solicits SBIR 
proposals on behalf of CDC and FDA.16  However, NIH does not oversee the 
other OpDivs SBIR programs.  OpDivs make their own funding decisions, 
and each must adhere to SBAs SBIR Policy Directives to ensure program 
integrity.   
SBIR Requirements  In the SBIR Policy Directive for agencies, two of the requirements related to 
preventing fraud, waste, and abuse pertain to ensuring awardee eligibility 
for Eligibility and 
and preventing duplicative awards.17  
Duplicative Funding 
Ensuring awardee eligibility  
As a part of its oversight responsibilities, each agency must ensure that 
applicants comply with program eligibility requirements before they receive 
SBIR awards.  Among other eligibility criteria, agencies must ensure that the 
applicant:  
  has a principal investigator (the primary researcher who conducts 
and oversees the research project) who is primarily employed by the 
small business;18 
  will perform the required amount of research or analytical effort (i.e., 
does not plan to subcontract a significant portion of the work);   
  has 500 or fewer employees, including affiliates;  
  maintains a place of business in the United States and operates 
primarily within the United States; and 
  is organized as a for-profit entity.  
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  2 
OEI-04-18-00230   
At the time of our 2014 report, HHS OpDivs ensured that awardees were 
eligible by requiring them to certify that they intended to meet all eligibility 
requirements at the time of award.  NIH also used a procedure to request 
additional self-reported information, as needed, from applicants before 
giving them funding.19  In addition, when agencies that grant SBIR awards 
identify an applicant that may not meet eligibility requirements at the time 
of the award, the agencies are requiredand continue to be requiredto 
file a request with SBA.  SBA then assesses the applicants eligibility on all 
requirements.20 
In 2014, we reported concerns with the effectiveness of HHS procedures to 
ensure applicant eligibility.  Using a stratified, projectable sample of nearly 
1,000 SBIR awards funded across HHS OpDivs in 2011, we found that 
31 percent of awardees appeared to have questionable or unverified 
eligibility for at least one requirement, according to independent research 
we conducted.21  All of these awardees had certified their eligibility to HHS 
at the time of award.  
As a result, we recommended that HHS ensure awardee compliance with 
SBIR eligibility requirements.22  We suggested that to do this, HHS could:  
1.  implement a standardized process for verifying that a random 
sample or risk-based sample of awardees meet all eligibility 
requirements at the time of the award,  
2.  require applicants to provide proof that they will meet eligibility 
requirements at the time of the award, and  
3.  request SBA assistance to verify awardee eligibility.  
Since OIGs 2014 report, the SBIR Policy Directive has added new standards 
related to ensuring awardee eligibility:   
  Lifecycle certifications.  The SBIR Policy Directive now requires 
agencies to ensure awardee eligibility not just at the time of the 
award but also at various points throughout the lifecycle of the 
award.23  This helps ensure that as the award progresses, the 
awardees status has not changed in a way that affects its eligibility 
to continue receiving SBIR funds (e.g., if the principal investigator 
had changed to someone who is not primarily employed by the 
awardee, or if the small business had been purchased by a large 
corporation).  Increasingly, the Department of Justice is requiring 
lifecycle certifications before proceeding with criminal and civil 
prosecutions. 
  Fraud indicators.  The SBIR Policy Directive now directs agencies to 
work with the agencys OIG with regard to its efforts to establish 
fraud detection indicators.24  However, the requirement does not 
indicate that agencies must use or implement these fraud indicators 
in practice.  Identifying a standard set of fraud indicators and 
assessing each applicant on those indicators may be a useful way to 
identify applicants or awardees that pose a high risk for fraud, waste, 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  3 
OEI-04-18-00230   
or abuse.  NIH worked with our office, as well as with CDC and FDA, 
to develop a list of indicators of possible fraud for SBIR applicants 
and awardees.25  At the time that NIH developed this list, ACL was 
not funding SBIR awards, so NIH did not solicit ACL for input.   
Ensuring that awards are not duplicative 
Each participating agency must also develop policies and procedures to 
avoid funding SBIR work that is essentially equivalent (i.e., duplicative) to 
work funded by another agency or the same agency.26  This includes 
projects funded with SBIR money or any other Federal funds.   
At the time of our 2014 report, NIH stored data on HHS SBIR awardees and 
their projects on an internal HHS database that the other OpDivs could 
access.  NIH also provided all HHS awardee data to SBIR.gov.  NIH required 
applicants to disclose other active and pending financial support as part of 
its procedures to solicit additional self-reported information for grants.  
However, NIH did not require applicants to provide information on past 
awards, and it did not independently verify that applicants had disclosed all 
other active and pending financial support.   
In 2014, OIG found that within HHS, only NIH checked for duplicative 
funding within HHS, and no OpDivs completed the required check for 
duplicative awards across all Federal agencies.27  We therefore 
recommended that HHS improve procedures to check for duplicative 
awards.  We specifically suggested that HHS develop procedures beyond 
NIHs practice of requiring awardees to self-report additional information.  
We also noted that the new procedures should be consistent across HHS 
OpDivs to ensure that all SBIR applicants receive the same scrutiny 
regarding duplicative awards.   
Related Work  In 2017, the Government Accountability Office (GAO) found that NIH had 
implemented minimum requirements regarding ensuring awardee eligibility 
and preventing duplicative funding. 28  However, OIG believes that meeting 
the minimum requirements alone may not be enough to adequately protect 
this program.  In addition, GAO identified activities that agencies conducted 
to prevent fraud, waste, and abuse in their respective SBIR programs.29  
These included conducting in-person or virtual site visits of SBIR awardees; 
establishing offices or working groups within the agency specific to 
preventing fraud, waste, and abuse; holding orientation meetings with 
awardees to discuss rules and requirements; and requiring more 
certifications and reporting of awardee information than what is required in 
the policy directive.  GAO did not identify HHS as conducting any of these 
additional activities. 
Methodology  We reviewed the progress that HHS has made regarding the two 
outstanding recommendations from our 2014 report.  We collected 
information from HHS to assess its current policies, procedures, and 
practices to ensure that awardees are eligible and that awards are not 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  4 
OEI-04-18-00230   
duplicative.  We determined the extent to which these policies, procedures, 
and/or practices address the vulnerabilities identified in the 2014 report and 
whether we should consider the two recommendations to be implemented.   
To obtain HHSs policies and procedures, we requested from each OpDiv 
documentation of all actions it had taken since 2014 (e.g., formal, informal, 
or draft policy and procedure documents, emails, training materials) 
to ensure compliance with SBIR eligibility requirements and to check for 
duplicative awards.  We also requested documentation regarding ASFRs 
monitoring and oversight of HHS OpDivs regarding checks to ensure 
eligibility and prevent duplicative funding.     
To assess HHS practices, we reviewed a sample of 32 SBIR awardees that we 
identified as high risk.  To do this, in June 2016, we downloaded from the 
publicly available database at SBIR.gov the population of SBIR awards that 
HHS funded during award years 2015 or 2016.  This population consisted of 
1,074 awards for approximately 800 awardees, and these awards were for 
various lengths spanning 2014 through 2019.  We determined whether each 
award in this population demonstrated certain fraud indicators (e.g., the 
company address in the SBIR.gov data appeared to be a residential 
address).  We conducted additional Internet research on the resulting 
92 awardsrepresenting 70 awardeesto identify any initial concerns with 
eligibility and/or duplicative funding.30  From the results of our Internet 
research, we identified 32 awardees in our sample as high risk.  We then 
obtained and reviewed the HHS award files for these awardees to identify 
potential concerns regarding eligibility or duplicative funding.  For any 
concerns that we identified, we coordinated with other OIG components 
and with HHSprimarily, NIHs Office of Management Assessmentto 
determine whether the vulnerabilities warranted opening audits or 
investigations.   
To determine whether the two remaining recommendations should be 
considered implemented, we weighed any improvements that HHS made to 
its policies, procedures, and/or practices against any concerns we identified 
in the award files and the significance of those concerns.   
Limitations  We did not independently verify the completeness of the award files we 
received from HHS.  However, if we suspected that documentation was 
missing, we followed up and requested those documents.  For example, we 
requested correspondence between HHS and awardees for all awardees in 
our sample.  For some awardees, we did not receive any correspondence 
from HHS, so we followed up and requested it again.  In some cases, we 
received this additional documentation.    
Standards  We conducted this study in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General on 
Integrity and Efficiency. 
   
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  5 
OEI-04-18-00230   
FINDINGS 
HHS has not  Since our 2014 report, HHS has taken only limited action to address the 
vulnerabilities we identified regarding awardee eligibility and duplicative 
implemented OIG 
funding.  Specifically, HHS OpDivs have taken minimal action to improve 
recommendations 
policies and procedures for ensuring awardee eligibility, and they have 
to ensure SBIR  taken no action to improve policies and procedures for preventing 
awardee eligibility  duplicative funding.  Further, OpDivs current practices in both of these 
areas are not effective, as we identified a total of 22 awardees that 
and prevent 
appeared to be ineligible and/or to be receiving duplicative funding.  (All 
duplicative funding 
22 awardees appeared ineligible, and 1 of the 22 also appeared to be 
receiving duplicative funding.)  We also identified inconsistencies among 
OpDivs in their SBIR policies and procedures, which indicates that ASFR is 
not fulfilling its responsibilities to coordinate compliance and ensure 
consistency in implementation of the OpDivs SBIR programs. 
HHS allowed potentially ineligible awardees to receive SBIR funds 
In response to our 2014 recommendation for HHS to ensure that awardees 
comply with SBIR eligibility requirements, HHS has taken limited action.  For 
example, some of the HHS OpDivs have conducted limited trainings and 
established checklists for staff to use when making eligibility determinations.  
However, these checklists vary across the OpDivs, and when we reviewed 
award files, we did not see consistent use of these checklists in practice.  
Further, although ASFR provided a document that outlined its coordination 
and oversight responsibilities, ASFR did not provide any documentation or 
other evidence demonstrating actions that it has taken to implement this 
policy (e.g., efforts it has taken to coordinate compliance and ensure 
consistency in oversight of awardee eligibility across the OpDivs).   
Further, HHS has not taken other actions we recommended in 2014 that 
could help ensure awardees comply with eligibility requirements.  
Specifically, HHS has not implemented a standardized process for verifying 
that a random sample or risk-based sample of awardees meet all eligibility 
requirements at the time of the award, nor has HHS required applicants to 
provide proof that they will meet eligibility requirements at the time of the 
award.  Although HHS must request SBA assistance when an applicant does 
not appear to meet eligibility requirements, NIH explained to us that it does 
this only on a case-by-case basis.31  Further, HHS has requested SBA 
assistance for only four applicants since 2014.  Since our 2014 report, the 
share of such requests out of the total number of awards that HHS has 
funded has actually decreased.  See Exhibit 1.   
 
 
   
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  6 
OEI-04-18-00230   
Exhibit 1:  Since 2014, HHS has decreased the percentage of SBIR 
awardees for which it has sought SBA eligibility determinations 
 
2014 Report* 2019 Report**
800 awardees 3,500 awardees
4 SBA eligibility  4 SBA eligibility 
determinations determinations
0.5% of awardees 0.1% of awardees
 
Source:  OIG analysis in 2018 of SBIR.gov and HHSs documentation of SBA eligibility checks in 2011 and 
2014-2018.  
* The 2014 report used data for awards funded in 2011.  
** The 2019 report uses data for awards funded between 2014 and 2018.   
 
HHS has made limited progress in addressing the new requirements that 
the SBIR Policy Directive added regarding awardee eligibility.  The actions 
that HHS took in these areas were in addition to our recommendations from 
2014, as the SBIR Policy Directives new requirements went into effect after 
the time period of our 2014 review.     
  Lifecycle certifications.  As of 2018, NIHs practice was to require 
awardees to complete lifecycle certifications and keep them on file 
at the awardees location; NIH did not collect the certifications from 
awardees.32  Effective January 2019, NIH, CDC, and FDA are requiring 
awardees to submit lifecycle certifications to the respective OpDiv 
funding the award.33  However, the revised policy does not indicate 
whether OpDiv staff will review and independently research the 
information on these certifications to ensure that awardees continue 
to be eligible.34  The policy also does not indicate whether or how 
followup will occur if there are eligibility concerns.  In addition, the 
new 2019 procedures do not include ACL.  Currently, ACL requires 
awardees to complete the lifecycle certifications and keep them on 
file at the awardees location.  ACL requests that the awardee email 
or upload the lifecycle certification to the project officer, but it does 
not require them to do so.   
  Fraud indicators.  NIH distributed to CDC, FDA, and ACL the list of 
SBIR fraud indicators that NIH had developed in collaboration with 
OIG.  However, neither the OpDivs nor ASFR has provided guidance 
to staff on how to use this list of fraud indicators (e.g., what sources 
to use to determine whether the fraud indicators are present for 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  7 
OEI-04-18-00230   
an awardee, what action to take if any fraud indicators are 
identified).  Further, we did not see any consistent evidence in the 
award files that OpDiv staff consulted the list of fraud indicators 
while reviewing award fileswe did not find completed checklists or 
other notes to show that staff found the same fraud indicators that 
we found in our examination of award files. 
Despite the actions that HHS has taken, we continue to identify potentially 
ineligible awardees that received HHS SBIR funds.  Of the 32 awardees we 
identified as high risk, 22 awardees appeared to not meet at least 1 SBIR 
eligibility requirement.  The specific eligibility concerns we identified among 
these 22 awardees are: 
  15 awardees had principal investigators who appeared to be 
primarily employed by a company other than the SBIR awardee; 
  4 awardees appeared not to be performing the required amount of 
research or analytical effort themselves (i.e., the awardees planned 
to subcontract a significant portion of the work);   
  4 awardees (including affiliates) appeared to be employing more 
than 500 individuals; 
  2 awardees appeared to be operating primarily outside the United 
States; and 
  0 awardees appeared to be nonprofit entities; however, 3 awardees 
appeared to be relying significantly on resources from nonprofit 
entities. 
These 22 awardees have received over $140 million in HHS SBIR funding.35  
Partly because of the significance of the eligibility concerns we identified, 
OIG and HHS initiated investigations or audits of 13 of these awardees. 
HHS may have funded SBIR awards that were duplicative of other 
awards 
HHS has not taken action in response to our recommendation to improve 
policies and procedures to ensure HHS does not fund duplicative awards.  
Specifically, since 2014, none of the OpDivs has provided evidence that it 
has improved policies or procedures to check for duplicative awards across 
all Federal agencies.   
  NIH did not provide any documentation to demonstrate that it had 
made any improvements to its policies or procedures.  Further, we 
did not see evidence in grant files that NIH had made 
improvements.  That is, NIH did not document in any files we 
reviewed that it had independently verified awardees self-reported 
information or whether applicants disclosed all other active and 
pending financial support. 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  8 
OEI-04-18-00230   
  CDC provided documentation that demonstrated potential 
improvements to its policies and procedures.  However, this 
documentation appeared to have been created in response to our 
data request and did not appear to be formal CDC policy.  We did 
not review CDC grant files to determine the extent to which this 
document reflects actual CDC practice.   
  FDA stated that it now adheres to NIHs policies and procedures; 
however, it did not provide evidence of these improvements, and we 
did not review FDA grant files to determine if any improvements had 
been made. 
  We did not include ACL in our 2014 report, and we therefore cannot 
determine whether it has improved its policies since that time.  ACL 
has stated that it adheres to NIHs policies and procedures, but we 
did not see evidence of it in the grant files we reviewed.   
Further illustrating the insufficiency of these actions in accomplishing 
effective oversight, the current methods allowed at least one potentially 
duplicative award in our review.  This awardee also had at least one 
eligibility concern that we identified.  The awardee received over $1.6 million 
in HHS SBIR funding since 2010, as well as funding from other Federal 
agencies.  Partly as a result of concerns about the potentially duplicative 
funding we identified, multiple Federal agencies, including HHS OIG, have 
initiated an investigation of this awardee.    
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  9 
OEI-04-18-00230   
CONCLUSION  
The SBIR program provides high-risk funding to startups and small 
businesses, and the program has specific eligibility requirements.  Therefore, 
it is crucial that HHS ensure consistent and effective oversight of the 
program.  In 2014, we identified several vulnerabilities within the program 
and recommended that HHS implement actions to address these concerns.  
However, HHS has taken limited action since 2014 regarding these 
vulnerabilities, and we continue to have concerns about HHSs oversight of 
the SBIR program.  Specifically, our two recommendations that were 
outstanding at the time we began this review remain unimplemented:     
  HHS should ensure awardee compliance with SBIR eligibility 
requirements. 
  HHS should improve procedures to check for duplicative awards. 
Although GAO found in 2017 that NIH is meeting the minimum 
requirements regarding checking eligibility and duplicative funding, our 
findings indicate that meeting the minimum requirements alone does not 
adequately protect the SBIR program.  Furthermore, because HHS funds 
one of the largest SBIR programs in the Federal government, the 
Department should be at the forefront of efforts to prevent fraud, waste, 
and abuse in the program.  However, HHSs oversight is lacking compared 
to that of other agencies whose activities GAO described.   
We continue to advise HHS that to implement both of our unimplemented 
recommendations, it should take the four actions we listed in our 
2014 report.  In this 2019 report, we provide further clarification regarding 
those actions.  (Additionally, we will be sending separately to HHS a list of 
all the awardees that are not being investigated by OIG, so that HHS can 
address the vulnerabilities identified in this report.)  Specifically, we suggest 
that OpDivs do the following to implement OIGs two outstanding 
recommendations: 
  Implement a standardized process for verifying that a random 
sample or risk-based sample of awardees meet all eligibility 
requirements at the time of the award and during the lifecycle of the 
award.   
 
To do this, each OpDiv could conduct a risk assessment of each 
awardee both pre-award and at various points throughout the 
lifecycle of the awards.  We reviewed the award files for a small 
percentage of HHS SBIR awardees in 2015 or 2016.  This review 
demonstrates the effectiveness of this type of risk assessment, as 
over two-thirds of the awardees (22 of 32 awardees) that we 
identified as high risk were ones that we later determined 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  10 
OEI-04-18-00230   
to be potentially ineligible or potentially receiving duplicative 
awards.  These 22 awardees have received over $140 million in HHS 
SBIR funding.  Further, OIG and HHS initiated investigations or 
audits of over half of these awardees (13 of 22 awardees).   
 
As a part of the risk assessment, OpDivs could conduct independent 
research on the applicants and awardees beyond the information 
that awardees self-report.  In addition, the OpDivs could collect 
proof of applicant and awardee eligibility both at the time of the 
award and throughout the lifecycle of the award.  For example, 
OpDiv staff could conduct in-person or virtual site visits for 
applicants or awardees that have reported what the OpDiv deems to 
be questionable information as to the location where the awardee 
will perform the work.  That is, these site visits could help ensure that 
the awardees have sufficient space to do the research described in 
the application, that the location matches the location listed in the 
application, and that the awardee has access to the space listed in 
the application.     
 
In addition, in light of new SBIR Policy Directive requirements since 
2014, OpDivs could useat a minimumthe fraud indicators and 
lifecycle certifications when conducting the risk assessments.  
Because the fraud indicators are relevant to both of our 
recommendations, this risk assessment could both evaluate 
an awardees eligibility and identify any potential duplicative 
funding.  ASFR could also standardize the risk assessments across 
and within OpDivs so that each awardee is assessed fairly and 
consistently within HHS.  In developing the risk assessments, HHS 
will need to define high risk.  In creating this definition, HHS may 
wish to consider factors such as the dollar amounts of an awardees 
current award and overall awards and any previous performance 
problems.  As an interim measureuntil HHS establishes these 
definitions and a process for identifying high-risk awardees in 
a standardized mannereach OpDiv could independently verify 
that a random sample of its SBIR awardees meet all eligibility 
requirements at the time of the award and during the lifecycle of the 
award. 
 
  Request SBA assistance to verify awardee eligibility.   
 
The OpDivs may wish to do this only for applicants or awardees that 
it identifies as high risk.  
 
   
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  11 
OEI-04-18-00230   
  Develop proceduresbeyond collecting only self-reported 
informationto check for duplicative funding immediately before 
funding awards.   
 
OpDivs could proactively search award sitesboth internal HHS 
award sites and external Federal award sitesto determine the 
extent to which awards are duplicative within HHS, across Federal 
agencies, and over time.  These searches could reveal potential 
duplicative funding that awardees failed to self-report.      
In 2014, we recommended that HHS create a central office to oversee the 
SBIR program and facilitate the consistent implementation of our remaining 
recommendations.  Though HHS implemented this recommendation by 
allocating to ASFR the responsibility for compliance, oversight and 
consistency across HHSs SBIR program, we continue to see and be 
concerned by inconsistencies that we identified across HHS OpDivs.  We 
believe that in its new role coordinating OpDivs, ASFR could continue to 
address these concerns by taking a larger coordinating role in both 
implementing these recommendations and ensuring consistency across 
OpDivs.  For exampleonce ASFR has taken the suggested actions to 
address these unimplemented recommendationsASFR may want to 
ensure that HHS OpDivs conduct training for all staff who review SBIR 
awards on the new procedures, and that they do so at regular intervals 
(e.g., upon initial employment and annually thereafter).  Additionally, ASFR 
may also want to ensure that the OpDivs monitor that these new 
procedures are being consistently used in practice and are being 
documented in all awardee grant files. 
 
 
   
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  12 
OEI-04-18-00230   
AGENCY COMMENTS AND OIG RESPONSE 
HHS considers the two outstanding recommendations from the 2014 OIG 
report to be fully implemented.  HHS reiterates its belief that its policies and 
procedures for ensuring SBIR awardee eligibility and identifying duplicative 
funding are fully compliant with all applicable requirements.  HHS also 
points to the 2017 GAO report that found NIH to have met all minimum 
requirements regarding ensuring awardee eligibility and preventing 
duplicative funding.  
HHS states that furthermore, it is constantly working to maintain successful 
implementation of, compliance with, and oversight of the program.  It states 
that it will continue efforts to ensure compliance, oversight, and consistency 
across OpDivs to strengthen the SBIR program.  For example, HHS is 
considering leveraging technology resources that may provide greater 
support in ensuring compliance throughout the SBIR award life cycle.   
OIG continues to consider both of the recommendations from our 
2014 report to be unimplemented because HHS has not taken sufficient 
action to address the vulnerabilities we identified.  HHS has not 
implemented a standardized process for verifying that a random sample or 
risk-based sample of awardees meet all eligibility requirements, as 
recommended by OIG.  HHS also has not developed procedures to check 
for duplicative funding beyond collecting self-reported information from 
applicants regarding current awards, pending awards, and past awards. 
Meeting the minimum requirements does not fulfil OIGs outstanding 
recommendations, nor does it appear to be sufficiently preventing fraud, 
waste, and abuse in the SBIR program.  Despite the actions that HHS has 
taken, OIG identified 22 awardees that were potentially ineligible or 
potentially receiving duplicative awards. 
For the full text of ASFRs comments, see the Appendix.  
 
   
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  13 
OEI-04-18-00230   
APPENDIX:  Agency Comments 
 
 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  14 
OEI-04-18-00230   
 
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  15 
OEI-04-18-00230   
 
ACKNOWLEDGMENTS 
Lauren Buss served as the lead analyst for this study.  Others in the Office of 
Evaluation and Inspections who conducted the study include Lucio Verani.  
Office of Evaluation and Inspections staff who provided support include 
Althea Hosein, Seta Hovagimian, and Christine Moritz.  
This report was prepared under the direction of Dwayne Grant, Regional 
Inspector General for Evaluation and Inspections in the Atlanta regional 
office, and Jaime Stewart, Assistant Regional Inspector General.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
To obtain additional information concerning this report or to obtain copies, 
contact the Office of Public Affairs at Public.Affairs@oig.hhs.gov.  
Recommendation Followup:  Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program  16 
OEI-04-18-00230   
ABOUT THE OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public 
Law 95-452, as amended, is to protect the integrity of the Department of 
Health and Human Services (HHS) programs, as well as the health and 
welfare of beneficiaries served by those programs.  This statutory mission is 
carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit  The Office of Audit Services (OAS) provides auditing services for HHS, either 
by conducting audits with its own audit resources or by overseeing audit 
Services 
work done by others.  Audits examine the performance of HHS programs 
and/or its grantees and contractors in carrying out their respective 
responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, 
abuse, and mismanagement and promote economy and efficiency 
throughout HHS. 
Office of Evaluation  The Office of Evaluation and Inspections (OEI) conducts national evaluations 
to provide HHS, Congress, and the public with timely, useful, and reliable 
and Inspections 
information on significant issues.  These evaluations focus on preventing 
fraud, waste, or abuse and promoting economy, efficiency, and 
effectiveness of departmental programs.  To promote impact, OEI reports 
also present practical recommendations for improving program operations.   
Office of  The Office of Investigations (OI) conducts criminal, civil, and administrative 
investigations of fraud and misconduct related to HHS programs, 
Investigations 
operations, and beneficiaries.  With investigators working in all 50 States 
and the District of Columbia, OI utilizes its resources by actively 
coordinating with the Department of Justice and other Federal, State, and 
local law enforcement authorities.  The investigative efforts of OI often lead 
to criminal convictions, administrative sanctions, and/or civil monetary 
penalties. 
Office of Counsel to  The Office of Counsel to the Inspector General (OCIG) provides general 
legal services to OIG, rendering advice and opinions on HHS programs and 
the Inspector 
operations and providing all legal support for OIGs internal operations.  
General 
OCIG represents OIG in all civil and administrative fraud and abuse cases 
involving HHS programs, including False Claims Act, program exclusion, and 
civil monetary penalty cases.  In connection with these cases, OCIG also 
negotiates and monitors corporate integrity agreements.  OCIG renders 
advisory opinions, issues compliance program guidance, publishes fraud 
alerts, and provides other guidance to the health care industry concerning 
the anti-kickback statute and other OIG enforcement authorities. 
 
   
                                                 
1 SBA, SBIR/STTR Program Basics, Course 1, Tutorial 1.  Accessed at https://www.sbir.gov/tutorials/program-basics/tutorial-1 on 
March 15, 2019.  
2 OIG analysis of SBIR.gov Dashboard data from 1982 through 2017.  
3 Since HHSs SBIR program funds both grants and contracts, we use the term awards to refer to grants or contracts.  
4 NIH, Overview of the HHS SBIR/STTR Program, Presentation at the 19th Annual NIH SBIR/STTR Conference, November 7-9, 2017. 
Accessed at https://ctsi.mcw.edu/images/2_Matthew-Portnoy_NIH-Annual-Overview.pdf on April 2018. 
5 OIG, Vulnerabilities in the HHS Small Business Innovation Research Program, OEI-04-11-00530, April 2014.  Accessed at 
https://oig.hhs.gov/oei/reports/oei-04-11-00530.pdf on October 10, 2018.  
6 U.S. Department of Justice, Masstech, Richard Lee, and Arnold Lee to Pay U.S. $1.9 Million to Settle False Claims Act Allegations 
Relating to Small Business Innovation Research Awards, May 2018.  Accessed at https://www.justice.gov/usao-md/pr/masstech-
richard-lee-and-arnold-lee-pay-us-19-million-settle-false-claims-act-allegations on May 9, 2018. 
7 The Small Business Technology Transfer (STTR) program is modeled after the SBIR program and was created by the Small 
Business Technology Transfer Act of 1992.  Though the STTR program is similar in concept to SBIR, we did not include STTR in our 
review.  SBA, About SBIR and STTR.  Accessed at: https://www.sbir.gov/about on April 23, 2018.  
8 SBA, SBIR/STTR Program Basics, Course 1, Tutorial 1.  Accessed at https://www.sbir.gov/tutorials/program-basics/tutorial-1 on 
May 8, 2018. 
9 Ibid. 
10 The 11 agencies that participate in the SBIR program are the Department of Agriculture, the Department of Commerce, the 
Department of Defense, the Department of Education, the Department of Energy, HHS, the Department of Homeland Security, the 
Department of Transportation, the Environmental Protection Agency, the National Aeronautics and Space Administration, and the 
National Science Foundation.   
11 SBA, SBIR 2014 Policy Directive, p. 4.  Accessed at: https://sbir.gov/sites/default/files/sbir_pd_with_1-8-14_amendments_2-24-
14.pdf on April 10, 2018. 
12 Ibid, p. 42.  
13 The Administration for Children and Families (ACF) previously met the threshold to have an SBIR program and was included in 
our 2014 report.  However, since 2016, ACFs extramural research and development budget has not exceeded $100 million, so it 
does not currently fund SBIR awards.  In addition, we did not include ACL in our 2014 report because it was not funding SBIR 
awards at that time.   
14 In 2017, NIH funded approximately 95 percent of HHSs SBIR awards.  
15 OIG analysis of SBIR.gov Dashboard data from 2017. 
16 NIH, SBIR/STTR Funding2018 Solicitations.  Accessed at: https://sbir.nih.gov/funding on April 12, 2018.  
17 SBA, SBIR 2014 Policy Directive, p. 30.  SBA includes 10 minimum requirements on which agencies must take action in order to 
prevent fraud, waste, and abuse in their respective SBIR programs. 
18 To be considered primarily employed by a company, the principal investigator must spend more than half of his or her time in 
the employ of the company at the time of the award and during the proposed project.  Occasionally, deviation from this 
requirement may occur; such deviation must be approved in writing.  SBA, SBIR 2014 Policy Directive, p. 15. 
19 NIH, Grants Policy StatementOctober 2010, pp. I54-I55.  Accessed at: 
https://grants.nih.gov/grants/policy/nihgps_2010/nihgps_2010.pdf on January 17, 2019. 
20 SBA, SBIR 2014 Policy Directive, p. 50. 
21 The number of awards that CDC and FDA granted in 2011 was small in comparison to that of NIH, so our review included all 
awards from CDC and FDA.  Further, ACF did not fund any awards during our period of review.  OIG, Vulnerabilities in the HHS 
Small Business Innovation Research Program, OEI-04-11-00530, April 2014. 
22 OIG, Vulnerabilities in the HHS Small Business Innovation Research Program, OEI-04-11-00530, April 2014.   
23 SBA, SBIR 2014 Policy Directive, p. 30.  
24 Ibid. 
25 A list of pre-award fraud indicators can be found on the NIH website.  NIH, Office of Management, Fraud Indicators.  Accessed 
at https://oma.od.nih.gov/DPI/Pages/Fraud-Indicators.aspx on December 21, 2017. 
26 SBA, SBIR 2014 Policy Directive, p. 30.  
27 OIG, Vulnerabilities in the HHS Small Business Innovation Research Program, OEI-04-11-00530, April 2014.   
28 GAO, Small Business Research Programs:  Additional Actions Needed to Implement Fraud, Waste, and Abuse Prevention 
Requirements, GAO-17-337, April 2017. 
29 Ibid. 
30 If an awardee has accurately disclosed a residential address, the awardee may use that address as a place of performance to 
carry out the work of SBIR award without violating SBIR requirements.  However, the use of a residential address is still considered 
an HHS SBIR fraud indicator.   
 
   
                                                                                                                                                                         
31 National Institutes of Health, NIH Grants Policy Statement, November 2016, p. 360. 
32 GAO, Small Business Research Programs:  Additional Actions Needed to Implement Fraud, Waste, and Abuse Prevention 
Requirements, GAO-17-337, April 2017. 
33 These changes were in response to a GAO recommendation.  GAO closed this recommendation as having been implemented.  
NIH, Revised Process for SBIR/STTR Life Cycle Certifications, October 29, 2018.  Accessed at 
https://grants.nih.gov/grants/guide/notice-files/NOT-OD-19-025.html on November 11, 2018.   
34 NIH stated that it provides additional guidance to staff on the review of lifecycle certifications; however, NIH did not provide 
documentation of this guidance.  Further, NIH did not state what staff should do if they identify eligibility concerns during the 
review of lifecycle certifications, and NIH did not provide any documentation that offered such guidance. 
35 One of these awardees has been receiving HHS SBIR awards since 1985.