Small Business Research Programs: Additional Actions Needed to Implement Fraud, Waste, and Abuse Prevention Requirements
Published: 2017-04-25T00:00:00

Fast Facts:
For decades, federal agencies have made awards to fund research and development through the Small Business Innovation Research and Small Business Technology Transfer programs. In 2012, the Small Business Administration developed requirements to help agencies prevent fraud, waste, and abuse in the programs.
However, we found that the 11 participating agencies have varied in their implementation of these fraud prevention requirements. We recommended that SBA confirm that agencies are fully implementing these requirements.

Highlights:
section_title: Why GAO Did This Study
paragraphs: For about 35 years, federal agencies have made awards to small businesses for technology research and development through the SBIR program and, for the last 25 years, through the STTR program. Following a 2009 congressional hearing about fraud in the programs, the SBIR/STTR Reauthorization Act of 2011 included separate requirements for SBA and OIGs to address and prevent fraud, waste, and abuse.
The act also included a provision for GAO to review what the agencies and their OIGs have done to address fraud, waste, and abuse in the programs. This report examines (1) the extent to which SBA and the participating agencies have implemented measures to prevent fraud, waste, and abuse for the SBIR and STTR programs and (2) the extent to which the agencies' OIGs have implemented the act's requirements.
GAO compared documentation from SBA, the 11 participating agencies, and the agencies' OIGs to their respective requirements and interviewed SBA, agency, and OIG officials.
section_title: What GAO Found
paragraphs: The 11 agencies participating in the Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs have varied in their implementation of the fraud, waste, and abuse prevention requirements developed by the Small Business Administration (SBA) after the programs were reauthorized in 2011. SBA, which oversees the programs, amended the SBIR and STTR policy directives in 2012, as required by the reauthorization act, to include 10 minimum requirements to help agencies prevent potential fraud, waste, and abuse in the programs. GAO found that the extent to which the agencies have fully implemented each of the requirements in the directives varies. For example, all 11 agencies have fully implemented 2 requirements, more than half of the agencies have fully implemented 6 other requirements, and 1 and 3 agencies, respectively, have fully implemented the remaining 2 requirements. Officials from 9 agencies told GAO they have implemented other activities beyond the minimum requirements included in the directives, such as conducting site visits to small businesses to confirm that the necessary facilities exist for technical research and development work. Although SBA issued the policy directives, it has taken few actions to oversee agencies' efforts to implement the requirements. SBA officials said they checked on the implementation of one of the requirements, but did not know whether the participating agencies were implementing the other requirements because they had not confirmed this information. Without confirming that each participating agency is implementing the fraud, waste, and abuse prevention requirements in the policy directives, SBA does not have reasonable assurance that each agency has a system in place to reduce its' vulnerability to fraud, waste, and abuse.
Similarly, Offices of Inspectors General (OIG) varied in their implementation of the fraud, waste, and abuse prevention requirements specifically assigned to them in the reauthorization act, with between 5 and 11 OIGs implementing each requirement. For example, OIGs at each of the 11 agencies have shared information on fraud, waste, and abuse. Of the 11 participating agencies, the Department of Defense (DOD) is the only one whose oversight and audit responsibilities are separated between its various OIGs and specific investigative services, so that DOD has both an OIG as well as an investigative service as do each of the military services. By law, the OIGs of each military service within DOD—Army, Navy, and Air Force—are each required to implement these requirements. However, GAO found that none of the three military service OIGs had taken actions to implement the requirements, although the DOD OIG had taken some steps to implement them. The division of duties between the military services' OIGs and their respective investigative services makes it difficult to track the implementation of these requirements at DOD. Without the three military services' OIGs implementing the requirements themselves or delegating the implementation of the requirements to the investigative services, the DOD OIGs may not be able to detect fraud, waste, and abuse in DOD's SBIR and STTR programs, which have the largest budgets for these programs.
section_title: What GAO Recommends
paragraphs: GAO is making six recommendations, including that SBA confirm agency implementation of the fraud, waste, and abuse requirements, and that the Army, Navy, and Air Force OIGs implement the OIG requirements or delegate them to the investigative services. These agencies generally agreed with the recommendations addressed to them.

section_title: Letter
paragraphs: For about 35 years, federal agencies have made awards to small  businesses for technology research or research and development (R&D)  through the Small Business Innovation Research (SBIR) program and, for  the last 25, through the Small Business Technology Transfer (STTR)  program. Federal agencies have awarded an average of about $2 billion  a year through these programs and a total of more than $40 billion for  150,000 contracts and grants since their inception in 1982 and 1992,  respectively. In recent years, several agencies’ Offices of Inspectors  General (OIG) have investigated and referred for prosecution several  cases of fraud, waste, or abuse in the SBIR and STTR programs. From  January 2010 through December 2016, the OIGs reported that they  initiated about 110 SBIR or STTR investigations, including at least 45  investigations that involved multiple agencies. As of December 2016,  these investigations have resulted in 14 guilty verdicts or pleas; more  than $31 million in criminal restitution, civil settlements, or termination of  funding of SBIR or STTR awards; and the suspension or debarment of 40  individuals or companies from participation in the programs. Over the  same period, federal agencies made about 38,000 SBIR or STTR awards  to small businesses.
SBIR and STTR awards have supported the development and  commercialization of innovative technologies. For example, one company  received seven SBIR or STTR awards totaling $4.4 million to develop  new spacecraft systems and enabling technologies. Another company  received about $660,000 for an SBIR award to develop a diagnostic tool  for Zika virus infection. Eleven federal agencies currently participate in the  SBIR program: the Departments of Agriculture (USDA), Commerce,  Defense (DOD), Education, Energy (DOE), Health and Human Services  (HHS), Homeland Security (DHS), and Transportation (DOT); the  Environmental Protection Agency (EPA); the National Aeronautics and  Space Administration (NASA); and the National Science Foundation  (NSF). Five of these agencies also participate in the STTR program:  DOD, DOE, HHS, NASA, and NSF. Each participating agency is to  manage its SBIR and STTR programs in accordance with program laws  and regulations and the policy directives issued by the Small Business  Administration (SBA), which oversees the two programs.
Both programs were reauthorized in 2011. Under the SBIR/STTR  Reauthorization Act of 2011 (reauthorization act), SBA was to amend the  SBIR and STTR policy directives to include requirements for participating  agencies to prevent fraud, waste, and abuse in the SBIR and STTR  programs. The Small Business Act requires agencies to follow the policy  directives. According to the policy directives, potential fraud, waste, and  abuse in the programs includes, among other activities, misrepresenting  how funds were used under an award, misusing award funds, falsifying  reporting results from an award, and extravagant or needless spending of  an award. The reauthorization act also included several requirements for  participating agencies’ OIGs to address SBIR and STTR fraud, waste,  and abuse.
The reauthorization act includes a provision for GAO to review what the  agencies and agency OIGs are doing to prevent, identify, respond to, and  reduce fraud, waste, and abuse in the SBIR and STTR programs, every 4  years. We last issued a report on these issues in November 2012. This  report examines the extent to which (1) participating agencies and SBA  have implemented measures to prevent fraud, waste, and abuse for the  SBIR and STTR programs and (2) OIGs have implemented fraud, waste,  and abuse prevention requirements for the SBIR and STTR programs.
To address our first objective, we requested and reviewed  documentation, such as guidance and procedures, from each of the  participating agencies and compared that documentation to the  requirements in the SBIR and STTR policy directives. We assessed  agencies’ implementation of the requirements but not the effectiveness of  their implementation. We determined that an agency had fully  implemented a requirement if an agency could demonstrate, through  interviews with agency officials and documentation provided by them, as  appropriate, that it had fully implemented each part of the requirement.  We determined that the agency partially implemented a requirement if an  agency could demonstrate, through interviews with agency officials and  documentation provided by them, as appropriate, that it had implemented  at least one part of the requirement. We determined that the agency had  not implemented the requirement if it could not provide evidence for  implementing any part of that requirement. We limited our review of DOD  and HHS to the components that spent more than $100 million on SBIR  and STTR programs in fiscal year 2014, the most recent year for which  data were available at the start of our review. As such, we limited our  review of DOD’s efforts to the three military departments—Army, Air  Force, and Navy—that comprised 70 percent of the spending on DOD’s  SBIR and STTR programs in fiscal year 2014, the most recent year for  which data were available when we started our review. We also included  the Office of the Secretary of Defense, which oversees the SBIR and  STTR programs for all DOD components. Additionally, we limited our  review of HHS’s program to the National Institutes of Health, which  comprises 98 percent of HHS’s SBIR and STTR programs. Further, we  requested and reviewed documentation from SBA to determine the  actions it has taken to oversee the agencies’ efforts related to fraud,  waste, and abuse. In addition, we interviewed SBA and participating  agencies’ SBIR and STTR program staff regarding their actions to  address fraud, waste, and abuse in the programs. We also interviewed a  non-generalizable sample of 11 small businesses that have received  SBIR or STTR awards from at least three agencies from 2012 through  2016 to obtain information on their experiences with, and knowledge of,  fraud, waste, and abuse activities by agencies and challenges the small  businesses may have faced regarding the SBIR and STTR fraud, waste,  and abuse prevention requirements.
To address our second objective, we requested and reviewed  documentation, such as reports and training information, from the  participating agencies’ OIGs and compared that documentation to the  fraud, waste, and abuse prevention requirements for the OIGs included in  the reauthorization act. We assessed agency OIGs’ implementation of the  requirements but not the effectiveness of their implementation. We  determined that an OIG had fully implemented a requirement if it could  provide documentation that it had fully implemented each part of the  requirement. We determined that an OIG partially implemented a  requirement if it could provide documentation that it had implemented at  least one part of the requirement. We determined that an OIG had not  implemented a requirement if it could not provide evidence for  implementing any part of that requirement. In addition, we interviewed  SBA and participating agencies’ OIG and investigative staff who have  worked on SBIR and STTR reviews and investigations regarding agency  actions to address fraud, waste, and abuse in the programs. Appendix I  provides more detail on our scope and methodology.
We conducted this performance audit from April 2016 to April 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The SBIR program was initiated in 1982 and has four purposes: (1) to use  small businesses to meet federal R&D needs, (2) to stimulate  technological innovation, (3) to increase commercialization of innovations  derived from federal R&D efforts, and (4) to encourage participation in  technological innovation by small businesses owned by disadvantaged  individuals and women. The purpose of the STTR program—initiated in  1992—is to stimulate a partnership of ideas and technologies between  innovative small businesses and research institutions through federally  funded R&D. The SBIR and STTR programs are similar in that  participating agencies identify topics for R&D projects and support small  businesses, but the STTR program requires the small business to partner  with a research institution—such as a nonprofit college or university or  federally funded R&D center. The programs are currently authorized  through fiscal year 2022.
The Small Business Act, which authorizes the programs, establishes the  amount of an agency’s funding that must be spent on the SBIR and STTR  programs each year. In general, the programs are similar across  participating agencies. All of the participating agencies follow the same  general process to obtain proposals from and make awards to small  businesses for both the SBIR and STTR programs. While the Small  Business Act requires participating agencies to manage their programs to  meet the requirements of the act, the policy directives, and SBA  regulations, each participating agency has considerable flexibility in  designing and managing the specifics of its programs under these  requirements, such as determining research topics, selecting award  recipients, and administering funding agreements. At least once per year,  each participating agency issues a solicitation requesting proposals for  projects in topic areas determined by the agency. Each participating  agency uses its own process to review proposals and determine which  proposals should receive awards. Those agencies that have both SBIR  and STTR programs usually use the same process for both programs.  Small businesses are allowed to apply with the same proposal to multiple  agencies, but the small business is not allowed to accept multiple awards  for the same work.
In August 2009, the Senate Committee on Commerce, Science, and  Transportation held a hearing on fraud, waste, and abuse in the SBIR  program. Shortly after that hearing, the Council of the Inspectors  General on Integrity and Efficiency’s Misconduct in Research Working  Group began to discuss fraud in the SBIR and STTR programs and to  coordinate efforts related to these programs among the OIGs from SBA  and each of the 11 participating agencies. The working group also  established a separate subgroup of investigative agents from SBA, the 11  participating agencies’ OIGs, and the Department of Justice to share  information on ongoing cases, lessons learned, and best practices related  to SBIR investigations.
The reauthorization act required SBA to add fraud, waste, and abuse  prevention requirements to the policy directives for agencies to  implement. In 2012, SBA issued revised policy directives for the SBIR  and STTR programs that included new requirements designed to help  agencies prevent potential fraud, waste, and abuse in the SBIR and  STTR programs. SBA developed these requirements in consultation with  participating agencies and a working group of OIGs. The fraud, waste,  and abuse sections of the SBIR and STTR policy directives contain the  same information and requirements. To meet the 10 requirements, each  participating agency must, at a minimum, take the actions summarized  below:
Require certifications from award recipients that they are in  compliance with specific program requirements at the time of the  award, as well as after the award and during the life cycle of the  funding agreement.
Include information explaining how an individual can report fraud,  waste, and abuse on the agency’s respective program website and in  each funding solicitation using the method provided by the agency’s  OIG, such as publishing the agency’s fraud hotline number.
Designate at least one individual in the agency to, at a minimum,  serve as the liaison for the SBIR or STTR program, the OIG, and the  agency’s suspension and debarment official and ensure that inquiries  regarding fraud, waste, and abuse are referred to the appropriate  office.
Include on its program website information concerning successful  prosecutions of fraud, waste, and abuse in the programs.
Establish a written policy requiring all personnel involved with the  program to notify the OIG if anyone suspects fraud, waste, and/or  abuse and ensure the policy is communicated to all personnel.
Create or ensure there is an adequate system to enforce  accountability by developing separate standardized templates for  referrals to the OIG and the Suspension and Debarment Official, as  well as a process for tracking such referrals.
Ensure compliance with program eligibility requirements and terms of  funding agreements.
Work with the agency’s OIG in its efforts to establish fraud detection  indicators; coordinate sharing of information on fraud, waste, and  abuse between federal agencies; and improve education and training  to program officials, applicants, and award recipients.
Develop policies and procedures to avoid funding essentially  equivalent work already funded by another agency.
Consider enhanced reporting requirements during the funding  agreement.
According to the Inspector General Act of 1978, as amended, agency  OIGs are established in order to create independent and objective units to  provide leadership and coordination and recommend policies for activities  designed to promote economy, efficiency, and effectiveness in the  administration of agencies’ programs and prevent and detect fraud and  abuse in their agencies’ programs and operations. Additional purposes of  agency OIGs include conducting and supervising audits, inspections, and  investigations. Furthermore, according to the act, OIGs are to provide a means for keeping the head of the agency and Congress fully and  currently informed about problems and deficiencies related to the  administration of such programs and operations and the need for and  progress of corrective action. In addition to the requirements for the  participating agencies, the reauthorization act included requirements for  the participating agencies’ OIGs. Each OIG is to cooperate to prevent  fraud, waste, and abuse in the SBIR program and the STTR program by: establishing fraud detection indicators;  reviewing regulations and operating procedures of the federal agency;  coordinating information sharing between Federal agencies, to the  extent otherwise permitted under federal law; and  improving the education and training of and outreach to: administrators of the SBIR program and the STTR program of the applicants to the SBIR program or the STTR program; and  recipients of awards under the SBIR or STTR program.
In addition, each participating agency’s OIG is to submit an annual report  to specified congressional committees detailing any SBIR or STTR fraud,  waste, or abuse investigations over the past year, including the costs for  those investigations, among other things.
The Small Business Act and the SBIR and STTR policy directives outline  SBA’s responsibilities for overseeing the SBIR and STTR programs.  Specifically, the Small Business Act requires SBA to survey and monitor  the operation of the SBIR and STTR programs at the agency level.  Further, the policy directives state that SBA is responsible for ensuring  that each participating agency has taken steps to maintain a fraud, waste,  and abuse prevention system to minimize their impact on the programs.
Our Framework for Managing Fraud Risks in Federal Programs (Fraud  Risk Framework) provides comprehensive guidance for conducting fraud  risk assessments and using the results as part of the development of a  robust antifraud strategy. It also describes concepts and leading  practices for establishing an organizational structure and culture that are  conducive to fraud risk management, designing and implementing  controls to prevent and detect potential fraud, and monitoring and  evaluating fraud risk management activities.
section_title: Implementation of Agency Fraud, Waste, and Abuse Prevention Requirements Has Varied, and SBA Has Provided Limited Oversight of the Implementation
paragraphs: Agencies have varied in their implementation of the SBIR and STTR  fraud, waste, and abuse prevention requirements in SBA’s policy  directives, although some agencies have taken actions beyond those  required in the policy directives. Beyond issuing the policy directives,  however, SBA has taken few actions to oversee the participating  agencies’ implementation of the fraud waste, and abuse prevention  requirements. Further, SBA has not evaluated the fraud, waste, and  abuse requirements in the directives to determine whether the  requirements are clear and effective.
subsections: section_title: Agencies Have Varied in Implementation of Their Fraud, Waste, and Abuse Prevention Requirements, and Some Have Engaged in Additional Prevention Activities
paragraphs: Agencies have varied in their implementation of the 10 minimum fraud,  waste, and abuse prevention requirements included in SBA’s policy  directives. All 11 agencies fully implemented 2 of the requirements: to  include how to report fraud, waste, and abuse on the agency’s website  and solicitation, and to designate a liaison for the OIG and Suspension  and Debarment Official. For 6 other requirements, more than half of the  agencies had fully implemented the requirements while the other  agencies had partially or not implemented them. For the remaining 2  requirements, 3 agencies had fully implemented 1, while only 1 agency  had fully implemented the other. Figure 1 shows the number of agencies  that implemented each of the requirements, and appendix II provides  additional information on individual agencies’ implementation of the  requirements.
Agencies varied in their degrees of implementation for some  requirements. For example, NASA is the only agency that fully  implemented all three components of the requirement to develop  templates for referrals to the OIG and Suspension and Debarment  Official.  Three agencies did not implement any of the components of the  requirement. Of the 7 agencies that partially implemented this  requirement, none had both templates, 2 agencies did not have a tracking  system in place, and 1 agency had a partial tracking system in place.  Officials from most agencies said that they either use their OIG’s standard  process or contact their OIG in person, by telephone, or e-mail to make  referrals to the OIG. Additionally, 3 agencies—HHS, NASA, and NSF— implemented all of the components of the requirement to coordinate with  the OIG on fraud, waste, and abuse, while the other agencies varied in  their implementation of the components.  For example, 7 agencies’ SBIR  or STTR offices did not implement or fully implement the requirement to  work with their OIG to establish fraud detection indicators.
In addition to the variation in the number of agencies that have  implemented each requirement, we found that agencies varied in how  they implemented the requirements. Some examples of how agencies  have implemented requirements include the following:
Require certifications from awardees. Small businesses must certify  that they are eligible for the SBIR and STTR programs and that they  meet specific program requirements during the life of the funding  agreement. Six agencies fully implemented and 5 agencies partially  implemented the certification requirement. The agencies that fully  implemented the requirement used the language required by the  policy directives and told us they collected all the certifications.  However, we identified some variation in how the remaining agencies  implemented the requirement. For example, 1 agency—HHS— requires awardees to sign certifications at the appropriate times but  does not collect the signed life cycle certifications from small  businesses. Instead, awardees complete the life cycle certifications  and maintain them on file at their locations. HHS officials told us that  this practice is in accordance with HHS’s records and retention policy  and the SBIR contract solicitation, and that they believe HHS is  compliant with the policy directives because small businesses must  provide the life cycle certifications upon request. The remaining 4  agencies that partially implemented the requirement required small  businesses to submit certifications, but did not use the certification  language that is required by the policy directives.
List examples of successful prosecutions on website. Six agencies  fully implemented the requirement to post examples of successful  fraud prosecutions on their SBIR website and 2 agencies partially  implemented the requirement with one of their components posting  the information. The agencies that posted examples of successful  prosecutions implemented the requirement differently, in the absence  of specific direction. Specifically, 4 agencies posted the information on  a page designated for reporting fraud, waste, and abuse and 3  agencies posted the information on other pages, where it could be  more difficult for applicants or awardees to find. For example, 1  agency posted an example of a prosecution with other program news  stories, such as announcements of solicitations. However, as of  February 2017, the information was on the second page of the list of  news stories, making it difficult to find. Additionally, 1 agency posted  the information on an internal website that award recipients or  applicants cannot typically access. Officials from the 3 agencies that  did not post such examples told us they did not have any successful  prosecutions of their own to post or did not know where to find such  information.
Consider enhanced reporting requirements. Nine agencies fully  implemented the requirement to consider enhanced reporting  requirements during the funding agreement; however, interpretations  of how to implement the requirement varied widely among the  agencies. The policy directives require agencies only to consider  enhanced reporting requirements during the funding agreement and  do not require agencies to implement such reporting requirements.  Officials from the agencies that had implemented the requirement said  they typically interpreted enhanced reporting as monthly invoices and  reports, project demonstrations, or additional certifications.
We identified one instance in which an agency has not fully implemented  a requirement and this could affect its ability to prosecute fraud, waste,  and abuse in the programs. As discussed previously, HHS requires small  business awardees to sign certifications at the appropriate times, but  these small businesses are not required to submit the life cycle  certifications to the agency. HHS OIG officials told us that they raised  concerns about this practice to HHS SBIR officials based, in part, on their  2014 review of the HHS SBIR and STTR programs. Of the 11  participating agencies, HHS is the only agency that administers but does  not collect the self-certifications from SBIR and STTR applicants or  awardees, according to agency officials. Having copies of the certification  forms allow agencies to document small businesses’ assurance that they  are aware of and agree to comply with program requirements. HHS OIG  officials told us they continue to be concerned that HHS does not require  the small businesses to submit the SBIR and STTR certifications to the  SBIR officials. In addition, OIGs at most of the participating agencies said  that they often use these self-certifications to show intent to commit fraud,  if any fraud later occurs, as the small businesses are certifying the  accuracy and truth of the information they are submitting to the agency.  Without collecting copies of the certification forms, it may be more difficult  to prosecute HHS SBIR or STTR awardees if they commit fraud, waste,  or abuse.
In addition to the requirements in the policy directives, officials from 9  agencies told us they implemented other activities to help identify or  prevent fraud, waste, and abuse in the programs. Examples of agency  activities include the following:
Conducting site visits. Officials from 4 agencies— Education, DOE,  DHS, and NASA—told us they conduct site visits to their SBIR or  STTR awardees, either in person or virtually, in part to identify and  prevent fraud, waste, and abuse. Site visits allow officials to view,  either in person or remotely, the awardee’s research efforts and can  confirm that the necessary facilities exist for technical R&D work.  According to Department of Education officials, its virtual site visits  serve as a way to confirm that that the SBIR awardee has completed  the work proposed.
Establishing offices or working groups. Two agencies have  established or are planning to establish offices or working groups to  address potential fraud, waste, and abuse issues. For example, NASA  established the Acquisition Integrity Program, which is an office that  works as the liaison between the agency’s SBIR and STTR program  staff and the OIG, as one way to help reduce and prevent fraud,  waste, and abuse in the programs. This office monitors the  coordination of criminal, civil, contractual, and administrative remedies  for significant investigations of fraud or corruption related to  procurement activities agency-wide, among other things. In addition,  DOD’s SBIR and STTR program manager told us that, beginning in  early 2017, he plans to convene a working group comprised of SBIR  and STTR program officials and investigative service staff from the  Army, Navy, Air Force, and other parts of DOD to discuss best  practices and share information regarding fraud, waste, and abuse  issues.
Orientation meetings. According to officials, 3 agencies—DHS, EPA,  and NSF—hold in-person orientation meetings with awardees to  provide an overview of the agency’s SBIR or STTR program and  related rules and requirements, including a presentation on fraud,  waste, and abuse.
Certifications and Reporting. Six agencies require more certifications  or reporting from awardees than is required in the policy directives.  Specifically, officials from these agencies told us they require  additional certifications beyond the three mandated life cycle  certifications: (1) at the time of final payment or disbursement of  Phase I funding, (2) before more than half of Phase II funding has  been paid or disbursed, and (3) before final payment or disbursement  of Phase II funding. For example, DOT and some Commerce  officials told us that they require awardees to submit life cycle  certifications with every invoice. Army, EPA, and NASA officials told  us that they require monthly or quarterly reporting by awardees.  Further, both Army and NSF officials told us that they require the  additional reporting in order for awardees to receive their SBIR or  STTR funds.
Representatives from each of the 11 SBIR and STTR small businesses  that we interviewed said that they had not experienced any challenges in  complying with the programs’ fraud, waste, and abuse prevention  requirements. Of the 10 fraud, waste, and abuse prevention requirements  that the agencies must implement, small businesses are directly affected  by only 2 requirements: providing life cycle certifications and, if required  by their awarding agency, participating in fraud, waste, and abuse  training. Representatives from each of the 11 small businesses we  interviewed told us they did not find these fraud, waste, and abuse  prevention requirements to be burdensome, and representatives from 9 of  the small businesses told us that the level of the SBIR and STTR fraud,  waste, and abuse prevention requirements are about the right amount.  Representatives from nearly all of the small businesses we interviewed  said they had seen the effects of the agencies’ implementation of some of  the requirements. For example, representatives from 10 of the small  businesses reported that at least 1 agency from which they had received  an award had provided information to them on how to report fraud, waste,  and abuse to the agency’s OIG, either on the agency’s SBIR or STTR  website or in the solicitation that they used to apply for funding. Further,  representatives from all 11 small businesses that we interviewed said that  they had not observed any fraud, waste, or abuse in the SBIR or STTR  programs by another small business.
section_title: SBA Has Taken Few Actions to Oversee Agencies’ Implementation of Fraud, Waste, and Abuse Prevention Requirements
paragraphs: SBA has taken few actions to oversee agencies’ implementation of the  policy directives’ minimum requirements to address fraud, waste, and  abuse in the SBIR and STTR programs. In 2012, SBA convened a group  of SBIR and STTR program managers and OIG officials to develop and  issue the fraud, waste, and abuse prevention requirements. Additionally,  according to SBA officials, SBA checked the agencies’ SBIR and STTR  program websites to confirm that each agency provided information on its  website and in each solicitation on how to report fraud, waste, and abuse,  as required by one of the fraud, waste, and abuse prevention  requirements. Further, in 2016, SBA officials said they made some  improvements to the SBIR.gov website, which includes SBA’s database  of SBIR and STTR awards, to include the full text of proposals for all  SBIR or STTR awards, improving the appearance of awards in the  analytics section of the website, and improving accuracy of the data by  reviewing incoming data for completeness and duplicate entries. By SBA  making this information available, SBA officials said that agencies could  search on the website to identify essentially equivalent work that could  lead to duplicate funding. However, most of the program managers we  interviewed said that the website—in its current form—was not useful for  searching for duplicate awards. Finally, according to officials, SBA  provides opportunities for SBIR and STTR program managers to discuss  the implementation of the fraud, waste, and abuse prevention  requirements. SBA hosts meetings with SBIR and STTR program  managers every 2 months to discuss various aspects of the programs.  According to SBA’s meeting agendas, fraud, waste, and abuse was on  the agenda once between July 2015 and May 2016, although officials  said that program managers could discuss the requirements more  frequently, if needed. In addition to the program managers’ meetings,  SBA officials said they are considering establishing a working group that  could address fraud, waste, and abuse but they had not done so as of  January 2017.
However, SBA had not taken steps to ensure that each agency had  implemented all of the fraud, waste, and abuse requirements. As noted  earlier, the Small Business Act requires SBA to survey and monitor the  operation of the SBIR and STTR programs at the agency level. Further,  the policy directives state that SBA is responsible for ensuring that each  participating agency has taken steps to maintain a fraud, waste, and  abuse prevention system to minimize their impact on the programs. With  the exception of its efforts to confirm that agencies had included  information on reporting fraud, waste, and abuse on their websites and in  solicitations described above, SBA has not confirmed implementation of  the fraud, waste, and abuse prevention requirements. Specifically, SBA  officials do not know the status of agencies’ implementation because they  have not requested documentation from the agencies or other evidence  to determine whether implementation has occurred. Without confirming  that participating agencies are implementing the requirements, SBA does  not have reasonable assurance that each agency has a system in place  to help reduce their vulnerability to fraud, waste, and abuse. SBA officials  told us that they believe that they have fulfilled their role to oversee  agencies’ implementation of the fraud, waste, and abuse prevention  requirements by convening the group of program managers and OIG  officials to develop and issue the requirements. However, SBA’s issuance  of the requirements neither constitutes oversight of those requirements  nor ensures their implementation by the 11 participating agencies.
section_title: SBA Has Not Assessed the Fraud, Waste and Abuse Requirements in the Policy Directives to Ensure that They are Effective and Clear
paragraphs: SBA updated the SBIR and STTR policy directives in 2012 to include the  fraud, waste, and abuse prevention requirements. However, SBA officials  said they have not taken action since 2012 to review the requirements to  determine whether they are effective or whether any revisions are  needed. We identified requirements that some agency officials said were  not clear, or may be unnecessary.
We identified 3 requirements that some agency officials said were not  clear.
List examples of successful prosecutions on agency websites. The  policy directives require agencies to list examples of successful fraud  prosecutions on their websites, but they do not indicate whether the  examples must be from the agency itself or whether the agency is to  post examples from other participating agencies in the absence of its  own examples. As noted earlier, officials at 3 agencies told us they  were unaware of, or did not have any, successful SBIR or STTR  prosecutions to post. However, if the requirement is designed to deter  fraud, it may be useful for agencies to post examples of prosecutions  regardless of the agency in which the example originated. A  representative from one small business we interviewed said that  seeing the posted prosecutions on an agency’s SBIR website made  the agency’s efforts against fraud, waste, and abuse more credible.  For this reason, in our assessment of agencies’ implementation of the  requirements, we concluded that an agency had not implemented the  requirement if it did not include any examples of successful  prosecutions on its website, even if the agency said that it did not  have any.
In addition, the policy directives do not indicate where on the website  each agency is supposed to post these examples of successful  prosecutions. As mentioned previously, the agencies that posted this  information did so in different places on their websites. According to  NSF program officials, NSF’s SBIR website has more than 80 pages  and the officials indicated that it was unclear where prosecution  information should be posted. Additionally, OIG officials at 1 agency  raised concerns about the location of the examples that the SBIR  program had posted, noting that if the point of posting such  prosecutions was to deter fraud, the information should be on the  main part of the website to ensure that users saw it. However, officials  at 1 agency raised potential privacy concerns about posting  information about successful prosecutions on their program website,  indicating that it was not clear in the policy directives what kind of  information agencies are required to include on their websites.
Consider enhanced reporting. The policy directives require agencies  only to consider enhanced reporting requirements during the funding  agreement and do not require agencies to implement such reporting  requirements. As mentioned previously, the 9 agencies that fully  implemented this requirement did so in various ways. Some agency  officials—including officials at the 2 agencies that had not fully  implemented the requirement—told us they were unclear about what  the requirement meant. In our assessment of agencies’  implementation of the requirements, we determined that an agency  implemented the requirement if it considered any type of reporting not  already required by the policy directives. Further, program managers  at 1 agency raised a concern that enhanced reporting could constitute  an undue burden on the small businesses.
Policies to avoid funding essentially equivalent work. The requirement  for participating agencies to check “essentially equivalent work” is  inconsistent with the definition of that term elsewhere in the policy  directives, which could make the requirement unclear. The fraud,  waste, and abuse requirement in the policy directives specifies that  agencies should check for essentially equivalent work funded by other  agencies. Most agencies have implemented the requirement as  written, and in our assessment of agencies’ implementation of the  requirements, we determined that an agency implemented the  requirement if it checked for essentially equivalent work at 1 or more  agencies. However, elsewhere in the policy directives, “essentially  equivalent work” is defined as work that is substantially the same  research in more than one application submitted to the same federal  agency or two or more different federal agencies. Two of the 5  agencies that have multiple offices involved in their SBIR or STTR  programs did not check, or did not fully check, for essentially  equivalent work within their own agencies. SBA officials  acknowledged that the policy directives were inconsistent in this  regard but said that the agencies should look for the definition  elsewhere in the policy directives. However, without consistent  definitions of the terms, SBA has no assurance that participating  agencies are appropriately checking for such work that they fund as  well as such work funded by other agencies, placing agencies at a  higher risk of funding essentially equivalent work.
Under federal standards for internal control, an oversight body should  oversee the entity’s internal control system, and that communication is  necessary for effective oversight. The standards state that management  is to evaluate and document the results of ongoing monitoring and  personnel may report the nature of its findings to the oversight body.  According to the standards, the oversight body is to receive quality  information on significant matters relating to risks, changes, or issues that  impact the entity. As mentioned previously, SBA meets every 2 months  with the SBIR and STTR program managers to discuss various issues.  According to the SBA officials, no one has raised questions or expressed  confusion about implementing the fraud, waste, and abuse prevention  requirements. However, given that we identified several areas in which  agencies expressed confusion or implemented the requirements  differently, SBA may need to more proactively solicit agency information,  which would be consistent with internal control standards for an oversight  body.
Additionally, based on our analysis of agencies’ implementation of the  requirements and interviews with program managers and OIG officials, 2  of the requirements—to use a separate, standardized template for SBIR  and STTR program officials to make referrals to their OIGs and to require  training for SBIR and STTR applicants—may be unnecessary. Only 1  agency fully implemented the requirement to create separate  standardized templates for referrals to the agency’s OIG and Suspension  and Debarment Official. It is not clear from the requirement as written if  any agency templates for referrals to the OIG and to the Suspension and  Debarment Official would meet the requirement, or if the templates need  to be SBIR or STTR specific. DOT OIG officials said that they considered  creating a separate form for reporting fraud, waste, and abuse for the  SBIR program, but they determined it was a more efficient process to use  their existing standard form. Similarly, EPA OIG officials said it would be a  lot of extra work and complications to develop a template specific to the  SBIR program, particularly when the existing template used for all other  programs is working well. In our assessment of agencies’ implementation  of the requirements, we determined that an agency had implemented the  requirement if it had separate templates for referrals to the OIG and the  Suspension and Debarment Official, regardless of whether these  templates were SBIR or STTR specific.
In addition, the requirement to train SBIR and STTR applicants—who  may or may not receive an SBIR or STTR award—on fraud, waste, and  abuse issues is a component of the requirement for agencies to  coordinate with the OIG and may present an unnecessary burden on the  agencies and OIGs. Based on our analysis, 7 agencies did not fully  address this aspect of the requirement. The Air Force, one component  within DOD, requires all applicants to take an online training and provide  the certificate showing that they completed the training as part of their  SBIR or STTR applications. Air Force officials estimated that about half of  the applicants for the first solicitation that required this certification were  originally ineligible for awards because they did not fully complete the  training or demonstrate that they had done so. However, the Air Force  provided a grace period so that the small businesses could complete the  training and receive the required certification, making them eligible for  awards. Based on data from fiscal year 2013, the most recent year for  which data are available, of the 20,200 SBIR Phase 1 applications that  agencies received, about 15 percent received SBIR awards. Similarly, in  2013, of the about 2,700 STTR Phase 1 applications that agencies  received, about 18 percent received STTR awards.
Moreover, SBA has not evaluated whether any of the requirements need  to be updated. In 2012, SBA included templates in its policy directives  that include language that agencies are supposed to use for the  certifications required of the small businesses. Officials from 1 agency— NASA—said that they originally used the language included in SBA’s  sample certification, but as a result of lessons learned from working with  the Department of Justice on SBIR fraud prosecutions, NASA has made  revisions to strengthen its self-certification forms. However, NASA  program officials told us they did not notify SBA of the change in the  language. SBA officials told us they met with NASA program officials in  March 2017 to discuss the changes in the self-certification language.
Leading practices in our Fraud Risk Framework state that agencies are  responsible for evaluating outcomes using a risk-based approach and  adapting activities to improve fraud risk management.  In this context,  an evaluation of the outcomes could include assessing whether the  requirements are necessary and meeting their intended purposes; are  placing an undue burden on the agencies; or otherwise need to be  revised, updated, or eliminated, among other things. However, SBA  officials told us that they have not evaluated the outcomes of participating  agencies’ implementation of the fraud, waste, and abuse prevention  requirements. Without evaluating the outcomes of the requirements, SBA  does not have reasonable assurance that the requirements are  necessary, appropriate, and meet the intended purpose of preventing  fraud, waste, and abuse in SBIR and STTR programs and cannot change  them accordingly.
section_title: The Majority of OIG Requirements Have Been Implemented by Most Offices, but DOD Military Services’ OIGs Are Not Implementing These Requirements
paragraphs: Most OIGs for the 11 participating agencies have implemented the  majority of their SBIR and STTR fraud, waste, and abuse prevention  requirements, as specified in the reauthorization act, with 2 OIGs  engaging in additional activities to prevent and address fraud. However,  the OIGs for the military services—Army, Air Force and Navy—are not  implementing the requirements, or delegating them to their investigative  services.
subsections: section_title: Most OIGs Have Implemented the Majority of Their Fraud, Waste, and Abuse Prevention Requirements and Some Identified Challenges to Implementing Requirements
paragraphs: Most OIGs for the participating agencies have implemented the majority  of their fraud, waste, and abuse prevention requirements for the SBIR  and STTR programs that were included in the reauthorization act. For  example, OIGs at 5 of the 11 agencies—Education, DOE, HHS, NASA,  and NSF—have implemented all of the fraud, waste, and abuse  prevention requirements for the programs. The 6 other OIGs have varied  in their implementation of the requirements. Between 5 and 11 OIGs have  fully implemented each of the requirements. Specifically, all 11 of the  OIGs have established fraud detection indicators and shared information  on fraud, waste, and abuse. Most of the OIGs have provided training for  SBIR and STTR administrators, as well as training for SBIR and STTR  awardees. (See fig. 2 and app. III for more information on the OIGs’  implementation of fraud, waste, and abuse prevention requirements).
Officials from 4 of the 6 OIGs that did not implement all of their  requirements said that they had not done so because they were not  previously aware of the specific SBIR and STTR fraud, waste, and abuse  prevention requirements for the OIGs but said they would do so in the  future. In addition, officials from the 3 agencies whose OIGs had not  provided fraud, waste, and abuse training to SBIR or STTR awardees told  us that they plan to do so in the future.
In addition, the reauthorization act requires participating agencies’ OIGs  to submit annual reports to specified congressional committees detailing  any SBIR or STTR fraud, waste, or abuse investigations over the past  year, including the costs for those investigations, among other things.  Each of the 11 agencies’ OIGs submitted reports for each of the 4  years.
Some OIGs also have implemented or plan to implement additional  activities beyond those required in the reauthorization act. Examples of  these activities include the following:
NASA OIG officials told us that OIG staff make in-person visits to  some NASA SBIR or STTR awardees to check on their status,  including checking for any fraud, waste or abuse issues. The OIG staff  are then able to share this information with the NASA program staff.
DOE OIG officials said they generally plan to conduct audits of the  agency’s SBIR programs every 3 to 4 years, in an effort to  consistently offer recommendations to improve and strengthen DOE’s  SBIR programs, including any issues they find related to fraud, waste  or abuse.
The OIGs have also shared information through an interagency working  group focusing on fraud, waste, and abuse in the SBIR and STTR  programs, which is organized by the Council of the Inspectors General on  Integrity and Efficiency. The NSF OIG has taken leadership of this  working group on behalf of the Council, and DOE and NASA OIG officials  serve as co-chairs of the group. Representatives from each participating  agency’s OIG attend this working group, which meets quarterly. The SBA  OIG does not officially participate in this group, but an SBA OIG official  told us he has attended some of the meetings and, additionally, has  provided support on specific SBIR or STTR fraud cases, among other  things. OIG officials told us this working group provides a forum for the  members to share information and best practices related to identifying  and preventing fraud, waste, and abuse in the SBIR and STTR programs.
For example, in its December 2016 meeting, the group discussed ways to  implement the requirement in the reauthorization act to train applicants  and awardees, according to officials from the NSF OIG.
As part of the working group, the NSF OIG has sponsored two  conferences—in 2011 and 2016—to share information on fraud, waste,  and abuse in the SBIR and STTR programs. The 2016 conference  included speakers from SBA, the participating agencies’ OIGs and their  SBIR program leaders, as well as Department of Justice prosecutors who  had brought SBIR and STTR fraud cases to trial. Approximately 200  officials from the OIGs, SBIR and STTR agency program offices, and the  Department of Justice attended this 1-day conference. The NSF OIG has  also developed informational materials on SBIR fraud to share with other  participating agencies’ OIGs.
As with the agency requirements for the SBIR and STTR programs, most  of the fraud, waste, and abuse prevention requirements for the OIGs do  not directly affect small businesses, except for the requirement to conduct  fraud, waste, and abuse training. Representatives we interviewed from 8  of the 11 small businesses said that their businesses had taken training  on fraud, waste, and abuse issues provided by an agency that gave them  an SBIR or STTR award. Representatives from each of the 8 small  businesses said that such fraud, waste, and abuse training for SBIR and  STTR awardees was useful. For example, a representative from 1 small  business told us that it was important for awardees to know the rules  about fraud, waste, and abuse in the programs. This representative said  that requiring the same fraud, waste, and abuse training of all awardees  is important so that all of the small businesses are held to the same  standards for the program. None of the small business representatives  we interviewed said that they saw the fraud, waste, and abuse training as  a burden. For example, two representatives we interviewed from 1 small  business said that the time they had spent on the training was a relatively  short time commitment to get a fairly significant amount of taxpayer funds  for their project.
Officials from some OIGs identified some challenges in implementing  their fraud, waste and abuse prevention requirements and addressing  fraud, waste, and abuse in the 11 agencies’ programs, including:
Submitting annual reports to Congress. Three OIGs told us that they  found it a challenge to submit the required reports to congressional  committees. For example, OIG officials at 1 agency said that because  the SBIR or STTR investigations tend to last longer than 1 year, the  annual report to Congress may not provide a full picture of all of the  SBIR or STTR investigative work that the agency OIG has done in  that year. In terms of the timing and reporting period of reports, the  reauthorization act requires the OIGs to submit the annual report to  the committees by October 1 each year on activities conducted over  the past year. The OIG working group discussed this requirement and  interpreted it to mean that they had to report on the investigations  from the preceding fiscal year but found that it would be challenging to  report the information accurately for the fiscal year on the first day of  the new fiscal year, according to an NSF OIG official. For that reason,  the working group notified the relevant congressional committees that  they would submit the reports by November 1 instead; the NSF OIG  official told us that the working group received no objections to this  date change.
Relative priority of the SBIR or STTR programs compared to other  programs. Officials from 5 agencies’ OIGs or investigative services  told us that SBIR and STTR investigations are generally a lower  priority for them because the programs represent a relatively small  amount of money compared to other programs that their agencies  fund. These officials said that the relatively small budgets involved  for the SBIR and STTR programs present a challenge for them to  investigate potential fraud, waste, and abuse in the SBIR and STTR  programs because they need to prioritize their investigations in areas  where the agencies spend more money, such as on larger programs  that their agencies fund. For example, HHS OIG officials told us their  main focus is on Medicare and Medicaid fraud, because those  programs represent the majority of their agency’s funding.
Communication between OIGs and agencies. OIG officials from 2  agencies that have multiple offices that implement SBIR or STTR  programs told us that they struggle to coordinate with all of the  relevant SBIR and STTR offices within their agency and to know what  each office has done, or not done, in its activities. For example, OIG  officials from 1 agency told us that it is hard for them to identify the  right people in each office to include on calls or to learn how each  office oversees the SBIR program and complies with the SBIR  requirements, among other things.
section_title: OIG Responsibilities are Dispersed in DOD, and Military Service OIGs Are Not Implementing or Delegating Their SBIR and STTR Fraud, Waste, and Abuse Prevention Requirements
paragraphs: DOD is unique among the SBIR and STTR agencies in that oversight and  audit responsibilities are separated between various OIGs and specific  investigative services. According to the reauthorization act, each  participating agency’s OIG is responsible for implementing the fraud,  waste, and abuse prevention requirements, and under the Small  Business Act, a participating agency includes DOD’s military  departments. However, the DOD OIGs do not investigate SBIR and STTR  fraud; instead, such investigations are conducted by separate  investigative services within each DOD component, according to a DOD  investigative official. We found that the military service OIGs—Army, Air  Force, and Navy—are neither implementing all of their SBIR and STTR  fraud, waste, and abuse prevention requirements, nor delegating the  completion of these requirements to the investigative services.
Specifically, we found that none of the three military services’ OIGs had  taken actions to implement their SBIR fraud, waste, and abuse prevention  requirements, although the DOD OIG had taken some steps to implement  these requirements. Specifically, the DOD OIG established fraud  detection indicators and has shared information with other federal  agencies on SBIR and STTR fraud cases through its involvement in the  OIG working group on SBIR and STTR fraud, waste, and abuse.  However, the DOD OIG has only partially reviewed the SBIR and STTR  regulations and operating procedures for the three services—Army, Air  Force, and Navy—that constitute the largest budgets for SBIR and STTR  programs in DOD. Moreover, while the DOD OIG has been involved in  the training of SBIR and STTR program staff, it has not coordinated or  been involved in the training of SBIR and STTR applicants or awardees.
On the other hand, the Army, Air Force, and Navy investigative services  have implemented several of the SBIR and STTR fraud, waste, and  abuse prevention measures that are required of the OIGs. For example,  representatives from the Naval Criminal Investigative Service, the Army’s  Criminal Investigation Command, and the Air Force’s Office of Special  Investigations have coordinated information sharing by attending the OIG  working group on SBIR and STTR fraud, waste, and abuse. Officials from  all three investigative services in our review also told us that they have  conducted, or are conducting, fraud investigations in conjunction with  other federal agencies and are sharing information to do so, which meets  the spirit of one of the OIG requirements. In addition, the Air Force’s  Office of Special Investigations recently developed—and helped the Air  Force SBIR and STTR program to launch—fraud, waste, and abuse  training for all applicants. Naval Criminal Investigative Service staff also  told us they provided SBIR fraud training to some Navy personnel who  review the SBIR and STTR applications. In addition to the measures  outlined above, the DOD OIG has consistently submitted annual reports  to congressional committees detailing the number of SBIR and STTR  fraud, waste, and abuse investigations over the past year, the costs of  those investigations, and other related items.
The division of duties between the military services’ OIGs and their  respective investigative services makes it difficult to track DOD’s  implementation of the requirements. The military services’ OIGs are  responsible for implementing the fraud, waste, and abuse prevention  requirements; however, the investigative services, which generally  investigate fraud, typically conduct several of the activities included in the  SBIR and STTR fraud, waste, and abuse prevention requirements.  Without the three military services’ OIGs implementing the requirements  themselves or delegating the implementation of the requirements to the  investigative services, the DOD OIGs may not be able to detect fraud,  waste, and abuse in DOD’s SBIR and STTR programs, which have the  largest budgets for these programs.
section_title: Conclusions
paragraphs: Participating agencies and their OIGs have taken steps to implement  many of their respective requirements that are designed to help the  agencies prevent fraud, waste, and abuse in their SBIR and STTR  programs. However, we found that the agencies have varied in their  implementation of program requirements, and we identified four areas in  which SBA’s oversight or review of these requirements has been limited.  First, SBA has not confirmed agencies’ implementation of the minimum  fraud, waste, and abuse prevention requirements. Without confirming that  participating agencies are implementing the minimum fraud, waste, and  abuse prevention requirements in the policy directives by, for example,  requesting documentation, SBA does not have reasonable assurance that  each agency has a fraud, waste, and abuse prevention system in place to  help reduce their vulnerability to fraud, waste, and abuse. Second,  because SBA has not taken action since 2012 to review the  requirements, it does not know whether they are effective or whether any  revisions are needed. Given that we identified several areas in which  agencies expressed confusion or implemented the requirements  differently, SBA may need to more proactively solicit agency information.  Third, because the fraud, waste, and abuse prevention requirement  regarding “essentially equivalent work” is inconsistent with the definition  earlier in the policy directives, SBA has no assurance that participating  agencies are appropriately checking for such work that they fund as well  as such work funded by other agencies. As a result, agencies may be at a  higher risk of funding essentially equivalent work. Fourth, SBA has not  evaluated the outcomes of the agencies’ implementation of the fraud,  waste, and abuse prevention requirements and therefore does not have  reasonable assurance that the requirements are necessary, appropriate,  and meet the intended purpose of preventing fraud, waste, and abuse in  the SBIR and STTR programs.
Additionally, we found that HHS does not collect the life cycle  certifications from award recipients to ensure that they are in compliance  with specific program requirements. HHS is the only agency that does not  collect copies of the certification forms. Without collecting copies of the  certification forms, it may be more difficult to prosecute HHS SBIR or  STTR awardees if they commit fraud, waste, or abuse.
With regard to the OIGs, DOD is the only agency in our review with  multiple OIG offices and also multiple investigative services. However, the  three military services’ OIGs within DOD have not implemented all of the  requirements or delegated them to the investigative services. The military  services’ OIGs are responsible for implementing the requirements, but the  requirements include activities that are typically undertaken by the  investigative services within DOD. Without the three military services’  OIGs implementing the requirements themselves or delegating them to  the investigative services, the DOD OIGs may not be able to detect fraud,  waste, and abuse in DOD’s SBIR and STTR programs, which have the  largest budgets for these programs.
section_title: Recommendations for Executive Action
paragraphs: We are making six recommendations.
To help improve agencies’ implementation of the fraud, waste, and abuse  prevention requirements in the policy directives, we recommend that the  Administrator of SBA take the following four actions:
Confirm that each SBIR and STTR agency is implementing the  minimum fraud, waste, and abuse prevention requirements in the  policy directives, by, for example, requesting documentation from  agencies.
Request input from the participating agencies regarding the clarity of  the requirements; review all of the SBIR and STTR minimum fraud,  waste, and abuse prevention requirements, including the agency  requirement to post information about successful SBIR or STTR fraud  prosecutions; determine whether any additional guidance is needed;  and revise the policy directives accordingly.
Revise the fraud, waste, and abuse provisions in the policy directives  to reflect the definition of essentially equivalent work used elsewhere  in the policy directives and require participating agencies to check for  essentially equivalent work that they fund as well as such work funded  by other agencies.
Evaluate SBIR and STTR agencies’ fraud, waste, and abuse  outcomes to ensure the fraud, waste, and abuse prevention  requirements are appropriate and meet their intended purpose for the  SBIR and STTR programs.
To help improve the implementation of the fraud, waste, and abuse  prevention requirements, we recommend that the Secretary of HHS direct  the HHS SBIR and STTR program offices to collect copies of the self- certification forms from its SBIR and STTR awardees.
To help ensure that DOD is implementing the fraud, waste, and abuse  prevention requirements to the OIGs, we recommend that the Inspectors  General of the Army, Navy, and Air Force implement the requirements  themselves or delegate the implementation of the requirements to the  investigative services.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to SBA and the 11 participating  agencies for review and comment. Four agencies—SBA, HHS, DOD, and  Education—provided written comments, which are reproduced in  appendixes IV through VII. Five agencies—SBA, Commerce, DOD, DOT,  and NSF—provided technical comments, which we incorporated, as  appropriate. Five agencies—DHS, DOE, EPA, NASA, and USDA—had  no technical or written comments.
DOD and SBA generally agreed with our recommendations, but HHS did  not concur with the recommendation to collect the self-certifications from  its SBIR and STTR awardees. Specifically, DOD stated that it concurred  with our recommendation that the Army, Navy, and Air Force OIGs  implement the fraud, waste, and abuse requirements themselves or  delegate the implementation of the requirements to the investigative  services, but provided no additional details.
SBA generally agreed with GAO’s four recommendations, and noted that  it will do more to ensure that agencies are implementing the fraud, waste,  and abuse requirements. For the first recommendation, SBA stated that it  will request that each participating agency confirm their implementation of  the minimum fraud, waste, and abuse prevention requirements. For the  second recommendation, SBA stated it will contact all agencies in writing  to inquire if additional clarity is needed regarding any of the fraud, waste,  and abuse requirements, and, if necessary, will provide additional  guidance. For the third recommendation, SBA stated that it will take steps  to revise the fraud, waste, and abuse prevention requirements in the  SBIR and STTR policy directives to reflect the definition of essentially  equivalent work as noted in section 3 of the policy directives. For the  fourth recommendation, SBA stated that it will survey the participating  agencies regarding whether the requirements are necessary and meeting  their intended purposes, are placing undue burdens on the agencies, or  need to be revised, updated, or eliminated.
While SBA generally agreed with our recommendations, it also noted in  its comments that it does not have the legislative authority to conduct full- scale audits and assessments of each participating agency's fraud,  waste, and abuse outcomes in the SBIR and STTR programs. As we  stated in this report, the Small Business Act requires SBA to  independently survey and monitor the operation of the SBIR and STTR  programs within the participating agencies. Further, the policy directives  state that SBA is responsible for ensuring that each participating agency  has taken steps to maintain a fraud, waste, and abuse prevention system  to minimize their impact on the programs. We continue to believe that the  Small Business Act and the policy directives require SBA to take an  oversight role for the programs’ fraud, waste, and abuse prevention  requirements.
SBA’s written comments also state that each participating agency has its  own OIG that has the authority, expertise, and skill necessary to analyze  whether that particular agency is effectively implementing fraud, waste,  and abuse measures in its SBIR or STIR program, and suggested that  many of the responsibilities that GAO recommends to SBA could be more  effectively and efficiently handled by the OIGs. We agree that the OIGs  have a role in preventing and detecting fraud and abuse in their agencies’  programs and operations generally. However, as we found in this report,  several agencies’ OIGs and investigative services noted that the SBIR  and STTR programs are often a lower priority because the programs  represent a relatively small amount of money compared to other  programs that their agencies fund, and that they need to prioritize their  investigations in areas where the agencies spend more money. Because  the Small Business Act and SBIR and STTR policy directives include  requirements for SBA to monitor the operation of the programs and  ensure agencies have taken steps to maintain fraud, waste, and abuse  prevention systems, we believe the recommendations that we are making  to SBA are appropriate.
In addition, SBA stated that none of the participating agencies had  communicated ambiguity in or a misunderstanding of any fraud, waste,  and abuse requirements, and thus SBA was unaware of the need to  clarify these requirements. We agree that agencies had not raised issues  about the requirements with SBA, and state this in the report. However, in  interviews with agency program officials about the requirements during  this review, we identified areas where the agencies were implementing  the requirements differently and program officials confirmed that parts of  the requirements were unclear. In some cases, program officials asked us  how they were supposed to implement these requirements. Such  questions and variation in the implementation show that there is  ambiguity in the requirements or misunderstanding among agencies.
In its comments, HHS raised three issues explaining why it did not concur  with our recommendation. First, HHS stated that it has implemented the  requirements in the policy directives for life cycle certifications. As noted  in our report, HHS requires that awardees complete certifications and  keep them on file and available for review. However, the fraud, waste,  and abuse prevention requirements state that agencies are to require  certifications from award recipients during the life cycle of the award.  Further, the section of the policy directives that contains the certification  templates states that the forms are to be submitted by the applicant to the  contracting or granting agency. We do not believe that HHS has fully  implemented this requirement because HHS does not require awardees  to submit the certifications to HHS. Without collecting the life cycle  certifications, HHS has no assurance that awardees have completed  them.
Second, HHS stated that the agency cannot accurately determine when  certifications are due to collect them because its financial data is typically  45 days in arrears. Award recipients are required to complete life cycle  certifications at three different financial milestones: when receiving the  final payment for a Phase I award, prior to receiving 50 percent of the  total amount for a Phase II award, and prior to the final payment for a  Phase II award. There is no specific timeframe for agencies to collect the  certifications, and we see no issue with collecting them within 45 days of  these financial milestones. HHS also stated that requiring grantees to  submit certifications would create a substantial administrative burden.  HHS does not explain, however, why if the recipient has to fill out the  certification form in any case, submitting the form is likely to be a  significant additional administrative burden. Also, as noted in the report,  all of the participating agencies—with the exception of HHS—collect the  certifications from awardees, and none mentioned to us that it created a  significant administrative burden.
Third, HHS stated that grant fraud cases, including those for the SBIR or  STTR programs, have been successfully prosecuted without grantees  proactively submitting life cycle certifications. However, as stated in this  report, HHS OIG officials told us that they raised concerns to HHS SBIR  staff about the practice of allowing awardees to maintain the certifications  at their small businesses instead of submitting them to the agency. In  addition, OIG officials from most of the participating agencies told us that  they use these certifications to show the intent to commit fraud, if any  fraud occurs later, because the small businesses are certifying the  accuracy and truth of the information they are submitting to the agency.   We continue to believe that taking steps to collect the certifications from  SBIR and STTR awardees would bring HHS into full compliance with this  requirement, and would provide HHS with better assurance that the  awardees understand and agree to the terms of the contract. We  therefore continue to believe that it is important for HHS to collect the  signed life cycle certification forms from small businesses and retained  the recommendation.
We are sending copies of this report to the appropriate congressional  committees; the Secretaries of Agriculture, Commerce, Defense,  Education, Energy, Health and Human Services, Homeland Security, and  Transportation; the Administrators of the Small Business Administration,  the Environmental Protection Agency, and the National Aeronautics and  Space Administration; the Director of the National Science Foundation;  the Inspectors General of the Army, Air Force, and Navy; and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-3841 or NeumannJ@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made key contributions to  this report are listed in appendix VIII.
section_title: Appendix I: Objectives, Scope and Methodology
paragraphs: This report examines the extent to which (1) participating agencies and  the Small Business Administration (SBA) have implemented fraud, waste,  and abuse prevention requirements in the Small Business Innovation  Research (SBIR) and Small Business Technology Transfer (STTR)  programs and (2) OIGs have implemented fraud, waste, and abuse  prevention requirements in the SBIR and STTR programs.
To answer our first objective, we reviewed relevant laws and directives,  including the reauthorization act for the SBIR and STTR programs  (reauthorization act) and the SBIR and STTR policy directives, and our  prior report on SBIR and STTR fraud, waste, and abuse issues. We  requested and reviewed documentation from the 11 participating  agencies on their actions to address fraud, waste, and abuse and to  implement the requirements and compared this information to the  requirements in the policy directives. We focused on steps taken since  2012 because that was the first year that the fraud, waste, and abuse  prevention requirements for agencies contained in the policy directives  went into effect. We assessed agencies’ implementation of the  requirements but not the effectiveness of their implementation. We  determined that an agency had fully implemented a requirement if the  agency could demonstrate, through interviews with agency officials and  documentation provided by them, as appropriate, that it had fully  implemented each part of the requirement. We determined that an  agency partially implemented a requirement if the agency could  demonstrate, through interviews with agency officials and documentation  provided by them, as appropriate, that it had at least implemented one  part of the requirement. We determined that an agency had not  implemented the requirement if it could not provide evidence for  implementing any part of that requirement. We limited our review of the  Departments of Defense (DOD) and Health and Human Services (HHS)  to the components that spent more than $100 million on SBIR and STTR  in fiscal year 2014, the last year that we had data at the start of our  review. For DOD, this includes the three military departments—Army, Air  Force, and Navy—that comprise 70 percent of DOD’s SBIR and STTR  programs. We also included the Office of the Secretary of Defense, which  oversees the SBIR and STTR programs for all DOD components. For  HHS, our review includes the National Institutes of Health, which  comprises 98 percent of HHS’s SBIR and STTR programs. Further, we  requested and reviewed information from SBA to determine the actions  SBA has taken to oversee the agencies’ efforts related to fraud, waste,  and abuse. In addition, we interviewed program managers from SBA and  the participating agencies regarding their actions to address fraud, waste,  and abuse in the programs using a standard set of interview questions.  To characterize views throughout the report, we defined modifiers to  quantify officials’ views as follows:  “Most” agencies represents 7 or more agencies’ officials.  “Several” agencies represents 5 to 6 agencies’ officials.  “Some” agencies represents 3 to 4 agencies’ officials  To address our second objective, we reviewed the requirements for fraud,  waste, and abuse for the participating agencies’ OIGs in the  reauthorization act. We requested and reviewed documentation from the  11 participating agencies’ OIGs on their actions to address the fraud,  waste, and abuse prevention requirements and compared this information  to the requirements in the reauthorization act. We focused on steps taken  since 2012 because that was the first full year that the fraud, waste, and  abuse prevention requirements for OIGs went into effect. We assessed  OIGs’ implementation of the requirements but not the effectiveness of  their implementation. We determined that an OIG had fully implemented a  requirement if it could provide documentation that it had fully implemented  each part of the requirement. We determined that an OIG partially  implemented the requirement if it could provide documentation that had at  least implemented one part of the requirement. We determined that an  OIG had not implemented the requirement if it could not provide evidence  for implementing any part of that requirement. In addition, we interviewed  SBA and participating agencies’ OIG and investigative staff who have  worked on SBIR and STTR reviews and investigations regarding their  actions to address fraud, waste, and abuse in the programs, using a  standard set of interview questions. To characterize views throughout the  report, we defined modifiers to quantify officials’ views as follows:  “Most” OIGs represents 7 or more OIGs’ officials.  “Several” OIGs represents 5 to 6 OIG’s officials.  “Some” OIGs represents 3 to 4 OIGs’ officials  To help inform both objectives, we conducted interviews with a non- generalizable sample of 11 small businesses to obtain information on  their experiences with, and knowledge of, fraud, waste, and abuse  prevention activities by agencies and the challenges the small businesses  faced regarding the SBIR and STTR fraud, waste, and abuse prevention  requirements. To select these 11 small businesses, we used publicly  available data on SBIR and STTR awardees available on SBA’s SBIR  and STTR program website (www.SBIR.gov). We downloaded a list of all  of the SBIR or STTR awards by any agency in 2012 through 2016. We  selected 2012 as the beginning year because it was the year that  agencies started implementing the new fraud, waste, and abuse  prevention provisions required by the policy directives for the programs.  We identified the small businesses that had received awards from at least  3 agencies and prepared a spreadsheet for each agency that listed all of  the small businesses that had received at least three awards, including at  least one from that agency. We focused on small businesses that had  received SBIR or STTR awards from at least 3 agencies since 2012 to  maximize the number of agencies with which the small businesses had  experience. We used a random number generator to assign random  numbers to each of the small businesses on each agency list and sorted  the lists by the randomly generated numbers. We contacted the first small  business on each agency’s list to request an interview. If we did not  receive a response from the small business after three attempts, we  contacted the next small business on the list until we received a  response. The information collected from these small businesses is  anecdotal and cannot be generalized to all small businesses that receive  SBIR or STTR awards, but provide illustrative examples of small  businesses’ experiences with the fraud, waste, and abuse prevention  requirements.
We conducted this performance audit from April 2016 to April 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Agency Implementation of Small Business Innovation Research and Small Business Technology Transfer Fraud, Waste, and Abuse Prevention Requirements
paragraphs: The 2011 reauthorization of the Small Business Innovation Research  (SBIR) and Small Business Technology Transfer (STTR) programs  (reauthorization act) required the Small Business Administration (SBA) to  add fraud, waste, and abuse prevention requirements to the policy  directives for agencies to implement. The policy directives for each  program contain the same requirements. Table 1 contains our  assessment of each agency’s implementation of the requirements as of  December 2016 based on documentation provided by the agencies and  interviews with agency officials. Further, we assessed agencies’  implementation of the requirements but not the effectiveness of their  implementation. We focused our review on whether the agency had taken  any action to implement the requirement. The full text of the  requirements, as they appear in the Policy Directives for the programs, is  as follows:  At a minimum, agencies must:
Require certifications from award recipients that they are in  compliance with specific program requirements at the time of the  award, as well as after the award and during the life cycle of the  funding agreement.
Include information explaining how an individual can report fraud,  waste, and abuse on the agency’s respective program website and in  each funding solicitation using the method provided by the agency’s  Office of the Inspector General (OIG), such as publishing the agency’s  fraud hotline number.
Designate at least one individual in the agency to, at a minimum,  serve as the liaison for the SBIR or STTR program, the OIG, and the  agency’s Suspension and Debarment Official and ensure that  inquiries regarding fraud, waste, and abuse are referred to the  appropriate office.
Include on its program website information concerning successful  prosecutions of fraud, waste, and abuse in the programs.
Establish a written policy requiring all personnel involved with the  program to notify the OIG if anyone suspects fraud, waste, and/or  abuse and ensure the policy is communicated to all personnel.
Create or ensure there is an adequate system to enforce  accountability by developing separate standardized templates for  referrals to the OIG and the suspension and debarment official, as  well as a process for tracking such referrals.
Ensure compliance with program eligibility requirements and terms of  funding agreements.
Work with the agency’s OIG in its efforts to establish fraud detection  indicators; coordinate sharing of information on fraud, waste, and  abuse between federal agencies; and improve education and training  to program officials, applicants, and award recipients.
Develop policies and procedures to avoid funding essentially  equivalent work already funded by another agency.
Consider enhanced reporting requirements during the funding  agreement.
We limited our review of the Departments of Defense (DOD) and Health  and Human Services (HHS) to the components that spent more than  $100 million on the SBIR and STTR programs in fiscal year 2014, the last  year for which we had data at the start of our review. As such, we limited  our review of DOD’s efforts to the three military departments—Army, Air  Force and Navy—that comprise 70 percent of DOD’s SBIR and STTR  programs. We also included the Office of the Secretary of Defense, which  oversees the SBIR and STTR programs for all DOD components.  Additionally, we limited our review of HHS’s program to the National  Institutes of Health, which comprises 98 percent of HHS’s SBIR and  STTR programs.
Partially implemented requirement  Did Not implement requirement  Our assessment of the SBIR and STTR fraud, waste, and abuse requirements at DOD included  three DOD components in our review—Army, Air Force, and Navy.  Our assessment of the SBIR and STTR fraud, waste, and abuse requirements at HHS included one  HHS component—the National Institutes of Health.  NASA is receiving partial credit for the required certifications from awardees because NASA is not  using the exact language in the self certifications from the small businesses, as required in the policy  directive. However, NASA officials told us that they have updated the language for the self- certifications based on lessons learned from prosecuting SBIR fraud cases, which is why NASA is  using different language for the certifications than that provided in the policy directives.  NSF is receiving partial credit for the required templates for the OIG and the Suspension and  Debarment Official because NSF agency officials do not have a template for making referrals to the  Suspension and Debarment Official. NSF OIG officials provided information on how they make  referrals to the Suspension and Debarment Official, but because this requirement is directed at the  agency staff and calls specifically for a template, NSF received partial credit for this requirement.
section_title: Appendix III: Offices of Inspectors General Implementation of Small Business Fraud, Waste, and Abuse Prevention Requirements
paragraphs: The 2011 reauthorization of the Small Business Innovation Research  (SBIR) and Small Business Technology Transfer (STTR) programs  (reauthorization act) included five fraud, waste, and abuse prevention  requirements for the participating Offices of the Inspectors General (OIG)  to implement. The table below contains our assessment of each OIG’s  implementation of the requirements as of December 2016 based on  documentation provided by the OIGs and interviews with OIG officials.  Further, we assessed the OIGs’ implementation of the requirements but  not the effectiveness of their implementation. We focused our review on  whether the agency OIG had taken any action to implement the  requirement. The full text of the requirements, as they appear in the  statute reauthorizing the programs, is as follows:  The Inspector General of each Federal agency that participates in the  SBIR program or STTR program shall cooperate to prevent fraud, waste,  and abuse in the SBIR program and the STTR program by:
Establishing fraud detection indicators.
Reviewing regulations and operating procedures of the Federal  agency.
Coordinating information sharing between Federal agencies, to the  extent otherwise permitted under federal law.
The DOD OIGs have overall responsibility for implementing these requirements under the  reauthorization act. However, the responsibilities for investigating fraud, which are typically found  within the other participating agencies’ OIGs, are separate for DOD and are located instead in  specific investigative services. We found that the three DOD investigative services in our review have  implemented several of the SBIR and STTR fraud, waste, and abuse requirements, as noted in our  report. However, the table above reflects only the work that the DOD OIG has done to implement the  requirements. We found that the DOD component OIGs had not done anything to implement these  requirements.
section_title: Appendix IV: Comments from the Small Business Administration
section_title: Appendix V: Comments from the Department of Health and Human Services
section_title: Appendix VI: Comments from the Department of Defense
section_title: Appendix VII: Comments from the Department of Education
section_title: Appendix VIII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Hilary Benedict (Assistant  Director), Matt Ambrose, Lisa Brown, Greg Campbell, Antoinette  Capaccio, Justin Fisher, Cindy Gilbert, Kirsten Jacobson, TyAnn Lee,  Rebecca Makar, and Sara Sullivan made key contributions to this report.