Small Business Administration: Undercover Tests Show HUBZone Program Remains Vulnerable to Fraud and Abuse
Published: 2010-06-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Small Business Administration's (SBA) Historically Underutilized Business Zone (HUBZone) program provides federal contracting assistance to small firms located in economically distressed areas, with the intent of stimulating economic development. In July 2008 and March 2009, GAO reported on substantial vulnerabilities to fraud and abuse in the HUBZone application and monitoring process. GAO also found 10 HUBZone firms in the Washington, D.C., area and 19 firms in four other metropolitan areas in Alabama, California, and Texas that made fraudulent or inaccurate representations to get into or remain in the HUBZone program. Given the Committee's continued concern over fraud and abuse in the HUBZone program, GAO (1) performed additional proactive testing of SBA's HUBZone certification process, and (2) determined whether SBA has taken any actions against the 29 case study firms GAO identified in its prior work. Using publicly available resources to fabricate documents, GAO proactively tested SBA's application process by applying for HUBZone certification for four bogus businesses with fictitious owners and employees. GAO also interviewed SBA officials and reviewed SBA data about the 29 case study firms. GAO did not attempt to project the extent of fraud and abuse in the program nor systematically assess HUBZone program controls.
section_title: What GAO Found
paragraphs: The HUBZone program remains vulnerable to fraud and abuse. Using falsified documents and employee information, GAO obtained HUBZone certification for three bogus firms using the addresses of the Alamo in Texas, a public storage facility in Florida, and a city hall in Texas as principle office locations. A simple Internet search by SBA could have revealed these as phony applications. While the agency has required more documentation in its application process since GAO's July 2008 report, GAO's testing shows that SBA does not adequately authenticate self-reported information and, for these cases, did not perform site visits to validate the addresses. Further, the changes have significantly increased the time it takes SBA to process applications. Specifically, SBA took 7 or more months to process each of the bogus applications--at least 6 months longer than for GAO's previous investigations. SBA continually lost documentation for GAO's fourth application, and eventually withdrew it after GAO failed to resubmit the same materials for the fourth time. On its Web site, SBA reported that applicants are experiencing delays during the application process. SBA has taken some action on most of the 29 firms that GAO previously reported did not meet HUBZone program requirements. The SBA decertified 16 firms from the HUBZone program, and another 8 firms voluntarily withdrew. While GAO maintains all 29 firms did not meet requirements at the time of its review, SBA stated that the other 5 firms were in compliance at the time of its own review and so remain certified. Since GAO's March 2009 report, 17 of the 29 companies have received more than $66 million in federal obligations for new contracts. GAO recently reported that one firm has also defrauded the SBA 8(a) program. Because the SBA did not promptly debar the firm from federal contracts, it was able to fraudulently receive an additional $600,000 in noncompetitive 8(a) federal contracts since GAO's last report. SBA recently proposed debarring this firm. National Historic Landmark Address (The Alamo) Used by GAO as Principle

section_title: Letter
paragraphs: In fiscal year 2009, federal agencies obligated nearly $3 billion in sole  source or set-aside contracts to firms participating in the Historically  Underutilized Business Zone (HUBZone) program, which we have shown  to be vulnerable to fraud and abuse. Administered by the Small Business  Administration (SBA), this program is meant to spur economic growth in  underdeveloped areas by helping qualified small businesses secure federal  contracts. Qualified businesses located in HUBZones—economically  distressed areas with low income levels or high unemployment rates—are  eligible to bid on federal prime contracts and subcontracts available  exclusively to program participants, in addition to benefiting from other  contracting preferences. The SBA must certify that a small business meets  the following criteria to qualify for the program: the firm must be owned  and controlled by one or more U.S. citizens; at least 35 percent of full-time  (or full-time equivalent) employees live in a HUBZone; and the principal  office, where most qualifying employees work, must be in a HUBZone.  According to the SBA’s Dynamic Small Business Web site, as of March  2010, 9,300 firms were participating in the program.
In July 2008, we testified that the SBA’s lack of an effective fraud  prevention program meant its application process could not provide  reasonable assurance that only eligible firms were being certified to  participate in the program. Using fictitious employee and owner  information and fabricated documentation, we easily obtained HUBZone  certification for four bogus firms. We also identified 10 firms from the  Washington, D.C., metro area that participated in the program even though  they did not meet eligibility criteria. In March 2009, we reported on 19  additional HUBZone firms from Alabama, California, and Texas that were  not eligible for the program.
Because you expressed concerns about continued fraud and abuse in the  program, we (1) performed additional proactive testing of the SBA’s  HUBZone certification process and (2) determined what actions, if any,  the SBA has taken against the 29 case study firms we identified in our  prior work.
To proactively test the SBA’s HUBZone certification process, we created  four new bogus firms and applied for HUBZone certification using false  information and fabricated documents to meet the SBA’s certification  requirements. Our applications contained fictitious employee information  and bogus principal office addresses. We used publicly available guidance  provided by the SBA to create the applications. When necessary, we  fabricated documents to support our applications using commercially  available hardware, software, and materials. To determine what actions, if  any, the SBA has taken against the 29 firms that we found misrepresented  their HUBZone status, we made inquiries on our referrals with SBA  officials from the HUBZone Program Office, and the SBA’s Suspension and  Debarment Official (SDO). To identify federal obligations received by the  firms subsequent to our referral to SBA, we analyzed data from the  Federal Procurement Data System-Next Generation. We also reviewed the  SBA’s Dynamic Small Business Web site to determine the current  HUBZone status of the 29 firms. To identify firms that represented  themselves as HUBZone certified, where they may possibly receive  benefits from improperly being associated with the program, even after  they were decertified by the SBA, we reviewed the Web sites of all 29  firms. We did not review SBA records to confirm actions on the 29 firms or  the firms’ actions to comply with HUBZone requirements.
Our work was not designed to systematically assess HUBZone program  controls or to determine the legal sufficiency of any actions SBA took  against the selected firms we referred for investigation. We conducted our  investigation from October 2008 through June 2010 in accordance with  quality standards for investigations as set forth by the Council of the  Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
paragraphs: The HUBZone program was established by the HUBZone Act of 1997 to  stimulate economic development by providing federal contracting  preferences to small businesses operating in economically distressed  communities known as HUBZones. The SBA is responsible for  administering the program and certifying applicant firms that meet  HUBZone program requirements. To be certified, in general, firms must  meet the following criteria: 1) the company must be small by SBA size  standards; 2) the company’s principal office—where the greatest number  of employees perform their work—must be located in a HUBZone; 3) the  company must be at least 51 percent owned and controlled by U.S.  citizens; and 4) at least 35 percent of the company’s full-time (or full-time  equivalent) employees must reside in a HUBZone. As of March 2010,  approximately 9,300 firms were listed in the SBA’s Dynamic Small  Business database as participating in the HUBZone program.
A certified HUBZone firm is eligible for a variety of federal contracting  benefits, such as sole source contracts and set-aside contracts.  Contracting officers may award a sole source contract to a HUBZone firm  if, among other things, the officer does not have a reasonable expectation  that two or more qualified HUBZone firms will submit offers and the  anticipated award price of the proposed contract, including options, will  not exceed $5.5 million for manufacturing contracts or $3.5 million for all  other contracts. Once a qualified firm receives a HUBZone contract, the  firm is required to spend at least 50 percent of the personnel costs of the  contract on its own employees. The company must also represent, as  provided in the application, that it will ‘‘attempt to maintain’’ having 35  percent of its employees reside in a HUBZone during the performance of  any HUBZone contract it receives.
The SBA must ensure that both applicant and participant firms meet and  maintain eligibility criteria at the time of application and, if they are  granted certification, throughout their tenure in the program. During the  application process, firms attest to the authenticity of the information that  they submit to the SBA regarding their eligibility. Subsequent to  certification, SBA regulations require firms to immediately notify the  agency if any material changes occur that affect their eligibility, such as  changes to the number of employees residing in a HUBZone or the  location of the firm’s principal office. Moreover, certified HUBZone firms  competing for government contracts must verify in the government’s  Online Representations and Certifications Application (ORCA) that there  have been “no material changes in ownership and control, principal office,  or the percentage of employee’s living in a HUBZone since it was certified  by the SBA.” Firms and individuals who misrepresent their eligibility  during the application process or while participating in the program are  subject to civil and criminal penalties; decertification from the HUBZone  program; or debarment from all federal contracts.
section_title: SBA’s HUBZone Certification Process Remains Vulnerable to Fraud and Abuse
paragraphs: The SBA continues to struggle with reducing fraud risks in its HUBZone  certification process despite reportedly taking steps to bolster its controls.  The agency certified three of our four bogus firms based on fraudulent  information, including fabricated explanations and supporting  documentation. The SBA lost documentation for our fourth application on  multiple occasions, forcing us to abandon our application. Our testing  revealed that the SBA does not adequately authenticate self-reported  information—especially as it pertains to information regarding whether a  firm’s principal office location meets program requirements. For example,  for our successful firms, we used the addresses of the Alamo, a public  storage facility in Florida, and a city hall in Texas as our principal office  locations—locations that a simple Internet search could have revealed as  ineligible for the program. While ensuring that a HUBZone applicant’s  principal office is legitimately located in a HUBZone is a complicated  process, the SBA’s failure to verify principal office locations leaves the  program vulnerable to firms misrepresenting the locations of their  principal offices and thus, benefits of the program not going to areas that  are economically disadvantaged. Figure 1 below shows one of the  acceptance letters we received.
In contrast to our last test of the HUBZone certification process, the SBA  considerably increased the amount of documentation it requested to  support each application and its attempts to contact and communicate  with the owners we represented in our applications. However, the SBA  also increased the amount of time it takes to certify firms and, by all  indications, suspended the use of agency processing time guidelines as  indicated by an e-mail that we received from an SBA official and  information that the agency posted on its Web site. The SBA took at least  7 months to process each of the three applications from our bogus  companies that it certified. In our previous test, the SBA certified our firms  in as little as 2 weeks, with minimal requests for documentary evidence.  SBA’s increased processing times failed to prevent our fraudulent firms  from being certified.
As we indicated in our March 2009 report, the SBA initiated a process of  reengineering the HUBZone program in response to our findings and  recommendations. Though we did not assess the effectiveness of the  actions that the SBA undertook to strengthen its internal controls, we  were still able to exploit those weaknesses in order to obtain program  certification for our bogus firms.
Specific details about each of our fraudulent applications are reported  below.
Fictitious Application 1: We received HUBZone certification about 7  months after submitting this application to the SBA. For the principal  office location, we used the address of the Alamo, a National Historic  Landmark in Texas. We claimed that both the firm’s employees were  HUBZone residents. Nearly 3 months after submission, we received an e- mail from the SBA requesting a copy of the HUBZone maps that we used  to verify the residency of our employees, birth certificates, copies of tax  returns for the last 3 years, corporate documents, and a copy of our firm’s  rental agreement and a recent utility bill. We fabricated these documents  using publicly available materials and software and submitted them to the  SBA. The SBA then requested a copy of the firm’s most recent official  payroll records and sought clarification between the number of employees  who worked at our firm’s principal office and those who worked off site.  We were also required to provide additional payroll records and  corresponding banking statements with the line-by-line transactions that  supported the payments that we claimed to make to our fictitious  employees. After all of the requested information was provided, we were  approved for HUBZone certification. Figure 2 provides a timeline  highlighting the major interactions that occurred with the SBA during the  processing of this application.
Fictitious Application 2: The SBA certified this bogus company 14  months after our investigators applied for HUBZone certification. The  address we used for our principal office was the same as a rental storage  unit in Florida. We claimed the firm was a partnership that employed two  individuals who both resided in a HUBZone. To substantiate our firm’s  principal address, the agency requested that we submit a lease, a recent  utility and telephone bill, and a copy of our firm’s business registration. To  verify the firm’s business activity and ownership, the SBA requested  copies of our firm’s federal business income tax returns for the last 3 years  and birth certificates of the two owners, and a copy of our firm’s  partnership agreement. To verify employee information, the SBA  requested copies of each of the HUBZone resident employees’ driver’s  licenses or voter registration cards, a copy of our firm’s quarterly  unemployment tax filings, and certified copies of the firm’s quarterly  payroll. SBA also requested tax information and a copy of our firm’s most  recent payroll documents, which we fabricated and provided to the SBA.  Several months thereafter, our bogus firm was granted HUBZone  certification.
Fictitious Application 3: After 7 months of processing, SBA approved  this bogus firm for HUBZone participation. The address of this firm’s  principal office was a city hall in Texas. We indicated that two of the firm’s  employees who worked for the bogus firm lived in a HUBZone. Several  months after processing our application, the SBA requested documentary  evidence of the firm’s location, business activity, ownership, and employee  information. After the SBA deemed the fabricated information that we  submitted regarding payroll as insufficient to determine our employee  information, the agency put our application on hold until we provided  further documentation. We then provided SBA with a sworn statement to  support information regarding payroll. SBA requested clarification about  the frequency that our bogus employees worked from the principal office  and granted HUBZone certification soon after.
Fictitious Application 4: After 4 months of processing, the SBA  withdrew this application after we abandoned it. We abandoned this  application because the SBA claimed that it did not receive supplementary  documentation that we repeatedly provided. Two months after the initial  submission of this application, we followed up with the SBA to inquire  about its status. At the point of inquiry, SBA indicated that our application  was being assigned to an analyst for processing. Two months after our  inquiry, we received a request for supporting documentation that was  similar to those we received in our previous applications. We provided the  requested information 3 days after receiving the request. Two weeks later,  we followed up to confirm receipt of our documents. The SBA indicated  that it did not receive the information that we provided, so we resent the  information and requested that the agency confirm receipt. Three weeks  later, after failing to receive confirmation on the receipt of our  documentation, we inquired about the status of our application. Again, the  agency told us that it did not receive the documentation and subsequently  gave us one day to resubmit it. If not provided, the agency indicated, our  application would be withdrawn. We decided to abandon the application  and our application was withdrawn from the program.
section_title: SBA Has Taken Some Actions on the 29 HUBZone Firms Previously Investigated by GAO
paragraphs: As of March 2010, the SBA has reviewed the status of all 29 firms we  referred to it from our prior HUBZone investigations. Since our March  2009 report, these firms have received more than $66 million in federal  obligations for new contracts. Not all of these obligations are necessarily  improper, and some do not relate to HUBZone contracts. Of the 29 firms,  16 were decertified by the SBA, 8 voluntarily withdrew from the HUBZone  program, and 5 were found by the agency to be in compliance with  program requirements and remain certified. We did not attempt to verify  SBA’s work. And although SBA indicated that firms sometimes come in  and out of compliance while in the program, we maintain that the firms  represented in the cases that the SBA reviewed and determined to meet  HUBZone program requirements were out of compliance at the time of our  review. In addition, we found that five decertified firms continued to  market themselves, through their Web sites, as HUBZone certified even  after the SBA removed them from the HUBZone program. Tables 1 and 2  below show the results of the SBA’s review of the 29 firms we referred  from our July 2008 testimony and March 2009 report.
We also found that one firm continued to benefit from another SBA  program even though it misrepresented its eligibility for the HUBZone  program and was decertified by the SBA. This firm, a construction firm  that was a part of our recent investigation into fraud and abuse in the  SBA’s 8(a) Business Development Program, also had been 8(a) certified  while in the HUBZone program.  During that investigation, we found  that the firm misrepresented its status as a qualified 8(a) firm because it  was being controlled by individuals who did not qualify for the program.  Because the SBA did not promptly suspend or debar the firm, this firm  was able to receive nearly $600,000 in additional noncompetitive 8(a)  contracts since our last report. According to SBA officials, SBA has  recently proposed debarment for this firm.
section_title: Corrective Action Briefing
paragraphs: We briefed SBA officials on the results of our investigation on June 17,  2010. Regarding our proactive testing, SBA officials indicated that it was  unreasonable to expect them to have identified our fictitious firms due to  the bogus documentation that we included in our applications. For  example, SBA officials stated that the submission of false affidavits would  subject an applicant to prosecution. SBA officials also stated that  competitors may identify fraudulent firms and likely protest if those firms  were awarded a HUBZone contract. While competitors may identify some  ineligible firms that were awarded contracts, it is SBA’s responsibility to  ensure that only eligible firms participate in the HUBZone program. We  suggested that SBA conduct Internet searches on the addresses of  applicant firms to help validate principal office locations. We also  indicated that if SBA had conducted site visits at the addresses of the firms  represented in our applications, those applications would have been  identified as fraudulent. SBA officials stated that due to resource  constraints, they primarily conduct site visits on certified firms that  receive large prime HUBZone contracts.
Regarding our 29 referred firms, SBA officials stated that debarment has  recently been proposed for an additional firm. We suggested that if SBA  determines that a HUBZone firm is not eligible for the program, it should  consider conducting a review of that firm’s eligibility if that firm is also  certified in other SBA programs. SBA agreed with our suggestion. In  addition, SBA provided technical comments which we incorporated into  our report.
As arranged with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this letter. At that time, we will send copies of this report to the  Administrator of the Small Business Administration, interested  congressional committees and members, and other interested parties. In  addition, this report will also be available at no charge on GAO’s Web site  at http://gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report were Andy O’Connell,  Assistant Director; Matthew Valenta, Assistant Director; Lerone Reid,  Analyst-In-Charge; Eric Eskew, Agent-In-Charge; Jason Kelly; Barbara  Lewis; Jeff McDermott; and Timothy Walker.