Service-Disabled Veteran-Owned Small Business Program: Vulnerability to Fraud and Abuse Remains
Published: 2012-08-01T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The SDVOSB program provides federal contracting opportunities to business-owning veterans who incurred or aggravated disabilities in the line of duty. SBA administers the government-wide program, while VA maintains databases of veterans and SDVOSBs and oversees its own contracts. GAO has reported several times since 2009 that both programs were vulnerable to fraud and abuse and recommended improvements. In October 2010, Congress passed the Veterans Small Business Verification Act (2010 Act), part of the Veterans Benefits Act of 2010, to provide tools to VA to more-thoroughly validate firms eligibility before listing them in VetBiz, the database used by VA contracting officials to award SDVOSB contracts.
GAO was asked to assess (1) VAs progress in addressing remaining vulnerabilities to fraud and abuse in its SDVOSB program and (2) actions taken by SBA or other federal agencies to improve government-wide SDVOSB fraud-prevention controls. GAO reviewed agency documentation and interviewed agency officials. GAO also investigated cases of alleged fraud and abuse. GAO did not project the extent of fraud and abuse in the program.
section_title: What GAO Found
paragraphs: The Department of Veterans Affairs (VA) Service-Disabled Veteran-Owned Small Business (SDVOSB) program remains vulnerable to fraud and abuse. VA has made inconsistent statements about its progress verifying firms listed in VetBiz using the more-thorough process the agency implemented in response to the Veterans Small Business Verification Act (2010 Act). In one communication, VA stated that as of February 2011, all new verifications would use the 2010 Act process going forward. However, as of April 1, 2012, 3,717 of the 6,178 SDVOSB firms (60 percent) listed as eligible in VetBiz had not been verified under the 2010 Act process. Of these 3,717 firms, 134 received $90 million in new VA SDVOSB set-aside or sole-source contract obligations from November 30, 2011, to April 1, 2012. While the 2010 Act did not include a deadline for verification using the more-thorough process, the presence of firms that have only been subjected to the less-stringent process that VA previously used represents a continuing vulnerability. VAs Office of Inspector General (OIG) reported that the less-stringent process was in many cases insufficient to establish control and ownership and in effect allowed businesses to self-certify as SDVOSBs with little supporting documentation. VA has taken some positive action to enhance its fraud prevention efforts by establishing processes in response to 6 of 13 recommendations GAO issued in October 2011, including conducting unannounced site visits to high-risk firms and developing procedures for referring suspicious SDVOSB applications to the OIG. VA has also begun action on some remaining recommendations, such as providing fraud awareness training and removing contracts from ineligible firms, though these procedures need to be finalized.
Regarding the government-wide SDVOSB program, no action has been taken by agencies to improve fraud-prevention controls. Relying almost solely on firms self-certification, the program continues to lack controls to prevent fraud and abuse. The Small Business Administration (SBA) does not verify firms eligibility status, nor does it require that they submit supporting documentation. While SBA is under no statutory obligation to create a verification process, five new cases of potentially ineligible firms highlight the danger of taking no action. These firms received approximately $190 million in SDVOSB contract obligations. In one case, a firm found ineligible by VA continued to self-certify as an SDVOSB and received about $860,000 from the General Services Administration and the Department of Interior. Further, the Department of Defense (DOD) OIG reported in 2012 that DOD provided $340 million to firms that potentially misstated their SDVOSB status. To address these vulnerabilities, GAO previously suggested that Congress consider providing VA with the authority necessary to expand its SDVOSB eligibility verification process government-wide. Such an action is supported by the fact that VA maintains the database identifying which individuals are service-disabled veterans and is consistent with VAs mission of service to veterans. However, the problems GAO identified with VAs verification process indicate that an expansion of VAs authority to address government-wide program problems should not be undertaken until VA demonstrates that its process is successful in reducing its own SDVOSB programs vulnerability to fraud and abuse.
section_title: What GAO Recommends
paragraphs: GAO recommends that VA take steps to ensure that all firms within VetBiz have undergone the 2010 Act verification process. VA generally concurred with the recommendation but expressed concern about how specific report language characterized its program. GAO made some changes to the report but continues to believe that the program remains vulnerable to fraud and abuse.

section_title: Letter
paragraphs: In fiscal year 2010, federal agencies awarded $10.8 billion in small- business obligations to firms in the Service-Disabled Veteran-Owned  Small Business (SDVOSB) program, according to the Small Business  Administration (SBA). The SDVOSB program is intended to honor  business-owning veterans who incurred or aggravated disabilities in the  line of duty by providing their firms with sole-source and set-aside  contracting opportunities. Firms must meet several requirements to be  eligible to participate in the program, such as being majority-owned by  one or more service-disabled veterans who manage and control daily  business operations.
SBA, which administers the government-wide SDVOSB program, does  not verify firms’ eligibility for the program, and has stated that its only  statutory obligation is to report on other agencies’ success in meeting  SDVOSB contracting goals. In 2009, we investigated 10 cases in which  ineligible firms that self-certified their service-disabled veteran-owned  business status received about $100 million in SDVOSB contracts. Since  2009, we have issued nine reports and testimonies detailing how the  SDVOSB program is vulnerable to fraud and abuse.
Accounting for about 30 percent of government-wide awards, the  Department of Veterans Affairs (VA) awarded $3.2 billion in SDVOSB  contracts in fiscal year 2010. Unlike SBA, VA is bound by law to verify  firms’ eligibility; the Veterans Benefits, Health Care, and Information  Technology Act of 2006 (2006 Act) requires VA to maintain a database of  SDVOSBs and Veteran-Owned Small Businesses (VOSB), known as  VetBiz. The 2006 Act also requires that VA verify the ownership, control,  and veteran or service-disabled status of firms listed in VetBiz to confirm  that they are eligible to receive VA SDVOSB set-aside and sole-source  contracts. In response to the 2006 Act, VA chose to implement a  verification process consisting of checking whether a firm’s owner was  listed in VA’s database of service-disabled veterans and conducting  searches on publicly available websites such as the Excluded Parties List  System (EPLS), which lists firms that have been debarred from doing  business with the federal government. Nonetheless, we reported in 2009  and 2010 that this verification process allowed ineligible firms to be  wrongly certified. In 2011, VA’s Office of Inspector General (OIG) also  reported on the basis of a random selection of 42 firms that 32 of 42  SDVOSBs and VOSBs listed in the VetBiz database were ineligible for  the VA SDVOSB program.
As part of our past work, we made recommendations to strengthen both  government-wide and VA fraud-prevention controls. Further, in response  to the Veterans Small Business Verification Act (2010 Act), part of the  Veterans’ Benefits Act of 2010, VA implemented a more-thorough  verification process that includes unannounced and announced site visits,  and review and analysis of company documentation to validate a firm’s  eligibility as owned and controlled by serviced-disabled veterans before  listing the firm in VetBiz. In July 2011, we reported that both SBA and VA  had taken positive steps in response to our findings and  recommendations, but that both the government-wide and VA programs  remained vulnerable to fraud and abuse.program remains vulnerable to fraud and abuse, you requested that we  update our prior work and report the status of our recommendations.  Therefore, we assessed (1) VA’s progress in addressing remaining  vulnerabilities to fraud and abuse in its SDVOSB program and (2) actions  taken by SBA or other federal agencies since our previous reports to  improve government-wide SDVOSB fraud-prevention controls.
To assess vulnerabilities in VA’s verification process, we reviewed prior  findings and recommendations from GAO audits and investigations of  VA’s VetBiz verification program, including the status of   We also reviewed  recommendations we issued to VA in October 2011. VA’s standard operating procedures, internal control policies, a VA OIG  report, and other related documents.officials about the status of VA’s verification efforts. To assess VA’s  progress toward verifying all firms in VetBiz under the 2010 Act, we  reviewed relevant statutes and regulations governing the program, VA  guidance, VA statements provided to Congress, and related documents.  We also interviewed various agency officials.
To assess actions taken to improve government-wide SDVOSB fraud- prevention controls since our previous reports, we reviewed prior findings  and recommendations from our audits and investigations of the SDVOSB  program. We reviewed applicable guidance on internal control standards  from our Standards for Internal Control in the Federal Government, the  fraud-prevention framework, and a Department of Defense (DOD) OIG  report. We requested information from SBA on any actions that it has  taken in response to our recommendations. We also requested  information from SBA and VA on any actions taken related to the 10  cases of ineligible firms identified in our previous work. In addition, we  contacted agency OIGs who received our fraud referrals pertaining to  these 10 cases to learn of any action taken against the firms. We also  searched the Central Contractor Registration (CCR) to determine  whether original case-study firms were self-certified as SDVOSBs and  searched VA’s VetBiz online database to determine whether original  case-study firms were listed in the system as verified SDVOSB firms. In  addition, we searched EPLS to determine if any agencies had suspended  or debarredinvestigated.   the original case-study firms or related individuals we  To further assess vulnerabilities in both the government-wide and VA  SDVOSB fraud-prevention controls, we investigated new allegations from  informants regarding firms that received SDVOSB contracts through  fraudulent or abusive eligibility misrepresentations. We did not design our  work to identify all firms that misrepresent themselves as SDVOSBs or  commit fraudulent or abusive activity in the SDVOSB program, nor did we  attempt to identify fraud and abuse in SDVOSB subcontracts. In addition,  our case examples cannot be projected to the overall population of  SDVOSB firms. To identify potential cases, we reviewed SDVOSB  contract awards and protests filed with SBA since 2008 and VA since  2010. We also analyzed the CCR database and VA’s VetBiz database of  applicants for fraudulent activity and reviewed over 100 allegations of  fraud and abuse we received from informants between 2009 through  2011. From these sources, we selected 10 potential cases for further  investigation on the basis of a variety of factors, including the credibility  and specificity of facts and evidence provided in protests and allegations  and whether a firm received multiple SDVOSB contracts since fiscal year  2010. We attempted to select case studies from two categories:  SDVOSBs verified in VetBiz and firms listed in CCR as SDVOSBs that  were not verified by VA. In addition, these 10 cases were not under  investigation by the SBA or VA OIGs at the time of selection.
To validate the facts in these cases, we interviewed some firm owners  and managers and reviewed relevant documentation, such as business  filings and tax returns, to determine if SDVOSB eligibility requirements  had been met. We reviewed certifications made by firms, such as  certifications about a firm’s size, SDVOSB status, and line of business, in  the federal government’s Online Representations and Certifications  Application (ORCA) and CCR. We also analyzed data from Federal  Procurement Data System-Next Generation (FPDS-NG) from October  2009 through December 2011 to identify SDVOSB contract obligations  received by the firms, and confirmed the contract information with  awarding agencies. We also reviewed Accurint reports to identify  whether owners and firms had any criminal records and federal tax liens  and validated this information if necessary. Ultimately, through a  combination of data matching, a review of public records, and interviews,  we were able to substantiate the informants’ allegations in 4 of the 10  cases and have gathered enough evidence to indicate firms in a fifth case  may be ineligible. We have highlighted examples from these 5 cases  throughout this report and will refer them to SBA and VA and other  appropriate agencies for further review. We were unable to conclusively  determine eligibility in the remaining 5 cases.
To assess the reliability of the data sources used for this report, including  EPLS, FPDS-NG, and VetBiz, we interviewed agency officials and traced  information to source documents when possible. We verified the  suspension and debarment information with SBA and the appropriate  agencies. We verified the contract obligations with the awarding  agencies. We also verified the firms’ VetBiz SDVOSB verification status  with VA. We determined that the data were sufficiently reliable for the  purpose of our audit. We conducted this performance audit from January  2011 to July 2012 in accordance with generally accepted government  auditing standards. the audit to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives. We  performed our investigative work from January 2011 to July 2012 in  accordance with the standards prescribed by the Council of the  Inspectors General on Integrity and Efficiency.
Some of the work in this report is based on prior GAO products issued in 2012, 2011,  and 2009. GAO, Service-Disabled Veteran-Owned Small Business Program:  Governmentwide Fraud Prevention Control Weaknesses Leave Program Vulnerable to  Fraud and Abuse, but VA Has Made Progress in Improving Its Verification Process,  GAO-12-443T (Washington, D.C.: Feb. 7, 2012); Service-Disabled Veteran-Owned Small  Business Program: Additional Improvements to Fraud Prevention Controls Are Needed,  GAO-12-205T (Washington, D.C.: Nov. 30, 2011); GAO-11-589T; and GAO-10-108.
subsections: section_title: Background
paragraphs: Federal regulations set requirements for a small business to qualify as an  SDVOSB. SDVOSB eligibility regulations mandate that a firm must be a  small business and at least 51 percent-owned by one or more service- disabled veterans who control the management and daily business  operations of the firm. Federal statutes and the Federal Acquisition  Regulations (FAR) require all prospective contractors to update the  ORCA to state whether their firm qualifies as an SDVOSB. Additionally,  the SDVOSB, as a contractor, is required to register in CCR. Contracting  officials are required to check CCR, which includes information such as a  firm’s status as an SDVOSB, prior to awarding most federal contracts,  including an SDVOSB set-aside or sole-source contract. Once an  SDVOSB receives a contract, SDVOSB regulations also place restrictions  on the amount of work that can be subcontracted.
Once CVE verifies a business, it sends an approval letter to the firm.  Under regulations  first promulgated in 2008, firms retained their eligibility status for 1 year from the date of  the letter.  However, on June 27, 2012, VA issued updated regulations extending the  eligibility period to 2 years before reverification is required.
SDVOSB status are required by law to be debarred from contracting with  VA for a reasonable period of time, as determined by VA. Additionally,  VA regulations state that if a firm or owner is currently debarred or  suspended, or is delinquent or in default on significant financial  obligations owed to the federal government, then the firm or owner is  ineligible for VA’s VetBiz verification program.
Federal law has established government-wide goals for specific types of  small businesses to receive a percentage of the total value of all prime- contract and subcontract awards for each fiscal year. The statutorily-  of all  mandated goal for SDVOSB participation is not less than 3 percent federal contract dollars awarded each fiscal year. SBA stated in its most  recent report that, in fiscal year 2010, $10.8 billion in small-business  obligations were awarded to firms that self-certified themselves in the  CCR as SDVOSBs. DOD SDVOSB contracts accounted for $5.3 billion  or 49 percent of government-wide SDVOSB contracts during fiscal year  2010, and VA SDVOSB contracts accounted for $3.2 billion, or 30  percent during the same period. Figure 1 summarizes the federal  contracts awarded in fiscal year 2010 by federal agencies.
Since 2009, GAO has issued nine reports or testimonies on the SDVOSB  program, focusing on its vulnerability to fraud and abuse, and agencies’  actions to prevent contracts from going to firms that misrepresent  themselves as SDVOSBs. When discussing the SDVOSB program, we  have shown that a well-designed fraud-prevention system should consist  of three crucial elements: (1) up-front preventive controls, (2) detection  and monitoring, and (3) investigations and prosecutions. Figure 2 below  outlines the key aspects of an effective fraud-prevention framework.
The most effective and most efficient part of a fraud-prevention  framework involves the institution of rigorous controls at the beginning of  the process. At a minimum, preventive controls for the SDVOSB program  should be designed to verify that a firm seeking SDVOSB status is eligible  for the program. Even with effective prevention controls, there is residual  risk that firms that appeared to meet SDVOSB program requirements  initially will violate program rules once they obtain contracts. This fact  makes effective monitoring and detection controls essential in a robust  fraud-prevention framework. Detection and monitoring efforts include  activities such as periodic reviews of suspicious firms and evaluating  firms to provide reasonable assurance that they continue to meet  program requirements. Finally, fraud-prevention controls are not fully  effective unless identified fraud is aggressively prosecuted or companies  are suspended, debarred, or otherwise held accountable, or both.
section_title: VA’s Program Remains Vulnerable to Fraud and Abuse as a Result of a Lack of Inventory Control and Potentially Ineligible Firms Listed in VetBiz
paragraphs: VA has made numerous conflicting statements about its progress  verifying firms listed in VetBiz under the more-thorough process the  agency implemented in response to the 2010 Act. These statements  indicate that VA has taken an inconsistent approach to prioritizing the  verification of firms and has been unable to accurately track the status of  its efforts. Specifically, at the close of our audit work, documentation  provided by VA indicated that thousands of SDVOSBs listed as eligible in  VetBiz received millions of dollars in SDVOSB sole-source and set-aside  contract obligations even though they had not been verified under the  more-thorough process implemented in response to the 2010 Act. At that  time, VA told us it planned to remove all firms that had their 1-year  verification period expired and had not provided documentation for  reverification under the 2010 Act process. Since then, on June 27, 2012,  VA implemented an interim final rule that extends the eligibility of verified  firms to 2 years, including firms for which the eligibility period had expired  but that had not yet been reverified. Extending the eligibility period may  allow VA to focus its efforts on more thoroughly verifying firms that were  previously verified under VA’s less-stringent 2006 Act process. However,  the extension also allows thousands of firms to continue to be eligible for  contracts even though they have not undergone the more-thorough  process. With regard to our previous work, VA has taken some positive  action to enhance its fraud prevention efforts by establishing processes in  response to 6 of 13 recommendations we issued in October 2011. VA has  also begun action on some remaining recommendations.
subsections: section_title: VA Has Difficulty Tracking Its Inventory of Firms
paragraphs: VA has provided a number of conflicting statements and explanations  related to the status of its verification program, indicating that it is having  difficulty tracking its inventory of firms and whether they were verified  under the process implemented to carry out the 2010 Act. As we  previously stated, the process VA implemented to review firms under the  2006 Act consisted of checking whether a firm’s owner was listed in VA’s  database of service-disabled veterans and conducting searches on  publicly available websites such as the EPLS, which lists firms that have  been debarred from doing business with the federal government. In  contrast, VA stated that it implemented a more-thorough verification  process under the 2010 Act that included unannounced and announced  site visits and a review and analysis of company documentation.
Although the 2010 Act did not include a date by which VA must complete  the verification of firms, within 60 days of the law’s enactment VA was  required to notify all unverified firms listed in its VetBiz database about  the need to apply for verification by submitting documents to establish  veteran ownership and control. Firms were required to do so within 90  days of receipt of the notification in order to avoid removal of the firm from  VetBiz. VA officials told us that the agency prioritized its verification under  the process implemented in response to the 2010 Act by reviewing (1)  new applications for firms that had previously only self-certified in VetBiz  (i.e., firms that had not been reviewed under the processes VA created  for the 2006 Act or 2010 Act); (2) new firms that had initially applied for  verification after the 2010 Act, to include reprocessing any firms that were  denied through the new requirements and subsequently requested  reconsideration; and (3) applications for firms initially verified in VetBiz  under the process VA chose to implement for the 2006 Act.
However, our review of information provided by VA raises concerns about  the status of this process and whether VA knows how many of its firms  have actually been verified under the processes implemented in response  to the 2010 Act. In one communication, VA stated that as of February  2011, VA’s 2006 Act verification process had been discontinued, and all  new verifications would use the process implemented in response to the  2010 Act going forward. Because firms would need to reverify 1 year  later, this meant that only firms verified under the 2010 Act process  should have been in VetBiz as of February 2012. In November 2011, VA  reported that it had removed all unverified firms from its database on  September 4, 2011. Subsequently, while reviewing new cases involving  firms that had received VA SDVOSB contracts, we found instances where  firms were not verified under VA’s 2010 Act process, but rather were  verified under its 2006 Act process.
When we met with VA in February 2012 to discuss our new cases,  officials confirmed that there were still firms in VetBiz that had not been  through the processes implemented in response to the 2010 Act, but did  not explain how many firms still had not gone through the new process.  Then, on April 23, 2012, officials told us that they had recently removed  thousands of firms from VetBiz because these firms had not supplied the  supporting documentation that VA decided was required for verification  under the process implemented in response to the 2010 Act; VA indicated  that it planned to remove hundreds of additional firms for the same  reason. VA has provided conflicting statements about whether these firms  received the December 2010 request to supply documentation. Further,  over the next month, VA officials provided us with at least seven differing  accounts of the number of SDVOSBs verified under the processes  implemented for the 2006 Act and 2010 Act, the number of SDVOSBs  they planned to remove, and the timing of the removals. VA’s conflicting  statements create uncertainty about the status of the agency’s efforts to  verify firms under the process implemented for the 2010 Act. Without a  clear inventory and methods designed to track the verification process  firms have undergone, VA cannot provide reasonable assurance that all  firms appearing in VetBiz have been verified as owned and controlled by  a veteran or service-disabled veteran.
In its agency comments, VA explained these inventory issues by noting  (1) the lack of a comprehensive case-management system has created  the need for aggregate workarounds and resulted in inconsistent  aggregate reporting; (2) the limitations of its current case-management  system make it difficult to track the inventory of firms; and (3) as the  limitations of the case-management system increase over time, the  potential of CVE to lose track of how many firms have been verified also  increases. VA also noted that its verification priorities have evolved over  time.
As of the close of our audit work, the information provided by VA  indicated that thousands of potentially ineligible firms remain listed in  VetBiz because they have not been verified under the more thorough  process implemented for the 2010 Act. Our analysis shows that as of  April 1, 2012, 3,717 of the 6,178 SDVOSBs (60 percent) listed as eligible  in VetBiz had yet to be verified using the more-thorough verification  process. Of these 3,717 firms listed as eligible on April 1, 2012, 134  received a total of $90 million in new VA SDVOSB sole-source or set- aside contract obligations during the 4-month period from November 30,  2011, to April 1, 2012. On May 14, 2012, VA told us that it removed  1,857 of these 3,717 SDVOSBs from April 2 to April 10, 2012, so that  they are no longer eligible for VA SDVOSB sole-source and set-aside  contracts. According to VA, the remaining 1,860 firms that had not  received a review under the 2010 Act process were projected to be  removed in July 2012 unless the firms provided adequate documentation  supporting their eligibility. VA also stated that these firms were identified  as being in “reverification” and no such expired firm was eligible for an  actual contract award until the reverification decision had been  completed.
Since then, on June 27, VA implemented an interim final rule that extends  the eligibility of verified firms to 2 years. VA told us it interprets “verified”  to include any firm that has been verified under either its 2006 or 2010  Act processes. Therefore, according to the interim rule, as long as a firm  is verified under either process and is in its 2-year eligibility period, VA is  only authorized to initiate a verification examination if it receives credible  evidence calling into question a participant’s eligibility. Furthermore, VA  considered firms whose prior 1-year eligibility period had recently expired,  but who had not yet been through reverification, to be within the scope of  the new rule, thus extending their eligibility another year. Extending the  eligibility period may allow VA to focus its efforts on more thoroughly  verifying firms that were previously verified under its less-stringent 2006  Act process. However, the extension also allows thousands of firms to  continue to be eligible for contracts even though they have not undergone  the more-thorough process. For example, according to information  provided by VA in its comments, as of July 13, 2012, there are 6,079  SDVOSBs and VOSBs listed in VetBiz. Of these, 3,724 were verified  under the more-through process implemented under the 2010 Act and  2,355—over 38 percent--were verified under VA’s less-rigorous 2006 Act  process. As VA acknowledges in its agency comments, “the retention of  firms verified prior to the 2010 Act  increases the possibility  awards will go to firms that will not be verified when the more rigorous  process is applied.”
Moreover, past audits show the risk of providing SDVOSB contracts to  firms reviewed under VA’s 2006 Act process. For example, in 2011, VA’s  own OIG issued a report that reviewed both SDVOSBs and VOSBs listed  in VetBiz and found that 10 of 14 SDVOSBs and VOSBs verified under  VA’s 2006 Act process and listed as eligible were in fact ineligible for  these respective programs. The report identified several reasons for why  these firms were ineligible, including improper subcontracting practices,  lack of control and ownership, and improper use of SDVOSB status,  among others. Further, the report noted VA’s document-review process  under the 2006 Act “in many cases was insufficient to establish control  and ownership…  in effect allowed businesses to self-certify as a  veteran-owned or service-disabled veteran-owned small business with  little supporting documentation.” The report goes on to state that VA’s  failure to maintain “accurate and current” information in the VetBiz  database also exacerbated problems in the verification process. VA’s OIG  also used statistical sampling methods to project that (1) $500 million of  VA SDVOSB and VOSB contracts were awarded annually to ineligible  firms and (2) VA will award about $2.5 billion in SDVOSB and VOSB  contracts to ineligible firms over the next 5 years if it does not strengthen  its oversight and verification procedures.
section_title: VA Has Made Some Progress in Addressing Our Prior Recommendations
paragraphs: In October 2011, we issued 13 recommendations to VA related to  vulnerabilities in the verification process implemented by VA after the  2010 Act; VA generally concurred with our recommendations. As of June  2012, VA has provided us with documentation demonstrating that it has  established procedures in response to 6 of these recommendations.  Figure 3 shows the status of the recommendations; more specific  information on each recommendation follows the figure. We have not  assessed the effectiveness of any of the procedures that VA has  established thus far as this is beyond the scope of this report.
VA has provided additional guidance and training to the VA  contracting personnel on the use of the VetBiz website. In  December 2011, VA issued a guidance memo requiring VA  contracting personnel to check VetBiz to ensure that a firm is verified  both upon receipt of an offer and prior to award. In November 2011,  VA also provided training to the contracting personnel on the use of  VetBiz. Providing guidance and training to current and new  contracting personnel will help to ensure that these staff are aware of  the need to check VetBiz prior to awarding a contract.
VA has established formal procedures for VA staff to refer  suspicious applications to the OIG and provided guidance on  what type of cases to refer to the OIG. In April 2012, VA issued  procedures for VA staff to use if they identify suspicious information or  possible misrepresentations on an application for eligibility during their  initial review process. These procedures contain step-by-step  instructions for how to notify the OIG about suspicious applications.  Specifically, CVE’s “risk team” makes a determination as to whether  or not an applicant has intentionally misrepresented its status in an  apparent attempt to defraud the government. If the information is  credible, the applicant is referred to the VA OIG. If VA OIG accepts  the referral, it conducts preliminary inquiries to determine whether a  full investigation into criminal activity is warranted. If the OIG declines  the investigation, VA can refer the matter to VA’s Debarment  Committee, which VA instituted in September 2010 specifically to  debar firms that had violated SDVOSB regulations. In addition to  these procedures, from November 2011 through January 2012, VA  provided three training sessions to the VA staff on the type of red  flags to note during the application review.
VA has explored the feasibility of validating applicants’  information with third parties. In 2012, VA met with Dun and  Bradstreet to explore the feasibility of utilizing their services to  validate applicants’ information, such as names and titles of business  owners. Validating applicants’ information with third parties may help  enhance VA’s ability to assess the accuracy of self-reported  information.
VA has formalized a process for conducting unannounced site  visits to firms identified as high-risk during the verification  process. In June 2012, VA issued procedures for VA to conduct  unannounced site visits on a sample of 50 percent of high-risk firms  identified during the verification process. Formalizing this process with  a focus on high-risk firms may help provide reasonable assurance that  only eligible firms gained access to the VetBiz database.
VA has developed and implemented a process for unannounced  site visits to verified companies to obtain greater effectiveness  and consistency in the verification process. VA’s aforementioned  June 2012 procedures also apply to verified companies. VA  developed a process to select on a weekly basis, based on a  combination of random and risk-based factors, verified firms to  receive an unannounced site visit. In addition, according to VA it has  started making these unannounced site visits. Conducting these site  visits may help provide reasonable assurance to VA that the  verification process is effective.
VA has developed and implemented specific procedures and  criteria for staff to make referrals to the Debarment Committee  and VA OIG as a result of misrepresentations identified during  initial verification and periodic reviews. VA’s aforementioned April  2012 procedures also apply to false information or misrepresentations  identified after VA’s initial review of the application, during the firm’s  eligibility period. These procedures may increase VA’s success in  pursuing firms that have misrepresented their eligibility for the  program.
VA has not provided regular fraud-awareness training to CVE  and VA contracting personnel. One of the most significant  challenges to an effective verification program is to have sufficient  human capital with proper training and experience. Although VA has  not established regular fraud-awareness training, it has made  progress in this area. For example, VA told us that its OIG recently  provided training on procurement fraud and that its General Counsel  provides weekly training on examination procedures and policies in  order to educate staff on fraud prevention. In addition, VA said that it  has plans to require all CVE staff to attend a fraud examiners course;  several CVE staff were already scheduled to attend fraud training in  July 2012. Having sufficient human capital with the proper training and  experience would enhance the effectiveness of the verification  program.
VA has not developed and implemented procedures for  conducting unannounced site visits to contract performance  locations and interviews with contracting officials to better  assess whether verified companies comply with program rules  after verification. VA has started conducting announced site visits as  part of its subcontracting compliance review program. This program is  used to determine if a firm is performing in accordance with  percentage of work performance requirements and other  subcontracting commitments. However, VA has not developed and  implemented procedures for conducting unannounced site visits to  contract performance locations and interviews with contracting  officials. The unannounced site visits and interviews with contracting  officials would allow VA to better assess whether verified firms comply  with program rules after verification.
VA has not developed procedures for risk-based periodic  reviews of verified firms receiving contracts to assess  compliance with North American Industry Classification System  (NAICS) size standards and SDVOSB program rules. In order to  be eligible for SDVOSB set-aside and sole-source contracts, a firm  must qualify as a small business under NAICS size standards. In draft  guidelines, VA included supplemental information for VA staff to  review the firm’s NAICS codes size standards, but these guidelines  have yet to be finalized. Moreover, the draft guidelines do not include  procedures for periodic reviews of verified firms’ compliance with  these standards. Such procedures would help improve continued  compliance with SDVOSB program rules.
VA has not developed and implemented specific processes and  criteria for the Debarment Committee on compliance with the  requirement in the 2006 Act to debar, for a reasonable period,  firms and related parties that misrepresent their SDVOSB status.  According to VA, its Debarment Committee relies on procedures  outlined in the FAR and the VA Acquisition Regulations to determine  the length of debarments.
VA has not developed specific guidelines outlining the  Debarment Committee’s decision process to debar firms that  misrepresent their SDVOSB status. VA should provide the  Debarment Committee with guidelines to aid its decision-making  process in determining what constitutes a “misrepresentation”  deserving of debarment, as that term is used in the 2006 Act.
VA has not developed procedures on removing SDVOSB  contracts from ineligible firms. According to the VA Acquisition  Regulations, the Deputy Senior Procurement Executive has the  authority to determine whether VA should terminate a contract with a  debarred firm. However, VA has not developed procedures to remove  SDVOSB contracts from ineligible firms. According to VA, it is in the  process of developing a policy on removing SDVOSB contracts from  ineligible firms as determined by status protests. In addition, VA is in  the process of providing guidance to the acquisition workforce on  removing SDVOSB contracts from ineligible firms. Until VA develops  procedures on removing SDVOSB contracts from ineligible firms, the  SDVOSB program is at risk for ineligible firms to abuse the program  and retain contracts obtained through fraud and abuse.
VA has not formalized procedures to advertise debarments and  prosecutions. VA has not formalized procedures for advertising  debarments and prosecutions, though the Debarment Committee, the  OIG, and CVE have listed these actions on their websites.
section_title: No Action Has Been Taken to Improve Government-wide SDVOSB Fraud- Prevention Controls
paragraphs: No action has been taken to improve government-wide SDVOSB fraud- prevention controls as the program continues to remain a self-certification  program. Because federal law does not require it, SBA does not verify  firms’ eligibility status, nor does it require that firms submit supporting  documentation. According to SBA, it is only authorized to perform  eligibility reviews in a protest situation, including those cases where SBA  itself has reason to believe that a firm misrepresented its SDVOSB status.  However, without basic checks on firms’ eligibility claims, SBA cannot  provide reasonable assurance that legitimate SDVOSBs are receiving  government contracts. In fact, five of our new case-study firms received  SDVOSB set-aside and sole-source contract obligations, totaling  approximately $190 million, of which $75 million were new SDVOSB set- aside and sole-source contract obligations, from October 1, 2009, to  December 31, 2011, despite evidence indicating they are ineligible for the  program.  With regard to our original 10 case-study firms reported in  October 2009, some are under investigation by SBA OIG and punitive  actions have been taken against others. To address vulnerabilities in the  government-wide program, we previously suggested that Congress  consider providing VA with the authority necessary to expand its  SDVOSB eligibility verification process government-wide. Such an action  is supported by the fact that VA maintains the database identifying which  individuals are service-disabled veterans and is consistent with VA’s  mission of service to veterans. However, such action should not be  undertaken until VA demonstrates that its verification process is  successful in reducing the SDVOSB program’s vulnerability to fraud and  abuse.
subsections: section_title: Self-Certification Allows Ineligible Firms to Win and Perform SDVOSB Contracts
paragraphs: In our previous work, we found that the SDVOSB program did not have  effective government-wide fraud-prevention controls in place and was  vulnerable to fraud and abuse.in place for SDVOSB contracting. Because federal law does not require it,  SBA and agencies awarding contracts—other than VA—do not have a  process in place to validate a firm’s eligibility for the program, and rely on  the firms self-certifying as a service-disabled veteran-owned business in  CCR. We found the only process in place to detect fraud in the  government-wide SDVSOB program involved a formal bid-protest  process at SBA, whereby interested parties to a contract award could  protest another firm’s SDVOSB eligibility or small-business size.  However, we reported that this self-policing process did not prevent  ineligible firms from receiving SDVOSB contracts. SBA officials have told  us that they have limited responsibility over the SDVOSB program, and  that the agency’s only statutory obligation is to report on other agencies’  success in meeting SDVOSB contracting goals.
Outside of VA, there was no verification  Our new case studies highlight instances of the fraud and abuse that  resulted from the lack of verification of firms’ SDVOSB status. In fact, five  of our new case-study firms received SDVOSB set-aside and sole-source  contract obligations, totaling approximately $190 million from October 1,  2009, to December 31, 2011, despite evidence indicating they are  ineligible for the program. Of this $190 million, $75 million were new  SDVOSB set-aside and sole-source contract obligations. In four of the  cases we examined, we were able to substantiate informants’ allegations  of ineligibility as follows:
Non-SDVOSB joint venture. An SDVOSB entered a joint venture  with a non-SDVOSB firm and received about $16 million in new  government-wide SDVOSB set-aside contract obligations. Such joint  ventures are eligible if the SDVOSB firm manages the joint venture  and the contract work. However, the owner, a service-disabled  veteran, admitted to our investigators that his SDVOSB firm did not  manage the joint venture. Therefore, the joint venture is ineligible.  This firm is currently listed as a SDVOSB in CCR, which allows the  firm to compete for government-wide SDVOSB contracts.
VA-denied firm. Though VA denied a firm SDVOSB status in 2010  because the firm was not controlled by a service-disabled veteran  owner, the firm continued to self-certify in CCR. A VA site visit found  the service-disabled veteran worked mostly at another company, and  the non-service-disabled veteran vice president controlled the firm. In  2011, when the firm applied for VA verification again, the size of the  firm was also questioned as it shared ownership or management with  at least four different entities, including companies owned by a non- service-disabled veteran minority owner. The company withdrew its  application to be a VA verified SDVOSB. In total, the firm received  about $21 million in SDVOSB set-aside and sole-source contracts  from DOD, the General Services Administration (GSA), the  Department of the Interior (DOI), the U.S. Department of Agriculture  and the VA, $16 million of which were new SDVOSB set-aside and  sole-source contract obligations. After VA denied the firm, the firm  continued to self-certify as a SDVOSB in CCR and GSA, and DOI  awarded the firm about $860,000 in new SDVOSB set-aside contracts  obligations. This firm is currently listed as a SDVOSB in CCR, which  allows the firm to compete for government-wide SDVOSB contracts.
Multiple firms not veteran–controlled. A service-disabled veteran  and two non-service disabled veteran co-owners owned two firms and  a joint venture at the same location. VA found one of the firms  ineligible. The operating agreements of two of the firms allowed the  two minority owners to control the firms, rather than the service- disabled veteran. Additionally, the joint venture, created by one of the  firms, was also ineligible because the service-disabled veteran’s firm  did not manage the joint venture and the contract work. Therefore,  none of the three firms were eligible for the SDVOSB program. The  three firms received over $91 million in SDVOSB set-aside and sole- source contract obligations, about $18 million of which were new  SDVOSB set-aside and sole- source contract obligations, from VA  and the Department of Health and Human Services. The three firms  have been removed from VA VetBiz. However, these firms are  currently listed as SDVOSBs in CCR, which allows the firms to  compete for government-wide SDVOSB contracts.
Not service-disabled veteran–controlled. This firm is ineligible for  the SDVOSB program because the veteran does not control the daily  operations. The service-disabled veteran was not the Chief Executive  Officer, and the firm’s operating agreement did not give the service- disabled veteran the exclusivity to make decisions for the company. In  addition, the service-disabled veteran owner lived 500 miles away  from the firm, received only $12,000 compared to the non-service- disabled veteran minority owner’s $88,000 salary, and failed to meet  or communicate with subcontractors. This firm received about $37  million in SDVOSB set-aside contract obligations, $446,000 of which  were new SDVOSB set-aside contract obligations, from DOD and  DOI. During the course of our work, SBA and VA found this company  ineligible for the SDVOSB program. This firm no longer self-certifies  as a SDVOSB in CCR. On May 25, 2012, SBA debarred the non- service-disabled veteran and the firm, making them ineligible for  further contracts with the federal government.
We were unable to substantiate allegations in a fifth case, but found  evidence that the firm in question may be ineligible for the SDVOSB  program because the service-disabled veteran owner may not spend  sufficient time at the SDVOSB. The service-disabled veteran owner  worked as an attorney at a legal services organization Monday through  Friday about 40 hours a week, which could prevent the veteran from  managing the day-to-day proceedings of the SDVOSB. This firm received  about $25 million in new SDVOSB set-aside and sole-source contract  obligations from VA and the Department of Transportation. This firm is  now listed as verified in VetBiz and is currently listed as a SDVOSB in  CCR, which allows the firm to compete for government-wide SDVOSB  contracts.
The DOD OIG likewise reported that DOD, which awarded about half of  government-wide SDVOSB contracts in 2010, did not require adequate  verification of contractor status before awarding contracts. After its review  of DOD contracts awarded from October 2009 to July 2010, the OIG  reported that $1.9 million in SDVOSB contracts went to firms that were  not registered in CCR as SDVOSBs and $340.3 million went to  contractors that potentially misstated their SDVOSB status. The OIG  also found that DOD awarded 12 SDVOSB set-aside and sole-source  contracts for a total of $11.5 million to six firms that VA rejected. The OIG  went on to recommend that DOD create an SDVOSB verification  program, but the agency disagreed, citing an absence of evidence  indicating that such a program would produce a net benefit to eligible  SDVOSBs, and that Congress had not provided DOD with either the  resources or authority to establish such a system.
To address the vulnerabilities within the government-wide program  caused by reliance on a self-certification process, we suggested in 2009  that Congress consider providing VA with the authority and resources  necessary to expand its SDVOSB eligibility verification process to all  contractors seeking to bid on SDVOSB contracts government-wide. Such  an action is supported by the fact that VA maintains the database  identifying which individuals are service-disabled veterans and is  consistent with VA’s mission of service to veterans. In 2011, legislation  was also introduced and passed in the Senate requiring all agencies to  use VA’s VetBiz for SDVOSB contract awards; this legislation has not  become law. However, as shown by our current work, VA’s program  remains vulnerable to fraud and abuse because the agency has been  unable to accurately track the status of its efforts and because potentially  ineligible firms remain listed in VetBiz. Consequently, VA’s ability to show  that its process is successful in reducing the SDVOSBs program’s  vulnerability to fraud and abuse remains an important factor in any  consideration about the potential expansion of VA’s eligibility verification  process government-wide. GAO has ongoing work that will, in part,  examine some of the key issues that need to be addressed if VA’s  verification program were to be implemented government-wide.
section_title: Actions Taken against Ineligible Firms
paragraphs: In 2009, we found that ineligible firms in 10 cases received $100 million in  SDVOSB contracts and $300 million in other federal contracts. We  referred all 10 of these cases to the appropriate agency OIGs. As of April  2012, while none of the firms are currently suspended or debarred by the  agencies that received our referrals, some actions have been taken:
The SBA OIG is proceeding with six open investigations. In addition,  the SBA OIG has joined forces with other agency OIGs to pursue  several cases. Specific details cannot be provided until the cases  have been fully adjudicated.
One individual related to a case is being prosecuted by the U.S.
Attorney for wire fraud and fraud against the United States involving a  contract valued at $1 million or more related to its misrepresentation  as an SDVOSB. In addition, this individual and a related firm were  suspended by the Department of Transportation for procurement  fraud.
One individual related to a case-study is being charged by the U.S.
Attorney with conspiracy to commit wire fraud and forfeiture of his  assets up to $400,000. This individual allegedly conspired to defraud  the SBA and other government contractors by falsely representing his  business as a service-disabled veteran-owned and operated  business.
Another case-study firm pled guilty to wire fraud in relation to  fraudulently receiving Historically Underutilized Business Zone  (HUBZone) federal contracts.ineligible for the SDVOSB program, in conjunction with the firm’s  admitting defrauding the HUBZone program, raises the concern of  ineligible firms applying for multiple procurement programs.
Our previous finding that the case was  Actions taken against firms that violate the SDVOSB program  requirements should help protect the government’s interest and help  discourage ineligible firms from abusing the SDVOSB program. As  previously discussed, providing more emphasis on debarments and  investigations could further help the government deter firms from  attempting to fraudulently gain access to the SDVOSB program.
section_title: Conclusions
paragraphs: The SDVOSB program has provided billions of dollars in contracting  opportunities to deserving service-disabled veterans. However, our body  of work, along with work by the DOD OIG and VA OIG, has found that the  program is vulnerable to fraud and abuse, which has allowed millions of  dollars to be awarded to ineligible firms. The government-wide program  remains particularly vulnerable since it relies on an honor-system-like  process whereby firms self-certify their eligibility. VA has the only program  within the government dedicated to verifying SDVOSB firms’ eligibility; VA  also has responsibility for maintaining a database of service-disabled  veterans and a listing of firms that are eligible for the SDVOSB program.  Given VA’s mission of service to veterans, we previously suggested that  Congress consider expanding VA’s program government-wide to employ  more effective fraud-prevention controls over the billions of dollars  awarded to SDVOSBs outside of VA. However, such action should not be  undertaken until VA demonstrates that its verification process is  successful in reducing the SDVOSB program’s vulnerability to fraud and  abuse.
Furthermore, while the results of this most-recent assessment show that  VA has made some progress in improving its verification process in  response to the 2010 Act, it has made conflicting statements regarding  the verification of firms and has been unable to accurately track the status  of its efforts. These problems have resulted in thousands of potentially  ineligible SDVOSBs receiving millions of dollars in sole-source and set- aside contract obligations. By better managing its inventory of firms,  maintaining the accuracy of firms’ status in VetBiz, and applying the 2010  Act verification process to all firms, VA can be more confident that the  billions of dollars meant to provide VA contracting opportunities to our  nation’s service-disabled veteran entrepreneurs make it to the intended  beneficiaries.
section_title: Recommendations for Executive Action
paragraphs: To minimize potential fraud and abuse in VA’s SDVOSB program and  provide reasonable assurance that legitimate SDVOSB firms obtain the  benefits of this program, we recommend that the Secretary of Veterans  Affairs ensure that all firms within VetBiz have undergone its 2010 Act  verification process. Specifically, this should include consideration of the  following three actions: (1) inventory firms listed in VetBiz to establish a  reliable beginning point for the verification status of each firm; (2)  establish procedures to maintain the accuracy of the status of all firms  listed in VetBiz, including which verification process they have undergone;  and (3) expeditiously verify all current VetBiz firms and new applicants  under the 2010 Act verification procedures.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of our report to VA and SBA for comment. In its  written comments, reproduced in appendix I, VA stated that it concurred  with our first two recommendations. It concurred “in principle” with the  third, to verify all current VetBiz firms and new applicants under the  processes implemented under the 2010 Act. With respect to this  recommendation, VA noted that it implemented an interim rule on June  27, 2012, that extends the eligibility of verified firms to 2 years. VA told us  it interprets “verified” to include any firm that has been verified under  either its 2006 or 2010 Act processes. Therefore, according to the interim  final rule, as long as a firm is verified under either process and is in its 2- year eligibility period, VA is only authorized to initiate a verification  examination if it receives credible evidence calling into question a  participant’s eligibility. Extending the eligibility period may allow VA to  focus its efforts on more thoroughly verifying firms that were previously  verified under its less-stringent 2006 Act process. However, the extension  also allows thousands of firms to continue to be eligible for contracts even  though they have not undergone the more thorough process. We  acknowledge that VA has latitude under the law to modify its own  regulations as necessary. However, the interim final rule in effect  removes a backlog of firms and appears to be a self-created impediment  delaying verification under the 2010 Act process. We remain convinced  that the verification process utilized by VA prior to the 2010 Act process  does not provide reasonable assurance that only eligible SDVOSBs  participate in the program. Given this ongoing vulnerability to fraud and  abuse, we continue to believe that VA should expeditiously verify current  VetBiz firms and new applicants under the 2010 Act verification process.
Despite these concurrences, VA commented that our report was  misleading and inaccurate with respect to (1) our characterizations of a  2011 VA OIG report, (2) conflicting statements made by VA, and (3) VA’s  implementation of our previously issued recommendations. We disagree.  First, VA stated that our use of the VA OIG’s 2011 report was misleading  because the report examined a period when the VetBiz database  included self-certified firms in addition to firms verified under the  processes implemented under the 2006 Act. VA also claims the VA OIG  report contains excessive extrapolations because it examined eligibility  requirements beyond ownership and control. Specifically, VA notes that  14 of the 42 firms reviewed for the OIG report had been through the  verification process VA used in response to the 2006 Act and claims that  only 3 were determined to be ineligible based on ownership and control.  VA’s statement is incomplete and misleading. According to the OIG, an  additional 7 were determined to be ineligible for reasons that could be  identified during a robust verification process. As a result, the OIG found  10 of 14 firms verified under VA’s 2006 Act process to be ineligible—an  eligibility failure rate comparable to the overall eligibility failure rate cited  in the report.
With regard to the aforementioned 7 firms, the OIG determined they were  ineligible because they were engaged in improper subcontracting  practices, such as “pass-through” contracts. Pass-through contracts occur  when businesses or joint venture/partnerships list veterans or service  disabled veterans as majority owners of the business but, contrary to  programs requirements, the non-veteran owned business either  performed or managed the majority of the work and received a majority of  the contracts’ funds. Given that the firms being reviewed by the OIG  already had existing contracts in place, the OIG was able to identify the  pass-through contracts by conducting site visits and reviewing business  documentation, the same steps that VA claims are taken during the  verification process it implemented in response to the 2010 Act. While we  acknowledge that it is difficult to identify pass-through contracts for  applicants to the program who don’t have any preexisting contracts, VA  should be conducting such a review for those firms that have contracts in  place. As we have noted in past reports, VA’s fraud prevention controls  should include detection and monitoring measures to assure that firms  are completing the work required of an SDVOSB contract.
Second, VA disagrees that it provided numerous conflicting statements to  us regarding its verification efforts, stating that the verification process  has evolved and that VA faces technical limitations related to its case- management system. While we acknowledge these concerns, it is  important to note that VA did not provide us with any explanation as to its  evolving priorities during the course of our audit and instead repeatedly  sent us contradictory information without any clarification. Moreover, not  all of the conflicting statements VA made can be attributed to  inadequacies in its case-management system or to evolving priorities.  Specifically, the information we received during the course of our audit  work changed so significantly over such a short period of time that the  evidence GAO collected does not support VA’s assertion that it “knows  how many firms have been verified” and can “track individual firms,” as  VA claims in its agency comment letter. Examples of the conflicting  statements we received include the following:
Removal of firms: On April 23, 2012, VA told us that about 900  SDVOSBs and VOSBs listed in VetBiz were targeted for removal  because they had not been verified under the 2010 Act process.  By April 27, 2012, this number increased to approximately 3,500  SDVOSBs and VOSBs. On May 2, 2012, we received two more  differing accounts of SDVOSBs and VOSBs targeted for removal-- 2,660 firms and 2,646 firms--in the same email.
Implementation of the 2010 Act process: On February 16,  2012, VA told us that it continued to verify firms under the process  implemented under the 2006 Act between January and May 2011.  Then, on April 23, 2012, VA told us that it stopped verifying firms  under its 2006 Act process in February 2011 and began  verification under its 2010 Act process at the same time. Next, on  May 12, 2012, VA told us that it stopped verifying firms under the  2006 Act process in January 2011 and began verifying under the  2010 Act at the end of December 2010. In the same  communication, VA told us that no firm was approved under its  2006 Act process after February 2011. But on May 21, 2012, VA  sent us a list of firms and verification dates showing that multiple  firms were last verified under its 2006 Act process past February  2011, with at least two firms verified under iits 2006 Act process  as late as May 2011.
Finally, VA stated it believed all previous GAO recommendations issued  in October 2011 should be closed. For GAO to close a recommendation,  it must be implemented or actions must have been taken that essentially  meet the recommendation’s intent. Further, the responsible agency must  provide evidence, with sufficient supporting documentation, that the  actions are being implemented adequately. By the end of our audit work,  we were able to close 6 of the 13 recommendations that we issued to VA  in October 2011 based on documentation VA provided demonstrating that  the agency had taken specific actions in response to our  recommendations. Although VA indicated that it would like to close out  the remaining recommendations, it either did not demonstrate that it had  taken an action to implement a recommendation or did not provide the  supporting documentation needed to show that the recommendation was  in fact implemented. We had several discussions with VA staff about our  requirements for closing recommendations, the last occurring on June 22,  2012.  Moreover, we noted in our report any progress VA has made with  respect to each recommendation; the information VA provided in this  letter had previously been acknowledged in our report. For the 7  recommendations that remain open after the issuance of this report, we  will continue to seek from VA additional documentation necessary to  demonstrate that implementation has occurred. At such time, we will  close each recommendation, as appropriate.
In addition, VA provided technical comments, which we addressed as  appropriate. We provide annotated responses to VA’s more detailed  comments in appendix I.
In written comments received through e-mail, SBA stated that it is  committed to eliminating fraud, waste, and abuse in all of its programs  including the government-wide SDVOSB program. In addition, SBA  stated that it maintains a “robust and thorough” protest and appeal  process. However, as noted in our report, SBA’s bid-protest process  alone—that is, without upfront eligibility verification and other related  measures—cannot provide reasonable assurance that only legitimate  firms are awarded SDVOSB contracts. In addition, five new case studies  developed for this report highlight instances of fraud and abuse. SBA  disagreed with the draft report’s portrayal of actions taken against the  firms that were the subject of the 10 case studies developed as part of  our October 2009 report. We revised our report where appropriate. SBA  also stated that it had taken actions against firms in addition to those cited  in our case studies, but did not provide specific examples. Finally, SBA  stated that it was implementing training to help its staff identify fraud and  abuse and working to improve its referral process and collaboration with  other agencies. Such efforts could help reduce the SDVOSB program’s  vulnerability. However, these efforts would affect only SBA’s investigation  and prosecution efforts, and not prevention, detection, and monitoring. If  the government-wide program included measures to prevent, detect, and  monitor fraud in the SDVOSB program, SBA could be more confident that  the billions of dollars meant to provide contracting opportunities to our  service-disabled veteran entrepreneurs make it to the intended  beneficiaries.
We are sending copies of this report to interested congressional  committees, the Administrator of SBA, the Secretary of Veterans Affairs,  and other interested parties. The report is also available at no charge on  the GAO website at http://www.gao.gov.
If you have any questions concerning this report, please contact Richard  J. Hillman at (202) 512-6722 or hillmanr@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report.
section_title: Appendix I: Comments from the Department of Veterans Affairs
subsections: section_title: GAO Comments
paragraphs: 1.  We clarified the report to indicate what the Department of Veterans  Affairs (VA) Office of Inspector General (OIG) reported on its findings  in 2011 and also to indicate that the report includes all firms in VetBiz,  not just those verified under the Veterans Benefits, Health Care, and  Information Technology Act of 2006 (2006 Act) process. The  remainder of VA’s comments related to the OIG report are inaccurate,  based on our review of the report and discussions with VA’s OIG staff.   See the Agency Comments and Our Evaluation section of this report  for more detail. 2.  In the final report, we deleted the draft report’s discussion of  information about the Center for Veterans Enterprise (CVE) being  responsible for helping veterans who are interested in forming or  expanding their own small businesses.  3.  Our report’s characterization of the Veterans Small Business  Verification Act (2010 Act), part of the Veterans’ Benefits Act of 2010,  is correct and we did not make associated changes to the report.  While VA’s recommended change points out that VA removed firms  that self-represented or had expired eligibility periods, these  categories of firms are included by the “all unverified businesses”  language in the existing report language.  4.  We deleted the sentence stating that SDVOSBs are required to  receive a portion of government-wide contractual dollars annually.  5.  We have revised our draft report to note that according to VA, (1) the  lack of a comprehensive case-management system has created the  need for aggregate workarounds and resulted in inconsistent  aggregate reporting, (2) the limitations of the case-management  system make it difficult to track the inventory of firms, and (3) as the  limitations of the case-management system increase over time, the  potential of CVE to lose track of how many firms have been verified  also increases. We also acknowledge VA’s assertion that its  verification priorities have evolved over time. However, not all of the  conflicting statements VA made can be attributed to inadequacies in  its case-management system or to evolving priorities. One of the  many examples relates to the December 2010 request for  documentation mentioned in the 2010 Act. Specifically, on April 23,  2012, VA told us that between late March 2012 and early April 2012 it  had removed over 3,000 SDVOSBs and VOSBs because these firms  had failed to provide requested business documentation. We asked  whether the firms removed in April 2012 had been sent this request.   In response, VA told us that the firms removed in April 2012 did not  receive the December 2010 document. Then on May 12, 2012, VA  told us the firms had in fact been sent the December 2010 letter.  Later, on June 20, 2012, VA told us that it did not send the December  2010 letter to all firms listed in VetBiz at the time to avoid a flood of  applications. In its agency comments, VA states that the 2010 Act did  not require it to send all firms listed in VetBiz in December 2010 a  request for documentation if the firms had been verified under the  2006 Act and this verification had not yet expired.  6.  We revised the text in our draft report to more-clearly reflect that  thousands of SDVOSBs listed as eligible in VetBiz received millions of  dollars in contract obligations even though they had not been verified  under the more-thorough process that VA implemented in response to  the 2010 Act.  VA’s recommended changes also suggest that firms  that were verified under the 2006 Act process could not be  immediately reverified under the more-thorough 2010 Act process  because, in addition to resource-allocation priorities, VA was limited  by the requirements of 38 C.F.R. § 74.15(c). However, we note that  VA has latitude under the law to modify its own regulations as  necessary to ensure that only valid SDVOSBs are included in VetBiz.  Furthermore, VA’s recent decision to amend 38 C.F.R. § 74.15 and  extend the VetBiz eligibility term from 1 year to 2 years appears to be  a self-created impediment to ensuring all firms expeditiously undergo  the more-thorough 2010 Act process. 7.  We revised the text in our report to reflect that the 2010 Act required  VA to notify all unverified firms about the need to apply for verification.  8.  The language VA objects to concerning VA’s prioritization of  verifications under the 2010 Act process is taken directly from  documentation provided by VA during the course of our audit.  Accordingly, we made no changes to the report. 9.  The language VA objects to concerning removal of firms is taken  directly from oral and written statements made by VA during the  course of our audit. Accordingly, we made no changes to the report. 10. The firms mentioned in this footnote are related to one of the new  cases we reviewed as a result of allegations we received from  confidential informants. These firms were not verified under the  process implemented under the 2010 Act and we determined that  they were in fact ineligible for the SDVOSB program because the  firms’ operating agreements allowed the two minority owners to  control the firms, rather than the service-disabled veteran. These firms  received approximately $16 million in VA SDVOSB set-aside and  sole-source contract obligations from October 2010 to December  2011. Accordingly, we made no changes to the report. 11. We revised our report to make clear that we were referring to  verification using the processes implemented under the 2010 Act.  12. We received conflicting statements from VA as to which firms  received the December 2010 notification later and have revised the  text to clearly reflect this fact.  13. We revised the text in our report to more-clearly reflect that thousands  of potentially ineligible firms remain listed in VetBiz because they have  not been verified under the more-thorough process implemented for  the 2010 Act. While these firms have been verified under the 2006 Act  process, past audits show the potential risk of providing SDVOSB  contracts to firms reviewed under this process. VA’s recommended  change does not acknowledge this risk and is therefore incomplete.  Moreover, our statements that were related to the number of firms not  verified under the requirements of the 2010 Act, the dollar amounts  those firms received, and the number of firms VA planned to remove  were all supported by evidence and were accurate at the close of our  audit work. We have clarified the report to indicate that fact and  included information on the requirements of the interim final rule VA  implemented on June 27, 2012. Specifically, in our final report we  have noted that the rule extends a firm’s eligibility period for 2 years.  We also note that VA interprets “verified” to include any firm that has  been verified under either the 2006 Act or 2010 Act processes,  meaning that this rule will allow thousands of firms to remain eligible  for contracts even though they have not undergone the more- thorough process implemented under the 2010 Act process. See the  Agency Comments and Our Evaluation section of this report for a  more-thorough discussion of this issue. 14. To this point, VA has not provided sufficient documentation to close  the 7 recommendations that remain open. GAO will continue to work  with VA to confirm the status of its efforts to address our  recommendations and will close recommendations, as long as  necessary supporting evidence is provided.  15. Our report states that VA has made progress in the area of fraud- awareness training. However, VA has not provided any  documentation to show that fraud-awareness training is being  provided on a regular basis, as we recommended. Our  recommendation will remain open until necessary evidence to close it  is provided. Accordingly, we have not changed the language in our  report. 16. The FAR and the VA Acquisition Regulations do not provide specific  processes and criteria for the Debarment Committee on compliance  with the requirement in the 2006 Act to debar, for a reasonable period  of time, firms and related parties that misrepresented their SDVOSB  status. VA should provide additional guidance to the Debarment  Committee on the specific process and criteria to use to debar firms  as required by the 2006 Act. Accordingly we have not changed the  language in our report.  17. The recommendation requested that VA develop specific guidelines  outlining the Debarment Committee's decision process to debar firms  that misrepresent their SDVOSB status. VA needs to provide  supporting documentation demonstrating that VA provided the  Debarment Committee with the guidance outlining the decision  process to debar firms that misrepresent their SDVOSB status.   Accordingly, we have not changed the language in our report. 18. VA cites provisions of the FAR and the VA Acquisition Regulations  containing guidance for continuing current contracts to firms that were  found ineligible through the debarment process. However, our  recommendation asked VA to develop procedures to remove  SDVOSB contracts from ineligible firms. Accordingly, we have not  changed the language in our report. 19. Our report acknowledges that VA advertises the debarments and  prosecutions on the Debarment Committee, VA OIG, and CVE  websites. However, our recommendation specifically asked for VA to  formalize procedures to advertise debarments and prosecutions, and  we have not received any documentation related to such procedures.   Accordingly, we have not changed the language in our report.
section_title: Related GAO Products
paragraphs: Service-Disabled Veteran-Owned Small Business Program:  Governmentwide Fraud Prevention Control Weaknesses Leave Program  Vulnerable to Fraud and Abuse, but VA Has Made Progress in Improving  Its Verification Process. GAO-12-443T. Washington, D.C.: February 7,  2012.
Service-Disabled Veteran-Owned Small Business Program: Additional  Improvements to Fraud Prevention Controls Are Needed. GAO-12-205T.  Washington, D.C.: November 30, 2011.
Service-Disabled Veteran-Owned Small Business Program: Additional  Improvements to Fraud Prevention Controls Are Needed. GAO-12-152R.  Washington, D.C.: October 26, 2011.
Service-Disabled Veteran-Owned Small Business Program: Preliminary  Information on Actions Taken by Agencies to Address Fraud and Abuse  and Remaining Vulnerabilities. GAO-11-589T. Washington, D.C.: July 28,  2011.
Department of Veterans Affairs: Agency Has Exceeded Contracting Goals  for Veteran-Owned Small Businesses, but It Faces Challenges with Its  Verification Program. GAO-10-458. Washington, D.C.: May 28, 2010.
Service-Disabled Veteran-Owned Small Business Program: Fraud  Prevention Controls Needed to Improve Program Integrity. GAO-10-740T.  Washington, D.C.: May 24, 2010.
Service-Disabled Veteran-Owned Small Business Program: Case Studies  Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of  Dollars in Contracts. GAO-10-306T. Washington, D.C.: December 16,  2009.
Service-Disabled Veteran-Owned Small Business Program: Case Studies  Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of  Dollars in Contracts. GAO-10-255T. Washington, D.C.: November 19,  2009.
Service-Disabled Veteran-Owned Small Business Program: Case Studies  Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of  Dollars in Contracts. GAO-10-108. Washington, D.C.: October 23, 2009.