Service-Disabled Veteran-Owned Small Business Program: Fraud Prevention Controls Needed to Improve Program Integrity
Published: 2010-05-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Service-Disabled Veteran-Owned Small Business (SDVOSB) program is intended to provide federal contracting opportunities to qualified firms. In fiscal year 2008, the Small Business Administration (SBA) reported $6.5 billion in sole-source, set-aside, and other SDVOSB contract awards. Testimonies GAO delivered on November 19 and December 16, 2009 identified millions of dollars in SDVOSB contracts that were awarded to ineligible firms, and weaknesses in fraud prevention controls at the SBA and VA which allowed ineligible firms to receive contracts. GAO was asked to testify about the key elements of a fraud prevention framework within the SDVOSB program and to provide an update on the status of fraud referrals made based on the prior investigation of selected SDVOSB firms. To address these objectives, GAO reviewed prior findings from audits and investigations of the SDVSOB program and contacted investigative agency officials concerning the referrals GAO made on prior work. GAO also reviewed applicable guidance on internal control standards from the Comptroller General's Standards for Internal Controls in the Federal Government.
section_title: What GAO Found
paragraphs: GAO founda lack of government-wide prevention controls, a lack of validation of information provided by SDVOSB firms used to substantiate their eligibility for the program, non-existent monitoring of continued compliance with program requirements, and an ineffective process for investigating and prosecuting firms found to be abusing the program. The results of GAO's investigation serve to emphasize the overall lesson that a complete fraud prevention framework is necessary in order to minimize fraud, waste, and abuse within the SDVOSB program. The most effective and most efficient part of the framework involves the institution of rigorous controls at the beginning of the process for becoming eligible to bid on SDVOSB contracts. Next, active and continual monitoring of contractors performing SDVOSB contracts is also essential. Given the examples GAO identified of firms owned by a service-disabled veteran who subcontracted 100 percent of contract work to non-SDVOSB firms, it is essential that federal agencies monitor compliance with program rules after contract performance has begun. Finally, as shown in GAO's investigation, prevention and monitoring controls are not effective unless identified fraud is aggressively prosecuted or companies are suspended, debarred or otherwise held accountable. GAO's prior investigation into allegations of fraud and abuse within SDVOSB contracts found 10 firms that were ineligible for the program but received approximately $100 million in SDVOSB contracts. Upon completion of its investigation, GAO referred all 10 cases to various agency officials who had contracts with the firms, and each agency's Inspector General (IG). Based on the referrals, agencies have taken a variety of actions including the cancellation of existing contracts, termination of future contract options, and opening of civil and criminal investigations. IG officials have stated that many of their investigations are ongoing, and therefore details cannot be provided due to the risk of jeopardizing the investigation. These 10 companies have obtained over $5 million in new SDVOSB sole-source and set-aside contact obligations since November 2009.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss fraud prevention within the  Service-Disabled Veteran-Owned Small Business (SDVOSB) program. The  federal government’s long-standing policy has been to use its buying  power—the billions of dollars it spends through contracting each year—to  maximize procurement opportunities for small businesses. The SDVOSB  program is an extension of this policy. It is also intended to honor the  extraordinary service rendered to the United States by veterans with  disabilities incurred or aggravated in the line of duty during active service  in the armed forces. The Veterans Benefits Act of 2003, which established  the program, permits contracting officers to award set-aside and sole- source contracts to any small business concern owned and controlled by  one or more service-disabled veterans. Executive Order 13360 also  requires federal procurement officials and prime contractors to provide  opportunities for these firms to increase their federal contracting and  subcontracting. In order to be eligible for a set-aside or sole-source  SDVOSB contract, a firm must meet certain criteria. It must be majority- owned by one or more service-disabled veterans who manage and  control daily business operations. A firm must also qualify as a small  business under the North American Industry Classification System  (NAICS) industry-size standards. Currently, in the governmentwide  SDVOSB program, firm officials are allowed to self-certify themselves as  being SDVOSB by attesting that they meet the criteria.
The Small Business Administration (SBA) which, along with federal  procuring agencies, administers the SDVOSB program, reported in fiscal  year 2008 that $6.5 billion in federal contracts were awarded to firms that  self-certified themselves as SDVOSBs. Government contracts to SDVOSBs  accounted for only 1.5 percent of all government contract dollars paid in  fiscal year 2008. Since the SDVOSB program began, the government has  not met its annual mandated goal of 3 percent. In addition to SBA’s  statutory authority over administration of the SDVOSB program, several  other government agencies have separate authority over issues related to  the SDVOSB program. The Veterans Benefits, Health Care, and  Information Technology Act requires the Department of Veterans Affairs  (VA) to maintain a database of SDVOSBs and Veteran-Owned Small  Businesses (VOSB) so a contractor’s eligibility can be verified, and  requires VA to determine the eligibility of firms bidding on VA SDVOSB  and VOSB contracts. In addition, the Office of Federal Procurement Policy  (OFPP), within the Office of Management and Budget, provides overall  direction for governmentwide procurement policies, regulations, and  procedures to promote economy, efficiency, and effectiveness in the  acquisition processes. The Procurement Policy Office’s primary focus is on  the Federal Acquisition Regulation (FAR), the governmentwide regulation  governing agency acquisitions of goods and services, including actions on  SDVOSB set-aside and sole-source contracts.
Testimonies we presented on November 19 and December 16, 2009,  identified millions of dollars in SDVOSB contracts that were awarded to  ineligible firms and weaknesses in fraud prevention controls at the SBA  and VA that allowed ineligible firms to receive contracts. Problems  highlighted in the testimonies included a lack of governmentwide controls,  a lack of validation of information provided by SDVOSB firms used to  substantiate their eligibility for the program, non-existent monitoring of  continued compliance with program requirements, and an ineffective  process for investigating and prosecuting firms found abusing the  program. In addition, our work also found that VA’s process for validating  a firm’s eligibility may not be effective because two of the firms we  identified as ineligible were certified as SDVSOB program eligible firms  through VA’s verification process. The various areas of control  weaknesses resulted in little or no assurance that firms receiving contracts  met SDVOSB criteria. Based on these findings, we made recommendations  to the SBA and the VA to explore the feasibility of improving program  controls and institute consequences for firms that misrepresent their  eligibility for the program. VA and the SBA generally agreed with our  recommendations and VA has begun developing a validation process for  VOSBs and SDVOSBs receiving VA contracts. Yet at the conclusion or our  prior investigation, SBA had not yet taken action to implement a  governmentwide comprehensive fraud prevention framework for the  SDVOSB program. Additionally, we provided a matter for congressional  consideration that Congress should consider providing VA with the  authority and resources necessary to expand its SDVOSB eligibility  verification process to all contractors seeking to bid on SDVOSB contracts  governmentwide.
Given the Federal government’s emphasis on providing contract dollars to  SDVOSB firms, the billions of dollars spent annually on SDVOSB  contracts, and weakness identified by GAO, it is imperative that the SBA,  VA, and federal-agency contracting offices work together to implement  comprehensive fraud prevention controls. My testimony today will (1)  describe the key elements of a fraud prevention framework that is needed  within the SDVOSB program and (2) provide an update on the status of  fraud referrals we made based on our prior investigation of selected  SDVOSB contractors.
To address our objectives, we reviewed prior findings from GAO audits  and investigations of the SDVSOB program. We also reviewed applicable  guidance on internal control standards from the Comptroller General’s  Standards for Internal Controls in the Federal Government. We contacted  SBA to determine changes since the issuance of our report. SBA reported  conducting meetings with the VA and is setting up a task force to address  SDVOSB program weaknesses. Due to the short time frame on this request  we were unable to determine whether SBA’s actions will adequately  address weaknesses previously identified. We conducted our audit work in  May 2010 in accordance with U.S. generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our objectives.
subsections: section_title: Framework for Fraud Prevention, Detection, and Prosecution
paragraphs: The results of our investigation serve to emphasize the overall lesson that  a complete fraud prevention framework is necessary in order to minimize  fraud, waste, and abuse within the SDVOSB program. The most effective  and most efficient part of the framework involves the institution of  rigorous controls at the beginning of the process for becoming eligible to  bid on SDVOSB contracts. Specifically, controls that validate firms’  eligibility, including ownership and control by one or more service- disabled veterans, is the first and most important control. Next, active and  continual monitoring of contractors performing SDVOSB contracts is also  essential. Given the numerous examples we identified of firms owned by a  service-disabled veteran who subcontracted 100 percent of contract work  to non-SDVOSB firms, it is essential that program officials monitor  compliance with program rules after contract performance has begun.  Finally, as shown in our investigation, preventive and monitoring controls  are not effective unless identified abusers are aggressively prosecuted  and/or face other consequences such as suspension, debarment or  termination of contracts and future contract options. The examples we  identified of cases where SBA found a firm misrepresented its eligibility  for the SDVOSB program, but failed to penalize the firm, undermine the  positive effects of the few controls currently in place. Figure 1 provides an  overview of how preventive controls serve as the first and most important  part of the frame work because they are designed to screen out ineligible  firms before they get service-disabled sole source or set-aside contracts.  Monitoring controls and prosecution or other consequences also helps  minimize the extent to which a program is vulnerable to fraud.
subsections: section_title: Preventive Controls Reduce the Potential for Fraud through Limiting Access to SDVOSB Contracts
paragraphs: Preventive controls are a key element of an effective fraud prevention  framework and are also described in the Standards for Internal Controls in  the Federal Government. Preventive controls are especially important  because they limit access to program resources through front-end  controls. Our experience shows that once contracts are awarded and  money disbursed to ineligible SDVOSB contractors, it is unlikely that any  money will be recovered or even that the contract will be terminated.  Preventive controls for the SDVOSB program should, at a minimum, be  designed to verify that a firm seeking SDVOSB status is eligible for the  program. However, during our investigation, we found that there are no  governmentwide controls that verify whether firms who self-certify as  SDVOSBs meet program requirements. VA performs some level of  validation of contractors claiming to be SDVOSBs that bid on VA  contracts, but even that process was primarily based on a review of self- reported data. The key to the validation process within the SDVOSB  program must be verifying self-reported contractor data with independent  third-party sources. Key data to validate with preventive controls should  include whether the owner or owners are service-disabled veterans,  whether the service-disabled veteran owner(s) manage and control daily  operations, and whether the business qualifies as a small business under  the primary NAICS industry-size standards for the SDVOSB contract  awarded.
Validation of whether a business owner is a service-disabled veteran must  be the first step in the SDVOSB prevention framework. Coordination  between VA, SBA, and potentially DOD will be necessary to ensure an  accurate determination is made. VA already maintains a database of  service-disabled veterans, and therefore, it appears that data necessary for  this validation are already available. However, during our investigation, we  found that 1 of the 10 firms we investigated was owned by an individual  who was not a service-disabled veteran, but received more than $7.5  million dollars in Federal Emergency Management Agency (FEMA)  contracts. This firm is a prime example of why the relatively simple  process of validating an individual’s status as a service-disabled veteran  can prevent fraud within the SDVOSB program.
In addition to the validation of firm owners’ status as service-disabled  veterans, preventive controls should also validate whether firm owners  actually manage and control daily operations. This must be accomplished  in order to prevent “rent-a-vet” situations where a firm finds a willing  service-disabled veteran to pose as the “owner” of a firm while in reality,  other ineligible firm members manage and control the daily operations of a  business. One case uncovered during our investigation found that the  service-disabled veteran owner actually played no part in business  operations related to the primary government contracts won by the firm,  and worked from home on non-government related contracts. The alleged  owner also did not receive any salary from the firm and tax returns  showed that he received less in Internal Revenue Service (IRS) 1099  distributions than the 10 percent minority owner. In order to identify these  types of situations, controls must utilize a variety of tools including a  review of independent third-party information such as individual and  company tax returns obtained directly from the IRS. Other processes such  as performing unannounced site visits to an applicant’s place of business  can provide evidence to indicate management and control of daily  operations, whether the firm is a shell company operating with a mail box  as an address or a legitimate firm with employees and assets and whether  a firm is co-located with another non-SDVOSB firm that will likely perform  all contract work. In our previous work, we used unannounced site visits  when conducting our investigations of the 10 firms that through various  fraudulent schemes, obtained $100 million in service-disabled sole-source  and set-aside contracts.
Verification of whether a firm meets NAICS’s industry-size standards is  another part of preventive controls that can help minimize fraud and abuse  within the program. During our investigation, we found that one company  had violated small business size standards and received more than $171  million in federal contracts between fiscal years 2003 and 2009. We were  able to identify the company’s information through a review of contract  obligation information within the Federal Procurement Data System-Next  Generation (FPDS-NG). FPDS-NG is a publicly available database that  allows a user to search for federal contracts awarded to specific firms. As  part of comprehensive preventive controls, a review of these types of  databases as well as company IRS tax returns will provide information to  ensure a prospective SDVOSB firm is not already a large business. Beyond  validation of data and checks with independent third parties, it is also  important that personnel performing the validation of a firm’s SDVOSB  status are well trained and aware of the potential for fraud. Fraud  awareness training with frontline personnel is crucial to stropping fraud  before it gains access to the program. Additionally, when implementing  any new set of controls, it is important that agencies field test new  controls and provide a safety net to deal with firms who feel they were  inappropriately rejected from the SDVOSB program. Finally, a properly  managed and staffed prevention program should not create a large  backlog of legitimate firms attempting to be certified. Unfortunately, as  GAO testified at the end of April, VA’s certification program has a large  backlog of businesses awaiting site visits and some higher-risk businesses  have been verified months before their site visits occurred or were  scheduled to occur. Verifying businesses prior to site visits may allow  ineligible firms to appear as eligible and to receive SDVOSB set-aside and  sole-source contracts.
section_title: Monitoring and Detection Controls Provide Assurance That Firms in the SDVOSB Program Continue to Adhere to Eligibility Requirements
paragraphs: Even with effective preventive controls, there is substantial residual risk  that firms that may have appeared to meet SDVOSB program requirements  initially will violate program rules after being awarded SDVOSB contracts.  Monitoring and detection are not as efficient or effective as prevention  because once a contractors are in the program and fraudulently receive a  SDVOSB sole-source or set-aside contract, there are few if any  consequences if they are caught. Detection and monitoring efforts, which  are addressed in the Standards for Internal Control in the Federal  Government, include data-mining of transactions and other reviews. Our  investigation found cases where firms may have initially been able to meet  a program’s eligibility criteria, but subsequently violated subcontracting  rules of the program after subcontracting 100 percent of the SDVOSB  contract work to a non-SDVOSB firm. Our findings therefore emphasize  why it is important for a comprehensive fraud prevention framework to  have detection and monitoring controls in place to identify violations. For  the SDVOSB program, there are several areas that require periodic review,  including monitoring of a firms compliance with industry-size standards  and monitoring of the performance of required percentage of work on  SDVOSB contracts.
In order to confirm that an SDVOSB firm continues to comply with NAICS  standards, agencies should periodically data-mine FPDS-NG and other  relevant federal procurement data to determine the number and size of  contracts awarded and funds obligated to SDVOSB firms. A thorough  review of this data is important so that all contacts awarded to a firm or its  joint ventures are identified. During our investigation, we found one firm  that received more than $171 million in federal funds through more than  five different joint ventures. This example shows why data-mining efforts  must be creative and thorough in order to effectively prevent fraud. In  addition, data mining can also be done to review existing contracts with  company information to determine whether a company could reasonably  perform contracts given its area of expertise. For example, through data  mining we found one firm during our investigation that initially listed its  area of expertise as construction. However, the firm had recently been  performing multiple janitorial service contracts across the country. While  this was not a definite indicator of fraud, subsequent on-site unannounced  site visits found that the firm was subcontracting 100 percent of the  contract work to an international firm with more than $12 billion in annual  revenues.
Monitoring of the firms active participation in contracts is another way to  ensure SDVOSB program requirements are being met. During our work,  we identified cases where firms, which may have initially appeared  legitimate on paper, that actually functioning as pass-throughs and  subcontracting 100 percent of the work to non-SDVOSB firms. Controls to  help identify these situations would include conducting unannounced site  visits to contract performance locations and contacting local contracting  officers to determine with whom they interact during the contract  performance period. In addition, a periodic review of the types of  contracts awarded to a firm compared with company information can help  identify firms requiring further review. Finally, when fraudulent activity is  identified through data mining and monitoring controls, agencies should  also use that information to help improve future preventive controls when  appropriate.
section_title: Investigations and Prosecutions Serve as a Deterrent for Potential Future Abuse
paragraphs: The final element of a comprehensive fraud prevention framework is the  aggressive investigation and prosecution of firms that abuse the SDVOSB  program or other consequences such as suspension, debarment, and  termination of contracts and cancellation of contract options. These back- end controls are often the most costly and least effective means of  reducing fraud in a program. However, the deterrent value of prosecuting  those who commit fraud sends the message that the government will not  tolerate firms that falsely represent themselves as SDVOSB firms. Our  investigation found that while the SBA has successfully identified multiple  firms that falsely certified themselves as SDVOSB firms, in October of 2009  when we issued our report, SBA had not attempted to suspend or debar  the problem firms. In addition, during our investigation, we could not find  any examples of referrals for prosecution of these firms to the Department  of Justice by the VA or SBA Inspectors General for fraud within the  SDVOSB program. In order for the SBA and VA to ensure the highest level  of compliance with SDVOSB program requirements, there must be  consequences for those firms that chose to fraudulently misrepresent  themselves as SDVOSB firms. Agencies have tools available such as  suspension, debarment, and removal from the program, termination of  contracts and cancellation of future contract options. Finally, as with  fraud found through monitoring controls, lessons learned from  investigations and prosecutions should be utilized to strengthen controls  earlier in the process and improve the overall fraud prevention framework.
section_title: Referrals from GAO’s Investigation Have Resulted in Action from Agency Inspector General Offices
paragraphs: Our prior investigation into allegations of fraud and abuse within SDVOSB  contracts found 10 firms that were ineligible for the program but received  approximately $100 million in SDVOSB contracts. Upon completion of our  investigation, we referred all 10 cases to various agency officials who had  contracts with the firms and to each agency’s IG. Based on our referrals,  agencies have taken a variety of actions including the termination of  existing contracts, the decision not to extend contract performance by  exercising future contract options, and the opening of civil and criminal  investigations. IG officials have stated that most of their investigations are  ongoing and that therefore, details cannot be provided because of the risk  of jeopardizing the investigation. However, in at least one case, the future  contract options under a janitorial services contract were not exercised  and, the firm was not allowed to perform work beyond the initial contract  performance period. In addition, this firm’s subcontractor, which  performed 100 percent of the contact work, initiated its own investigation.  The subcontractor’s investigation determined one of its employees helped  to perpetrate the fraud by creating fictitious documents at the request of  the SDVOSB firm’s owner. In another case, the SDVOSB firm was found to  be intentionally overcharging a federal agency by inflating the hourly labor  rate of unapproved subcontracted employees from a temporary  employment agency. Finally, in one case, multiple federal investigative  agencies have an ongoing criminal investigation and are working together  on a grand jury indictment. Additionally, these 10 case-study firms have  received more than $5 million in new contract obligations on SDVOSB  sole-source and set-aside contacts and more than $10 million in other new  contract obligations since November 2009.
section_title: Conclusions
paragraphs: Our investigation of the SDVOSB program shows that existing controls are  ineffective at minimizing the risk for fraud and abuse. Our 10 cases alone  show that approximately $100 million in SDVOSB contracts have gone to  ineligible firms. With billions of dollars being spent annually on SDVOSB  contracts, agency officials should use lessons learned to implement a  comprehensive fraud prevention framework. Controls at each point in the  process are the key to minimizing the government’s risk. With a  comprehensive framework in place, the government can be more  confident that the billions of dollars meant to help provide opportunities  to our nation’s service-disabled veterans actually make it to the intended  beneficiaries.
Mr. Chairman and Members of the Subcommittee, this concludes my  statement. I would be pleased to answer any questions that you or  Members of the Subcommittee have at this time.
section_title: Contacts and Acknowledgments
paragraphs: For additional information about this testimony, please contact Gregory D.  Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.