Our proactive testing found ineffective HUBZone program eligibility controls, exposing the federal government to fraud and abuse. In a related report and testimony released concurrently with this testimony, we reported that SBA generally did not verify the data entered by firms in its online application system. We found that SBA was therefore vulnerable to certifying firms based on fraudulent application information. Our use of bogus firms, fictitious employees, and fabricated explanations and documents to obtain HUBZone certification demonstrated the ease with which HUBZone certification could be obtained by providing fraudulent information to SBA's online application system. In all four instances, we successfully obtained HUBZone certification from SBA for the bogus firms represented by our applications. See figure 1 for an example of one of the acceptance letters we received. Although SBA requested documentation to support one of our applications, the agency failed to recognize the information we provided in all four applications represented bogus firms that actually failed to meet HUBZone requirements. For instance, the principal office addresses we used included a virtual office suite from which we leased part-time access to office space and mail delivery services for $250 a month, two different retail postal service centers from which we leased mailboxes for less than $24 a month, and a Starbucks coffee store. An Internet search on any of the addresses we provided would have raised "red flags" and should have led to further investigation by SBA, such as a site visit, to determine whether the principal office address met program eligibility requirements. Because HUBZone certification provides an opening to billions of dollars in federal contracts, approval of ineligible firms for participation in the program exposes the federal government to contracting fraud and abuse, and moreover, can result in the exclusion of legitimate HUBZone firms from obtaining government contracts. We provide specific details regarding each application below. Fictitious Application One: Our investigators submitted this fictitious application and received HUBZone certification 3 weeks later. To support the application, we leased, at a cost of $250 a month, virtual office services from an office suite located in a HUBZone and gave this address as our principal office location. Specifically, the terms of the lease allowed us to schedule use of an office space up to 16 hours per month and to have mail delivered to the suite. Our HUBZone application also indicated that our bogus firm employed two individuals with one of the employees residing in a HUBZone. Two business days after submitting the application, an SBA official emailed us requesting a copy of the lease for our principal office location and proof of residency for our employee. We created the documentation using publicly available hardware and software and faxed copies to SBA to comply with the request. SBA then requested additional supporting documentation related to utilities and cancelled checks. After we fabricated this documentation and provided it to SBA, no further documentation was requested before SBA certified our bogus firm. Fictitious Application Two: Four weeks after our investigators submitted this fictitious application, SBA certified the bogus firm to participate in the HUBZone program. For this bogus firm, our "principal office" was a mailbox located in a HUBZone that our investigators leased from a retail postal service provider for less than $24 a month. The application noted that our bogus firm had nine employees, four of which lived in a HUBZone area. SBA requested a clarification regarding a discrepancy in the application information, but no further contact was made before we received our HUBZone certification. Fictitious Application Three: Our investigators completed this fictitious application and received HUBZone certification 2 weeks later. For the principal office address, our investigators used a Starbucks coffee store located in a HUBZone. In addition, our investigators indicated that our bogus firm employed two individuals with one of the employees residing in a HUBZone area. SBA did not request any supporting documentation or explanations for this bogus firm prior to granting HUBZone certification. Fictitious Application Four: Within 5 weeks of submitting this fictitious application, SBA certified our bogus firm. As with fictitious application two, our investigators used the address for a mailbox leased from a retail postal service provider located in a HUBZone for the principal office. Our monthly rental cost for the "principal office" was less than $10 per month. Our application indicated that two of the three employees that worked for the bogus firm lived in a HUBZone. SBA requested a clarification regarding a small discrepancy in the application information, but no further contact was made before receiving the HUBZone certification. We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Since 2006, federal agencies have obligated a total of more than $105 million to these firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both the principal office and employee residency requirements while 4 met the principal office requirement but significantly failed the employee residency requirement. We also found other HUBZone firms that use virtual office suites to fulfill SBA's principal office requirement. We investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. According to HUBZone regulations, persons or firms are subject to criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program including failure to correct "continuing representations" that are no longer true. During the application process, applicants are not only reminded of the program requirements, but are required to agree to the statement that anyone failing to correct "continuing representations" shall be subject to fines, imprisonment, and penalties. Further, the Federal Acquisition Regulation (FAR) requires all prospective contractors to update ORCA-- the government's Online Representations and Certifications Application-- which includes certifying whether the firm is currently a HUBZone firm and that there have been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." However, we found that all 10 of these case-study firms continued to represent themselves to SBA, ORCA, GAO, and the general public as eligible to participate in the HUBZone program. Because the 10 case study examples clearly are not eligible, we consider each firm's continued representation indicative of fraud. We referred the 10 firms to SBA OIG for further investigation. We determined that 10 case study examples from the Washington, D.C., metropolitan area failed to meet the program's requirements. Specifically, we found that 6 out of the 10 failed both HUBZone requirements to operate a principal office in a HUBZone and to ensure that 35 percent or more of employees resided in a HUBZone. Our review of payroll records also found that the remaining four firms failed to meet the 35 percent HUBZone employee residency requirement by at least 15 percent. In addition, all 10 of the case study examples continued to represent themselves to SBA, ORCA, GAO, and the general public as HUBZone program-eligible. One HUBZone firm self-certified in ORCA that it met HUBZone requirements in March 2008 despite the fact that we had spoken with its owner about 3 weeks before about her firm's noncompliance with both the principal office and HUBZone residency requirements. Table 1 highlights the 10 case-study firms we investigated. Case 1: Our investigation clearly showed that this firm represented itself as HUBZone-eligible even though it did not meet HUBZone requirements at the time of our investigation. This firm, which provided business management, engineering, information technology, logistics, and technical support services, self-certified in July 2007 in ORCA that it was a HUBZone firm and that there had been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." We also interviewed the president in March 2008 and she claimed that her firm met the HUBZone requirements. However, the firm failed the principal office requirement. Our site visits to the address identified by the firm as its principal office found that it was a small room that had been rented on the upper floor of a dentist's office where no more than two people could work comfortably. No employees were present, and the only business equipment in the rented room was a computer and filing cabinet. The building owner stated that the president of the firm used to conduct some business from the office, but that nobody had worked there "for some time." Moreover, the president indicated that instead of paying rent at the HUBZone location, she provided accounting services to the owner at a no-cost exchange for use of the space. See figure 2 for a picture of the building the firm claimed as its principal office (arrow indicates where the office is located). Further investigation revealed that the firm listed its real principal office (called the firm's "headquarters" on its Web site) at an address in McLean, Virginia. In addition to not being a HUBZone, McLean, Virginia, is in one of the wealthiest jurisdictions in the United States. Our site visit to this second location revealed that the majority of the firm's officers in addition to about half of the qualifying employees worked there and indicated this location was the firm's actual principal office. When we interviewed the president, she claimed that the McLean, Virginia, office was maintained "only for appearance." See figure 3 for a picture of the McLean, Virginia, building where the firm rented office space. Based on our review of payroll documents we received directly from the firm, we also determined the firm failed the 35 percent HUBZone residency requirement. The payroll documents indicated that only 15 of the firm's 72 employees (21 percent) lived in a HUBZone as of December 2007. We also found that in January 2007 during SBA's HUBZone recertification process the president self-certified that 38 percent of the firm's employees lived in a HUBZone. However, the payroll documents received directly from firm showed only 24 percent of the firm's employees lived in a HUBZone at that time. In 2006 the Department of the Army, National Guard Bureau, awarded a HUBZone set-aside contract with a $40 million ceiling to this firm based on its HUBZone status. Although only $3.9 million have been obligated to date on the contract, because the firm remains HUBZone-certified, it can continue to receive payments up to the $40 million ceiling based on its HUBZone status until 2011. We referred this firm to SBA OIG for further investigation. Case 2: Our investigation determined that this firm, a general contractor specializing in roofing and sheet metal, continued to represent itself as HUBZone-eligible even though it did not meet HUBZone requirements. While he self-certified to the firm's HUBZone status in ORCA in September 2007, the vice president admitted during our interview in April 2008 that the firm did not meet HUBZone requirements. Nonetheless, after our interview, the firm continued actively to represent that it was a HUBZone firm--including a message in large letters on its Web site and business cards declaring that the firm was "HUBZone certified." The firm's vice- president self-certified during the SBA's HUBZone certification process in March 2007 that, as shown in figure 4, the firm's principal office was one- half of a residential duplex in Landover, Maryland. We visited this location during normal business hours and found no employees present. Our investigative work also found that the vice president owned another firm, which did not participate in the HUBZone program. A visit to this firm, which was located in Capitol Heights, Maryland--not in a HUBZone--revealed that both it and the HUBZone firm operated out of the same location. Further, payroll documents we received from the HUBZone firm indicated that it had 34 employees but that only 4 employees (or 12 percent) lived in a HUBZone as of December 2007. Based on our analysis of FPDS-NG data, between fiscal years 2006 and 2007 federal agencies obligated about $12.2 million for payment to the firm. Of this, about $4 million in HUBZone contracts were obligated by the Department of the Air Force. Because this firm clearly did not meet either principal office or employee HUBZone requirements at the time of our investigation but continued to represent itself as HUBZone-certified we referred this firm to SBA OIG for further investigation. Case 3: Our investigation demonstrated that this firm continued to represent itself as HUBZone-eligible while failing to meet HUBZone requirements. This firm, which specializes in the design and installation of fire alarm systems, self-certified in May 2007 in ORCA that it was a HUBZone firm and that there had been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." However, when we interviewed the president in April 2008, he acknowledged that the firm "technically" did not meet the principal office requirement. For its HUBZone certification in April 2006, an address in a HUBZone in Rockville, Maryland, was identified as its principal office location. We visited this location during normal business hours and found the address was for an office suite that provided virtual office services. According to the lease between the HUBZone firm and the office suite's management, the firm did not rent office space, but paid $325 a month to use a conference room on a scheduled basis for up to 4 hours each month. Absent additional services provided by the virtual office suite, it would be impossible for this firm to meet the principal office requirement under this lease arrangement. Moreover, the president of the firm told us that no employees typically worked at the virtual office. Additional investigative work revealed that the firm's Web site listed a second address for the firm in McLean, Virginia, which as noted above is not in a HUBZone. Our site visit determined this location to be where the firm's president and all qualifying employees worked. In addition, the payroll documents we received from the firm revealed that the percentage of employees living in a HUBZone during calendar year 2007 ranged from a low of 6 percent to a high of 15 percent--far below the required 35 percent. Based on our analysis of FPDS-NG data, between fiscal years 2006 and 2007 federal agencies obligated about $3.3 million for payment to the firm. Of this, over $460,000 in HUBZone contracts were obligated by the Department of Veterans Affairs. Further, in addition to admitting the firm did not meet the principal office requirement, the president was also very candid about having received subcontracting opportunities from large prime contracting firms based solely on the firm's HUBZone certification. According to the president, the prime contractors listed the HUBZone firm as part of their "team" to satisfy their HUBZone subcontracting goals. However, he contended that these teaming arrangements only occasionally resulted in the prime contractor purchasing equipment from his firm. Because it continued to represent itself as HUBZone-eligible, we referred it to SBA OIG for further investigation. Virtual offices are located nationwide and provide a range of services for individuals and firms, including part-time use of office space or conference rooms, telephone answering services, and mail forwarding. During our proactive testing discussed above, we leased virtual office services from an office suite located in a HUBZone and fraudulently submitted this address to SBA as our principal office location. The terms of the lease allowed us to schedule use of an office space for up to 16 hours per month, but did not provide permanent office space. Even though we never used the virtual office space we rented, we still obtained HUBZone certification from SBA. Our subsequent investigation of two virtual office suites located in HUBZones--one of which we used to obtain our certification--found that other firms had retained HUBZone certification using virtual office services. Based on our review of lease agreements, we found that, absent additional services provided by the virtual office suites, some of these firms could not possibly meet principal office requirements. For example: One HUBZone firm that claimed its principal office was a virtual office address had a lease agreement providing only mail-forwarding services. The mail was forwarded to a different address not located in a HUBZone. Absent additional services provided by the virtual office suite, it would be impossible for this firm to perform any work at the virtual office location with only a mail-forwarding agreement. Five HUBZone firms that claimed their principal office was a virtual office address leased less than 10 hours of conference room usage per month at the same time they maintained at least one other office outside of a HUBZone. Absent additional services provided by the virtual office suite, it would be impossible for these firms to meet principal office requirements with only 10 hours of conference room time per month, leading us to conclude that the majority of work at these companies was performed in the other office locations. Five other firms claimed their principal office was a virtual office address but leased office space for less than 20 hours a month. These firms simultaneously maintained at least one other office outside of a HUBZone. Absent additional services provided by the virtual office suite, it would be impossible for these firms to meet principal office requirements with only 20 hours of rented office time per month, leading us to conclude that the majority of work at these companies was performed in the other office locations. The virtual office arrangements we investigated clearly violate the requirements of the HUBZone program and, in some cases, exemplify fraudulent representations. We briefed SBA officials on the results of our investigation on July 9, 2008. They were concerned about the vulnerabilities to fraud and abuse we identified. SBA officials expressed interest in pursuing action, including suspension or debarment, against our 10 case study firms and any firm that may falsely represent their eligibility for the HUBZone program. They were also open to suggestions to improve fraud prevention controls over the HUBZone application process, such as performing steps to identify addresses of virtual office suites and mailboxes rented from postal retail centers. Madam Chairwoman and Members of the Committee, this concludes my statement. I would be pleased to answer any questions that you or other Members of the Committee may have at this time. For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. To proactively test whether the Small Business Administration's (SBA) controls over the Historically Underutilized Business Zone (HUBZone) application process were operating effectively, we applied for HUBZone certification using bogus firms, fictitious employees, fabricated explanations, and counterfeit documents to determine whether SBA would certify firms based on fraudulent information. We used publicly available guidance provided by SBA to create four applications. We did the minimal work required to establish the bogus small business firms represented by our applications, such as obtaining a Data Universal Numbering System (DUNS) number from Dun & Bradstreet and registering with the Central Contractor Registration database. We then applied for HUBZone certification with our four firms using SBA's online HUBZone application system. Importantly, the principal office addresses we provided to SBA, although technically located in HUBZones, were locations that would appear suspicious if investigated by SBA. When necessary (e.g., at the request of SBA application reviewers), we supplemented our applications with fabricated explanations and counterfeit supporting documentation created with publicly available computer software and hardware and other material. To identify examples of firms that participate in the HUBZone program even though they do not meet eligibility requirements, we first obtained and analyzed a listing of HUBZone firms from the SBA's Certification Tracking System as of January 2008 and federal procurement data from the Federal Procurement Data System-Next Generation (FPDS-NG) for fiscal years 2006 and 2007. We then performed various steps, including corresponding with SBA officials and testing the data elements used for our work electronically, to assess the reliability of the data. We concluded that data were sufficiently reliable for the purposes of our investigation. To develop our case studies, we limited our investigation to certified HUBZone firms with a principal office located in the Washington, D.C., metropolitan area and for which federal agencies reported obligations on HUBZone preference contracts--HUBZone sole source, HUBZone set- aside, and HUBZone price preference--totaling more than $450,000 for fiscal years 2006 and 2007. We selected 16 for further investigation based on indications that they either failed to operate a principal office in a HUBZone or ensure that at least 35 percent of employees resided in a HUBZone, or both. We also investigated one firm referred through GAO's FraudNet Hotline. For the selected 17 firms, we then used investigative methods, such as interviewing firm managers and reviewing firm payroll documents, to gather information about the firms and to determine whether the firms met HUBZone requirements. We also reviewed information about each firm in the Online Representations and Certifications Application system (ORCA). During our investigation, we also identified a couple of addresses for virtual office suites in the Washington, D.C., metropolitan area where several different HUBZone firms claimed to have their principal office. We investigated two of these virtual office suites to determine whether HUBZone firms at these locations met program eligibility requirements. For the selected virtual office suites, we obtained and reviewed the lease agreements between the HUBZone firms and the virtual office suite management and verified any of the HUBZone firms' other business addresses. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
The Historically Underutilized Business Zone (HUBZone) program is intended to provide federal contracting opportunities to qualified small business firms in order to stimulate development in economically distressed areas. As manager of the HUBZone program, the Small Business Administration (SBA) is responsible for certifying whether firms meet HUBZone program requirements. To participate in the HUBZone program, small business firms must certify that their principal office (i.e., the location where the greatest number of employees work) is located in a HUBZone and that at least 35 percent of the firm's employees live in HUBZones. Given the Committee's concern over fraud and abuse in the HUBZone program, GAO was asked to (1) proactively test whether SBA's controls over the HUBZone application process were operating effectively to limit program certification to eligible firms and (2) identify examples of selected firms that participate in the HUBZone program even though they do not meet eligibility requirements. To perform its proactive testing, GAO created four bogus businesses with fictitious owners and employees and applied for HUBZone certification. GAO also selected 17 HUBZone firms based on certain criteria, such as receipt of HUBZone contracts, and investigated whether they met key program eligibility requirements. GAO identified substantial vulnerabilities in SBA's application and monitoring process, clearly demonstrating that the HUBZone program is vulnerable to fraud and abuse. Considering the findings of a related report and testimony issued today, GAO's work shows that these vulnerabilities exist because SBA does not have an effective fraud-prevention program in place. Using fictitious employee information and fabricated documentation, GAO easily obtained HUBZone certification for four bogus firms. For example, to support one HUBZone application, GAO claimed that its principal office was the same address as a Starbucks coffee store that happened to be located in a HUBZone. If SBA had performed a simple Internet search on the address, it would have been alerted to this fact. Further, two of GAO's applications used leased mailboxes from retail postal services centers. A post office box clearly does not meet SBA's principal office requirement. We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Since 2006, federal agencies have obligated a total of more than $105 million to these 10 firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both principal office and employee residency requirements while 4 met the principal office requirements but significantly failed the employee residency requirement. For example, one firm that failed both principal office and employee residency requirements had initially qualified for the HUBZone program using the address of a small room above a dentist's office. GAO's site visit to this room found only a computer and filing cabinet. No employees were present, and the building owner told GAO investigators that nobody had worked there "for some time." During its investigation, GAO also found that some HUBZone firms used virtual office suites to fulfill SBA's principal office requirement. GAO investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. For example, one firm continued to certify it was a HUBZone firm even though its lease only provided mail forwarding services at the virtual office suite.