The HUBZone program was established by the HUBZone Act of 1997 to stimulate economic development by providing federal contracting preferences to small businesses operating in economically distressed communities known as HUBZones. The SBA is responsible for administering the program and certifying applicant firms that meet HUBZone program requirements. To be certified, in general, firms must meet the following criteria: 1) the company must be small by SBA size standards; 2) the company's principal office--where the greatest number of employees perform their work--must be located in a HUBZone; 3) the company must be at least 51 percent owned and controlled by U.S. citizens; and 4) at least 35 percent of the company's full-time (or full-time equivalent) employees must reside in a HUBZone. As of March 2010, approximately 9,300 firms were listed in the SBA's Dynamic Small Business database as participating in the HUBZone program. A certified HUBZone firm is eligible for a variety of federal contracting benefits, such as sole source contracts and set-aside contracts. Contracting officers may award a sole source contract to a HUBZone firm if, among other things, the officer does not have a reasonable expectation that two or more qualified HUBZone firms will submit offers and the anticipated award price of the proposed contract, including options, will not exceed $5.5 million for manufacturing contracts or $3.5 million for all other contracts. Once a qualified firm receives a HUBZone contract, the firm is required to spend at least 50 percent of the personnel costs of the contract on its own employees. The company must also represent, as provided in the application, that it will ''attempt to maintain'' having 35 percent of its employees reside in a HUBZone during the performance of any HUBZone contract it receives. The SBA must ensure that both applicant and participant firms meet and maintain eligibility criteria at the time of application and, if they are granted certification, throughout their tenure in the program. During the application process, firms attest to the authenticity of the information that they submit to the SBA regarding their eligibility. Subsequent to certification, SBA regulations require firms to immediately notify the agency if any material changes occur that affect their eligibility, such as changes to the number of employees residing in a HUBZone or the location of the firm's principal office. Moreover, certified HUBZone firms competing for government contracts must verify in the government's Online Representations and Certifications Application (ORCA) that there have been "no material changes in ownership and control, principal office, or the percentage of employee's living in a HUBZone since it was certified by the SBA." Firms and individuals who misrepresent their eligibility during the application process or while participating in the program are subject to civil and criminal penalties; decertification from the HUBZone program; or debarment from all federal contracts. The SBA continues to struggle with reducing fraud risks in its HUBZone certification process despite reportedly taking steps to bolster its controls. The agency certified three of our four bogus firms based on fraudulent information, including fabricated explanations and supporting documentation. The SBA lost documentation for our fourth application on multiple occasions, forcing us to abandon our application. Our testing revealed that the SBA does not adequately authenticate self-reported information--especially as it pertains to information regarding whether a firm's principal office location meets program requirements. For example, for our successful firms, we used the addresses of the Alamo, a public storage facility in Florida, and a city hall in Texas as our principal office locations--locations that a simple Internet search could have revealed as ineligible for the program. While ensuring that a HUBZone applicant's principal office is legitimately located in a HUBZone is a complicated process, the SBA's failure to verify principal office locations leaves the program vulnerable to firms misrepresenting the locations of their principal offices and thus, benefits of the program not going to areas that are economically disadvantaged. Figure 1 below shows one of the acceptance letters we received. In contrast to our last test of the HUBZone certification process, the SBA considerably increased the amount of documentation it requested to support each application and its attempts to contact and communicate with the owners we represented in our applications. However, the SBA also increased the amount of time it takes to certify firms and, by all indications, suspended the use of agency processing time guidelines as indicated by an e-mail that we received from an SBA official and information that the agency posted on its Web site. The SBA took at least 7 months to process each of the three applications from our bogus companies that it certified. In our previous test, the SBA certified our firms in as little as 2 weeks, with minimal requests for documentary evidence. SBA's increased processing times failed to prevent our fraudulent firms from being certified. As we indicated in our March 2009 report, the SBA initiated a process of reengineering the HUBZone program in response to our findings and recommendations. Though we did not assess the effectiveness of the actions that the SBA undertook to strengthen its internal controls, we were still able to exploit those weaknesses in order to obtain program certification for our bogus firms. Specific details about each of our fraudulent applications are reported below. Fictitious Application 1: We received HUBZone certification about 7 months after submitting this application to the SBA. For the principal office location, we used the address of the Alamo, a National Historic Landmark in Texas. We claimed that both the firm's employees were HUBZone residents. Nearly 3 months after submission, we received an e- mail from the SBA requesting a copy of the HUBZone maps that we used to verify the residency of our employees, birth certificates, copies of tax returns for the last 3 years, corporate documents, and a copy of our firm's rental agreement and a recent utility bill. We fabricated these documents using publicly available materials and software and submitted them to the SBA. The SBA then requested a copy of the firm's most recent official payroll records and sought clarification between the number of employees who worked at our firm's principal office and those who worked off site. We were also required to provide additional payroll records and corresponding banking statements with the line-by-line transactions that supported the payments that we claimed to make to our fictitious employees. After all of the requested information was provided, we were approved for HUBZone certification. Figure 2 provides a timeline highlighting the major interactions that occurred with the SBA during the processing of this application. Fictitious Application 2: The SBA certified this bogus company 14 months after our investigators applied for HUBZone certification. The address we used for our principal office was the same as a rental storage unit in Florida. We claimed the firm was a partnership that employed two individuals who both resided in a HUBZone. To substantiate our firm's principal address, the agency requested that we submit a lease, a recent utility and telephone bill, and a copy of our firm's business registration. To verify the firm's business activity and ownership, the SBA requested copies of our firm's federal business income tax returns for the last 3 years and birth certificates of the two owners, and a copy of our firm's partnership agreement. To verify employee information, the SBA requested copies of each of the HUBZone resident employees' driver's licenses or voter registration cards, a copy of our firm's quarterly unemployment tax filings, and certified copies of the firm's quarterly payroll. SBA also requested tax information and a copy of our firm's most recent payroll documents, which we fabricated and provided to the SBA. Several months thereafter, our bogus firm was granted HUBZone certification. Fictitious Application 3: After 7 months of processing, SBA approved this bogus firm for HUBZone participation. The address of this firm's principal office was a city hall in Texas. We indicated that two of the firm's employees who worked for the bogus firm lived in a HUBZone. Several months after processing our application, the SBA requested documentary evidence of the firm's location, business activity, ownership, and employee information. After the SBA deemed the fabricated information that we submitted regarding payroll as insufficient to determine our employee information, the agency put our application on hold until we provided further documentation. We then provided SBA with a sworn statement to support information regarding payroll. SBA requested clarification about the frequency that our bogus employees worked from the principal office and granted HUBZone certification soon after. Fictitious Application 4: After 4 months of processing, the SBA withdrew this application after we abandoned it. We abandoned this application because the SBA claimed that it did not receive supplementary documentation that we repeatedly provided. Two months after the initial submission of this application, we followed up with the SBA to inquire about its status. At the point of inquiry, SBA indicated that our application was being assigned to an analyst for processing. Two months after our inquiry, we received a request for supporting documentation that was similar to those we received in our previous applications. We provided the requested information 3 days after receiving the request. Two weeks later, we followed up to confirm receipt of our documents. The SBA indicated that it did not receive the information that we provided, so we resent the information and requested that the agency confirm receipt. Three weeks later, after failing to receive confirmation on the receipt of our documentation, we inquired about the status of our application. Again, the agency told us that it did not receive the documentation and subsequently gave us one day to resubmit it. If not provided, the agency indicated, our application would be withdrawn. We decided to abandon the application and our application was withdrawn from the program. As of March 2010, the SBA has reviewed the status of all 29 firms we referred to it from our prior HUBZone investigations. Since our March 2009 report, these firms have received more than $66 million in federal obligations for new contracts. Not all of these obligations are necessarily improper, and some do not relate to HUBZone contracts. Of the 29 firms, 16 were decertified by the SBA, 8 voluntarily withdrew from the HUBZone program, and 5 were found by the agency to be in compliance with program requirements and remain certified. We did not attempt to verify SBA's work. And although SBA indicated that firms sometimes come in and out of compliance while in the program, we maintain that the firms represented in the cases that the SBA reviewed and determined to meet HUBZone program requirements were out of compliance at the time of our review. In addition, we found that five decertified firms continued to market themselves, through their Web sites, as HUBZone certified even after the SBA removed them from the HUBZone program. Tables 1 and 2 below show the results of the SBA's review of the 29 firms we referred from our July 2008 testimony and March 2009 report. We also found that one firm continued to benefit from another SBA program even though it misrepresented its eligibility for the HUBZone program and was decertified by the SBA. This firm, a construction firm that was a part of our recent investigation into fraud and abuse in the SBA's 8(a) Business Development Program, also had been 8(a) certified while in the HUBZone program. During that investigation, we found that the firm misrepresented its status as a qualified 8(a) firm because it was being controlled by individuals who did not qualify for the program. Because the SBA did not promptly suspend or debar the firm, this firm was able to receive nearly $600,000 in additional noncompetitive 8(a) contracts since our last report. According to SBA officials, SBA has recently proposed debarment for this firm. We briefed SBA officials on the results of our investigation on June 17, 2010. Regarding our proactive testing, SBA officials indicated that it was unreasonable to expect them to have identified our fictitious firms due to the bogus documentation that we included in our applications. For example, SBA officials stated that the submission of false affidavits would subject an applicant to prosecution. SBA officials also stated that competitors may identify fraudulent firms and likely protest if those firms were awarded a HUBZone contract. While competitors may identify some ineligible firms that were awarded contracts, it is SBA's responsibility to ensure that only eligible firms participate in the HUBZone program. We suggested that SBA conduct Internet searches on the addresses of applicant firms to help validate principal office locations. We also indicated that if SBA had conducted site visits at the addresses of the firms represented in our applications, those applications would have been identified as fraudulent. SBA officials stated that due to resource constraints, they primarily conduct site visits on certified firms that receive large prime HUBZone contracts. Regarding our 29 referred firms, SBA officials stated that debarment has recently been proposed for an additional firm. We suggested that if SBA determines that a HUBZone firm is not eligible for the program, it should consider conducting a review of that firm's eligibility if that firm is also certified in other SBA programs. SBA agreed with our suggestion. In addition, SBA provided technical comments which we incorporated into our report. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of this report to the Administrator of the Small Business Administration, interested congressional committees and members, and other interested parties. In addition, this report will also be available at no charge on GAO's Web site at http://gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report were Andy O'Connell, Assistant Director; Matthew Valenta, Assistant Director; Lerone Reid, Analyst-In-Charge; Eric Eskew, Agent-In-Charge; Jason Kelly; Barbara Lewis; Jeff McDermott; and Timothy Walker.

Summary:
The Small Business Administration's (SBA) Historically Underutilized Business Zone (HUBZone) program provides federal contracting assistance to small firms located in economically distressed areas, with the intent of stimulating economic development. In July 2008 and March 2009, GAO reported on substantial vulnerabilities to fraud and abuse in the HUBZone application and monitoring process. GAO also found 10 HUBZone firms in the Washington, D.C., area and 19 firms in four other metropolitan areas in Alabama, California, and Texas that made fraudulent or inaccurate representations to get into or remain in the HUBZone program. Given the Committee's continued concern over fraud and abuse in the HUBZone program, GAO (1) performed additional proactive testing of SBA's HUBZone certification process, and (2) determined whether SBA has taken any actions against the 29 case study firms GAO identified in its prior work. Using publicly available resources to fabricate documents, GAO proactively tested SBA's application process by applying for HUBZone certification for four bogus businesses with fictitious owners and employees. GAO also interviewed SBA officials and reviewed SBA data about the 29 case study firms. GAO did not attempt to project the extent of fraud and abuse in the program nor systematically assess HUBZone program controls. The HUBZone program remains vulnerable to fraud and abuse. Using falsified documents and employee information, GAO obtained HUBZone certification for three bogus firms using the addresses of the Alamo in Texas, a public storage facility in Florida, and a city hall in Texas as principle office locations. A simple Internet search by SBA could have revealed these as phony applications. While the agency has required more documentation in its application process since GAO's July 2008 report, GAO's testing shows that SBA does not adequately authenticate self-reported information and, for these cases, did not perform site visits to validate the addresses. Further, the changes have significantly increased the time it takes SBA to process applications. Specifically, SBA took 7 or more months to process each of the bogus applications--at least 6 months longer than for GAO's previous investigations. SBA continually lost documentation for GAO's fourth application, and eventually withdrew it after GAO failed to resubmit the same materials for the fourth time. On its Web site, SBA reported that applicants are experiencing delays during the application process. SBA has taken some action on most of the 29 firms that GAO previously reported did not meet HUBZone program requirements. The SBA decertified 16 firms from the HUBZone program, and another 8 firms voluntarily withdrew. While GAO maintains all 29 firms did not meet requirements at the time of its review, SBA stated that the other 5 firms were in compliance at the time of its own review and so remain certified. Since GAO's March 2009 report, 17 of the 29 companies have received more than $66 million in federal obligations for new contracts. GAO recently reported that one firm has also defrauded the SBA 8(a) program. Because the SBA did not promptly debar the firm from federal contracts, it was able to fraudulently receive an additional $600,000 in noncompetitive 8(a) federal contracts since GAO's last report. SBA recently proposed debarring this firm. National Historic Landmark Address (The Alamo) Used by GAO as Principle