The HUBZone program was established by the HUBZone Act of 1997 to stimulate economic development through increased employment and capital investment by providing federal contracting preferences to small businesses in economically distressed communities. These areas, which are designated based on certain economic and census data, are known as HUBZones. As of January 2009, there were approximately 9,300 firms listed in the Central Contractor Registration database as participating in the HUBZone program. To ensure HUBZone areas receive the economic benefit from the program, SBA is responsible for determining whether firms meet HUBZone program requirements. To participate in the HUBZone program, small business firms generally must meet certain criteria established by the SBA, most notably: (1) the firm must be at least 51 percent owned and controlled by one or more U.S. citizens; (2) at least 35 percent of its employees must live in a HUBZone; (3) the principal office (i.e., the location where the greatest number of qualifying employees perform their work) must be located in a HUBZone; and (4) the firm must qualify as a small business under the size standard that corresponds with its primary industry classification. In addition, once a firm receives a HUBZone contract, the firm is required to abide by certain subcontracting limitations, which for most firms is to expend at least 50 percent of the personnel costs of a contract on their own employees or employees of other qualified HUBZone small business concerns. The SBA is legally responsible for ensuring that program participants meet program requirements. If a HUBZone firm does not meet program requirements or fails to notify the SBA of material changes that affect the firm's HUBZone eligibility, the SBA may use a variety of enforcement tools against the firm. Depending on the severity of the infraction, SBA can (1) decertify and remove the firm from the list of qualified HUBZone firms, (2) suspend and/or debar the firm from all federal contracts, and/or (3) refer the firm to the Department of Justice for civil and/or criminal prosecution. In July 2008, we testified that SBA's lack of controls over the HUBZone program exposed the government to fraud and abuse. Specifically, we identified substantial vulnerabilities in SBA's application and monitoring process by demonstrating the ease of obtaining HUBZone certification. For example, by using fictitious employee information and fabricated documentation, we easily obtained HUBZone certification for four bogus firms. In addition, we also identified 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. In June 2008, we reported that the Small Business Administration needed to take additional actions to certify and monitor HUBZone firms as well as to assess the results of the HUBZone program. Specifically, we found that the map SBA used to publicize qualified HUBZone areas was inaccurate. In addition, we found that the mechanisms that SBA used to certify and monitor HUBZone firms did not meet federal internal control standards and provided limited assurance that only eligible firms participated in the program. For example, SBA verified the information reported by firms on their application or during recertification--its process for monitoring firms--in limited instances and did not follow its own policy of recertifying all firms every 3 years. In the report, we made five recommendations designed to improve SBA's administration and oversight of the HUBZone program. We recommended that SBA correct and update its HUBZone map, develop and implement guidance to ensure more routine verification of application data, eliminate its backlog of recertifications, formalize and adhere to a specific time frame for decertifying ineligible firms, and further assess the effectiveness of the program. In responding to a draft of this report, SBA agreed with these recommendations and outlined steps that it plans to take to address them. HUBZone program fraud and abuse continues to be problematic for the federal government. We identified 19 firms in the states of Texas, Alabama, and California participating in the HUBZone program even though they clearly do not meet program requirements. Although we cannot conclude whether this is a systemic problem based on these cases, as shown in figure 1 below, the issue of misrepresentation clearly extends beyond the Washington, D.C., metropolitan area. In fiscal years 2006 and 2007, federal agencies had obligated a total of nearly $30 million to these firms for performance as the prime contractor on federal HUBZone contracts. HUBZone regulations also place restrictions on the amount of work that can be subcontracted to non-HUBZone firms. Specifically, HUBZone regulations generally require firms to expend at least 50 percent of the personnel costs of a contract on its own employees. As part of our investigative work, we found examples of service firms that subcontracted a substantial majority of HUBZone contract work to other non-HUBZone firms and thus did not meet this program requirement. When a firm subcontracts the majority of its work to other non-HUBZone firms it is undermining the HUBZone program's stated purpose of stimulating development in the economically distressed areas, as well as evading eligibility requirements for principal office and 35 percent residency requirement. According to HUBZone regulations, persons or firms are subject to criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program including failure to correct "continuing representations" that are no longer true. During the application process, applicants are not only reminded of the program eligibility requirements, but are required to agree to the statement that anyone failing to correct "continuing representations" shall be subject to fines, imprisonment, and penalties. Further, the Federal Acquisition Regulation (FAR) requires all prospective contractors to update the government's Online Representations and Certifications Application (ORCA), which includes a statement certifying whether the firm is currently a HUBZone firm and that there have been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." Of the 19 firms that did not meet HUBZone eligibility requirements, we found that all of them continued to represent themselves as eligible HUBZone interests to SBA. Because the 19 case examples clearly are not eligible, we consider each firm's continued representation indicative of fraud and/or abuse related to this program. Table 1 highlights 10 firms that we found to be egregiously out of compliance with HUBZone program requirements. Appendix I pro vides details on the other 9 cases that we examined. We will be referring all 19firms to SBA for further investigation and consideration for removal from the program. The following is a more detailed description of fraud and abuse from 3 of the cases that we investigated. Case Study 1: Our investigation clearly showed that this firm was being used as a front company because it was subcontracting the majority of its work to other firms. This firm is located in Fort Worth, Texas, and violated HUBZone program requirements because it did not expend at least 50 percent of personnel costs on its own employees or by using the personnel of other HUBZone firms as required by federal regulations. This firm, which consists of 8 employees, has obtained millions of dollars in HUBZone contracts to provide environmental consulting services. At the time of our investigation, company documents showed that the company was subcontracting between 71 and 89 percent of its total contract obligations to other non-HUBZone firms--in some cases, large firms. The principal admitted that her firm was not meeting contract performance requirements required by HUBZone regulations. Further, the principal stated that the firm made bids on HUBZone contracts knowing that the company would have to subcontract work to other firms after the award. The principal added that other large firms use HUBZone firms in this manner, referring to these HUBZone firms as "contract vehicles." By subcontracting the majority of its HUBZone work to non-HUBZone firms, this firm is clearly abusing its HUBZone designation and undermining the HUBZone program's stated purpose of stimulating small business development in economically distressed areas. Likewise, because the subcontracting is being conducted by non-HUBZone firms this firm is also evading eligibility requirements for principal office and the 35 percent residency requirement. This firm has been obligated over $2.3 million in HUBZone set-asides during fiscal years 2006 and 2007. Case Study 2: Our investigation demonstrated that this firm continued to misrepresent itself as HUBZone-eligible while failing to meet HUBZone requirements. This firm, which is a two-person--father and son--ground maintenance services company located in Jacksonville, Alabama, did not meet the principal office requirement, failed the 35 percent residency requirement, and served as a front company--subcontracting most of its HUBZone work to non-HUBZone firms. Our investigation found that the purported principal office was in fact a residential trailer in a trailer park. As shown in figure 2 below, the "suite number" of the principal office provided to SBA was actually the trailer number. The president of the company claimed that the trailer is the principal office and that an employee lived at that trailer. However, our investigation found that the president knowingly misrepresented and concealed material facts to a GAO investigator. We found that both employees live in non-HUBZone areas that are located about 90 miles from the trailer. Additionally, we verified that the trailer is occupied by someone not associated with the company. Further, our investigation found that neither employee lived in, nor worked at, the residential trailer since August 2007. Specifically, the U.S. Postal Service provided us a copy of the change of address form dated August 2007 that instructed the Postal Service to forward all mail from the trailer to another office in Birmingham, Alabama, which is not located in a HUBZone area. In addition, we obtained utility bill information that indicated that the last utility bill was paid by the firm in August 2007. According to DSBS, SBA most recently certified the firm at this address in April 2008. During the course of our investigation, this firm provided investigators with questionable documents in an attempt to make the residential trailer appear to be their actual principal office. As figure 3 shows, after our original interview with the president, we found that a new mailbox with the company name had been installed next to other mailboxes in the trailer park to give the perception that the firm resided at this trailer park. Despite the evidence that this firm had not paid utility bills or received mail at this location for over a year, the firm president also provided us with a "rental agreement" stating that their company was renting the trailer until June 2009. The authenticity of this "rental agreement" is highly suspicious given the evidence we gathered and our confirmation that an individual not related to the company was living in the trailer. For fiscal years 2006 and 2007, this firm received more than $900,000 in HUBZone set-aside obligations. Case Study 4: We determined that during the period of our investigation this firm represented itself as HUBZone certified while failing to meet both the 35 percent residency and principal office HUBZone eligibility requirements. This firm, which is located in Huntsville, Alabama, and provides information technology services, self-certified in ORCA in July 2008 that it was a HUBZone firm and that there had been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." The firm was certified by the SBA as a HUBZone firm in June 2002. Based on our review of payroll records and written correspondence that we received from the firm, we determined that the firm failed the 35 percent HUBZone residency requirement. These documents indicated that only 18 of 116 (16 percent) of the firm's employees who were employed in December 2007, lived in HUBZone-designated areas. To have met the 35 percent residency requirement, the firm would have needed at least 41 employees residing in HUBZone-designated areas, thus, the firm did not meet this requirement by 23 employees. In addition, we investigated the location that the firm purported to the SBA as its "principal office." Our investigation found that no employees were located at this office. Additional investigative work revealed that the firm's primary office was not located in a HUBZone. During the interview, the firm's president acknowledged that he "had recently become aware" that he was not in compliance with HUBZone requirements and was taking "corrective actions." However, the firm continued to represent itself as a HUBZone firm even after the firm's president acknowledged his company did not meet the program requirements. Based on our analysis of FPDS-NG data, between fiscal years 2006 and 2007 federal agencies obligated over $5.0 million in HUBZone awards to this firm, consisting mainly of 2 HUBZone set-aside contracts by the Department of the Navy. Our June 2008 report and July 2008 testimony clearly showed that SBA did not have effective internal controls related to the HUBZone program. In response to our findings and recommendations, SBA initiated a process of reengineering the HUBZone program. SBA officials stated that this process is intended to make improvements to the program that are necessary for making the program more effective while also minimizing fraud and abuse. To that end, SBA has hired business consultants as well as reached out to GAO in an attempt to identify control weaknesses in the HUBZone program and to strengthen its fraud prevention controls. Although SBA has initiated steps to address internal control deficiencies we identified in our June 2008 report, SBA has not yet incorporated effective controls for preventing, detecting, and investigating fraud and abuse within the HUBZone program. Internal controls comprise the plans, methods, and procedures used to meet missions, goals, and objectives and also serve as the first line of defense in safeguarding assets and preventing and detecting errors and fraud. Fraud prevention, on the other hand, requires a system of rules, which, in their aggregate, minimize the likelihood of fraud occurring while maximizing the possibility of detecting any fraudulent activity that may transpire. Fraud prevention systems set forth what actions constitute fraudulent conduct and specifically spell out who in the organization handles fraud matters under varying circumstances. The potential of being caught most often persuades likely perpetrators not to commit the fraud. Because of this principle, the existence of a thorough fraud prevention system is essential to fraud prevention and detection. As of the end of our field work, SBA does not have in place the key elements of an effective fraud prevention system. As shown in figure 4 below, a well-designed fraud prevention system (which can also be used to prevent waste and abuse) should consist of three crucial elements: (1) upfront preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. For the HUBZone program this would mean (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) the aggressive pursuit and prosecution of individuals committing fraud. In addition, as shown in figure 4, the organization should also use "lessons learned" from its detection and monitoring controls and investigation and prosecutions to design more effective preventive controls. We explain the three major fraud prevention elements in this model and how SBA is attempting to address them, in further detail below. We have previously reported that fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse. Thus, controls that prevent fraudulent firms and individuals from entering the program in the first place are the most important element in an effective fraud prevention program. The most crucial element of effective fraud prevention controls is a focus on substantially diminishing the opportunity for fraudulent access into the system through front-end controls. Preventive controls should be designed to include, at a minimum, a requirement for data validation, system edit controls, and fraud awareness training. Prior to implementing any new preventive controls, agencies must adequately field test the new controls to ensure they are operating as intended. SBA officials stated that as part of their interim process they are now requesting, from all firms that apply to the HUBZone program, documentation that demonstrates their eligibility. SBA stated that, in the past, it only requested additional information when it encountered obvious "red flags." Although requiring additional documentation has some value as a deterrent, the most effective preventive controls involve the verification of information, such as verifying a principal office location through an unannounced site visit. If SBA verified purported principal offices by conducting unannounced site visits, such as we did for our investigation, SBA would likely find similar instances of firms attempting to defraud the HUBZone program. In addressing one of our prior recommendations, the SBA issued a Desktop Manual for processing HUBZone applications. The manual provides guidance that alerts SBA staff of circumstances that warrant the need for supporting documentation. Although the Desktop Manual provides discretion to the analyst about the need to conduct a site visit, the Desktop Manual does not provide criteria when such site visits are warranted. In addition, SBA does not screen firms or individuals to ensure that they are not affiliated with prior firms that failed program eligibility reviews. As a result, an owner can change the name of a company that was removed from the HUBZone program to a new business name and be accepted back into the HUBZone program. Further, SBA did not adequately field test its interim process for processing applications. If it had done so, SBA would have known that it did not have the resources to effectively carry out its review of applications in a timely manner. As a result, SBA had a backlog of about 800 HUBZone applications as of January 2009. At that time, SBA officials stated that it would take about 6 months to process each HUBZone application--well over the 1 month goal set forth in SBA regulations. Although preventive controls are the most effective way to prevent fraud, continual monitoring is an important component in detecting and deterring fraud. Monitoring and detection within a fraud prevention program involve actions such as data-mining for fraudulent and suspicious applicants and evaluating firms to provide reasonable assurance that they continue to meet program requirements. As demonstrated in our July 2008 testimony, SBA's fraud control vulnerabilities in its application process make detection and monitoring particularly important for the HUBZone program. As a result of SBA's control vulnerabilities, there are likely hundreds and possibly thousands of firms in the HUBZone program that fail to meet program requirements. Although monitoring and detection is an important component of a fraud prevention system, we reported in June 2008 that the mechanisms SBA used to monitor HUBZone firms provided limited assurance that only eligible firms participate in the program. Specifically, we reported that a firm could be in the HUBZone program for years without being examined. In addition, although a HUBZone firm is supposed to be recertified every 3 years, we reported that more than 40 percent of the firms in the program for over 3 years had not been recertified. To address these weaknesses, SBA officials stated that during this fiscal year, they will be conducting program examinations on all HUBZone firms that received contracts in fiscal year 2007 to determine whether they still meet HUBZone requirements. In addition, SBA officials stated that as of September 2008, SBA had eliminated their backlog of recertifications. Although SBA has initiated several positive steps, SBA will need to make further progress to achieve an effective fraud monitoring program. For example, SBA has not found an effective and efficient way to verify the validity of a stated principal office during its recertification and application processes. In addition, SBA officials stated that although they modified their approach for conducting program examinations of HUBZone firms this fiscal year, they have not established a streamlined and risk-based methodology for selecting firms for program examinations going forward. Further, in order to determine whether firms meet eligibility requirements, SBA needs to incorporate an "element of surprise" into its program examinations such as using random, unannounced site visits to verify a stated principal office. Finally, SBA does not evaluate all HUBZone program requirements during program examinations; specifically, SBA does not review whether HUBZone firms are expending at least 50 percent of the personnel costs of a contract on their own personnel. As a result, as shown by several of our case studies, certain firms are allowed to act as "front" companies, whereby they subcontract the large majority of their work to non-HUBZone firms. This undermines the program's stated purpose of increasing employment opportunities, investment, and economic development in HUBZone areas. The final element of an effective fraud prevention system is the aggressive investigation and prosecution of individuals who commit fraud against the federal government. However, SBA currently does not have an effective process for investigating fraud and abuse within the HUBZone program. Although SBA's Desktop Manual for Processing HUBZone Applications states that an analyst may refer a HUBZone application to the Office of Inspector General or the Office of General Counsel, SBA has not established specific criteria or a process for referring firms that knowingly do not meet program requirements. To date, other than the firms identified by our prior investigation, the SBA program office has never referred any firms for debarment and/or suspension proceedings based on their findings from their program eligibility reviews. By failing to hold firms accountable, SBA has sent a message to the contracting community that there is no punishment or consequences for committing fraud or abusing the intent of the HUBZone program. However, as noted below, the SBA has started the debarment process on 7 of the 10 firms we found to have fraudulently or inaccurately misrepresented its HUBZone status in our earlier work. SBA has taken some enforcement steps on the 10 firms that we found did not meet HUBZone program requirements as of July 2008. According to SBA, as of January 2009, two of the firms have been removed from the program and two others are in the process of being removed. However, SBA's failure to examine some of the most egregious cases we previously identified has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone set-aside or price preference contracts to these firms. For example, a construction firm identified in our July 2008 testimony admitted that it did not meet HUBZone requirements and was featured in several national publications by name. It has continually represented itself as HUBZone certified and has received $2 million in HUBZone obligations and a $23 million HUBZone set-aside contract since our testimony. See figure 5 for a reproduction of the continual representation this firm makes on the top banner of its Web site. In the written statement for the July 2008 hearing, the Acting Administrator of SBA stated that the SBA would take "immediate steps to require site visits for those HUBZone firms that have received HUBZone contracts and will be instituting suspension and debarment proceedings against firms that have intentionally misrepresented their HUBZone status." SBA has referred 7 of these firms to its General Counsel for suspension and debarment. However, as of February 2009, according to SBA's Dynamic Small Business Web site, 7 of the 10 firms that we investigated were still HUBZone certified. Table 2 highlights the 10 firms that we noted at the July 2008 hearing that clearly did not meet the HUBZone program requirements, new HUBZone obligations and contracts these firms received, as well as the actions the SBA has taken against these firms as of January 2009. As noted in the table above, as of January 2009 SBA has conducted program evaluations on 7 of the 10 firms to determine whether the firms meet the eligibility requirements for the HUBZone program. Based on these evaluations, SBA has removed 2 firms from the HUBZone program and is in the process of providing due process to 2 additional firms to determine whether they should be removed. SBA officials stated that no action will be taken on 3 firms because SBA's program evaluations concluded that these firms met all the eligibility requirements of the HUBZone program. We attempted to verify SBA's work, but were not provided with the requested documentation to support their conclusion that the firms moved into compliance after our July 2008 testimony. SBA officials said they have not yet performed program evaluations for 3 of the most egregious firms because they are experiencing technical problems with SBA's caseload system. As such, these 3 firms remain eligible to receive HUBZone set-aside contracts. SBA is also pursuing suspension and debarment actions for 7 of these firms, and the Department of Justice considering civil actions on 5 of the 10 cases. Our work on the HUBZone program to date has shown that numerous ineligible firms have taken advantage of the opportunity to commit fraud against the federal government. The SBA has initiated steps to correct internal control deficiencies, but it still falls short in developing measures to prevent, detect, and prosecute fraud within the HUBZone program. Our work demonstrates that SBA's fraud controls lack important elements needed to screen and monitor firms which has led to HUBZone awards to firms that did not meet program requirements. For example, SBA's failure to verify principal office locations through unannounced site visits has led to firms operating their businesses from locations that are far from economically disadvantaged. In addition, a lack of oversight for monitoring all of the program requirements has allowed HUBZone firms to subcontract large portions of HUBZone work to non-HUBZone firms thereby failing to meet the program requirement that at least 50 percent of the personnel costs of a contract be expended on its own employees. Lastly, SBA's lack of enforcement within the HUBZone program has not had the effect of deterring fraudulent actors from entering or remaining in the program. Going forward, SBA must develop and incorporate effective fraud controls into its overall internal control process that will minimize fraud and abuse in the HUBZone program. To establish an effective fraud prevention system for the HUBZone program, the Administrator of the Small Business Administration should expeditiously implement the recommendations from our June 2008 report and take the following four actions: Consider incorporating a risk-based mechanism for conducting unannounced site visits as part of the screening and monitoring process. Consider incorporating policies and procedures into SBA's program examinations for evaluating if a HUBZone firm is expending at least 50 percent of the personnel costs of a contract using its own employees. Ensure appropriate policies and procedures are in place for the prompt reporting and referral of fraud and abuse to SBA's Office of Inspector General as well as SBA's Suspension and Debarment Official. Take appropriate enforcement actions on the 19 HUBZone firms we found to violate HUBZone program requirements to include, where applicable, immediate removal or decertification from the program, and coordination with SBA's Office of Inspector General as well as SBA's Suspension and Debarment Official. We received written comments on a draft of this report from SBA's Deputy Associate Administrator of the Office of Business Development and Government Contracting. In the response, SBA agreed with three of our four recommendations. SBA stated that it is in the process of re- engineering the entire HUBZone certification and eligibility process, and SBA believes that our recommendations are useful in making necessary program changes to minimize program risk and ensure that only eligible firms received HUBZone program benefits. SBA's written comments are provided in appendix II. SBA disagreed with our recommendation to consider incorporating policies and procedures into SBA's program examinations for evaluating if a HUBZone firm is complying with the performance-of-work requirements by expending at least 50 percent of the personnel costs of a contract using its own employees. SBA stated that although this requirement is included in SBA HUBZone regulations, it is not a criterion for HUBZone program eligibility but rather a mandatory contract term. SBA stated that contracting officers are required by the Federal Acquisition Regulations to insert such clauses regarding subcontracting limitations. If firms submit bids that indicate that they will not meet this requirement or fail to meet this requirement during performance of the contract, the contracting officer has the authority to reject a firm's bid or terminate the contract for default. SBA stated that it will continue to work with contracting officers to ensure that this requirement is monitored. While we recognize that contracting officers have a responsibility for monitoring the subcontracting limitation, SBA also has this responsibility. In order to receive HUBZone certification, a firm must certify to SBA that it will abide by this performance requirement, and SBA is required by statute to establish procedures to verify such certifications. In addition, verification that a firm is meeting the performance-of-work requirements is one of the subjects that SBA may review during its program examinations. Since SBA is not performing this review, it is possible that many firms may be receiving the benefits of the HUBZone program while evading the program requirements. Therefore, we continue to believe that SBA should consider incorporating policies and procedures into SBA's program examinations for evaluating if a HUBZone firm is meeting the performance-of-work requirements. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Administrator of the Small Business Administration and other interested parties. The report will also be available at no charge on GAO's Web site at www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who contributed to this report are listed in appendix III. This appendix presents summary information on 9 of 19 firms that clearly did not meet the program eligibility requirements of the HUBZone program. Table 3 shows the remaining case studies that we investigated. As with the 10 cases discussed in the body of this report, these 9 firms continued to represent themselves as eligible HUBZone interests to SBA. Because these 9 case examples clearly are not eligible, we consider each firm's continued representation indicative of fraud and/or abuse related to this program. In addition to the individual named above, Erika Axelson, Gary Bianchi, Donald Brown, Bruce Causseaux, Eric Eskew, Dennis Fauber, Craig Fischer, Robert Graves, Betsy Isom, Jason Kelly, Julia Kennon, Barbara Lewis, Olivia Lopez, Jeff McDermott, Andrew McIntosh, John Mingus, Andy O'Connell, Mary Osorno, Chris Rodgers, and Matt Valenta also provided assistance on this report.

Summary:
The Small Business Administration's (SBA) Historically Underutilized Business Zone (HUBZone) program provides federal contracting assistance to small firms located in economically distressed areas, with the intent of stimulating economic development. In July 2008, GAO identified substantial vulnerabilities in SBA's application and monitoring process that demonstrated the HUBZone program is vulnerable to fraud and abuse. GAO also investigated 10 case studies of HUBZone firms in the Washington, D.C., area that misrepresented their eligibility. GAO was asked to determine (1) whether additional cases of fraud and abuse exist outside of the Washington, D.C., area; (2) what actions, if any, SBA has taken to establish an effective fraud prevention program for the HUBZone program; and (3) what actions, if any, SBA took against the 10 case study firms in GAO's July 2008 testimony. To meet these objectives, GAO identified selected HUBZone firms based on certain criteria, such as magnitude of HUBZone contracts and firm location. GAO also interviewed SBA officials and reviewed SBA data. GAO found that fraud and abuse in the HUBZone program extends beyond the Washington, D.C., area. GAO identified 19 firms in Texas, Alabama, and California participating in the HUBZone program that clearly do not meet program requirements (i.e., principal office location or percentage of employees in HUBZone and subcontracting limitations). For example, one Alabama firm listed its principal office as "Suite 19," but when GAO investigators performed a site visit they found the office was in fact trailer 19 in a residential trailer park. The individual living in the trailer had no relationship to the HUBZone firm. In fiscal years 2006 and 2007, federal agencies obligated nearly $30 million to these 19 firms for performance as the prime contractor on HUBZone contracts and a total of $187 million on all federal contracts. Although SBA has initiated steps in strengthening its internal controls as a result of GAO's 2008 testimonies and report, substantial work remains for incorporating a fraud prevention system that includes effective fraud controls consisting of (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) the aggressive pursuit and prosecution of individuals committing fraud. In addition, SBA did not adequately field test its interim process for processing applications. If it had done so, SBA would have known that it did not have the resources to effectively carry out its review of applications in a timely manner. As a result, SBA had a backlog of about 800 HUBZone applications as of January 2009. At that time, SBA's interim application process was taking about 6 months--well over its 1-month goal set forth in SBA regulations. SBA has taken some enforcement steps on the 10 firms previously identified by GAO that knowingly did not meet HUBZone program requirements. However, SBA's failure to promptly remove firms from the HUBZone program and examine some of the most egregious cases from GAO's July 2008 testimony has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone contracts to these firms. For example, a construction firm from the July 2008 testimony admitted that it did not meet HUBZone requirements and was featured in several national publications by name. It has continually represented itself as HUBZone certified and has received $2 million in HUBZone obligations and a $23 million HUBZone set-aside contract since the July 2008 testimony.