SBA has not fully addressed deficiencies we have previously identified for the WOSB program, and these deficiencies are affected by SBA’s ongoing implementation of changes to the program authorized by the National Defense Authorization Act of 2015 (2015 NDAA). As of early June 2019, SBA had implemented one of the three changes to the program authorized in the 2015 NDAA. Specifically, in September 2015 SBA published a final rule to implement sole-source authority (to award contracts without competition), effective October 2015. The two other changes—authorizing SBA to implement its own certification process for WOSBs and requiring SBA to eliminate the option for firms to self-certify that they are eligible for the WOSB program—had not been implemented. On May 14, 2019, SBA published in the Federal Register a proposed rule that eliminates the self-certification option and describes a potential certification process to be administered by SBA. SBA officials have stated that the agency will not eliminate self-certification until the new certification process for the WOSB program is in place, which they expect to implement by June 2021. In addition, SBA has not fully addressed WOSB program oversight deficiencies described in our March 2019 report and first identified in our 2014 report. We reported that SBA did not have formal policies for reviewing the performance of its four approved third-party certifiers (private entities approved by SBA to certify the eligibility of WOSB firms), including their compliance with their agreements with SBA. Further, we found that SBA had not developed formal policies and procedures for, among other things, reviewing the monthly reports that certifiers submit to SBA. We recommended that the Administrator of SBA establish comprehensive procedures to monitor and assess the performance of the third-party certifiers in accordance with their agreements with SBA and program regulations. While SBA has taken some steps to address our recommendation, including conducting a compliance review of the certifiers in 2016, SBA officials said in June 2018 that SBA had no plans to conduct further compliance reviews until the final rule implementing the new certification process was completed. By waiting to improve its oversight of the WOSB program, SBA cannot provide reasonable assurance that certifiers are complying with program requirements and cannot improve its efforts to identify ineligible firms or potential fraud. In addition, the implementation of sole-source authority in light of these continued oversight deficiencies can increase program risk. Consequently, we maintain that our recommendation should be addressed. SBA also has not fully addressed deficiencies related to eligibility examinations that we described in our March 2019 report and first identified in our October 2014 report. We found that SBA lacked formalized guidance for its eligibility examination processes and that the examinations identified high rates of potentially ineligible businesses. As a result, we recommended that SBA enhance its examination of businesses that register for the WOSB program to ensure that only eligible businesses obtain WOSB set-asides. Specifically, we suggested that SBA should take actions such as (1) completing the development of procedures to conduct annual eligibility examinations and implementing such procedures; (2) analyzing examination results and individual businesses found to be ineligible to better understand the cause of the high rate of ineligibility in annual reviews and determine what actions are needed to address the causes, and (3) implementing ongoing reviews of a sample of all businesses that have represented their eligibility to participate in the program. SBA has taken some steps to implement our recommendation, such as including written policies and procedures for WOSB program eligibility examinations in a standard operating procedure and a Desk Guide. However, SBA does not collect reliable information on the results of its annual eligibility examinations. In addition, SBA continues to have no mechanism to look across examinations for common eligibility issues to inform the WOSB program. As we noted in 2014, by not analyzing examination results broadly, the agency is missing opportunities to obtain meaningful insights into the program, such as the reasons many businesses are deemed ineligible. Further, SBA still conducts eligibility examinations only of firms that have already received a WOSB award. Restricting the samples in this way limits SBA’s ability to better understand the eligibility of businesses before they apply for and are awarded contracts, as well as its ability to detect and prevent potential fraud. We recognize that SBA has made some effort to address our recommendation by documenting procedures for conducting annual eligibility examinations of WOSB firms. However, without maintaining reliable information on the results of eligibility examinations, developing procedures for analyzing results, and expanding the sample of businesses to be examined to include those that did not receive contracts, SBA limits the value of its eligibility examinations and its ability to reduce ineligibility among businesses registered to participate in the WOSB program. Leading fraud risk management practices state that federal program managers should design control activities that focus on fraud prevention over detection and response, to the extent possible. The deficiencies in SBA’s oversight of the WOSB program limit SBA’s ability to identify potential fraud risks and develop any additional control activities needed to address these risks. As a result, the program may continue to be exposed to the risk of ineligible businesses receiving set- aside contracts. In addition, in light of these continued deficiencies, the implementation of sole-source authority without addressing the other changes made by the 2015 NDAA could increase program risk. For these reasons, we maintain that our previous recommendation that SBA enhance its WOSB eligibility examination procedures should be addressed. In addition, similar to previous findings from SBA’s Office of Inspector General, our March 2019 report found that about 3.5 percent of contracts using a WOSB set-aside were awarded for ineligible goods or services from April 2011 through June 2018. At that time, SBA was not reviewing contracting data that could identify this problem and inform SBA which agencies making awards may need targeted outreach or training. As a result, we found that SBA could not provide reasonable assurance that WOSB program requirements were being met and that the program was meeting its goals. We recommended that SBA develop a process for periodically reviewing the extent to which WOSB program set-asides are awarded for ineligible goods or services and use the results to address identified issues, such as through targeted outreach or training to agencies making awards under the ineligible codes. In early May 2019, SBA said that it had initiated such efforts. In September 2018, we found that although SBA had adopted criteria and guidance for a risk-based approach to certifying and recertifying firms for the HUBZone program in March 2017, the extent to which it conducted a risk assessment to inform its approach was unclear. In 2015, we found that SBA lacked key controls for its recertification process and recommended that SBA assess the process. In 2009, SBA increased documentation requirements for certification but not recertification (which determines continued program eligibility every 3 years). In March 2017, SBA changed its recertification criteria and guidance to require firms with $1 million or more in HUBZone contract awards to provide documentation to support continuing eligibility. During our work for the September 2018 report, SBA officials stated they had completed a risk assessment of the HUBZone recertification process, but did not provide us with documentation on when they performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold. As of May 2019, SBA had not provided documentation showing that it had performed the risk assessment, but we maintain that an assessment of the recertification process would help inform a risk- based approach to reviewing and verifying information from firms that appear to pose the most risk to the program. In addition, SBA had not provided documentation showing that a technology-based solution designed to address some of the ongoing challenges with the recertification process had been implemented. SBA officials had previously estimated this solution would be available first in spring 2017 and then by the end of calendar year 2017. We also found in our September 2018 report that, based on our review of case files for a nongeneralizable sample of 12 firms in Puerto Rico that received HUBZone certification between March 2017 and March 2018, SBA did not consistently document or follow its policies and procedures for certification reviews: SBA did not have complete documentation in nine of 12 cases. SBA officials described alternative procedures they used to determine firms’ eligibility, but SBA had not updated its internal policy manuals to reflect these procedures, and analysts did not document use of such procedures in the files we reviewed. As a result, SBA did not have reasonable assurance that firms met HUBZone criteria. In four of 12 cases, SBA did not follow its policy to conduct three levels of review (by an analyst, a senior analyst, and the program director or deputy) when determining whether to approve or deny a firm. It was unclear to what extent SBA reviewed staff compliance with certification and recertification review procedures. SBA provided an assurance letter stating that it evaluated the Office of HUBZone’s internal controls and concluded the controls were effective, but the letter did not specify what steps SBA took for the evaluation. We recommended that SBA (1) update its internal policy manuals for certification and recertification reviews to reflect existing policies and procedures not currently in written guidance and (2) conduct and document reviews of staff compliance with procedures associated with HUBZone certification and recertification. In response to our report, SBA said that it planned to update its internal policies on certification and recertification by issuing a procedural notice and to begin reviewing and documenting staff compliance with the updated procedures outlined in the notice. However, as of May 2019, SBA had not provided documentation showing that it had completed these planned actions. In September 2018, we found that for fiscal year 2017, SBA revised the methodology for its Small Business Procurement Scorecard, which is used to assess federal agencies’ progress toward small business procurement goals. SBA made revisions to address requirements specified in the National Defense Authorization Act for Fiscal Year 2016. SBA (1) reduced the share of the total scorecard grade devoted to prime contracting achievement, which is the dollar amount of contracts awarded directly to small businesses, and (2) added an element calculating changes in the number of small businesses receiving prime contracts. SBA made two additional revisions—with input from other agencies’ representatives—to increase the share of subcontracting achievement results and the share of the peer review of required activities designed to facilitate small business procurement. In July 2018, officials said they had begun developing a plan to evaluate the effects of the revised scorecard methodology but did not provide a draft plan. Conducting a well-designed and comprehensive evaluation could aid SBA in determining whether the scorecard is an effective tool for helping to achieve the agency’s strategic goals. In our September 2018 report, we also found that the published fiscal year 2017 scorecards originally contained errors, including an incorrect grade and numeric score for one agency, and SBA does not have a process to ensure that scorecard results are published accurately. Although SBA later corrected the errors, it did not initially document that scorecards had been changed, which is inconsistent with SBA’s policy on information quality. SBA officials said that errors occurred in the process of formatting scorecards for publication. Errors in the published scorecards—and the initial lack of disclosure about corrections—weaken data reliability and may undermine confidence in scorecard data. We recommended that SBA (1) design and implement a comprehensive evaluation to assess scorecard revisions and (2) institute a process for reviewing scorecards for accuracy prior to publication and a mechanism for disclosing corrected information. Since our report, SBA has proposed a two-phase program evaluation of the scorecard. SBA officials said that they plan for phase one to include a report to Congress on the impact of the small business procurement goal program for Chief Financial Officers Act agencies and to provide a recommendation on continuing, modifying, expanding, or terminating the scorecard program. SBA plans to provide the phase one report in September 2019. In phase two, SBA plans to conduct a program evaluation that investigates the effectiveness of the small business contracting scorecard on federal agency small business contracting goal achievement. SBA has not provided a time frame for phase two. With respect to the second recommendation, SBA officials said that SBA has developed a procedure that includes a prepublication review process for procurement scorecards. The officials said the procedure identifies responsibilities, provides for an independent peer review, and includes supervisory review. Officials said the procedure also includes measures for post-publication review and corrections. We will review supporting documentation for this new procedure to assess whether this recommendation can be closed as implemented. Chairman Rubio, Ranking Member Cardin, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this testimony, please contact William Shear, Director, Financial Markets and Community Investment at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Andrew Pauline (Assistant Director), Paige Smith (Assistant Director), Winnie Tsen (Assistant Director), and Jennifer Schwartz. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Federal agencies conduct a variety of procurements that are reserved for small business participation through small business set-asides. These set-asides can be for small businesses in general, or they can be specific to small businesses that meet additional eligibility requirements in programs such as those for WOSB or HUBZone. SBA administers both the WOSB and HUBZone programs. SBA also produces an annual Small Business Procurement Scorecard to measure how much contracted spending federal agencies allocate to small businesses and whether the federal government is meeting its goals for awarding contracts to small businesses. GAO issued three reports between September 2018 and March 2019 on SBA contracting programs (see GAO-18-666 , GAO-18-672 , and GAO-19-168). This testimony is primarily based on these three reports and discusses prior GAO findings and SBA's progress on implementing GAO's recommendations on (1) the WOSB program, (2) the HUBZone program, and (3) SBA's procurement scorecard. To update the status of prior recommendations, GAO reviewed updates from SBA and interviewed officials. The Small Business Administration (SBA) has not fully implemented GAO's prior recommendations to address oversight deficiencies in the Women-Owned Small Business (WOSB) and Historically Underutilized Business Zone (HUBZone) programs and to improve evaluation of its procurement scorecard. GAO maintains that its recommendations should be addressed. Women-Owned Small Business Program. In its March 2019 report, GAO found that SBA had not addressed WOSB program oversight deficiencies identified in GAO's 2014 report (GAO-15-54). For example, GAO had found that SBA did not have procedures related to reviewing the performance of the four third-party certifers—private entities approved by SBA to certify the eligibility of WOSB firms—as well as information the certifiiers submitted to SBA. GAO recommended that SBA establish procedures to assess the performance of the certifiers and the information they submitted. While SBA conducted a compliance review of the certifiers in 2016, SBA said in June 2018 that it had no plans to conduct further compliance reviews until a final rule implementing a new certification process was completed. SBA officials said that they expected the rule to be implemented by June 2021. By waiting to improve its oversight of the WOSB program, SBA cannot provide reasonable assurance that certifiers are complying with program requirements and cannot improve its efforts to identify ineligible firms or potential fraud. HUBZone Program. In September 2018, GAO reported that it had reviewed case files for a nongeneralizable sample of 12 firms in Puerto Rico that received HUBZone certification between March 2017 and March 2018 and found that SBA did not consistently document or follow its policies and procedures for certification reviews. For example, SBA did not have complete documentation in nine of 12 cases and did not follow its policy to conduct three levels of review when determining whether to approve or deny a firm in four of 12 cases. As a result, SBA did not have reasonable assurance that firms meet HUBZone criteria. SBA said that it planned to implement GAO's recommendations that SBA (1) update internal policy manuals for certification and recertification and (2) conduct and document reviews of staff compliance with relevant procedures. However, as of May 2019, SBA had not provided documentation showing that it had completed these planned actions. Small Business Procurement Scorecard. For fiscal year 2017, SBA revised the methodology for its Small Business Procurement Scorecard, which assesses the efforts of federal agencies to support contracting with small businesses. For example, one revision reduced the share of the total scorecard grade devoted to prime contracting achievement (the dollar amount of contracts awarded directly to small businesses). GAO recommended in September 2018 that SBA design and implement a comprehensive evaluation to assess the scorecard revisions. Since that report was issued, SBA has proposed but not yet implemented a two-phase evaluation of the scorecard to include an evaluation of the scorecard's effect on federal agencies achieving small business contracting goals. SBA said that it expects to complete phase one by September 2019 and has not provided a time frame for phase two.