The HUBZone Act of 1997 (which established the HUBZone program) identified HUBZones as (1) qualified census tracts, which are determined generally by area poverty rate or household income; (2) qualified nonmetropolitan counties, which are determined generally by area unemployment rate or median household income; and (3) lands meeting certain criteria within the boundaries of an Indian reservation. Congress subsequently expanded the criteria for HUBZones to add former military bases and counties in difficult development areas outside the continental United States. The number of HUBZones increased from about 8,000 in 2000 to more than 14,000 in 2006. SBA generally updates HUBZone designations at least twice a year based on whether they meet statutory criteria (such as having certain income levels or poverty or unemployment rates). SBA generally uses data from other federal agencies to determine if areas still qualify for the HUBZone program. As a result of the updates, additional areas are designated for inclusion while other areas lose their designation. Census tracts and nonmetropolitan counties that lose their designation begin a 3- year “redesignation” period during which firms in those areas can continue to apply to and participate in the program and receive contracting preferences. For instance, about 3,400 HUBZones redesignated in 2012 lost their designations in 2015. Another approximately 2,500 census tracts and nonmetropolitan counties are scheduled to lose their designation by January 2020. After the 3 years, firms in these areas lose their certified status and the associated federal contracting award preferences. To be certified to participate in the HUBZone program, a firm must meet the following criteria: when combined with its affiliates, be small by SBA size standards; be at least 51 percent owned and controlled by U.S. citizens; have its principal office—the location where the greatest number of employees perform their work—in a HUBZone; and have at least 35 percent of its employees reside in a HUBZone. SBA recertifies firms (that is, determines that firms continue to meet HUBZone eligibility requirements to participate in the program) every 3 years. Since 2008, GAO has reported on weaknesses in the HUBZone program and SBA’s efforts to address those vulnerabilities. GAO made 11 recommendations intended to address identified problems associated with the program’s certification and recertification processes, communication with firms, and the program’s susceptibility to fraud and abuse (see app. I for a summary and status of our recommendations). The following sections discuss the weaknesses we previously identified and the program revisions and improvements SBA subsequently implemented in response to our recommendations. We reported in June 2008 that, for its certification process, SBA relied on data that firms entered in the online application system and performed limited verification of the self-reported information. Although agency staff had the discretion to request additional supporting documentation, SBA did not have specific guidance or criteria for such requests. Consequently we recommended that SBA develop and implement guidance to more routinely and consistently obtain supporting documentation upon application. In response to that recommendation, SBA revised its certification process, and since 2009 has required firms to provide documentation, which SBA officials review to determine the firms’ eligibility for the HUBZone program. SBA then performs a full-document review on all applications as part of its initial certification process to determine firms’ eligibility for the program. However, we also found in 2015 that the revised process SBA implemented resulted in delays in processing applications—81 percent of the 4,809 initial applications submitted between fiscal year 2009 and 2013 that we reviewed exceeded SBA’s processing goal of 90 days. Additional recommendations from our June 2008 report are discussed below. We previously found that SBA’s challenges with its certification process made the HUBZone program vulnerable to fraud and abuse. For example, in July 2008 we testified that 10 HUBZone firms in the Washington, D.C., area had made fraudulent or inaccurate representations to get into or remain in the HUBZone program, and in a March 2009 report we found that another 19 firms in four other metropolitan areas had made fraudulent representations. We also reported in June 2010 that although SBA had increased documentation requirements for the application process, SBA still was not adequately authenticating self-reported information. We demonstrated this by obtaining HUBZone certification for three bogus firms using the addresses of the Alamo in Texas, a public storage facility in Florida, and a city hall in Texas as principal office locations. When we revisited this issue in 2015, SBA officials told us that the agency conducted site visits on 10 percent of its portfolio of certified firms annually to help address these vulnerabilities. SBA selects the firms to receive site visits based on established criteria (such as the amount of HUBZone contract awards the firm has received) or on an as-needed basis in connection with the review of an initial certification application or after receipt of a protest. In 2008 and 2015, we identified a number of concerns with SBA’s HUBZone recertification process. Generally, SBA relied on self-reported information to make its recertification decisions and had a backlog of firms waiting to be recertified. As a result, SBA lacked reasonable assurance that only qualified firms were allowed to continue in the program and receive preferential contracting treatment. In February 2015, we reported that SBA relied on firms’ attestations of continued eligibility and generally did not request supporting documentation as part of the recertification process. SBA only required firms to submit a notarized recertification form stating that their eligibility information was accurate. SBA officials did not believe they needed to request supporting documentation from recertifying firms because all firms in the program had undergone a full document review, either at initial application or during SBA’s review of its legacy portfolio in fiscal years 2010–2012. However, as we found, the characteristics of firms and the status of HUBZone areas—the bases for program eligibility— often can change and need to be monitored. As a result, we concluded that SBA lacked reasonable assurance that only qualified firms were allowed to continue in the HUBZone program and receive preferential contracting treatment. We recommended that SBA reassess the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information. In March 2016, we found that SBA had not yet implemented additional controls (such as guidance for when to request supporting documents) for the recertification process because SBA officials believed that any potential risk of fraud would be mitigated by site visits to firms. The officials also cited resource limitations. Based on data that SBA provided, the agency visited about 10 percent of certified firms each year during fiscal years 2013–2015. SBA’s reliance on site visits alone would not mitigate the recertification weaknesses that were the basis for our recommendation. In recognition of SBA’s resource constraints, we stated in our 2015 report and reiterated in 2016 that SBA could apply a risk- based approach to its recertification process to review and verify information from firms that appear to pose the most risk to the program. We concluded that a lack of risk-based criteria and guidance for staff to request and verify firm information during the recertification process increased the risk that ineligible firms could obtain HUBZone contracts. We also reiterated that the characteristics of firms and the status of HUBZone areas—the bases for program eligibility—often can change, and needed to be monitored. As of February 2017, SBA officials told us that the agency had begun implementing a technology-based solution to address some of the ongoing challenges with the recertification process. The officials expected that the new solution would help them better assess firms and implement risk-based controls by the end of calendar year 2017. In 2008 and again in 2015, we found that the recertification process was backlogged—that is, firms were not being recertified within the 3-year time frame. In 2015, we reported that as of September 2014, SBA was recertifying firms that had been first certified 4 years previously. While SBA initially eliminated the backlog following our 2008 report, according to SBA officials the backlog recurred due to limitations with the program’s computer system and resource constraints. Consequently, in 2015 we again recommended that SBA take steps to ensure that significant backlogs would not recur. In response to the recommendation, SBA made some changes to its recertification process. For example, instead of manually identifying firms for recertification twice a year, SBA automated the notification process, enabling notices to be sent daily to firms (to respond to and attest that they continued to meet the eligibility requirements for the program). According to SBA officials, as of February 2017 this change has not yet eliminated the backlog. In 2008 and 2015, we reported on challenges some firms had faced or might have faced in understanding their eligibility status for the program. Generally, SBA relied on information posted on its website to communicate with interested parties about the HUBZone program. SBA’s HUBZone website includes links to the HUBZone map, which firms can use to determine if an address or a particular area is designated as a HUBZone. In our June 2008 report, we found that SBA’s HUBZone map contained ineligible areas and had not been updated to include currently eligible areas. As a result, ineligible small businesses had participated in the program, and eligible businesses had not been able to participate. Consequently, we recommended that SBA take steps to correct and update the map used to identify HUBZone areas and implement procedures to help ensure that the map would be updated with the most recently available data on a more frequent basis. In response to our recommendation, SBA subsequently contracted with its mapping vendor in 2008 to enable more frequent updating of the HUBZone map (at least annually). According to SBA officials, the accuracy of the map is checked twice after each upgrade, first by the mapping vendor and then by an SBA employee. We subsequently reported in February 2015 that while HUBZone designations can change with some frequency, SBA’s communications to firms about programmatic changes (including redesignation) generally had not been targeted or specific to firms that would be affected by the changes. At that time SBA used a broadcast e-mail (which simultaneously sends the same message to multiple recipients) to distribute program information. In 2015, SBA’s e-mail addressee list had not been updated to include firms certified since the list was created in 2013. While firms could sign up through SBA’s website to receive the e- mails, not all certified firms may have done so. Consequently, we recommended that SBA establish a mechanism to better ensure that firms are notified of changes to HUBZone designations that may affect their participation in the program. This recommendation was intended to address communications to all certified firms, whether newly certified or in the program for years. In response to our recommendation, SBA improved its notifications to newly certified firms but not to other certified firms. For example, SBA’s certification letter to firms with principal offices in a redesignated area specifically states that the firm is in a redesignated area, explains the implications of the designation, and notes when the redesignated status will expire. However, we found in March 2016 that SBA had not yet implemented changes to better ensure that all currently certified firms would be notified of changes that could affect their program eligibility. It is important that all certified firms potentially affected by such changes receive information about the changes or are made aware in a timely fashion of any effects on their program eligibility. As of February 2017, SBA had begun to improve its notifications to all firms. According to SBA officials, the agency has started sending program notices to all the firms in its portfolio. They told us that for its most recent notice in February 2017, the agency copied all the e-mail addresses in its HUBZone database and placed them in the e-mail distribution system. According to SBA officials, SBA intends to repeat this effort with subsequent notices. We will continue to monitor SBA’s implementation of this activity. Our June 2008 and February 2015 reports demonstrated that economic distress (based on poverty and unemployment rate and median household income) has been more severe in designated HUBZone areas than in redesignated areas. For example, in June 2008, we found that approximately 60 percent of qualified metropolitan census tracts had a poverty rate of 30 percent or more, while approximately 4 percent of redesignated metropolitan census tracts had a poverty rate of 30 percent or more. Similarly, we found that about 46 percent of qualified nonmetropolitan counties had a poverty rate of 20 percent or more, while 21 percent of redesignated nonmetropolitan counties had a poverty rate of 20 percent or more. In our February 2015 report, we analyzed indicators (including poverty and unemployment rate and median household income as of 2012) to illustrate the differences in economic conditions among HUBZone areas (qualified and redesignated areas) and non-HUBZone areas (nonqualified tracts or areas). We found that indicators for redesignated areas on average fell below those of qualified areas, consistent with what we reported in June 2008. We also found that indicators for redesignated areas on average fell between those of qualified areas and nonqualified areas. For this statement, we updated our prior analysis of the economic conditions of such areas (to include not only data as of 2012 but also as of 2015, the most current available). Based on current analysis of poverty and unemployment rate data, indicators for redesignated areas on average again fell between those of qualified and non-qualified areas (see fig. 1). For example, for census tracts in 2015 qualified tracts had poverty and unemployment rates of 34 percent and 13 percent, respectively; redesignated tracts had rates of 23 percent and 11 percent, respectively; and nonqualified tracts had rates of 12 percent and 7 percent, respectively. A similar pattern existed for nonmetropolitan counties. Also, while the poverty and unemployment rates for qualified and non-HUBZone nonmetropolitan counties remained relatively unchanged between 2012 and 2015, the unemployment rate decreased in redesignated counties. We also updated our analysis that included indicators for household income and housing value for qualified, redesignated, and non-HUBZone areas (by census tract). As shown in table 1, in both 2012 and 2015 qualified areas on average, had higher poverty and unemployment rates and lower median household income and housing values then either redesignated or non-HUBZone areas. On average, redesignated areas had economic indicators between those of qualified and nonqualified areas. Between 2012 and 2015 the poverty rate increased in qualified census tracts while the average median housing income and housing values decreased. In contrast, the average median household income increased for both redesignated and non-HUBZone areas during that period. As we have stated since our June 2008 report, while allowing continued eligibility for firms located in redesignated areas can benefit firms and communities in such areas, allowing continued eligibility could also result in diffusion—decreased targeting of areas with greatest economic distress—by lessening the competitive advantage on which small businesses may rely to thrive in economically distressed communities. Therefore, while allowing redesignated areas to remain eligible can generate economic benefits for such areas, the inclusion of such areas in the HUBZone program could limit the benefits that qualified areas with more depressed economic conditions might realize. In taking into account the potential impacts of actions that can expand or reduce the number of HUBZones and redesignated areas, our June 2008 report included a recommendation to SBA to further develop measures and implement plans to assess the effectiveness of the HUBZone program that take into account factors such as the economic characteristics of the HUBZone area. Although SBA took initial steps to develop such an assessment, the agency has not implemented our recommendation. We plan to continue to evaluate elements of the HUBZone program. The Puerto Rico Oversight, Management, and Economic Stability Act contains a provision for us to evaluate the application and utilization of SBA contracting activities (including contracting activities relating to HUBZone firms) in Puerto Rico. Our work will include an analysis of the impact of SBA’s June 2016 decision to remove a statutory cap on the number of qualified census tracts in metropolitan statistical areas in Puerto Rico (as well as nationwide). According to SBA, the removal of the cap resulted nationally in 2,015 additional census tracts qualifying as HUBZones at that time. We anticipate issuing the report in June 2017. Chairman Knight, Ranking Member Murphy, and members of the Subcommittee, this concludes my statement. I would be pleased to respond to any questions you may have. If you or your staff have any questions about this testimony, please contact William B. Shear, Director, Financial Markets and Community Investment, at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Harry Medina (Assistant Director), Daniel Newman (Analyst in Charge), Pamela Davidson, John McGrail, John Mingus, and Barbara Roesmann. The following table summarizes the status of our recommendations from HUBZone performance audits and investigations as of February 2017. We classify each recommendation as partially implemented (the agency took steps to implement the recommendation but more work remains); open (the agency has not taken steps to implement the closed, not implemented (the agency decided not to take action to implement the recommendation). The recommendations are listed by report. GAO recommendations Small Business Contracting: Opportunities Exist to Further Improve HUBZone Oversight: GAO-15-234, February 12, 2015 Establish a mechanism to better ensure that firms are notified of changes to HUBZone designations that may affect their participation in the program, such as ensuring that all certified firms and newly certified firms are signed up for the broadcast e-mail system or including more specific information in certification letters about how location in a redesignated area can affect their participation in the program Conduct an assessment of the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information, allowing firms to initiate the recertification process, and ensuring that sufficient staff will be dedicated to the effort so that a significant backlog in recertifications does not recur. HUBZONE Program: Fraud and Abuse Identified in Four Metropolitan Areas: GAO-09-440, March 25, 2009 Consider incorporating a risk-based mechanism for conducting unannounced site visits as part of the screening and monitoring process. Consider incorporating policies and procedures into SBA’s program examinations for evaluating if a HUBZone firm is expending at least 50 percent of the personnel costs of a contract using its own employees. Ensure appropriate policies and procedures are in place for the prompt reporting and referral of fraud and abuse to SBA’s Office of Inspector General as well as SBA’s Suspension and Debarment Official. Take appropriate enforcement actions on the 19 HUBZone firms we found to violate HUBZone program requirements to include, where applicable, immediate removal or decertification from the program, and coordination with SBA’s Office of Inspector General as well as SBA’s Suspension and Debarment Official. Closed-implemented GAO recommendations Small Business Administration: Additional Actions Are Needed to Certify and Monitor HUBZone Businesses and Assess Program Results: GAO-08-643, June 17, 2008 Take immediate steps to correct and update the map that is used to identify HUBZone areas and implement procedures to ensure that the map is updated with the most recently available data on a more frequent basis. Develop and implement guidance to more routinely and consistently obtain supporting documentation upon application and conduct more frequent site visits, as appropriate, to ensure that firms applying for certification are eligible. Establish a specific time frame for eliminating the backlog of recertifications and ensure that this goal is met, using either SBA or contract staff, and take the necessary steps to ensure that recertifications are completed in a more timely fashion in the future. Formalize and adhere to a specific time frame for processing firms proposed for decertification in the future. Closed-implemented Further develop measures and implement plans to assess the effectiveness of the HUBZone program that take into account factors such as (1) the economic characteristics of the HUBZone area and (2) contracts being counted under multiple socioeconomic subcategories. Closed - not Implemented This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The purpose of the HUBZone program is to stimulate economic development in economically distressed areas designated as HUBZones. SBA certifies small business firms located in HUBZones to participate in the HUBZone program—that is, determines they are eligible for federal contracting preferences under the program, such as awards of sole-source and set-aside contracts. HUBZone areas lose their designations when they no longer meet applicable criteria on economic conditions and enter a 3-year transitional period (“redesignation”) during which HUBZone firms can continue to apply to and participate in the program. HUBZone firms had almost $6.6 billion in obligations on active federal contracts for calendar year 2015. This testimony discusses, among other things, areas of weaknesses that GAO previously identified in reviews and fraud investigations of the program, related recommendations, and SBA's actions to address them. This statement is based on GAO's body of work issued between June 2008 and September 2016. GAO also met with SBA officials in February 2017 to discuss the status of open recommendations. Since 2008, GAO has made 11 recommendations to improve the HUBZone program. SBA has implemented seven of these recommendations, not implemented two and is in the process of implementing the other two. The Small Business Administration (SBA) designates economically distressed areas as Historically Underutilized Business Zones (HUBZones), based on data such as unemployment and poverty rates. Since 2008, GAO has issued several products that identified weaknesses in the HUBZone program and made recommendations to SBA to address them. While weaknesses remain, SBA has taken some steps to enhance program processes to varying extents. For example, Certification process. In 2008, GAO found that SBA performed limited verification of the information firms reported on applications. In response to GAO's recommendation to develop and implement guidance for the certification process, SBA has taken steps to improve its processes to verify the eligibility of firms applying to the program. Since fiscal year 2009, SBA has required firms to provide supporting documentation for applications that the agency then reviews. Susceptibility to fraud and abuse. In 2008 and 2009, GAO's investigations found 29 HUBZone firms in five metropolitan areas made fraudulent or inaccurate representations, which allowed them to get into or remain in the program. In response to GAO's recommendations to address potential fraud, SBA increased its documentation requirements. But in 2010, GAO still was able to obtain HUBZone certification using bogus addresses. Subsequently, according to SBA officials, in fiscal year 2010 SBA began conducting site visits to 10 percent of certified firms. Recertification process. Firms wishing to remain in the program must recertify their continued eligibility to SBA every 3 years. However, in 2015, GAO found that SBA had not required firms seeking recertification to submit any information to verify continued eligibility and instead simply relied on their attestations of continued eligibility. GAO recommended that SBA reassess its recertification process and add additional controls. As of February 2017, SBA had not yet implemented this recommendation. Communications with firms about designations. GAO found in 2015 that SBA's communications to firms about programmatic changes (including redesignation) generally were not specific to affected firms and thus some firms might not have been informed they would lose eligibility. GAO recommended that SBA establish a better notification mechanism. In response, SBA revised its letters to newly certified firms to inform them of the consequences of redesignation, and as of February 2017, SBA was implementing additional steps to ensure that all currently certified firms would be notified of changes that could affect their program eligibility.