HUBZone program fraud and abuse continues to be problematic for the federal government. We identified 19 firms in Texas, Alabama, and California participating in the HUBZone program even though they clearly do not meet program requirements (i.e., principal office location or percentage of employees residing in the HUBZone and subcontracting limitations). Although we cannot conclude whether this is a systemic problem based on these cases, the issue of misrepresentation clearly extends beyond the Washington, D.C., metropolitan area where we conducted our initial investigation. In fiscal years 2006 and 2007, federal agencies had obligated nearly $30 million to these 19 firms for performance as the prime contractor on federal HUBZone contracts. HUBZone regulations also place restrictions on the amount of work that can be subcontracted to non-HUBZone firms. Specifically, HUBZone regulations generally require a firm to expend at least 50 percent of the personnel costs of a contract on its own employees. As part of our investigative work, we found examples of service firms that subcontracted most HUBZone contract work to other non-HUBZone firms and thus did not meet this program requirement. When a firm subcontracts the majority of its work to other non-HUBZone firms, it is undermining the HUBZone program’s stated purpose of stimulating development in economically distressed areas, as well as evading eligibility requirements for principal office and 35 percent residency requirement. Examples of firms that did not meet HUBZone requirements included the following: An environmental consulting firm located in Fort Worth, Texas, that violated HUBZone program requirements because it did not expend at least 50 percent of personnel costs on its own employees or use personnel from other HUBZone firms. From fiscal year 2006 through fiscal year 2007, the Department of the Army obligated more than $2.3 million in HUBZone contracts to this firm. At the time of our investigation, company documents showed that the company was subcontracting from 71 to 89 percent of its total contract obligations to other non-HUBZone firms—in some cases, large firms. The principal admitted that her firm was not meeting the subcontracting performance requirement of HUBZone regulations. Further, the principal stated that the firm made bids on HUBZone contracts knowing that the company would have to subcontract work to other firms after the award. The principal added that other large firms use HUBZone firms in this manner, referring to these HUBZone firms as “contract vehicles.” A ground maintenance services company located in Jacksonville, Alabama, failed to meet both principal office and 35 percent residency requirements. From fiscal year 2006 through fiscal year 2007, this firm received more than $900,000 in HUBZone set-aside obligations. However, our investigation found that the purported principal office was in fact a residential trailer occupied by someone not associated with the company. The company had represented its office as located in “suite 19,” when in reality, the address was associated with trailer 19 in a residential trailer park. The two employees of the firm—a father and a son—lived in non- HUBZone areas that are located about 90 miles from the trailer park. This firm also subcontracted most of its HUBZone work to non-HUBZone firms. An information technology firm in Huntsville, Alabama, failed to meet both principal office and 35 percent residency requirements. From fiscal year 2006 through fiscal year 2007, federal agencies obligated over $5 million in HUBZone awards to this firm, consisting mainly of two HUBZone set-aside contracts. Based on our review of payroll records and written correspondence that we received from the firm, we determined that only 18 of 116 of the firm’s employees (16 percent) who were employed in December 2007 lived in HUBZone-designated areas. In addition, our investigation found that no employees were located at the location listed as a principal office. The firm’s president acknowledged that he “had recently become aware” that he was not in compliance with HUBZone requirements and was taking “corrective actions.” However, the firm continued to represent itself as a HUBZone firm even after this acknowledgment. According to HUBZone regulations, persons or firms are subject to criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program, including failure to correct “continuing representations” that are no longer true. During the application process, applicants are not only reminded of the program eligibility requirements, but are required to agree to the statement that anyone failing to correct “continuing representations” shall be subject to fines, imprisonment, and penalties. Further, the Federal Acquisition Regulation (FAR) requires all prospective contractors to update the government’s Online Representations and Certifications Application, which includes a statement certifying whether the firm is currently a HUBZone firm and that there have been “no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA.” Of the 19 firms that did not meet HUBZone eligibility requirements, we found that all of them continued to represent themselves as eligible HUBZone interests to SBA. Because the 19 case examples clearly are not eligible, we consider each firm’s continued representation indicative of fraud, abuse, or both related to this program. Our June 2008 report and July 2008 testimony clearly showed that SBA did not have effective internal controls related to the HUBZone program. In response to our findings and recommendations, SBA initiated a process of reengineering the HUBZone program. SBA officials stated that this process is intended to make improvements to the program that are necessary for making the program more effective while also minimizing fraud and abuse. To that end, SBA has hired business consultants and reached out to GAO in an attempt to identify control weaknesses in the HUBZone program and to strengthen its fraud prevention controls. As of the end of our fieldwork, SBA did not have in place the key elements of an effective fraud prevention system. A well-designed fraud prevention system (which can also be used to prevent waste and abuse) should consist of three crucial elements: (1) up-front preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. For the HUBZone program this would mean (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) decertification from the program of ineligible firms and the aggressive pursuit and prosecution of individuals committing fraud. Preventive controls. We have previously reported that fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse. Thus, controls that prevent fraudulent firms and individuals from entering the program in the first place are the most important element in an effective fraud prevention program. SBA officials stated that as part of their interim process they are now requesting from all firms that apply to the HUBZone program documentation that demonstrates their eligibility. While requiring additional documentation has some value as a deterrent, the most effective preventive controls involve the verification of information, such as verifying a principal office location through an unannounced site visit. Moreover, SBA did not adequately field-test its interim process for processing applications. If it had done so, SBA would have known that it did not have the resources to effectively carry out its review of applications in a timely manner. As a result, SBA had a backlog of about 800 HUBZone applications as of January 2009. At that time, SBA officials stated that it would take about 6 months to process each HUBZone application—well over the 1 month goal set forth in SBA regulations. Detection and monitoring. Although preventive controls are the most effective way to prevent fraud, continual monitoring is an important component in detecting and deterring fraud. We reported in June 2008 that the mechanisms SBA used to monitor HUBZone firms provided limited assurance that only eligible firms participate in the program. SBA officials stated that during this fiscal year, they will be conducting program examinations on all HUBZone firms that received contracts in fiscal year 2007 to determine whether they still meet HUBZone requirements. In addition, SBA officials stated that as of September 2008, SBA had eliminated its backlog of recertifications. Although SBA has initiated several positive steps, SBA will need to make further progress to achieve an effective fraud monitoring program, including steps to (1) verify the validity of a stated principal office during its recertification and application processes; (2) establish a streamlined and risk-based methodology for selecting firms for program examinations going forward; (3) incorporate an “element of surprise” into its program examinations, such as using random, unannounced site visits; and (4) review whether HUBZone firms are expending at least 50 percent of the personnel costs of a contract on their own personnel. Investigation and prosecution. The final element of an effective fraud prevention system is the aggressive investigation and prosecution of individuals who commit fraud against the federal government. However, SBA currently does not have an effective process for investigating fraud and abuse within the HUBZone program. To date, other than the firms identified by our prior investigation, the SBA program office has never referred any firms for debarment and/or suspension proceedings based on findings from its program eligibility reviews. By failing to hold firms accountable, SBA has sent a message to the contracting community that there is no punishment or consequences for committing fraud or abusing the intent of the HUBZone program. SBA has taken some enforcement steps on the 10 firms that we found did not meet HUBZone program requirements as of July 2008. According to SBA, as of January 2009, 2 of the firms have been removed from the program and 2 others are in the process of being removed. However, SBA’s failure to examine some of the most egregious cases we previously identified has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone set-aside or price preference contracts to these firms. In the written statement for the July 2008 hearing, the Acting Administrator of SBA stated that SBA would take “immediate steps to require site visits for those HUBZone firms that have received HUBZone contracts and will be instituting suspension and debarment proceedings against firms that have intentionally misrepresented their HUBZone status.” However, as of February 2009, according to SBA’s Dynamic Small Business Web site, 7 of the 10 firms that we investigated were still HUBZone certified. SBA has removed 2 firms from the HUBZone program and is in the process of providing due process to 2 additional firms to determine whether they should be removed. SBA officials stated that no action will be taken on 3 firms because SBA’s program evaluations concluded that these firms met all the eligibility requirements of the HUBZone program. We attempted to verify SBA’s work, but were not provided with the requested documentation to support its conclusion that the firms moved into compliance after our July 2008 testimony. SBA officials said that they have not yet performed program evaluations for 3 of the most egregious firms because they are experiencing technical problems with SBA’s caseload system. As such, these 3 firms remain eligible to receive HUBZone set-aside contracts. SBA is also pursuing suspension and debarment actions for 7 of these firms, and the Department of Justice is considering civil actions in 5 of the 10 cases. We will be referring all the cases we identified to SBA for further action. In our report, we also recommended that the Administrator of SBA expeditiously implement our June 2008 recommendations and take the following four actions: Consider incorporating a risk-based mechanism for conducting unannounced site visits as part of the screening and monitoring process. Consider incorporating policies and procedures into SBA’s program examinations for evaluating if a HUBZone firm is expending at least 50 percent of the personnel costs of a contract using its own employees. Ensure appropriate policies and procedures are in place for the prompt reporting and referral of fraud and abuse to SBA’s Office of Inspector General as well as SBA’s Suspension and Debarment Official. Take appropriate enforcement actions on the 19 HUBZone firms we found to violate HUBZone program requirements to include, where applicable, immediate removal or decertification from the program, and coordination with SBA’s Office of Inspector General as well as SBA’s Suspension and Debarment Official. In written comments on a draft of our report, SBA agreed with three of our four recommendations. SBA disagreed with our recommendation to consider incorporating policies and procedures into SBA’s program examinations for evaluating if a HUBZone firm is complying with the performance of work requirements by expending at least 50 percent of the personnel costs of a contract on its own employees. SBA stated that although this requirement is included in SBA HUBZone regulations, it is not a criterion for HUBZone program eligibility but rather a mandatory contract term. SBA stated that contracting officers are required by the FAR to insert such clauses regarding subcontracting limitations. While we recognize that contracting officers have a responsibility for monitoring the subcontracting limitation, SBA also has this responsibility. In order to receive HUBZone certification, a firm must certify to SBA that it will abide by this performance requirement, and SBA is required by statute to establish procedures to verify such certifications. Therefore, we continue to believe that SBA should consider incorporating policies and procedures into its program examinations for evaluating if a HUBZone firm is meeting the performance of work requirements. Madam Chairwoman, this concludes my statement. I would be pleased to answer any questions that you or other members of the committee may have at this time. For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. In addition to the individual named above, Bruce Causseaux, Senior Level Contract and Procurement Fraud Specialist; Matt Valenta, Assistant Director; Erika Axelson; Gary Bianchi; Donald Brown; Bruce Causseaux; Eric Eskew; Dennis Fauber; Craig Fischer; Robert Graves; Betsy Isom; Jason Kelly; Julia Kennon; Barbara Lewis; Olivia Lopez; Jeff McDermott; Andrew McIntosh; John Mingus; Andy O’Connell; Mary Osorno; and Chris Rodgers also provided assistance on this testimony. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Created in 1997, the HUBZone program provides federal contracting assistance to small businesses in economically distressed communities, or HUBZone areas, with the intent of stimulating economic development in those areas. On July 17, 2008, we testified before Congress that SBA's lack of controls over the HUBZone program exposed the government to fraud and abuse and that SBA's mechanisms to certify and monitor HUBZone firms provide limited assurance that only eligible firms participate in the program. In our testimony, we identified 10 firms from the Washington, D.C., metropolitan area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Of the 10 firms, 6 did not meet both principal office and employee residency requirements while 4 met the principal office requirement but significantly failed the employee residency requirement. We reported in our July 2008 testimony that federal agencies had obligated a total of nearly $26 million in HUBZone contract obligations to these 10 firms since 2006. After the hearing, Congress requested that we perform a follow-on investigation. We describe the results of this investigation and further background about the HUBZone program in a companion report that is being made public today. This testimony will summarize our overall findings. Specifically, this testimony will address (1) whether cases of fraud and abuse in the program exist outside of the Washington, D.C., metro area; (2) what actions, if any, SBA has taken to establish an effective fraud prevention system for the HUBZone program; and (3) what actions, if any, SBA has taken on the 10 firms that we found misrepresented their HUBZone status in July 2008. In summary, we found that fraud and abuse in the HUBZone program extends beyond the Washington, D.C., area. We identified 19 firms in Texas, Alabama, and California participating in the HUBZone program that clearly do not meet program requirements (i.e., principal office location or percentage of employees in HUBZone and subcontracting limitations). In fiscal years 2006 and 2007, federal agencies obligated nearly $30 million to these 19 firms for performance as the prime contractor on HUBZone contracts and a total of $187 million on all federal contracts. Although SBA has initiated steps to strengthen its internal controls as a result of our 2008 testimonies and report, substantial work remains for incorporating a fraud prevention system that includes effective fraud controls consisting of (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) the aggressive pursuit and prosecution of individuals committing fraud. SBA has taken some enforcement steps on the 10 firms previously identified by GAO that knowingly did not meet HUBZone program requirements. However, as of February 2009, according to SBA's Dynamic Small Business Web site, 7 of the 10 firms that we investigated were still HUBZone certified. SBA's failure to promptly remove firms from the HUBZone program and examine some of the most egregious cases from our testimony has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone contracts to these firms.