Fraud and abuse in the SDVOSB program allowed ineligible firms to improperly receive millions of dollars in set-aside and sole-source SDVOSB contracts, potentially denying legitimate service-disabled veterans and their firms the benefits of this program. We identified 10 case-study examples of firms that did not meet SDVOSB program eligibility requirements, received approximately $100 million in SDVOSB contracts, and over $300 million in additional dollars of 8(a), HUBZone, and non-SDVOSB federal government contracts. SBA found four of the firms ineligible for the SDVOSB program through the agency’s bid protest process. Nevertheless, because there are no requirements to terminate contracts when firms are found ineligible, several contracting agencies allowed the ineligible firms to continue their work. In addition, we identified six other case-study firms that were not eligible for the SDVOSB program. The misrepresentations case-study firms made included a firm whose owner was not a service-disabled veteran, a serviced-disabled veteran who did not control the firm’s day-to-day operations, a service- disabled veteran who was a full-time contract federal employee at MacDill Air Force Base, and firms that served as a “pass-through” for large and sometimes foreign-based corporations. In the case of a pass-through, a firm or joint venture lists a service-disabled veteran as the majority owner, but contrary to program requirements, all work is performed and managed by a non-service-disabled person or a separate firm. Federal regulations set requirements for a small business to qualify as an SDVOSB. As stated above, SDVOSB eligibility regulations mandate that a firm must be a small business and at least 51 percent–owned by one or more service-disabled veterans who control the management and daily business operations of the firm. In addition, SDVOSB regulations also place restrictions on the amount of work that can be subcontracted. Specifically, regulations require the SDVOSB to incur a mandatory percentage of the cost of the contract performance that can range from 15 percent to 50 percent, depending on the type of goods or services. The Federal Acquisition Regulation (FAR) requires all prospective contractors to update ORCA to state whether their firm qualifies as an SDVOSB under specific NAICS codes. Pursuant to 15 U.S.C. § 657 f(d), firms that knowingly making false statements or misrepresentations in certifying SDVOSB status are subject to penalties. Of the 10 cases we identify in this report, all 10 of them represented to be SDVOSBs in the Central Contractor Registration (CCR). Table 1 provides details on our 10 case- study firms that fraudulently or abusively misrepresented material facts related to their eligibility for the SDVOSB program. We plan to refer all 10 firms to appropriate agencies for further investigation and consideration for removal from the program. Case 1: This firm fraudulently certified itself as an SDVOSB in CCR so it could compete for over $200 million in SDVOSB contract awards that FEMA set aside for site maintenance for trailers provided to Hurricane Katrina and Rita victims in Louisiana. In May 2006, the same month as the FEMA request for proposals were posted, the majority owner of the SDVOSB applied for the first time to VA for service-connected disability compensation related to claimed injuries incurred during military service in the mid-1970s. In July 2006, VA requested that the SDVOSB’s owner provide evidence of his/her service-connected disability. The owner never responded. In December 2006, the VA denied the owner’s application for compensation and status as a service-disabled veteran. Six months later, SBA issued a decision, in response to an SDVOSB status protest, stating that the owner of the firm was not a service-disabled veteran. In its decision, the SBA concluded the SDVOSB firm and its joint venture did not qualify for SDVOSB contracts. Based on this decision, in July 2007, FEMA sent a letter terminating any future task orders for the firm and the joint venture and giving them until the end of August 2007 to cease all operations under both contract awards. In the end, the firm received approximately $7.5 million dollars from FEMA’s SDVOSB set-aside contracts prior to termination. The firm received no other punishments or sanctions for the fraudulent misrepresentation and has not been suspended or debarred from receiving future government contracts. Case 2: This firm, functioning as a pass-through for non-SDVOSB firms, improperly received over $5 million in SDVOSB contracts. Our investigation revealed that this firm, located in Chico, California, improperly subcontracted 100 percent of the work from an SDVOSB contract to a corporation headquartered in Europe that reported almost $12 billion dollars in revenue in 2008. The firm consists of two owners and three full-time employees. While the majority owner listed on company documents is a service-disabled veteran, neither the owner nor the firm’s employees perform any of the work related to SDVOSB contracts the firm receives. SDVOSB janitorial service contracts require that at least half of the personnel costs are incurred by employees of either the firm or another SDVOSB. When we interviewed the firm’s service-disabled veteran owner, he/she acknowledged that he/she subcontracted all of the firm’s work to other non-SDVOSB firms. The owner said the company’s business model is to (1) use Federal Business Opportunities (FedBizOps) to search for SDVOSB set-asides that the firm can find a subcontractor to complete; then (2) take over a portion of the subcontractor’s payroll to meet the percentage requirement for completing the work. The owner stated this process was used for the firm’s $3.5 million contract for janitorial services at a VA hospital in California, where the SDVOSB firm functioned as a pass-through for a non-SDVOSB foreign-based corporation, which is one of the world’s largest facility-service groups, with operations in 50 countries and almost $12 billion in annual revenue in 2008. For this contract, all employees performing the janitorial services were from the foreign-based corporation. The firm—with two owners and only three employees—has secured 21 SDVOSB contracts in nine different states for janitorial, construction, and other services. The work that is passed through to non-SDVOSB firms is valued at $5 million. Case 5: Our investigation found that a non-SDVOSB company used two SDVOSB firms as pass-throughs to obtain over $3 million in SDVOSB contracts. It did not have the SDVOSB firms perform the majority of the contract work as required. The company located in Austin, Texas, formed joint ventures with the two SDVOSB firms to receive contracts for septic- tank and related services from the Army at Fort Drum, New York, and Fort Irwin, California. The Fort Drum set-aside contract was protested in June 2008 through the SBA bid-protest process, which determined that the service-disabled veteran owner was not in control of the business. The SBA disqualified both the non-SDVOSB company and its joint venture from the SDVOSB program and deemed them ineligible to bid on such contracts in the future; however, SBA did not process either the company or the SDVOSB firm for suspension or debarment, which would generally exclude the firms from doing business with the federal government. Furthermore, SBA’s ruling did not result in the Army’s termination of its contracts with the joint ventures that were the subject of the protest because there are no requirements to terminate contracts awarded to firms ineligible for SDVOSB set-aside or sole-source contracts. The company that used the SDVOSB as a pass-through was allowed to continue to provide septic-tank and related services at Fort Drum through 2013 for a total value of up to $1.1 million. In 2009 the same non-SDVOSB company from Texas partnered with a different SDVOSB firm to receive a contract at Fort Irwin valued at up to $3 million for septic-tank and related services. Based on our case analysis, the SDVOSB owner does not control the SDVOSB firm. The SDVOSB owner is a former employee of the joint venture “partner” from Texas, as are 8 out of 10 employees. The SDVOSB owner also works 3 days each week at his brother’s bar in Illinois—located 1,800 miles away from the project site in California. In addition, the SDVOSB owner does not have control over payments received from the work performed at Fort Irwin. The non-SDVOSB company’s accountant, who is located in San Antonio, Texas, manages the SDVOSB firm’s bank accounts. Furthermore, a visit to the work site at Fort Irwin in June 2009 also revealed, as shown in figure 1 below, that the portable toilets and hand-wash stations on site all displayed the name and phone number of the non-SDVOSB company. In June of 2009 we visited the contract performance site at Fort Irwin, with the intention of inspecting the site unannounced. However, a Fort Irwin contracting officer notified the SDVOSB firm in advance of our site visit. Prior to our arrival it appeared that the SDVOSB owner had made an effort to conceal the true management and control over the contract. Specifically, upon arrival, the SDVOSB owner from Illinois was present on site to greet us, despite the fact that he lived over 1,800 miles away. In addition, a service truck displaying the SDVOSB firm’s logo was prominently displayed at the contract location. Further investigation revealed that the truck’s registration had been transferred the day of our visit from the non-SDVOSB company from Texas to the SDVOSB firm. However, the registration address remains in Texas at the office of the accountant for both businesses. Case 10: This case-study firm, functioning as a pass-through for a non- SDVOSB company, received approximately $900,000 for an SDVOSB contract. Our investigation found that the owner of the SDVOSB passed through all of the work for this furniture design and installation contract to a furniture dealer that his wife worked for, who then passed the work to a furniture manufacturer that actually designed and installed the furniture. When we interviewed the SDVOSB firm owner, he admitted that he had no experience in the furniture business. In addition, the SDVOSB owner works full-time at MacDill Air Force base—the same location as the contract award. This award is questionable on three counts: the SDVOSB owner’s full-time job with another employer should make it impossible for him to manage and control daily business operations on a large SDVOSB contract; the contract work was passed through to the manufacturer; and the owner’s daily interactions with Air Force personnel on base create the perception of preferential treatment. In addition, as shown in figure 2 below, the legitimacy of the SDVOSB firm is also in question because the firm’s physical address is the owner’s home and its mailing address is a mail-box rental store. When questioned, contracting officials at the base stated that they were aware that the SDVOSB firm owner was also a DOD contract employee and that he would likely not perform a majority of the work on the contract. Nevertheless, they felt the contract was awarded appropriately. MacDill Air Force Base awarded the firm, which has no employees, an SDVOSB set-aside contract for approximately $900,000 for furniture layout design, delivery, and installation. The SDVOSB firm owner has worked at the base for over 20 years as a telecommunications contract employee. The base director of contracting and the legal counsel who approved the award had prior working relationships with the SDVOSB owner on the base. Contracting officials told us that during the decision process for the award of the furniture contract, heavy emphasis was placed on past performance rather than price; however, the SDVOSB firm had no past- performance history. Contracting officials at the base instead allowed the SDVOSB firm to use past performance ratings of the furniture dealer, where the owner’s wife worked to meet the past-performance requirement. In addition, contracting officials were aware of the SDVOSB owner’s limited involvement in performing the contract. They even stated that the service-disabled veteran would likely not show up until it was time to collect his check. The military personnel in charge of overseeing the furniture layout design, delivery, and installation stated that the manufacturer was more involved than the SDVOSB or its affiliate dealer. We observed the delivery and installation of some of the furniture related to this contract. The manufacturer was the only company present to lead the installation process, with the plans they designed in-hand and their logo clearly printed on them. Despite the fact that this SDVOSB award clearly functioned as a pass-through for a non-SDVOSB firm, base officials did not consider the award to be improper. In fact, the Director of Contracting at the base stated that he estimates 90 percent of SDVOSB contracts are pass-throughs for non-SDVOSB companies. The 10 case studies discussed above show that significant control weaknesses in the SDVOSB program allow ineligible firms to receive millions in SDVOSB contracts. The lack of effective fraud-prevention controls by SBA and agencies awarding contracts allowed these ineligible firms to receive approximately $100 million of sole-source or set-aside SDVOSB contracts over the last several years. The SDVOSB program is essentially an eligibility-based program. However, neither the SBA, except when responding to a protest, nor contracting officials are currently verifying the eligibility of firms claiming to be SDVOSBs. For example, currently the SBA and contracting agencies do not have a process in place to access the VA service-disabled veteran’s database listing individuals that are valid service-disabled veterans. In addition, contracting officers are not required to validate that a firm’s owner is a service-disabled veteran prior to award. Unlike other small business contracting programs, such as the HUBZone and 8(a) programs, there also are no documentation submissions to substantiate eligibility for the program or application process associated with the SDVOSB program. This lack of controls substantially increases the risk for fraud and abuse in the SDVOSB program. The only process in place to detect fraud in the SDVOSB program involves a formal bid protest process at the SBA, whereby interested parties to a contract award can protest if they feel a firm misrepresented its small business size or SDVOSB eligibility in its bid submission. However, as shown by our case studies, this self-policing process does not prevent ineligible firms from receiving SDVOSB contracts. For example, bid- protest decisions do not always result in the termination of contracts with ineligible firms, even when termination costs would be minimal in cases where contract work had not begun. As some of our case studies show, even when firms are found ineligible to receive a contract, they can still retain it because current regulations do not require that the contracting agency terminate the contract. In addition, none of the firms found ineligible by the SBA through SDVOSB-status protests were suspended or debarred from receiving SDVOSB and other government contracts. When asked about its bid protest process, SBA officials stated that the bid protest process focuses on determining the eligibility of a firm for a specific contract and providing details on why a firm was found to be eligible or ineligible. SBA officials also stated that bid protest decisions do not include recommendations for suspension or debarment. Recently, in response to the Veterans Benefits, Health Care, and Information Technology Act, VA has taken steps to develop a validation program for contracts it awards to SDVOSBs and Veteran-Owned Small Businesses (VOSB). While not yet fully implemented, this validation program includes steps to verify a firm’s eligibility for the program including validating an owner’s SDV status and his/her control of day-to-day operations. The VA program also includes plans for site visits to firms seeking VA certification as an SDVOSB or VOSB. Our 10 case studies clearly show that fraud and abuse exist within the SDVOSB program. Without preventive controls our case studies show that millions of dollars of SDVOSB set-aside and sole-source contracts are being awarded to ineligible firms. Fraud prevention requires a system of rules which, in their aggregate, minimize the likelihood of fraud occurring while maximizing the possibility of detecting any fraudulent activity at a reasonable cost. Fraud-prevention systems set forth what actions constitute fraudulent conduct and specifically spell out who in the organization handles fraud matters under varying circumstances. The potential of being caught and disciplined can, in some cases, persuade likely perpetrators not to commit the fraud. Because of this principle, the existence of a thorough fraud-prevention system is essential to fraud prevention and detection. However, as shown by our case studies, there are at times no consequences for firms that fraudulently misrepresent their status as SDVOSBs or otherwise abuse the current system. Not only are firms not prosecuted, suspended, or debarred, but in many cases, because there is no requirement for agencies to terminate contracts awarded to ineligible firms, the firms are allowed to continue performing contracts, even when contract termination costs would be minimal in cases where contracted work had not begun. In addition, ineligible firms in some instances continue bidding on SDVOSB contracts without consequences. As of July 2009, the federal government does not have in place the key elements of an effective fraud-prevention system for the SDVOSB program. As shown in figure 3 below, a well-designed fraud-prevention system should consist of three crucial elements: (1) up-front preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. For the SDVOSB program this would mean (1) front-end controls over program eligibility prior to contract award, (2) fraud detection and monitoring of firms already receiving SDVOSB contracts, and (3) the aggressive pursuit and prosecution of individuals committing fraud to include suspension and debarment, or requirement to terminate the contract. In addition, as shown in figure 3, the organization should also use “lessons learned” from its detection and monitoring controls and investigations and prosecutions to design more-effective preventive controls. Currently the SDVOSB program has no preventive controls in place to prevent fraud and abuse in the program. In addition, the SBA and agencies awarding contracts do not have access to a database listing individuals that are valid service-disabled veterans. We have previously reported that fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse. This is especially important in a program like the SDVOSB program where even firms identified as receiving contracts through fraud or abuse face no real consequences as discussed below. Thus, controls that prevent fraudulent firms and individuals from entering the program in the first place are the most important element in an effective fraud-prevention program. The most crucial element of effective fraud-prevention controls is a focus on substantially diminishing the opportunity for fraudulent access into the system through front-end controls. Currently there are no preventive controls in place for the SDVOSB program. The SDVOSB program is essentially an eligibility-based program. However neither the SBA or contracting officials are required to verify the eligibility of firms claiming to be SDVOSBs. This lack of controls substantially increases the risk for fraud and abuse in the SDVOSB program. Although preventive controls are the most effective way to minimize fraud and abuse, continual monitoring is an important component in detecting and deterring fraud. Monitoring and detection within a fraud-prevention program involve actions such as data mining for fraudulent and suspicious applicants and evaluating firms to provide reasonable assurance that they continue to meet program requirements. Currently, the only process in place that can detect fraud and abuse in this program is the bid-protest process administered by SBA. Through the bid-protest process, interested parties self-police the SDVOSB program by exercising their right to challenge an SDVOSB award that is suspected to have been awarded to an ineligible firm. SBA will determine the eligibility of the firm, and if ruled ineligible, the SBA protest decision will state that the firm is supposed to be ineligible for additional SDVOSB awards. However, based on our case studies this process does not prevent the firms from bidding on SDVOSB contracts, because SBA protest decisions are not listed in CCR or ORCA, and therefore contracting officials may not be aware of protest decisions. Officials from the Inspector General offices within SBA and VA stated that they will respond to allegations of fraud and abuse within the SDVOSB program, but they do not actively monitor the program for fraud and abuse. Without continual monitoring of the program, the risk for persistent fraud and abuse increases. The final element of an effective fraud prevention system is the aggressive investigation and prosecution of individuals who commit fraud against the federal government. The SBA, through the bid-protest process, makes determinations of eligibility status in the SDVOSB program. However, there is not an effective process for prosecution, suspension, or debarment of program abusers. Without consequences, the bid-protest process is not an effective control for preventing future abuse. As mentioned in case studies above, firms determined to be ineligible for SDVOSB awards are not required to terminate those awards. In one case, a joint venture was determined to be a pass-through—it completed the contract and created another pass-through with a different service-disabled veteran to win another SDVOSB contract. Furthermore, although SBA’s regulations state that firms misrepresenting themselves as SDVOSB concerns may be suspended or debarred from government contracting and may suffer civil and criminal penalties for knowingly making false statements to the SBA, to-date, the SBA program office has never referred any firms for debarment or suspension proceedings, or both, based on SBA findings from its program-eligibility reviews. When asked about its bid protest process, SBA officials stated that the bid protest process focuses on determining the eligibility of a firm for a specific contract and providing details on why a firm was found to be eligible or ineligible. SBA officials also stated that bid protest decisions do not include recommendations for suspension and debarment. By failing to hold firms accountable, SBA and contracting agencies have sent a message to the contracting community that there is no punishment or consequences for committing fraud or abusing the intent of the SDVOSB program. The Veterans Benefits, Health Care, and Information Technology Act— which took effect in June 2007—requires VA to maintain a database of SDVOSBs and Veteran Owned Small Businesses (VOSB) so contractor eligibility can be verified. It also requires the VA to determine whether SDVOSBs and VOSBs are indeed owned and controlled by veterans or service-disabled veterans in order to bid and receive VA contracts. Lastly, it requires VA set-aside and sole-source awards be made only to firms that have had their eligibility verified. Currently these controls are being developed to validate eligibility for awarding VA contracts only. At the time the act took effect, VA already maintained an online database, VetBiz Vendor Information Pages, referred to as VA’s VetBiz database, in which nearly 16,500 firms had self-certified as SDVOSBs or VOSBs. VA began accepting applications to validate eligibility for the SDVOSB program from firms registered in the database in May 2008, after it published guidelines for the verification program in an interim final rule. To date, VA’s validation process has focused on cross-referencing information submitted by owners with the agency’s own data to confirm majority ownership by veterans or service-disabled veterans. VA also expects to pilot procedures for more detailed reviews of selected firms to verify day-to-day control by a service-disabled or other veteran. According to VA officials, the agency will begin requiring its contracting officers to use the set-aside and sole-source award authorities only with verified SDVOSBs and VOSBs after the agency finalizes rule making related to implementation of these authorities. As of March 2009, these program controls have not been implemented. Until this new program becomes operational, existing VA policy states that firms only have to be registered in VA’s database to receive set-aside or sole-source awards. Currently there are no plans to implement these controls governmentwide. Additional controls that VA plans to develop include its own certification process for prospective SDVOSB businesses. The process is to include a review of documents, validation of the owner’s status as a service-disabled veteran, and potential site visits to businesses bidding on VA SDVOSB contracts. Requiring submission of documents to demonstrate ownership and control of an SDVOSB has some value as a deterrent—ownership documents could have prevented instances demonstrated in our case studies where the service-disabled veteran was receiving less than 51 percent of the profits. The most effective preventive controls involve the verification of information, such as verifying service-disabled status with the VA’s database and service-disabled veteran participation in the business through an unannounced site visit. Verification of service- disabled veteran status by using the VA’s database could have prevented the most egregious example of fraud where the owner was not even a service-disabled veteran. Although VA’s proposed system was not intended for governmentwide use, once the certification system is in place, all SDVOSBs wishing to do business with VA will have to be certified. The SDVOSB program does not have effective governmentwide fraud- prevention controls in place and is vulnerable to fraud and abuse. In just the 10 cases we show in this report, the consequences of this lack of control include approximately $100 million of sole source and set aside SDVOSB contracts to companies that have figured out how to manipulate the current system. Even the few companies identified as ineligible through the bid-protest system face no real consequences, in times being allowed by the government to complete the contract they obtained through fraudulent representations. Victims of the fraud and abuse in this program are the legitimate service-disabled veterans and their firms. SBA’s only requirement is a “self-certification” process, whereby SDVOSB concerns self-certify their eligibility. However, VA has begun to develop a process for certifying the eligibility of SDVOSB firms prior to contract award, but that process currently only relates to firms bidding on VA SDVOSB contracts. To address governmentwide vulnerabilities we identified, an effective governmentwide process is necessary to certify the eligibility of all firms bidding on SDVOSB contracts. To be effective, this process should include coordination between the different agencies with the authority to improve program controls, and some form of punishment, such as prosecution, suspension, and debarment of fraudulent individuals and their companies. Our work documents numerous cases where the current governmentwide self-certification system over the SDVOSB program has allowed ineligible firms to receive millions of dollars in federal contracts. However, through the Veterans Benefits, Health Care, and Information Technology Act of 2007, Congress required VA to maintain a database of SDVOSBs, determine whether SDVOSBs are indeed owned and controlled by service-disabled veterans, and required VA set-aside and sole-source awards be made only to firms that have had their eligibility verified. Currently, the only efforts to put fraud prevention controls in place are at VA through their VetBiz program, which applies only to VA contracts. Given that outside of VA there is no verification program in place for SDVOSB contracting, Congress should consider providing VA with the authority and resources necessary to expand its SDVOSB eligibility verification process to all contractors seeking to bid on SDVOSB contracts governmentwide. In an effort to minimize the potential for fraud and abuse in the Service- Disabled Veteran-Owned Small Business (SDVOSB) program and to assure that legitimate service-disabled veterans and their firms reap the benefits of this program, we recommend that the Administrator of the Small Business Administration (SBA) and the Secretary of the Veterans Affairs (VA) coordinate with the Office of Federal Procurement Policy (OFPP) to explore the feasibility of expanding the use of the VA VetBiz “verified” database governmentwide for purposes of validating all SDVOSB eligible firms for contracting and, requiring that all contractors who knowingly misrepresent their status as an SDVOSB be debarred for a reasonable period of time. In addition, we recommend the Administrator of SBA refer all SDVOSB firms that submit misrepresentations of their status to SBA’s Office of Inspector General for review and further investigation. SBA and VA provided general observations and technical comments in response to a draft of this report. They also responded directly to our recommendations. Their responses are included in appendixes II and III. We have made revisions based on the observations and technical comments where appropriate. In response to our recommendations, VA generally agreed with our two recommendations. In its response VA expressed that specific authority would be required for other agencies to be able to rely on the department’s VetBiz database and exclude firms from acquisitions if not “verified” in this database. We recognize that additional authority may be required for other federal agencies to rely on certifications made in VA’s VetBiz database, and have raised this issue in our matter for congressional consideration. In addition, VA stated that governmentwide applicability of authority for federal agencies, other than VA, to initiate debarment actions related to acquisitions for any firms that misrepresent information on the status of that firm as a small business owned and controlled by veterans or service-disabled veterans would require OFPP to seek a revision to the Federal Acquisition Regulation to add SDVOSB status misrepresentation as a cause for debarment. Our recommendation concerning coordination between VA, SBA, and OFPP addresses this concern. SBA’s response, provided by the Associate Administrator for Government Contracting and Business Development, generally agreed with our recommendations; however, in its general observations and specific responses to our recommendations, SBA stated that they have limited responsibilities over the SDVOSB program and questioned the efficacy of one of our recommendations. Specifically, SBA stated that agency contracting officers bear the primarily the responsibility for ensuring only eligible SDVOSB firms perform SDVOSB set aside and sole source contracts. SBA also stated it is only authorized to perform eligibility reviews in a bid protest situation, and contracting officers, not SBA, are responsible for taking appropriate action after a bid protest decision is made. The Associate Administrator maintained that SBA was under no legal obligation to create a protest process for the SDVOSB program, and that its only statutory obligation is to report on other agencies’ success in meeting SDVOSB contracting goals. In addition, SBA expressed that it was not obligated to institute any type of fraud prevention controls within the SDVOSB program. While we acknowledge that there are shared responsibilities between SBA and agency contracting officers when attempting to prevent fraud in the SDVOSB program, we do not agree that SBA does not have responsibility or authority to develop and implement a process to provide reasonable assurance that only eligible SDVOSB firms are awarded set aside and sole source SDVOSB contracts. Specifically, its statutory responsibilities date back to December 2003, when the Veterans Benefits Act of 2003 amended the Small Business Act to provide that “ules similar to the rules of paragraphs (5) and (6) of Section 8(m)” shall apply to the SDVOSB program. Indeed, in an interim final rule implementing that section of the act, SBA acknowledged that it is statutorily authorized to administer the SDVOSB program. Classified to section 637 of Title 15 of the United States Code, the provisions in section 8(m) of the Small Business Act specifically require the Administrator of SBA to establish procedures relating to the “filing, investigation, and disposition of any challenge of the eligibility of a small business concern … and the verification … of the accuracy of any certification made or information provided to the Administrator by a small business.” To implement these verification procedures, SBA is authorized to conduct program examinations, including random examinations, of any certification made or information provided to the Administrator. To carry out its verification responsibilities, SBA is authorized to obtain information from any federal agency or department that the Administrator determines is necessary. In the event that the Administrator determines that an entity has misrepresented its status, that entity is subject to certain penalties. Given this specific legislative authority and responsibility, we believe that, contrary to its assertion, SBA has an obligation to assist in development and implementation of a verification process for the SDVOSB program to provide reasonable assurance that sole source and set aside SDVOSB contracting opportunities are only provided to eligible SDVOSB firms. In response to our first recommendation, SBA questioned the efficacy of expanding the use of VA’s VetBiz verified database governmentwide to verify the eligibility of SDVOSB firms for the program because of the self- certification nature of the program. We believe that the expansion of VA’s verification process to all SDVOSB contractors attempting to bid on federal contracts would provide assurances that only eligible SDVOSB firms receive the benefits of the special contract opportunities established by the SDVOSB program. We believe this verification is especially important given that the current set of controls over the SDVOSB program consist primarily of self-certifications made by contractors, as SBA represented in their response to a draft of this report. In SBA’s other response to our first recommendation, SBA stated that it is the contracting officer’s responsibility to enforce or pursue suggested penalties for firms who knowingly misrepresent their status as an SDVOSB firm. As stated above, we agree that there is a shared responsibility for prevention, detection, and punishment of fraud and abuse in the program between agency contracting officers and the SBA. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. We will then send copies of this report to interested congressional committees, the Administrator of SBA, the Secretary of VA, and other interested parties. The report will also be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To identify examples of firms that received Service-Disabled Veteran Owned Small Business (SDVOSB) contracts through fraudulent or abusive eligibility misrepresentations, we reviewed SDVOSB contract awards and protests filed with the Small Business Administration (SBA) since the programs inception in 2003. We also reviewed allegations of fraud and abuse sent to our fraud hotline, FraudNET. In addition, we posted inquiries on our Web page and on various veteran advocacy-groups’ Web pages and newsletters seeking information on fraud or abuse of the SDVOSB program. We received over 100 allegations of fraud and abuse in the SDVOSB program. From these sources, we selected 10 cases for further investigation based on a variety of factors, including facts and evidence provided in protests and allegations, whether a firm received multiple SDVOSB contracts, and whether a firm received other non- SDVOSB contracts. For the purposes of our investigation, we defined a case as one or more affiliated firms or joint ventures that obtained an SDVOSB contract. These cases include multiple firms owned by an individual or multiple firms affiliated through joint ventures and other types of partner agreements. To investigate these case studies, we interviewed firm owners and managers and reviewed relevant documentation, such as business filings and tax returns, to determine if SDVOSB eligibility requirements had been met. We also analyzed data from Federal Procurement Data System–Next Generation (FPDS-NG) for years 2003 through 2009 to identify SDVOSB contracts received by the firms since the program’s inception. Furthermore, we reviewed certifications made by firms, such as certifications about a firm’s size, SDVOSB status, and line of business, in the federal government’s Online Representations and Certifications Application (ORCA). To assess overall program vulnerabilities, we reviewed relevant laws and regulations governing the SDVOSB program. Our work was not designed to identify all firms that misrepresent themselves as SDVOSBs or commit fraudulent or abusive activity in the SDVOSB program. Our work also did not attempt to identify fraud and abuse in SDVOSB subcontracts. Our work focused on determining whether selected firms met program eligibility requirements. In addition, our 10 case-study examples cannot be projected to the overall population of SDVOSB firms. To determine whether the program has effective fraud-prevention controls in place, we interviewed agency officials from SBA, the Department of Veterans Affairs (VA), and various agency contracting officials about their responsibility over the program and controls currently in place to prevent, detect, and monitor fraud and abuse. We also reviewed information from the Federal Register—The President’s Executive Order, the Federal Acquisition Regulation (FAR), United States Code, and SBA guidance on government contracting programs to determine the extent to which SBA and awarding agencies are required to verify contractor eligibility for SDVOSB contracts. Furthermore, we compared current controls in the SDVOSB program to a fraud-prevention model developed by GAO and utilized in prior small business contracting investigations. In addition to the individual named above, Gary Bianchi, Bruce Causseaux, Randy Cole, Victoria De Leon, Ken Hill, John Ledford, Deanna Lee, Barbara Lewis, Vicki McClure, Jonathan Meyer, Andrew O’Connell, George Ogilvie, Gloria Proa, Barry Shillito, and Abby Volk also provided assistance on this report.

Summary: The Service-Disabled Veteran-Owned Small Business (SDVOSB) program is intended to provide federal contracting opportunities to qualified firms. In fiscal year 2007, the Small Business Administration (SBA) reported $4 billion in governmentwide sole source and set aside SDVOSB contract awards. Given the amount of federal contract dollars being awarded to SDVOSB firms, GAO was asked to determine (1) whether cases of fraud and abuse exist within the SDVOSB program, and (2) whether the program has effective fraud-prevention controls in place. To identify whether cases exist, GAO reviewed SDVOSB contract awards and protests since 2003, and complaints sent to our fraud hotline. GAO defined a case as one or more affiliated firms who were awarded one or more SDVOSB contracts. To assess fraud-prevention controls, GAO reviewed laws and regulations and conducted interviews with SBA and Department of Veterans Affairs (VA) officials. GAO did not attempt to project the extent of fraud and abuse in the program. GAO found that the SDVOSB program is vulnerable to fraud and abuse, which could result in legitimate service-disabled veterans' firms losing contracts to ineligible firms. The 10 case-study firms identified in this report received approximately $100 million from SDVOSB contracts through fraud or abuse of the program, or both. For example, contracts for Hurricane Katrina trailer maintenance were awarded to a firm whose owner was not a service-disabled veteran. GAO also found SDVOSB companies used as a pass-through for large, sometimes multinational corporations. In another case a full-time federal contract employee at MacDill Air Force Base set up a SDVOSB company that passed a $900,000 furniture contract on to a company where his wife worked, which passed the work to a furniture manufacturer that actually delivered and installed the furniture. GAO found that the government does not have effective fraud-prevention controls in place for the SDVOSB program. Specifically, SBA and agencies awarding SDVOSB contracts do not have processes in place to validate a firm's eligibility for the program prior to bid submission. SBA and contracting agencies also currently do not have a database of individuals that are service-disabled veterans, a key eligibility requirement for the program. According to VA, it is developing a database, called VetBiz, of validated SDVOSBs, but currently it is only used for contracting by the VA. SBA's bid-protest process is the only governmentwide control over the SDVOSB program. However, although ineligible firms have been identified through bid protests, firms found ineligible do not face real consequences, can be allowed to complete the contracts received, and are not suspended or debarred.