The results of our investigation serve to emphasize the overall lesson that a complete fraud prevention framework is necessary in order to minimize fraud, waste, and abuse within the SDVOSB program. The most effective and most efficient part of the framework involves the institution of rigorous controls at the beginning of the process for becoming eligible to bid on SDVOSB contracts. Specifically, controls that validate firms’ eligibility, including ownership and control by one or more service- disabled veterans, is the first and most important control. Next, active and continual monitoring of contractors performing SDVOSB contracts is also essential. Given the numerous examples we identified of firms owned by a service-disabled veteran who subcontracted 100 percent of contract work to non-SDVOSB firms, it is essential that program officials monitor compliance with program rules after contract performance has begun. Finally, as shown in our investigation, preventive and monitoring controls are not effective unless identified abusers are aggressively prosecuted and/or face other consequences such as suspension, debarment or termination of contracts and future contract options. The examples we identified of cases where SBA found a firm misrepresented its eligibility for the SDVOSB program, but failed to penalize the firm, undermine the positive effects of the few controls currently in place. Figure 1 provides an overview of how preventive controls serve as the first and most important part of the frame work because they are designed to screen out ineligible firms before they get service-disabled sole source or set-aside contracts. Monitoring controls and prosecution or other consequences also helps minimize the extent to which a program is vulnerable to fraud. Preventive controls are a key element of an effective fraud prevention framework and are also described in the Standards for Internal Controls in the Federal Government. Preventive controls are especially important because they limit access to program resources through front-end controls. Our experience shows that once contracts are awarded and money disbursed to ineligible SDVOSB contractors, it is unlikely that any money will be recovered or even that the contract will be terminated. Preventive controls for the SDVOSB program should, at a minimum, be designed to verify that a firm seeking SDVOSB status is eligible for the program. However, during our investigation, we found that there are no governmentwide controls that verify whether firms who self-certify as SDVOSBs meet program requirements. VA performs some level of validation of contractors claiming to be SDVOSBs that bid on VA contracts, but even that process was primarily based on a review of self- reported data. The key to the validation process within the SDVOSB program must be verifying self-reported contractor data with independent third-party sources. Key data to validate with preventive controls should include whether the owner or owners are service-disabled veterans, whether the service-disabled veteran owner(s) manage and control daily operations, and whether the business qualifies as a small business under the primary NAICS industry-size standards for the SDVOSB contract awarded. Validation of whether a business owner is a service-disabled veteran must be the first step in the SDVOSB prevention framework. Coordination between VA, SBA, and potentially DOD will be necessary to ensure an accurate determination is made. VA already maintains a database of service-disabled veterans, and therefore, it appears that data necessary for this validation are already available. However, during our investigation, we found that 1 of the 10 firms we investigated was owned by an individual who was not a service-disabled veteran, but received more than $7.5 million dollars in Federal Emergency Management Agency (FEMA) contracts. This firm is a prime example of why the relatively simple process of validating an individual’s status as a service-disabled veteran can prevent fraud within the SDVOSB program. In addition to the validation of firm owners’ status as service-disabled veterans, preventive controls should also validate whether firm owners actually manage and control daily operations. This must be accomplished in order to prevent “rent-a-vet” situations where a firm finds a willing service-disabled veteran to pose as the “owner” of a firm while in reality, other ineligible firm members manage and control the daily operations of a business. One case uncovered during our investigation found that the service-disabled veteran owner actually played no part in business operations related to the primary government contracts won by the firm, and worked from home on non-government related contracts. The alleged owner also did not receive any salary from the firm and tax returns showed that he received less in Internal Revenue Service (IRS) 1099 distributions than the 10 percent minority owner. In order to identify these types of situations, controls must utilize a variety of tools including a review of independent third-party information such as individual and company tax returns obtained directly from the IRS. Other processes such as performing unannounced site visits to an applicant’s place of business can provide evidence to indicate management and control of daily operations, whether the firm is a shell company operating with a mail box as an address or a legitimate firm with employees and assets and whether a firm is co-located with another non-SDVOSB firm that will likely perform all contract work. In our previous work, we used unannounced site visits when conducting our investigations of the 10 firms that through various fraudulent schemes, obtained $100 million in service-disabled sole-source and set-aside contracts. Verification of whether a firm meets NAICS’s industry-size standards is another part of preventive controls that can help minimize fraud and abuse within the program. During our investigation, we found that one company had violated small business size standards and received more than $171 million in federal contracts between fiscal years 2003 and 2009. We were able to identify the company’s information through a review of contract obligation information within the Federal Procurement Data System-Next Generation (FPDS-NG). FPDS-NG is a publicly available database that allows a user to search for federal contracts awarded to specific firms. As part of comprehensive preventive controls, a review of these types of databases as well as company IRS tax returns will provide information to ensure a prospective SDVOSB firm is not already a large business. Beyond validation of data and checks with independent third parties, it is also important that personnel performing the validation of a firm’s SDVOSB status are well trained and aware of the potential for fraud. Fraud awareness training with frontline personnel is crucial to stropping fraud before it gains access to the program. Additionally, when implementing any new set of controls, it is important that agencies field test new controls and provide a safety net to deal with firms who feel they were inappropriately rejected from the SDVOSB program. Finally, a properly managed and staffed prevention program should not create a large backlog of legitimate firms attempting to be certified. Unfortunately, as GAO testified at the end of April, VA’s certification program has a large backlog of businesses awaiting site visits and some higher-risk businesses have been verified months before their site visits occurred or were scheduled to occur. Verifying businesses prior to site visits may allow ineligible firms to appear as eligible and to receive SDVOSB set-aside and sole-source contracts. Even with effective preventive controls, there is substantial residual risk that firms that may have appeared to meet SDVOSB program requirements initially will violate program rules after being awarded SDVOSB contracts. Monitoring and detection are not as efficient or effective as prevention because once a contractors are in the program and fraudulently receive a SDVOSB sole-source or set-aside contract, there are few if any consequences if they are caught. Detection and monitoring efforts, which are addressed in the Standards for Internal Control in the Federal Government, include data-mining of transactions and other reviews. Our investigation found cases where firms may have initially been able to meet a program’s eligibility criteria, but subsequently violated subcontracting rules of the program after subcontracting 100 percent of the SDVOSB contract work to a non-SDVOSB firm. Our findings therefore emphasize why it is important for a comprehensive fraud prevention framework to have detection and monitoring controls in place to identify violations. For the SDVOSB program, there are several areas that require periodic review, including monitoring of a firms compliance with industry-size standards and monitoring of the performance of required percentage of work on SDVOSB contracts. In order to confirm that an SDVOSB firm continues to comply with NAICS standards, agencies should periodically data-mine FPDS-NG and other relevant federal procurement data to determine the number and size of contracts awarded and funds obligated to SDVOSB firms. A thorough review of this data is important so that all contacts awarded to a firm or its joint ventures are identified. During our investigation, we found one firm that received more than $171 million in federal funds through more than five different joint ventures. This example shows why data-mining efforts must be creative and thorough in order to effectively prevent fraud. In addition, data mining can also be done to review existing contracts with company information to determine whether a company could reasonably perform contracts given its area of expertise. For example, through data mining we found one firm during our investigation that initially listed its area of expertise as construction. However, the firm had recently been performing multiple janitorial service contracts across the country. While this was not a definite indicator of fraud, subsequent on-site unannounced site visits found that the firm was subcontracting 100 percent of the contract work to an international firm with more than $12 billion in annual revenues. Monitoring of the firms active participation in contracts is another way to ensure SDVOSB program requirements are being met. During our work, we identified cases where firms, which may have initially appeared legitimate on paper, that actually functioning as pass-throughs and subcontracting 100 percent of the work to non-SDVOSB firms. Controls to help identify these situations would include conducting unannounced site visits to contract performance locations and contacting local contracting officers to determine with whom they interact during the contract performance period. In addition, a periodic review of the types of contracts awarded to a firm compared with company information can help identify firms requiring further review. Finally, when fraudulent activity is identified through data mining and monitoring controls, agencies should also use that information to help improve future preventive controls when appropriate. The final element of a comprehensive fraud prevention framework is the aggressive investigation and prosecution of firms that abuse the SDVOSB program or other consequences such as suspension, debarment, and termination of contracts and cancellation of contract options. These back- end controls are often the most costly and least effective means of reducing fraud in a program. However, the deterrent value of prosecuting those who commit fraud sends the message that the government will not tolerate firms that falsely represent themselves as SDVOSB firms. Our investigation found that while the SBA has successfully identified multiple firms that falsely certified themselves as SDVOSB firms, in October of 2009 when we issued our report, SBA had not attempted to suspend or debar the problem firms. In addition, during our investigation, we could not find any examples of referrals for prosecution of these firms to the Department of Justice by the VA or SBA Inspectors General for fraud within the SDVOSB program. In order for the SBA and VA to ensure the highest level of compliance with SDVOSB program requirements, there must be consequences for those firms that chose to fraudulently misrepresent themselves as SDVOSB firms. Agencies have tools available such as suspension, debarment, and removal from the program, termination of contracts and cancellation of future contract options. Finally, as with fraud found through monitoring controls, lessons learned from investigations and prosecutions should be utilized to strengthen controls earlier in the process and improve the overall fraud prevention framework. Our prior investigation into allegations of fraud and abuse within SDVOSB contracts found 10 firms that were ineligible for the program but received approximately $100 million in SDVOSB contracts. Upon completion of our investigation, we referred all 10 cases to various agency officials who had contracts with the firms and to each agency’s IG. Based on our referrals, agencies have taken a variety of actions including the termination of existing contracts, the decision not to extend contract performance by exercising future contract options, and the opening of civil and criminal investigations. IG officials have stated that most of their investigations are ongoing and that therefore, details cannot be provided because of the risk of jeopardizing the investigation. However, in at least one case, the future contract options under a janitorial services contract were not exercised and, the firm was not allowed to perform work beyond the initial contract performance period. In addition, this firm’s subcontractor, which performed 100 percent of the contact work, initiated its own investigation. The subcontractor’s investigation determined one of its employees helped to perpetrate the fraud by creating fictitious documents at the request of the SDVOSB firm’s owner. In another case, the SDVOSB firm was found to be intentionally overcharging a federal agency by inflating the hourly labor rate of unapproved subcontracted employees from a temporary employment agency. Finally, in one case, multiple federal investigative agencies have an ongoing criminal investigation and are working together on a grand jury indictment. Additionally, these 10 case-study firms have received more than $5 million in new contract obligations on SDVOSB sole-source and set-aside contacts and more than $10 million in other new contract obligations since November 2009. Our investigation of the SDVOSB program shows that existing controls are ineffective at minimizing the risk for fraud and abuse. Our 10 cases alone show that approximately $100 million in SDVOSB contracts have gone to ineligible firms. With billions of dollars being spent annually on SDVOSB contracts, agency officials should use lessons learned to implement a comprehensive fraud prevention framework. Controls at each point in the process are the key to minimizing the government’s risk. With a comprehensive framework in place, the government can be more confident that the billions of dollars meant to help provide opportunities to our nation’s service-disabled veterans actually make it to the intended beneficiaries. Mr. Chairman and Members of the Subcommittee, this concludes my statement. I would be pleased to answer any questions that you or Members of the Subcommittee have at this time. For additional information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Service-Disabled Veteran-Owned Small Business (SDVOSB) program is intended to provide federal contracting opportunities to qualified firms. In fiscal year 2008, the Small Business Administration (SBA) reported $6.5 billion in sole-source, set-aside, and other SDVOSB contract awards. Testimonies GAO delivered on November 19 and December 16, 2009 identified millions of dollars in SDVOSB contracts that were awarded to ineligible firms, and weaknesses in fraud prevention controls at the SBA and VA which allowed ineligible firms to receive contracts. GAO was asked to testify about the key elements of a fraud prevention framework within the SDVOSB program and to provide an update on the status of fraud referrals made based on the prior investigation of selected SDVOSB firms. To address these objectives, GAO reviewed prior findings from audits and investigations of the SDVSOB program and contacted investigative agency officials concerning the referrals GAO made on prior work. GAO also reviewed applicable guidance on internal control standards from the Comptroller General's Standards for Internal Controls in the Federal Government. GAO founda lack of government-wide prevention controls, a lack of validation of information provided by SDVOSB firms used to substantiate their eligibility for the program, non-existent monitoring of continued compliance with program requirements, and an ineffective process for investigating and prosecuting firms found to be abusing the program. The results of GAO's investigation serve to emphasize the overall lesson that a complete fraud prevention framework is necessary in order to minimize fraud, waste, and abuse within the SDVOSB program. The most effective and most efficient part of the framework involves the institution of rigorous controls at the beginning of the process for becoming eligible to bid on SDVOSB contracts. Next, active and continual monitoring of contractors performing SDVOSB contracts is also essential. Given the examples GAO identified of firms owned by a service-disabled veteran who subcontracted 100 percent of contract work to non-SDVOSB firms, it is essential that federal agencies monitor compliance with program rules after contract performance has begun. Finally, as shown in GAO's investigation, prevention and monitoring controls are not effective unless identified fraud is aggressively prosecuted or companies are suspended, debarred or otherwise held accountable. GAO's prior investigation into allegations of fraud and abuse within SDVOSB contracts found 10 firms that were ineligible for the program but received approximately $100 million in SDVOSB contracts. Upon completion of its investigation, GAO referred all 10 cases to various agency officials who had contracts with the firms, and each agency's Inspector General (IG). Based on the referrals, agencies have taken a variety of actions including the cancellation of existing contracts, termination of future contract options, and opening of civil and criminal investigations. IG officials have stated that many of their investigations are ongoing, and therefore details cannot be provided due to the risk of jeopardizing the investigation. These 10 companies have obtained over $5 million in new SDVOSB sole-source and set-aside contact obligations since November 2009.