Federal regulations set requirements for a small business to qualify as an SDVOSB. SDVOSB eligibility regulations mandate that a firm must be a small business and at least 51 percent-owned by one or more service- disabled veterans who control the management and daily business operations of the firm. Federal statutes and the Federal Acquisition Regulations (FAR) require all prospective contractors to update the ORCA to state whether their firm qualifies as an SDVOSB. Additionally, the SDVOSB, as a contractor, is required to register in CCR. Contracting officials are required to check CCR, which includes information such as a firm’s status as an SDVOSB, prior to awarding most federal contracts, including an SDVOSB set-aside or sole-source contract. Once an SDVOSB receives a contract, SDVOSB regulations also place restrictions on the amount of work that can be subcontracted. Once CVE verifies a business, it sends an approval letter to the firm. Under regulations first promulgated in 2008, firms retained their eligibility status for 1 year from the date of the letter. However, on June 27, 2012, VA issued updated regulations extending the eligibility period to 2 years before reverification is required. SDVOSB status are required by law to be debarred from contracting with VA for a reasonable period of time, as determined by VA. Additionally, VA regulations state that if a firm or owner is currently debarred or suspended, or is delinquent or in default on significant financial obligations owed to the federal government, then the firm or owner is ineligible for VA’s VetBiz verification program. Federal law has established government-wide goals for specific types of small businesses to receive a percentage of the total value of all prime- contract and subcontract awards for each fiscal year. The statutorily- of all mandated goal for SDVOSB participation is not less than 3 percent federal contract dollars awarded each fiscal year. SBA stated in its most recent report that, in fiscal year 2010, $10.8 billion in small-business obligations were awarded to firms that self-certified themselves in the CCR as SDVOSBs. DOD SDVOSB contracts accounted for $5.3 billion or 49 percent of government-wide SDVOSB contracts during fiscal year 2010, and VA SDVOSB contracts accounted for $3.2 billion, or 30 percent during the same period. Figure 1 summarizes the federal contracts awarded in fiscal year 2010 by federal agencies. Since 2009, GAO has issued nine reports or testimonies on the SDVOSB program, focusing on its vulnerability to fraud and abuse, and agencies’ actions to prevent contracts from going to firms that misrepresent themselves as SDVOSBs. When discussing the SDVOSB program, we have shown that a well-designed fraud-prevention system should consist of three crucial elements: (1) up-front preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. Figure 2 below outlines the key aspects of an effective fraud-prevention framework. The most effective and most efficient part of a fraud-prevention framework involves the institution of rigorous controls at the beginning of the process. At a minimum, preventive controls for the SDVOSB program should be designed to verify that a firm seeking SDVOSB status is eligible for the program. Even with effective prevention controls, there is residual risk that firms that appeared to meet SDVOSB program requirements initially will violate program rules once they obtain contracts. This fact makes effective monitoring and detection controls essential in a robust fraud-prevention framework. Detection and monitoring efforts include activities such as periodic reviews of suspicious firms and evaluating firms to provide reasonable assurance that they continue to meet program requirements. Finally, fraud-prevention controls are not fully effective unless identified fraud is aggressively prosecuted or companies are suspended, debarred, or otherwise held accountable, or both. VA has made numerous conflicting statements about its progress verifying firms listed in VetBiz under the more-thorough process the agency implemented in response to the 2010 Act. These statements indicate that VA has taken an inconsistent approach to prioritizing the verification of firms and has been unable to accurately track the status of its efforts. Specifically, at the close of our audit work, documentation provided by VA indicated that thousands of SDVOSBs listed as eligible in VetBiz received millions of dollars in SDVOSB sole-source and set-aside contract obligations even though they had not been verified under the more-thorough process implemented in response to the 2010 Act. At that time, VA told us it planned to remove all firms that had their 1-year verification period expired and had not provided documentation for reverification under the 2010 Act process. Since then, on June 27, 2012, VA implemented an interim final rule that extends the eligibility of verified firms to 2 years, including firms for which the eligibility period had expired but that had not yet been reverified. Extending the eligibility period may allow VA to focus its efforts on more thoroughly verifying firms that were previously verified under VA’s less-stringent 2006 Act process. However, the extension also allows thousands of firms to continue to be eligible for contracts even though they have not undergone the more-thorough process. With regard to our previous work, VA has taken some positive action to enhance its fraud prevention efforts by establishing processes in response to 6 of 13 recommendations we issued in October 2011. VA has also begun action on some remaining recommendations. VA has provided a number of conflicting statements and explanations related to the status of its verification program, indicating that it is having difficulty tracking its inventory of firms and whether they were verified under the process implemented to carry out the 2010 Act. As we previously stated, the process VA implemented to review firms under the 2006 Act consisted of checking whether a firm’s owner was listed in VA’s database of service-disabled veterans and conducting searches on publicly available websites such as the EPLS, which lists firms that have been debarred from doing business with the federal government. In contrast, VA stated that it implemented a more-thorough verification process under the 2010 Act that included unannounced and announced site visits and a review and analysis of company documentation. Although the 2010 Act did not include a date by which VA must complete the verification of firms, within 60 days of the law’s enactment VA was required to notify all unverified firms listed in its VetBiz database about the need to apply for verification by submitting documents to establish veteran ownership and control. Firms were required to do so within 90 days of receipt of the notification in order to avoid removal of the firm from VetBiz. VA officials told us that the agency prioritized its verification under the process implemented in response to the 2010 Act by reviewing (1) new applications for firms that had previously only self-certified in VetBiz (i.e., firms that had not been reviewed under the processes VA created for the 2006 Act or 2010 Act); (2) new firms that had initially applied for verification after the 2010 Act, to include reprocessing any firms that were denied through the new requirements and subsequently requested reconsideration; and (3) applications for firms initially verified in VetBiz under the process VA chose to implement for the 2006 Act. However, our review of information provided by VA raises concerns about the status of this process and whether VA knows how many of its firms have actually been verified under the processes implemented in response to the 2010 Act. In one communication, VA stated that as of February 2011, VA’s 2006 Act verification process had been discontinued, and all new verifications would use the process implemented in response to the 2010 Act going forward. Because firms would need to reverify 1 year later, this meant that only firms verified under the 2010 Act process should have been in VetBiz as of February 2012. In November 2011, VA reported that it had removed all unverified firms from its database on September 4, 2011. Subsequently, while reviewing new cases involving firms that had received VA SDVOSB contracts, we found instances where firms were not verified under VA’s 2010 Act process, but rather were verified under its 2006 Act process. When we met with VA in February 2012 to discuss our new cases, officials confirmed that there were still firms in VetBiz that had not been through the processes implemented in response to the 2010 Act, but did not explain how many firms still had not gone through the new process. Then, on April 23, 2012, officials told us that they had recently removed thousands of firms from VetBiz because these firms had not supplied the supporting documentation that VA decided was required for verification under the process implemented in response to the 2010 Act; VA indicated that it planned to remove hundreds of additional firms for the same reason. VA has provided conflicting statements about whether these firms received the December 2010 request to supply documentation. Further, over the next month, VA officials provided us with at least seven differing accounts of the number of SDVOSBs verified under the processes implemented for the 2006 Act and 2010 Act, the number of SDVOSBs they planned to remove, and the timing of the removals. VA’s conflicting statements create uncertainty about the status of the agency’s efforts to verify firms under the process implemented for the 2010 Act. Without a clear inventory and methods designed to track the verification process firms have undergone, VA cannot provide reasonable assurance that all firms appearing in VetBiz have been verified as owned and controlled by a veteran or service-disabled veteran. In its agency comments, VA explained these inventory issues by noting (1) the lack of a comprehensive case-management system has created the need for aggregate workarounds and resulted in inconsistent aggregate reporting; (2) the limitations of its current case-management system make it difficult to track the inventory of firms; and (3) as the limitations of the case-management system increase over time, the potential of CVE to lose track of how many firms have been verified also increases. VA also noted that its verification priorities have evolved over time. As of the close of our audit work, the information provided by VA indicated that thousands of potentially ineligible firms remain listed in VetBiz because they have not been verified under the more thorough process implemented for the 2010 Act. Our analysis shows that as of April 1, 2012, 3,717 of the 6,178 SDVOSBs (60 percent) listed as eligible in VetBiz had yet to be verified using the more-thorough verification process. Of these 3,717 firms listed as eligible on April 1, 2012, 134 received a total of $90 million in new VA SDVOSB sole-source or set- aside contract obligations during the 4-month period from November 30, 2011, to April 1, 2012. On May 14, 2012, VA told us that it removed 1,857 of these 3,717 SDVOSBs from April 2 to April 10, 2012, so that they are no longer eligible for VA SDVOSB sole-source and set-aside contracts. According to VA, the remaining 1,860 firms that had not received a review under the 2010 Act process were projected to be removed in July 2012 unless the firms provided adequate documentation supporting their eligibility. VA also stated that these firms were identified as being in “reverification” and no such expired firm was eligible for an actual contract award until the reverification decision had been completed. Since then, on June 27, VA implemented an interim final rule that extends the eligibility of verified firms to 2 years. VA told us it interprets “verified” to include any firm that has been verified under either its 2006 or 2010 Act processes. Therefore, according to the interim rule, as long as a firm is verified under either process and is in its 2-year eligibility period, VA is only authorized to initiate a verification examination if it receives credible evidence calling into question a participant’s eligibility. Furthermore, VA considered firms whose prior 1-year eligibility period had recently expired, but who had not yet been through reverification, to be within the scope of the new rule, thus extending their eligibility another year. Extending the eligibility period may allow VA to focus its efforts on more thoroughly verifying firms that were previously verified under its less-stringent 2006 Act process. However, the extension also allows thousands of firms to continue to be eligible for contracts even though they have not undergone the more-thorough process. For example, according to information provided by VA in its comments, as of July 13, 2012, there are 6,079 SDVOSBs and VOSBs listed in VetBiz. Of these, 3,724 were verified under the more-through process implemented under the 2010 Act and 2,355—over 38 percent--were verified under VA’s less-rigorous 2006 Act process. As VA acknowledges in its agency comments, “the retention of firms verified prior to the 2010 Act increases the possibility awards will go to firms that will not be verified when the more rigorous process is applied.” Moreover, past audits show the risk of providing SDVOSB contracts to firms reviewed under VA’s 2006 Act process. For example, in 2011, VA’s own OIG issued a report that reviewed both SDVOSBs and VOSBs listed in VetBiz and found that 10 of 14 SDVOSBs and VOSBs verified under VA’s 2006 Act process and listed as eligible were in fact ineligible for these respective programs. The report identified several reasons for why these firms were ineligible, including improper subcontracting practices, lack of control and ownership, and improper use of SDVOSB status, among others. Further, the report noted VA’s document-review process under the 2006 Act “in many cases was insufficient to establish control and ownership… in effect allowed businesses to self-certify as a veteran-owned or service-disabled veteran-owned small business with little supporting documentation.” The report goes on to state that VA’s failure to maintain “accurate and current” information in the VetBiz database also exacerbated problems in the verification process. VA’s OIG also used statistical sampling methods to project that (1) $500 million of VA SDVOSB and VOSB contracts were awarded annually to ineligible firms and (2) VA will award about $2.5 billion in SDVOSB and VOSB contracts to ineligible firms over the next 5 years if it does not strengthen its oversight and verification procedures. In October 2011, we issued 13 recommendations to VA related to vulnerabilities in the verification process implemented by VA after the 2010 Act; VA generally concurred with our recommendations. As of June 2012, VA has provided us with documentation demonstrating that it has established procedures in response to 6 of these recommendations. Figure 3 shows the status of the recommendations; more specific information on each recommendation follows the figure. We have not assessed the effectiveness of any of the procedures that VA has established thus far as this is beyond the scope of this report. VA has provided additional guidance and training to the VA contracting personnel on the use of the VetBiz website. In December 2011, VA issued a guidance memo requiring VA contracting personnel to check VetBiz to ensure that a firm is verified both upon receipt of an offer and prior to award. In November 2011, VA also provided training to the contracting personnel on the use of VetBiz. Providing guidance and training to current and new contracting personnel will help to ensure that these staff are aware of the need to check VetBiz prior to awarding a contract. VA has established formal procedures for VA staff to refer suspicious applications to the OIG and provided guidance on what type of cases to refer to the OIG. In April 2012, VA issued procedures for VA staff to use if they identify suspicious information or possible misrepresentations on an application for eligibility during their initial review process. These procedures contain step-by-step instructions for how to notify the OIG about suspicious applications. Specifically, CVE’s “risk team” makes a determination as to whether or not an applicant has intentionally misrepresented its status in an apparent attempt to defraud the government. If the information is credible, the applicant is referred to the VA OIG. If VA OIG accepts the referral, it conducts preliminary inquiries to determine whether a full investigation into criminal activity is warranted. If the OIG declines the investigation, VA can refer the matter to VA’s Debarment Committee, which VA instituted in September 2010 specifically to debar firms that had violated SDVOSB regulations. In addition to these procedures, from November 2011 through January 2012, VA provided three training sessions to the VA staff on the type of red flags to note during the application review. VA has explored the feasibility of validating applicants’ information with third parties. In 2012, VA met with Dun and Bradstreet to explore the feasibility of utilizing their services to validate applicants’ information, such as names and titles of business owners. Validating applicants’ information with third parties may help enhance VA’s ability to assess the accuracy of self-reported information. VA has formalized a process for conducting unannounced site visits to firms identified as high-risk during the verification process. In June 2012, VA issued procedures for VA to conduct unannounced site visits on a sample of 50 percent of high-risk firms identified during the verification process. Formalizing this process with a focus on high-risk firms may help provide reasonable assurance that only eligible firms gained access to the VetBiz database. VA has developed and implemented a process for unannounced site visits to verified companies to obtain greater effectiveness and consistency in the verification process. VA’s aforementioned June 2012 procedures also apply to verified companies. VA developed a process to select on a weekly basis, based on a combination of random and risk-based factors, verified firms to receive an unannounced site visit. In addition, according to VA it has started making these unannounced site visits. Conducting these site visits may help provide reasonable assurance to VA that the verification process is effective. VA has developed and implemented specific procedures and criteria for staff to make referrals to the Debarment Committee and VA OIG as a result of misrepresentations identified during initial verification and periodic reviews. VA’s aforementioned April 2012 procedures also apply to false information or misrepresentations identified after VA’s initial review of the application, during the firm’s eligibility period. These procedures may increase VA’s success in pursuing firms that have misrepresented their eligibility for the program. VA has not provided regular fraud-awareness training to CVE and VA contracting personnel. One of the most significant challenges to an effective verification program is to have sufficient human capital with proper training and experience. Although VA has not established regular fraud-awareness training, it has made progress in this area. For example, VA told us that its OIG recently provided training on procurement fraud and that its General Counsel provides weekly training on examination procedures and policies in order to educate staff on fraud prevention. In addition, VA said that it has plans to require all CVE staff to attend a fraud examiners course; several CVE staff were already scheduled to attend fraud training in July 2012. Having sufficient human capital with the proper training and experience would enhance the effectiveness of the verification program. VA has not developed and implemented procedures for conducting unannounced site visits to contract performance locations and interviews with contracting officials to better assess whether verified companies comply with program rules after verification. VA has started conducting announced site visits as part of its subcontracting compliance review program. This program is used to determine if a firm is performing in accordance with percentage of work performance requirements and other subcontracting commitments. However, VA has not developed and implemented procedures for conducting unannounced site visits to contract performance locations and interviews with contracting officials. The unannounced site visits and interviews with contracting officials would allow VA to better assess whether verified firms comply with program rules after verification. VA has not developed procedures for risk-based periodic reviews of verified firms receiving contracts to assess compliance with North American Industry Classification System (NAICS) size standards and SDVOSB program rules. In order to be eligible for SDVOSB set-aside and sole-source contracts, a firm must qualify as a small business under NAICS size standards. In draft guidelines, VA included supplemental information for VA staff to review the firm’s NAICS codes size standards, but these guidelines have yet to be finalized. Moreover, the draft guidelines do not include procedures for periodic reviews of verified firms’ compliance with these standards. Such procedures would help improve continued compliance with SDVOSB program rules. VA has not developed and implemented specific processes and criteria for the Debarment Committee on compliance with the requirement in the 2006 Act to debar, for a reasonable period, firms and related parties that misrepresent their SDVOSB status. According to VA, its Debarment Committee relies on procedures outlined in the FAR and the VA Acquisition Regulations to determine the length of debarments. VA has not developed specific guidelines outlining the Debarment Committee’s decision process to debar firms that misrepresent their SDVOSB status. VA should provide the Debarment Committee with guidelines to aid its decision-making process in determining what constitutes a “misrepresentation” deserving of debarment, as that term is used in the 2006 Act. VA has not developed procedures on removing SDVOSB contracts from ineligible firms. According to the VA Acquisition Regulations, the Deputy Senior Procurement Executive has the authority to determine whether VA should terminate a contract with a debarred firm. However, VA has not developed procedures to remove SDVOSB contracts from ineligible firms. According to VA, it is in the process of developing a policy on removing SDVOSB contracts from ineligible firms as determined by status protests. In addition, VA is in the process of providing guidance to the acquisition workforce on removing SDVOSB contracts from ineligible firms. Until VA develops procedures on removing SDVOSB contracts from ineligible firms, the SDVOSB program is at risk for ineligible firms to abuse the program and retain contracts obtained through fraud and abuse. VA has not formalized procedures to advertise debarments and prosecutions. VA has not formalized procedures for advertising debarments and prosecutions, though the Debarment Committee, the OIG, and CVE have listed these actions on their websites. No action has been taken to improve government-wide SDVOSB fraud- prevention controls as the program continues to remain a self-certification program. Because federal law does not require it, SBA does not verify firms’ eligibility status, nor does it require that firms submit supporting documentation. According to SBA, it is only authorized to perform eligibility reviews in a protest situation, including those cases where SBA itself has reason to believe that a firm misrepresented its SDVOSB status. However, without basic checks on firms’ eligibility claims, SBA cannot provide reasonable assurance that legitimate SDVOSBs are receiving government contracts. In fact, five of our new case-study firms received SDVOSB set-aside and sole-source contract obligations, totaling approximately $190 million, of which $75 million were new SDVOSB set- aside and sole-source contract obligations, from October 1, 2009, to December 31, 2011, despite evidence indicating they are ineligible for the program. With regard to our original 10 case-study firms reported in October 2009, some are under investigation by SBA OIG and punitive actions have been taken against others. To address vulnerabilities in the government-wide program, we previously suggested that Congress consider providing VA with the authority necessary to expand its SDVOSB eligibility verification process government-wide. Such an action is supported by the fact that VA maintains the database identifying which individuals are service-disabled veterans and is consistent with VA’s mission of service to veterans. However, such action should not be undertaken until VA demonstrates that its verification process is successful in reducing the SDVOSB program’s vulnerability to fraud and abuse. In our previous work, we found that the SDVOSB program did not have effective government-wide fraud-prevention controls in place and was vulnerable to fraud and abuse.in place for SDVOSB contracting. Because federal law does not require it, SBA and agencies awarding contracts—other than VA—do not have a process in place to validate a firm’s eligibility for the program, and rely on the firms self-certifying as a service-disabled veteran-owned business in CCR. We found the only process in place to detect fraud in the government-wide SDVSOB program involved a formal bid-protest process at SBA, whereby interested parties to a contract award could protest another firm’s SDVOSB eligibility or small-business size. However, we reported that this self-policing process did not prevent ineligible firms from receiving SDVOSB contracts. SBA officials have told us that they have limited responsibility over the SDVOSB program, and that the agency’s only statutory obligation is to report on other agencies’ success in meeting SDVOSB contracting goals. Outside of VA, there was no verification Our new case studies highlight instances of the fraud and abuse that resulted from the lack of verification of firms’ SDVOSB status. In fact, five of our new case-study firms received SDVOSB set-aside and sole-source contract obligations, totaling approximately $190 million from October 1, 2009, to December 31, 2011, despite evidence indicating they are ineligible for the program. Of this $190 million, $75 million were new SDVOSB set-aside and sole-source contract obligations. In four of the cases we examined, we were able to substantiate informants’ allegations of ineligibility as follows: Non-SDVOSB joint venture. An SDVOSB entered a joint venture with a non-SDVOSB firm and received about $16 million in new government-wide SDVOSB set-aside contract obligations. Such joint ventures are eligible if the SDVOSB firm manages the joint venture and the contract work. However, the owner, a service-disabled veteran, admitted to our investigators that his SDVOSB firm did not manage the joint venture. Therefore, the joint venture is ineligible. This firm is currently listed as a SDVOSB in CCR, which allows the firm to compete for government-wide SDVOSB contracts. VA-denied firm. Though VA denied a firm SDVOSB status in 2010 because the firm was not controlled by a service-disabled veteran owner, the firm continued to self-certify in CCR. A VA site visit found the service-disabled veteran worked mostly at another company, and the non-service-disabled veteran vice president controlled the firm. In 2011, when the firm applied for VA verification again, the size of the firm was also questioned as it shared ownership or management with at least four different entities, including companies owned by a non- service-disabled veteran minority owner. The company withdrew its application to be a VA verified SDVOSB. In total, the firm received about $21 million in SDVOSB set-aside and sole-source contracts from DOD, the General Services Administration (GSA), the Department of the Interior (DOI), the U.S. Department of Agriculture and the VA, $16 million of which were new SDVOSB set-aside and sole-source contract obligations. After VA denied the firm, the firm continued to self-certify as a SDVOSB in CCR and GSA, and DOI awarded the firm about $860,000 in new SDVOSB set-aside contracts obligations. This firm is currently listed as a SDVOSB in CCR, which allows the firm to compete for government-wide SDVOSB contracts. Multiple firms not veteran–controlled. A service-disabled veteran and two non-service disabled veteran co-owners owned two firms and a joint venture at the same location. VA found one of the firms ineligible. The operating agreements of two of the firms allowed the two minority owners to control the firms, rather than the service- disabled veteran. Additionally, the joint venture, created by one of the firms, was also ineligible because the service-disabled veteran’s firm did not manage the joint venture and the contract work. Therefore, none of the three firms were eligible for the SDVOSB program. The three firms received over $91 million in SDVOSB set-aside and sole- source contract obligations, about $18 million of which were new SDVOSB set-aside and sole- source contract obligations, from VA and the Department of Health and Human Services. The three firms have been removed from VA VetBiz. However, these firms are currently listed as SDVOSBs in CCR, which allows the firms to compete for government-wide SDVOSB contracts. Not service-disabled veteran–controlled. This firm is ineligible for the SDVOSB program because the veteran does not control the daily operations. The service-disabled veteran was not the Chief Executive Officer, and the firm’s operating agreement did not give the service- disabled veteran the exclusivity to make decisions for the company. In addition, the service-disabled veteran owner lived 500 miles away from the firm, received only $12,000 compared to the non-service- disabled veteran minority owner’s $88,000 salary, and failed to meet or communicate with subcontractors. This firm received about $37 million in SDVOSB set-aside contract obligations, $446,000 of which were new SDVOSB set-aside contract obligations, from DOD and DOI. During the course of our work, SBA and VA found this company ineligible for the SDVOSB program. This firm no longer self-certifies as a SDVOSB in CCR. On May 25, 2012, SBA debarred the non- service-disabled veteran and the firm, making them ineligible for further contracts with the federal government. We were unable to substantiate allegations in a fifth case, but found evidence that the firm in question may be ineligible for the SDVOSB program because the service-disabled veteran owner may not spend sufficient time at the SDVOSB. The service-disabled veteran owner worked as an attorney at a legal services organization Monday through Friday about 40 hours a week, which could prevent the veteran from managing the day-to-day proceedings of the SDVOSB. This firm received about $25 million in new SDVOSB set-aside and sole-source contract obligations from VA and the Department of Transportation. This firm is now listed as verified in VetBiz and is currently listed as a SDVOSB in CCR, which allows the firm to compete for government-wide SDVOSB contracts. The DOD OIG likewise reported that DOD, which awarded about half of government-wide SDVOSB contracts in 2010, did not require adequate verification of contractor status before awarding contracts. After its review of DOD contracts awarded from October 2009 to July 2010, the OIG reported that $1.9 million in SDVOSB contracts went to firms that were not registered in CCR as SDVOSBs and $340.3 million went to contractors that potentially misstated their SDVOSB status. The OIG also found that DOD awarded 12 SDVOSB set-aside and sole-source contracts for a total of $11.5 million to six firms that VA rejected. The OIG went on to recommend that DOD create an SDVOSB verification program, but the agency disagreed, citing an absence of evidence indicating that such a program would produce a net benefit to eligible SDVOSBs, and that Congress had not provided DOD with either the resources or authority to establish such a system. To address the vulnerabilities within the government-wide program caused by reliance on a self-certification process, we suggested in 2009 that Congress consider providing VA with the authority and resources necessary to expand its SDVOSB eligibility verification process to all contractors seeking to bid on SDVOSB contracts government-wide. Such an action is supported by the fact that VA maintains the database identifying which individuals are service-disabled veterans and is consistent with VA’s mission of service to veterans. In 2011, legislation was also introduced and passed in the Senate requiring all agencies to use VA’s VetBiz for SDVOSB contract awards; this legislation has not become law. However, as shown by our current work, VA’s program remains vulnerable to fraud and abuse because the agency has been unable to accurately track the status of its efforts and because potentially ineligible firms remain listed in VetBiz. Consequently, VA’s ability to show that its process is successful in reducing the SDVOSBs program’s vulnerability to fraud and abuse remains an important factor in any consideration about the potential expansion of VA’s eligibility verification process government-wide. GAO has ongoing work that will, in part, examine some of the key issues that need to be addressed if VA’s verification program were to be implemented government-wide. In 2009, we found that ineligible firms in 10 cases received $100 million in SDVOSB contracts and $300 million in other federal contracts. We referred all 10 of these cases to the appropriate agency OIGs. As of April 2012, while none of the firms are currently suspended or debarred by the agencies that received our referrals, some actions have been taken: The SBA OIG is proceeding with six open investigations. In addition, the SBA OIG has joined forces with other agency OIGs to pursue several cases. Specific details cannot be provided until the cases have been fully adjudicated. One individual related to a case is being prosecuted by the U.S. Attorney for wire fraud and fraud against the United States involving a contract valued at $1 million or more related to its misrepresentation as an SDVOSB. In addition, this individual and a related firm were suspended by the Department of Transportation for procurement fraud. One individual related to a case-study is being charged by the U.S. Attorney with conspiracy to commit wire fraud and forfeiture of his assets up to $400,000. This individual allegedly conspired to defraud the SBA and other government contractors by falsely representing his business as a service-disabled veteran-owned and operated business. Another case-study firm pled guilty to wire fraud in relation to fraudulently receiving Historically Underutilized Business Zone (HUBZone) federal contracts.ineligible for the SDVOSB program, in conjunction with the firm’s admitting defrauding the HUBZone program, raises the concern of ineligible firms applying for multiple procurement programs. Our previous finding that the case was Actions taken against firms that violate the SDVOSB program requirements should help protect the government’s interest and help discourage ineligible firms from abusing the SDVOSB program. As previously discussed, providing more emphasis on debarments and investigations could further help the government deter firms from attempting to fraudulently gain access to the SDVOSB program. The SDVOSB program has provided billions of dollars in contracting opportunities to deserving service-disabled veterans. However, our body of work, along with work by the DOD OIG and VA OIG, has found that the program is vulnerable to fraud and abuse, which has allowed millions of dollars to be awarded to ineligible firms. The government-wide program remains particularly vulnerable since it relies on an honor-system-like process whereby firms self-certify their eligibility. VA has the only program within the government dedicated to verifying SDVOSB firms’ eligibility; VA also has responsibility for maintaining a database of service-disabled veterans and a listing of firms that are eligible for the SDVOSB program. Given VA’s mission of service to veterans, we previously suggested that Congress consider expanding VA’s program government-wide to employ more effective fraud-prevention controls over the billions of dollars awarded to SDVOSBs outside of VA. However, such action should not be undertaken until VA demonstrates that its verification process is successful in reducing the SDVOSB program’s vulnerability to fraud and abuse. Furthermore, while the results of this most-recent assessment show that VA has made some progress in improving its verification process in response to the 2010 Act, it has made conflicting statements regarding the verification of firms and has been unable to accurately track the status of its efforts. These problems have resulted in thousands of potentially ineligible SDVOSBs receiving millions of dollars in sole-source and set- aside contract obligations. By better managing its inventory of firms, maintaining the accuracy of firms’ status in VetBiz, and applying the 2010 Act verification process to all firms, VA can be more confident that the billions of dollars meant to provide VA contracting opportunities to our nation’s service-disabled veteran entrepreneurs make it to the intended beneficiaries. To minimize potential fraud and abuse in VA’s SDVOSB program and provide reasonable assurance that legitimate SDVOSB firms obtain the benefits of this program, we recommend that the Secretary of Veterans Affairs ensure that all firms within VetBiz have undergone its 2010 Act verification process. Specifically, this should include consideration of the following three actions: (1) inventory firms listed in VetBiz to establish a reliable beginning point for the verification status of each firm; (2) establish procedures to maintain the accuracy of the status of all firms listed in VetBiz, including which verification process they have undergone; and (3) expeditiously verify all current VetBiz firms and new applicants under the 2010 Act verification procedures. We provided a draft of our report to VA and SBA for comment. In its written comments, reproduced in appendix I, VA stated that it concurred with our first two recommendations. It concurred “in principle” with the third, to verify all current VetBiz firms and new applicants under the processes implemented under the 2010 Act. With respect to this recommendation, VA noted that it implemented an interim rule on June 27, 2012, that extends the eligibility of verified firms to 2 years. VA told us it interprets “verified” to include any firm that has been verified under either its 2006 or 2010 Act processes. Therefore, according to the interim final rule, as long as a firm is verified under either process and is in its 2- year eligibility period, VA is only authorized to initiate a verification examination if it receives credible evidence calling into question a participant’s eligibility. Extending the eligibility period may allow VA to focus its efforts on more thoroughly verifying firms that were previously verified under its less-stringent 2006 Act process. However, the extension also allows thousands of firms to continue to be eligible for contracts even though they have not undergone the more thorough process. We acknowledge that VA has latitude under the law to modify its own regulations as necessary. However, the interim final rule in effect removes a backlog of firms and appears to be a self-created impediment delaying verification under the 2010 Act process. We remain convinced that the verification process utilized by VA prior to the 2010 Act process does not provide reasonable assurance that only eligible SDVOSBs participate in the program. Given this ongoing vulnerability to fraud and abuse, we continue to believe that VA should expeditiously verify current VetBiz firms and new applicants under the 2010 Act verification process. Despite these concurrences, VA commented that our report was misleading and inaccurate with respect to (1) our characterizations of a 2011 VA OIG report, (2) conflicting statements made by VA, and (3) VA’s implementation of our previously issued recommendations. We disagree. First, VA stated that our use of the VA OIG’s 2011 report was misleading because the report examined a period when the VetBiz database included self-certified firms in addition to firms verified under the processes implemented under the 2006 Act. VA also claims the VA OIG report contains excessive extrapolations because it examined eligibility requirements beyond ownership and control. Specifically, VA notes that 14 of the 42 firms reviewed for the OIG report had been through the verification process VA used in response to the 2006 Act and claims that only 3 were determined to be ineligible based on ownership and control. VA’s statement is incomplete and misleading. According to the OIG, an additional 7 were determined to be ineligible for reasons that could be identified during a robust verification process. As a result, the OIG found 10 of 14 firms verified under VA’s 2006 Act process to be ineligible—an eligibility failure rate comparable to the overall eligibility failure rate cited in the report. With regard to the aforementioned 7 firms, the OIG determined they were ineligible because they were engaged in improper subcontracting practices, such as “pass-through” contracts. Pass-through contracts occur when businesses or joint venture/partnerships list veterans or service disabled veterans as majority owners of the business but, contrary to programs requirements, the non-veteran owned business either performed or managed the majority of the work and received a majority of the contracts’ funds. Given that the firms being reviewed by the OIG already had existing contracts in place, the OIG was able to identify the pass-through contracts by conducting site visits and reviewing business documentation, the same steps that VA claims are taken during the verification process it implemented in response to the 2010 Act. While we acknowledge that it is difficult to identify pass-through contracts for applicants to the program who don’t have any preexisting contracts, VA should be conducting such a review for those firms that have contracts in place. As we have noted in past reports, VA’s fraud prevention controls should include detection and monitoring measures to assure that firms are completing the work required of an SDVOSB contract. Second, VA disagrees that it provided numerous conflicting statements to us regarding its verification efforts, stating that the verification process has evolved and that VA faces technical limitations related to its case- management system. While we acknowledge these concerns, it is important to note that VA did not provide us with any explanation as to its evolving priorities during the course of our audit and instead repeatedly sent us contradictory information without any clarification. Moreover, not all of the conflicting statements VA made can be attributed to inadequacies in its case-management system or to evolving priorities. Specifically, the information we received during the course of our audit work changed so significantly over such a short period of time that the evidence GAO collected does not support VA’s assertion that it “knows how many firms have been verified” and can “track individual firms,” as VA claims in its agency comment letter. Examples of the conflicting statements we received include the following: Removal of firms: On April 23, 2012, VA told us that about 900 SDVOSBs and VOSBs listed in VetBiz were targeted for removal because they had not been verified under the 2010 Act process. By April 27, 2012, this number increased to approximately 3,500 SDVOSBs and VOSBs. On May 2, 2012, we received two more differing accounts of SDVOSBs and VOSBs targeted for removal-- 2,660 firms and 2,646 firms--in the same email. Implementation of the 2010 Act process: On February 16, 2012, VA told us that it continued to verify firms under the process implemented under the 2006 Act between January and May 2011. Then, on April 23, 2012, VA told us that it stopped verifying firms under its 2006 Act process in February 2011 and began verification under its 2010 Act process at the same time. Next, on May 12, 2012, VA told us that it stopped verifying firms under the 2006 Act process in January 2011 and began verifying under the 2010 Act at the end of December 2010. In the same communication, VA told us that no firm was approved under its 2006 Act process after February 2011. But on May 21, 2012, VA sent us a list of firms and verification dates showing that multiple firms were last verified under its 2006 Act process past February 2011, with at least two firms verified under iits 2006 Act process as late as May 2011. Finally, VA stated it believed all previous GAO recommendations issued in October 2011 should be closed. For GAO to close a recommendation, it must be implemented or actions must have been taken that essentially meet the recommendation’s intent. Further, the responsible agency must provide evidence, with sufficient supporting documentation, that the actions are being implemented adequately. By the end of our audit work, we were able to close 6 of the 13 recommendations that we issued to VA in October 2011 based on documentation VA provided demonstrating that the agency had taken specific actions in response to our recommendations. Although VA indicated that it would like to close out the remaining recommendations, it either did not demonstrate that it had taken an action to implement a recommendation or did not provide the supporting documentation needed to show that the recommendation was in fact implemented. We had several discussions with VA staff about our requirements for closing recommendations, the last occurring on June 22, 2012. Moreover, we noted in our report any progress VA has made with respect to each recommendation; the information VA provided in this letter had previously been acknowledged in our report. For the 7 recommendations that remain open after the issuance of this report, we will continue to seek from VA additional documentation necessary to demonstrate that implementation has occurred. At such time, we will close each recommendation, as appropriate. In addition, VA provided technical comments, which we addressed as appropriate. We provide annotated responses to VA’s more detailed comments in appendix I. In written comments received through e-mail, SBA stated that it is committed to eliminating fraud, waste, and abuse in all of its programs including the government-wide SDVOSB program. In addition, SBA stated that it maintains a “robust and thorough” protest and appeal process. However, as noted in our report, SBA’s bid-protest process alone—that is, without upfront eligibility verification and other related measures—cannot provide reasonable assurance that only legitimate firms are awarded SDVOSB contracts. In addition, five new case studies developed for this report highlight instances of fraud and abuse. SBA disagreed with the draft report’s portrayal of actions taken against the firms that were the subject of the 10 case studies developed as part of our October 2009 report. We revised our report where appropriate. SBA also stated that it had taken actions against firms in addition to those cited in our case studies, but did not provide specific examples. Finally, SBA stated that it was implementing training to help its staff identify fraud and abuse and working to improve its referral process and collaboration with other agencies. Such efforts could help reduce the SDVOSB program’s vulnerability. However, these efforts would affect only SBA’s investigation and prosecution efforts, and not prevention, detection, and monitoring. If the government-wide program included measures to prevent, detect, and monitor fraud in the SDVOSB program, SBA could be more confident that the billions of dollars meant to provide contracting opportunities to our service-disabled veteran entrepreneurs make it to the intended beneficiaries. We are sending copies of this report to interested congressional committees, the Administrator of SBA, the Secretary of Veterans Affairs, and other interested parties. The report is also available at no charge on the GAO website at http://www.gao.gov. If you have any questions concerning this report, please contact Richard J. Hillman at (202) 512-6722 or hillmanr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. 1. We clarified the report to indicate what the Department of Veterans Affairs (VA) Office of Inspector General (OIG) reported on its findings in 2011 and also to indicate that the report includes all firms in VetBiz, not just those verified under the Veterans Benefits, Health Care, and Information Technology Act of 2006 (2006 Act) process. The remainder of VA’s comments related to the OIG report are inaccurate, based on our review of the report and discussions with VA’s OIG staff. See the Agency Comments and Our Evaluation section of this report for more detail. 2. In the final report, we deleted the draft report’s discussion of information about the Center for Veterans Enterprise (CVE) being responsible for helping veterans who are interested in forming or expanding their own small businesses. 3. Our report’s characterization of the Veterans Small Business Verification Act (2010 Act), part of the Veterans’ Benefits Act of 2010, is correct and we did not make associated changes to the report. While VA’s recommended change points out that VA removed firms that self-represented or had expired eligibility periods, these categories of firms are included by the “all unverified businesses” language in the existing report language. 4. We deleted the sentence stating that SDVOSBs are required to receive a portion of government-wide contractual dollars annually. 5. We have revised our draft report to note that according to VA, (1) the lack of a comprehensive case-management system has created the need for aggregate workarounds and resulted in inconsistent aggregate reporting, (2) the limitations of the case-management system make it difficult to track the inventory of firms, and (3) as the limitations of the case-management system increase over time, the potential of CVE to lose track of how many firms have been verified also increases. We also acknowledge VA’s assertion that its verification priorities have evolved over time. However, not all of the conflicting statements VA made can be attributed to inadequacies in its case-management system or to evolving priorities. One of the many examples relates to the December 2010 request for documentation mentioned in the 2010 Act. Specifically, on April 23, 2012, VA told us that between late March 2012 and early April 2012 it had removed over 3,000 SDVOSBs and VOSBs because these firms had failed to provide requested business documentation. We asked whether the firms removed in April 2012 had been sent this request. In response, VA told us that the firms removed in April 2012 did not receive the December 2010 document. Then on May 12, 2012, VA told us the firms had in fact been sent the December 2010 letter. Later, on June 20, 2012, VA told us that it did not send the December 2010 letter to all firms listed in VetBiz at the time to avoid a flood of applications. In its agency comments, VA states that the 2010 Act did not require it to send all firms listed in VetBiz in December 2010 a request for documentation if the firms had been verified under the 2006 Act and this verification had not yet expired. 6. We revised the text in our draft report to more-clearly reflect that thousands of SDVOSBs listed as eligible in VetBiz received millions of dollars in contract obligations even though they had not been verified under the more-thorough process that VA implemented in response to the 2010 Act. VA’s recommended changes also suggest that firms that were verified under the 2006 Act process could not be immediately reverified under the more-thorough 2010 Act process because, in addition to resource-allocation priorities, VA was limited by the requirements of 38 C.F.R. § 74.15(c). However, we note that VA has latitude under the law to modify its own regulations as necessary to ensure that only valid SDVOSBs are included in VetBiz. Furthermore, VA’s recent decision to amend 38 C.F.R. § 74.15 and extend the VetBiz eligibility term from 1 year to 2 years appears to be a self-created impediment to ensuring all firms expeditiously undergo the more-thorough 2010 Act process. 7. We revised the text in our report to reflect that the 2010 Act required VA to notify all unverified firms about the need to apply for verification. 8. The language VA objects to concerning VA’s prioritization of verifications under the 2010 Act process is taken directly from documentation provided by VA during the course of our audit. Accordingly, we made no changes to the report. 9. The language VA objects to concerning removal of firms is taken directly from oral and written statements made by VA during the course of our audit. Accordingly, we made no changes to the report. 10. The firms mentioned in this footnote are related to one of the new cases we reviewed as a result of allegations we received from confidential informants. These firms were not verified under the process implemented under the 2010 Act and we determined that they were in fact ineligible for the SDVOSB program because the firms’ operating agreements allowed the two minority owners to control the firms, rather than the service-disabled veteran. These firms received approximately $16 million in VA SDVOSB set-aside and sole-source contract obligations from October 2010 to December 2011. Accordingly, we made no changes to the report. 11. We revised our report to make clear that we were referring to verification using the processes implemented under the 2010 Act. 12. We received conflicting statements from VA as to which firms received the December 2010 notification later and have revised the text to clearly reflect this fact. 13. We revised the text in our report to more-clearly reflect that thousands of potentially ineligible firms remain listed in VetBiz because they have not been verified under the more-thorough process implemented for the 2010 Act. While these firms have been verified under the 2006 Act process, past audits show the potential risk of providing SDVOSB contracts to firms reviewed under this process. VA’s recommended change does not acknowledge this risk and is therefore incomplete. Moreover, our statements that were related to the number of firms not verified under the requirements of the 2010 Act, the dollar amounts those firms received, and the number of firms VA planned to remove were all supported by evidence and were accurate at the close of our audit work. We have clarified the report to indicate that fact and included information on the requirements of the interim final rule VA implemented on June 27, 2012. Specifically, in our final report we have noted that the rule extends a firm’s eligibility period for 2 years. We also note that VA interprets “verified” to include any firm that has been verified under either the 2006 Act or 2010 Act processes, meaning that this rule will allow thousands of firms to remain eligible for contracts even though they have not undergone the more- thorough process implemented under the 2010 Act process. See the Agency Comments and Our Evaluation section of this report for a more-thorough discussion of this issue. 14. To this point, VA has not provided sufficient documentation to close the 7 recommendations that remain open. GAO will continue to work with VA to confirm the status of its efforts to address our recommendations and will close recommendations, as long as necessary supporting evidence is provided. 15. Our report states that VA has made progress in the area of fraud- awareness training. However, VA has not provided any documentation to show that fraud-awareness training is being provided on a regular basis, as we recommended. Our recommendation will remain open until necessary evidence to close it is provided. Accordingly, we have not changed the language in our report. 16. The FAR and the VA Acquisition Regulations do not provide specific processes and criteria for the Debarment Committee on compliance with the requirement in the 2006 Act to debar, for a reasonable period of time, firms and related parties that misrepresented their SDVOSB status. VA should provide additional guidance to the Debarment Committee on the specific process and criteria to use to debar firms as required by the 2006 Act. Accordingly we have not changed the language in our report. 17. The recommendation requested that VA develop specific guidelines outlining the Debarment Committee's decision process to debar firms that misrepresent their SDVOSB status. VA needs to provide supporting documentation demonstrating that VA provided the Debarment Committee with the guidance outlining the decision process to debar firms that misrepresent their SDVOSB status. Accordingly, we have not changed the language in our report. 18. VA cites provisions of the FAR and the VA Acquisition Regulations containing guidance for continuing current contracts to firms that were found ineligible through the debarment process. However, our recommendation asked VA to develop procedures to remove SDVOSB contracts from ineligible firms. Accordingly, we have not changed the language in our report. 19. Our report acknowledges that VA advertises the debarments and prosecutions on the Debarment Committee, VA OIG, and CVE websites. However, our recommendation specifically asked for VA to formalize procedures to advertise debarments and prosecutions, and we have not received any documentation related to such procedures. Accordingly, we have not changed the language in our report. Service-Disabled Veteran-Owned Small Business Program: Governmentwide Fraud Prevention Control Weaknesses Leave Program Vulnerable to Fraud and Abuse, but VA Has Made Progress in Improving Its Verification Process. GAO-12-443T. Washington, D.C.: February 7, 2012. Service-Disabled Veteran-Owned Small Business Program: Additional Improvements to Fraud Prevention Controls Are Needed. GAO-12-205T. Washington, D.C.: November 30, 2011. Service-Disabled Veteran-Owned Small Business Program: Additional Improvements to Fraud Prevention Controls Are Needed. GAO-12-152R. Washington, D.C.: October 26, 2011. Service-Disabled Veteran-Owned Small Business Program: Preliminary Information on Actions Taken by Agencies to Address Fraud and Abuse and Remaining Vulnerabilities. GAO-11-589T. Washington, D.C.: July 28, 2011. Department of Veterans Affairs: Agency Has Exceeded Contracting Goals for Veteran-Owned Small Businesses, but It Faces Challenges with Its Verification Program. GAO-10-458. Washington, D.C.: May 28, 2010. Service-Disabled Veteran-Owned Small Business Program: Fraud Prevention Controls Needed to Improve Program Integrity. GAO-10-740T. Washington, D.C.: May 24, 2010. Service-Disabled Veteran-Owned Small Business Program: Case Studies Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of Dollars in Contracts. GAO-10-306T. Washington, D.C.: December 16, 2009. Service-Disabled Veteran-Owned Small Business Program: Case Studies Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of Dollars in Contracts. GAO-10-255T. Washington, D.C.: November 19, 2009. Service-Disabled Veteran-Owned Small Business Program: Case Studies Show Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of Dollars in Contracts. GAO-10-108. Washington, D.C.: October 23, 2009.

Summary: The SDVOSB program provides federal contracting opportunities to business-owning veterans who incurred or aggravated disabilities in the line of duty. SBA administers the government-wide program, while VA maintains databases of veterans and SDVOSBs and oversees its own contracts. GAO has reported several times since 2009 that both programs were vulnerable to fraud and abuse and recommended improvements. In October 2010, Congress passed the Veterans Small Business Verification Act (2010 Act), part of the Veterans Benefits Act of 2010, to provide tools to VA to more-thoroughly validate firms eligibility before listing them in VetBiz, the database used by VA contracting officials to award SDVOSB contracts. GAO was asked to assess (1) VAs progress in addressing remaining vulnerabilities to fraud and abuse in its SDVOSB program and (2) actions taken by SBA or other federal agencies to improve government-wide SDVOSB fraud-prevention controls. GAO reviewed agency documentation and interviewed agency officials. GAO also investigated cases of alleged fraud and abuse. GAO did not project the extent of fraud and abuse in the program. The Department of Veterans Affairs (VA) Service-Disabled Veteran-Owned Small Business (SDVOSB) program remains vulnerable to fraud and abuse. VA has made inconsistent statements about its progress verifying firms listed in VetBiz using the more-thorough process the agency implemented in response to the Veterans Small Business Verification Act (2010 Act). In one communication, VA stated that as of February 2011, all new verifications would use the 2010 Act process going forward. However, as of April 1, 2012, 3,717 of the 6,178 SDVOSB firms (60 percent) listed as eligible in VetBiz had not been verified under the 2010 Act process. Of these 3,717 firms, 134 received $90 million in new VA SDVOSB set-aside or sole-source contract obligations from November 30, 2011, to April 1, 2012. While the 2010 Act did not include a deadline for verification using the more-thorough process, the presence of firms that have only been subjected to the less-stringent process that VA previously used represents a continuing vulnerability. VAs Office of Inspector General (OIG) reported that the less-stringent process was in many cases insufficient to establish control and ownership and in effect allowed businesses to self-certify as SDVOSBs with little supporting documentation. VA has taken some positive action to enhance its fraud prevention efforts by establishing processes in response to 6 of 13 recommendations GAO issued in October 2011, including conducting unannounced site visits to high-risk firms and developing procedures for referring suspicious SDVOSB applications to the OIG. VA has also begun action on some remaining recommendations, such as providing fraud awareness training and removing contracts from ineligible firms, though these procedures need to be finalized. Regarding the government-wide SDVOSB program, no action has been taken by agencies to improve fraud-prevention controls. Relying almost solely on firms self-certification, the program continues to lack controls to prevent fraud and abuse. The Small Business Administration (SBA) does not verify firms eligibility status, nor does it require that they submit supporting documentation. While SBA is under no statutory obligation to create a verification process, five new cases of potentially ineligible firms highlight the danger of taking no action. These firms received approximately $190 million in SDVOSB contract obligations. In one case, a firm found ineligible by VA continued to self-certify as an SDVOSB and received about $860,000 from the General Services Administration and the Department of Interior. Further, the Department of Defense (DOD) OIG reported in 2012 that DOD provided $340 million to firms that potentially misstated their SDVOSB status. To address these vulnerabilities, GAO previously suggested that Congress consider providing VA with the authority necessary to expand its SDVOSB eligibility verification process government-wide. Such an action is supported by the fact that VA maintains the database identifying which individuals are service-disabled veterans and is consistent with VAs mission of service to veterans. However, the problems GAO identified with VAs verification process indicate that an expansion of VAs authority to address government-wide program problems should not be undertaken until VA demonstrates that its process is successful in reducing its own SDVOSB programs vulnerability to fraud and abuse. GAO recommends that VA take steps to ensure that all firms within VetBiz have undergone the 2010 Act verification process. VA generally concurred with the recommendation but expressed concern about how specific report language characterized its program. GAO made some changes to the report but continues to believe that the program remains vulnerable to fraud and abuse.