The Small Business Reauthorization Act of 1997 sets a governmentwide goal for small business participation of not less than 23 percent of the total value of all prime contract awards––contracts that are awarded directly by an agency––for each fiscal year. This act also sets goals for participation by specific types of small businesses (see table 1). The statutorily mandated, governmentwide prime and subcontracting goal for SDVOSBs is 3 percent of all federal contract dollars. There is no governmentwide numerical goal for VOSBs. The 2006 Act provided VA with unique authority to award contracts to VOSBs and SDVOSBs on a priority basis to increase contracting opportunities for these businesses. This authority, referred to in this report as the “goals and preferences authority,” applies only to VA. Among other things, the 2006 Act requires VA to establish annual contracting goals for VOSBs and SDVOSBs not less than the governmentwide goal and to give preference to these businesses when awarding contracts. In FY07, VA set prime contracting goals of 7 percent for VOSBs and 3 percent for SDVOSBs. VA increased these goals for FY08 and FY09, to 10 percent for VOSBs and 7 percent for SDVOSBs. The law also requires VA to maintain a database of verified VOSBs and SDVOSBs and to confirm subcontract awards that it counts toward its small business goals. While the Federal Acquisition Regulation (FAR) is the overall governmentwide regulation governing agency acquisitions, the Veterans Affairs Acquisition Regulation (VAAR) governs acquisitions made under the 2006 Act. Under the VAAR, preference for awarding contracts must be made in the following order of priority: (1) SDVOSBs, (2) VOSBs, (3) HUBZones or 8(a) businesses, and (4) any other small business contracting preference. VA’s Office of Small and Disadvantaged Business Utilization (OSDBU), in conjunction with its Office of Acquisition and Logistics (OAL), is responsible for the development of policies and procedures to implement and execute the contracting goals and preferences under the 2006 Act. Additionally, OSDBU serves as VA’s advocate for small business concerns; provides outreach and liaison support to businesses (large and small) and other members of the private sector for acquisition-related issues; and is responsible for monitoring VA’s implementation of socioeconomic procurement programs, such as encouraging contracting with women- owned small businesses (WOSB) and HUBZone businesses. OSDBU is responsible for the development of VA policies and programs related to small business concerns, including the following: educating and training VA staff, including advising contracting officials on procurement strategies to ensure equitable opportunities for small business concerns; negotiating prime and subcontracting goals; and training, counseling, and assisting small businesses in their understanding of federal and agency procurement procedures, including advising businesses on marketing their products and services to VA and other federal agencies. The Center for Veterans Enterprise (CVE), within OSDBU, seeks to help veterans interested in forming or expanding their own small businesses. CVE also helps VA contracting offices identify veteran-owned small businesses and works with SBA’s Veterans Business Development Officers and Small Business Development Centers on veterans’ business financing, management, and technical assistance needs. Additionally, CVE is responsible for implementing VA’s verification program and maintains the database, known as VetBiz.gov, of verified businesses required by the 2006 Act. VetBiz.gov allows business owners to register and apply online for verification to CVE and also functions as a searchable database for contracting officers and the public. Once CVE approves a business, the business name appears with a verified logo within the database (see app. II for more information). Once verified, a firm retains that status for 1 year. VA exceeded its VOSB and SDVOSB contracting goals since FY07 and made significant use of its veteran preferences authorities but faces challenges in continuing to meet its other small business contracting goals and monitoring interagency agreements. For example, VA’s continued success in contracting with VOSBs and SDVOSBs has coincided with difficulties in meeting other small business goals, such as WOSB and HUBZone goals. Beginning January 1, 2009, agreements into which VA enters with federal agencies to acquire goods or services on VA’s behalf must include language requiring the agencies to comply, to the maximum extent feasible, with VA’s VOSB and SDVOSB contracting goals and preferences when acquiring goods or services. We found that one interagency agreement into which VA entered after January 1, 2009, did not contain the required language. VA does not have an effective process in place to ensure that all interagency agreements include the required language. Without an effective process to review interagency agreements for the required language, VA may not fully comply with the requirements of the 2006 Act and cannot be assured that the agencies in its interagency agreements are aware of the need to make maximum feasible efforts to contract with VOSBs and SDVOSBs. For FY07, VA established a contracting goal for VOSBs at 7 percent––that is, VA’s goal was to award 7 percent of its total procurement dollars to VOSBs. In FY07, VA exceeded this goal and awarded 10.4 percent of its contracting dollars to VOSBs (see fig. 1). VA subsequently increased its VOSB contracting goals to 10 percent for FY08 and FY09 and exceeded those goals as well––awarding 14.7 percent of contracting dollars to VOSBs in FY08 and 19.7 percent in FY09. For FY07, VA established a contracting goal for SDVOSBs equivalent to the governmentwide goal of 3 percent and exceeded that goal by awarding 7.1 percent of its contracting dollars to SDVOSBs (see fig. 2). VA subsequently increased this goal to 7 percent for FY08 and FY09 and exceeded the goal in those years as well. Specifically, VA awarded 11.8 and 16.7 percent of its contracting dollars to SDVOSBs in FY08 and FY09, respectively. In nominal dollar terms, VA’s contracting awards to VOSBs increased from $1.2 billion in FY07 to $2.8 billion in FY09, while at the same time, SDVOSB contracting increased from $832 million to $2.4 billion (see table 2). The increase of awards to VOSBs and SDVOSBs largely was associated with the agency’s greater use of the goals and preferences authorities established by the 2006 Act. For example, veteran set-aside and sole- source awards represented 39 percent of VA’s total VOSB contracting dollars in FY07. However, in FY09, VA’s use of these veteran preferences authorities increased to 59 percent of all VOSB contracting dollars. In nominal dollar terms, VA’s use of these veteran preferences authorities increased by $1.2 billion over the past 3 years (see fig. 3). VA’s use of set-aside and sole-source awards for SDVOSBs contributed to an even greater extent to the increase in awards to these businesses from FY07 through FY09. For each of these years, more than 90 percent of contracts to SDVOSBs were awarded through set-aside and sole-source mechanisms (see fig. 4). Additionally, as of February 2010, almost all contracting officers (93 percent) had received training on the goals and preferences authorities. According to VA officials and documents, the training includes guidance on VA’s final rule implementing the 2006 Act; the contracting order of priority; set-aside and sole-source procedures; market research procedures for VOSB and SDVOSB businesses; and guidelines applying to subcontracting, joint ventures, and interagency acquisition agreements. OAL continued training contracting officers in March 2010. In contrast, VA’s use of general contracting authorities––that is, governmentwide contract mechanisms to provide a simplified process for acquiring goods––for VOSBs (including SDVOSBs) consistently decreased from FY07 through FY09. For example, VA’s use of its other contracting authorities decreased from 52 percent of all VOSB (including SDVOSB) contracts in FY07 to 38 percent in FY09. In FY09, VA awarded $1.1 billion in contracting dollars to VOSBs without the use of any set-aside or sole- source mechanisms. In these cases, the majority of these awards were made using governmentwide contracts, such as the Federal Supply Schedule (FSS), and governmentwide agency contracts. See appendix III for more detailed information on the contracting dollars and percentages that VA awarded to VOSBs in FY07 through FY09. According to SBA’s Goaling Program, a small business can qualify for one or more small business categories, and an agency may take credit for a contract awarded under multiple goaling categories. For example, if a small business is owned and controlled by a service-disabled woman veteran, the agency may take credit for awarding a contract to this business under the VOSB, SDVOSB, and WOSB goaling categories. In addition, all awards made to SDVOSBs also count toward VOSBs goal achievement. In FY09, of the $2.8 billion awarded to VOSBs, the majority (63 percent) applied to both VOSBs and SDVOSBs and no other goaling category (see fig. 5). Furthermore, of the $1.7 billion awarded through the use of veteran preferences authorities (VOSB and SDVOSB set-aside and sole-source) in FY09, an even greater majority (77 percent) applied solely to the VOSB and SDVOSB goaling categories (see fig. 5). Although VA exceeded its contracting goals for VOSBs and SDVOSBs in FY07 through FY09, it did not meet its goals in other small business categories for that period. For example, VA’s contracting with WOSBs and HUBZone businesses decreased since the implementation of the 2006 Act (see fig. 6). More specifically, VA contracting with WOSBs decreased from $584 million in FY07 to $488 million in FY09. Additionally, VA contracting with HUBZone businesses decreased from $388 million in FY07 to $305 million in FY09. Furthermore, for the past 2 years VA failed to meet its 5 percent goal for WOSBs (see fig. 7). In FY08, VA’s total contracting dollars with WOSBs was 4 percent, and, in FY09, it was 3.4 percent. Additionally, VA failed to meet its 3 percent goal for contracting with HUBZone businesses for the past 2 years. For example, VA awarded 2.8 percent of its contracting dollars to HUBZone businesses in FY08, and awarded 2.1 percent in FY09. VA officials acknowledged that the implementation of the contracting priority required by the 2006 Act has led to a decrease in awards to WOSB and HUBZone businesses. As we have previously stated, VA’s regulations implementing the 2006 Act require contracting officers to award contracts according to the following order of priority: (1) SDVOSBs, (2) VOSBs, (3) HUBZones or 8(a) businesses, and (4) any other small business contracting preference. According to OSDBU officials, if contracting officers can easily identify VOSBs that also qualify as WOSB or HUBZone businesses (because a business can qualify for one or more small business categories), percentages of awards in all goal categories may increase. However, women veterans currently represent 8 percent of the entire veteran population, creating a challenge for VA to achieve the WOSB goal. VA has taken some recent steps to increase contracting opportunities for WOSB and HUBZone businesses. For example, in 2009, VA and SBA formed a working group to develop training sessions, resources, and marketing materials targeted to WOSB and HUBZone firms that also may be VOSBs and SDVOSBs. The marketing and education materials focus on explaining the nature of contracting preferences for VOSBs and SDVOSBs and the benefits of registering and applying for verification through VetBiz.gov. Additionally, OSDBU will continue to host monthly meetings in which VA vendors learn about FSS and how the vendors may be integrated into the system. Finally, according to VA, OSDBU has updated the agency’s Web site to provide assistance for contracting officers to help identify small businesses that fall into the various small business categories when awarding FSS contracts. Additionally, CVE has updated the VetBiz.gov database so that contracting officers can more readily locate VOSBs and SDVOSBs that also fall into the other small business categories. However, it remains to be seen whether VA’s recent efforts will be successful in increasing contracting opportunities for other small business categories. The Veterans’ Benefits Improvement Act of 2008 (Pub. L. No. 110-389 or the 2008 Act) amended the 2006 Act’s provisions to require that any agreements into which VA enters with other government entities to acquire goods or services on VA’s behalf on or after January 1, 2009, require the agencies to comply, to the maximum extent feasible, with VA’s contracting goals and preferences for VOSBs and SDVOSBs. Since January 1, 2009, VA has entered into six interagency agreements (see table 3). Additionally, VA has an interagency agreement with the U.S. Army Corps of Engineers, but the agreement was signed in September 2007. Therefore, the provisions of the 2008 Act are not applicable. According to agency officials, VA has agreements in place with additional federal agencies, but all were entered into before January 1, 2009. Therefore, the provisions of the 2008 Act also are not applicable. VA issued guidance to all contracting officers about managing interagency acquisitions in March 2009. However, the agreement with the Department of the Interior (DOI) did not include the required language addressing VA’s contracting goals and preferences until it was amended on March 19, 2010, after we informed the agency that the agreement was not in compliance with Pub. L. No. 110-389. According to VA officials, the agency’s acquisition and contracting attorneys are responsible for reviewing interagency agreements for compliance with these requirements. Additionally, the interagency agreement language comes from Office of Management and Budget (OMB) templates. However, VA does not have an effective process in place to ensure that all interagency agreements include the 2008 Act’s required language and to monitor the extent to which agencies comply with the requirements. For example, agency officials could not tell us whether contracts awarded under these agreements met the SDVOSB and VOSB preferences. Without a plan or oversight activity, such as monitoring, VA cannot be assured that agencies have made maximum feasible efforts to contract with VOSBs or SDVOSBs. VA has made limited progress in implementing a program to verify the veteran status, control, and ownership of businesses. As of April 8, 2010, VA had verified about 2,900 businesses––approximately 14 percent of VOSBs and SDVOSBs in the VetBiz.gov database. While VA has adopted policies and procedures to review businesses and began to implement a risk-based approach to conducting site visits, it has not met the requirement in the 2006 Act that it only use its veteran preferences authorities with verified businesses when awarding these types of contracts. Additionally, our review identified a number of weaknesses in the verification program. For example, files supporting verified businesses contained missing information and explanations of how staff determined that control and ownership requirements had been met has made it difficult to know whether verified businesses are truly owned and controlled by service-disabled veterans or veterans. VA’s procedures call for site visits to further investigate the ownership and control of higher- risk businesses, but the agency has a large and growing backlog of businesses awaiting site visits. VA has denied verification to more than 150 businesses but does not have a process in place to monitor contracting awards to effectively ensure that contracting officers do not use veteran preferences authorities to award contracts to denied businesses. Initial site visit findings also indicated misrepresentation by some business owners, but VA has not developed guidance for staff to follow when misrepresentation may have occurred. The weaknesses in VA’s verification process reduce assurances that verified firms are veteran-owned and -controlled small businesses, and VA does not have an effective process to ensure that contracting officers do not use veteran preferences authorities with denied businesses or to ensure that VA staff take appropriate action against businesses that may be misrepresenting their VOSB or SDVOSB status. In May 2008—approximately 1½ years after Pub. L. No. 109-461 was enacted—VA began verifying businesses and published interim final rules in the Federal Register, which included eligibility requirements and examination procedures, but did not finalize the rules until February 2010 (see fig. 8). According to VA officials, CVE initially modeled its verification program on SBA’s HUBZone program; however, CVE reconsidered verification program procedures after we reported on fraud and weaknesses in the HUBZone program. More recently, in December 2009, the agency (1) finalized changes to the VAAR that included an order of priority (preferences) for contracting officers to follow when awarding contracts and (2) trained contracting officers on the preferences and the VetBiz.gov database from January through March, 2010. Leadership and staff vacancies plus a limited overall number of positions have also contributed to the slow pace of implementation of the verification program. For approximately 1 year, leadership in OSDBU was lacking because the former Executive Director retired, and the position remained vacant from January 2009 until January 2010. Furthermore, one of two leadership positions directly below the Executive Director has been vacant since October 2008, and the other position has been filled temporarily by an Acting Director. The agency also faced delays in obtaining contracting support, which slowed implementation of the verification program. More than 1 year after the agency began verifying businesses, a contractor began conducting site visits (which further investigate control and ownership of businesses as part of the verification process). As of April 2010, CVE had 6.5 full-time-equivalent position vacancies, and VA officials told us existing staff have increased duties and responsibilities that contributed to slowed implementation. The slowness in implementing the verification program appears to have contributed to VA’s inability to meet the requirement in the 2006 Act that it only use its veteran preferences authorities to contract with verified businesses. Currently, contracting officers can use the veteran preferences authorities with both self-certified and verified businesses listed in the VetBiz.gov database. However, in its December 2009 rule, VA committed to only awarding contracts using the veteran preferences authorities to verified businesses starting on January 1, 2012. According to our analysis of FPDS-NG data, in FY09, the majority of contracting awards (75 percent) made under veteran preferences went to unverified businesses. In March 2010, the recently appointed Executive Director of OSDBU acknowledged in a congressional hearing the large undertaking and some challenges with starting a new program like the verification program. As of April 8, 2010, VA had verified about 2,900 businesses––approximately 14 percent of VOSBs and SDVOSBs in the VetBiz.gov database. VA has been processing an additional 4,701 applications, but the number of incoming applications continues to grow (see fig. 9). As of March 2010, CVE estimated that it had received more than 10,000 applications for verification since it started verifying businesses in May 2008. According to the 2006 Act, VA must maintain a database of verified businesses and, in doing so, must verify the veteran or service-disability status, control, and ownership of each business. The rules that VA developed pursuant to this requirement require VOSBs and SDVOSBs to register in VetBiz.gov to be eligible to receive contracts awarded using veteran preferences authorities. The small businesses must be owned and controlled by eligible parties, and the business must qualify as “sm under federal size standards. According to VA’s rules, an applicant must meet the following five eligibility requirements for verification: (1) be all” owned and controlled by a veteran or service-disabled veteran for a VOSB or SDVOSB, respectively; (2) demonstrate good character (any small business that has been debarred or suspended is ineligible); (3) make no false statements (any small business that knowingly submits false information is ineligible); (4) have no federal financial obligations (any small business that has failed to pay significant financial obligations to the federal government is ineligible); and (5) not have been found ineligible due to an SBA protest decision. VA has a two-step process to make the eligibility determinations for verification. Under the first step, CVE staff review veteran status and, if applicable, service-disability status and publicly available, primarily self- reported information about control and ownership for all businesses that apply for verification (see fig. 10). Business owners submit an application (VA Form 0877), which asks for basic information regarding the ownership of the company seeking verification, through VetBiz.gov and, upon request, must provide supporting documents to CVE. When applicants submit their VA Form 0877, they also must be able to provide, upon request, other items for review, such as financial statements, tax returns, articles of incorporation or organization, lease and loan agreements, payroll records, and bank account signature cards. Typically, these items are reviewed at the business during the second step of the review process—site visits, which can be announced or unannounced—but CVE staff may also request that the applicant send copies of other items for review during the first step. Apart from site visits, the CVE review is centralized––all staff and files are located in Washington, D.C. Under the second step, reviews or site visits are conducted to further investigate control and ownership for select high-risk businesses. In September 2008, VA adopted a risk-based approach to conducting site visits by implementing risk guidelines to determine which businesses would merit site visits. Staff are required to conduct a risk assessment for each business and assign a level of risk ranging from 1 to 4––with 1 being a high-risk business and 4 being a low-risk business. When VA staff conduct a risk assessment, they are to follow the agency’s risk guidelines which include criteria such as previous government contracting dollars awarded, business license status, annual revenue, and percentage of veteran-ownership. For example, if a business has previous VA contracts totaling more than $5 million, staff must assign that business a risk le 1 (high). Or, if a business is missing an active or business license in goodstanding, staff must assign a risk level of 2 (elevated). VA then uses these risk assessments to identify businesses for site visits. According to VA, it intends to examine all businesses assigned a high- or elevated-risk level during a site visit or other means, such as extensive document review and telephone interviews with the businesses’ key personnel. VA plans to refine its verification processes to address recommendations from a contractor’s review of the program and best practices identified in federal, state, or private-sector programs. In July 2009, VA hired an outside contractor to assess the verification program’s processes, benchmark VA’s program to other similar programs, and provide recommendations to VA on how to improve the program. VA received the contractor’s report and recommendations in November 2009. The contractor recommended that VA require business owners to submit key documents as part of the application for verification––such as business and professional licenses, copies of previous tax records, and lease or operating agreements. (VA currently requires businesses to have these documents on file for a possible review.) The contractor further recommended that VA upgrade its data system to expand its functionality to allow business owners to submit the documentation electronically and store electronic copies of the information. For example, the contractor recommended that VA adopt case-management software to better manage the flow of applications and interface with the VetBiz.gov database. According to the contractor’s analysis of CVE’s workforce and the growing application volume, CVE would need an additional 13 full-time positions to conduct verifications–– even after it made necessary improvements to reduce processing times for applications. VA officials told us that they plan to implement the contractor’s recommendations to require business owners to submit documentation as part of their initial application and to upgrade their data systems. (We further discuss data systems issues later in this report.) However, VA did not have a plan or specific time frames for implementing a thorough and effective verification program, including filling vacant staff positions, providing concrete steps and milestone dates for addressing the contractor’s recommendations, and hiring additional positions to conduct verifications. A plan, including specific time frames for completing improvements, would help VA meet the requirements in the 2006 Act that it maintain a database of verified businesses, and that VA contracting officers only use the veteran preferences authorities to award contracts to verified businesses. Based on our review of a random sample of the files for 112 businesses that VA had verified by the end of FY09, an estimated 48 percent of the files lacked the required information or documentation that CVE staff followed key verification procedures. Specifically, 20 percent were missing some type of required information, such as evidence that veteran status had been checked or that a quality review had taken place; 39 percent lacked information about how staff justified determinations that control and ownership requirements were met; and 14 percent were missing evidence that either a risk assessment had taken place or the risk assessment that occurred did not follow the agency’s risk guidelines. The overall estimated 20 percent of cases missing some type of required information included files missing evidence that veteran status was checked, eligibility to receive federal government contracts was checked, application forms were complete and signed, or a quality review had taken place. According to CVE’s verification procedures, staff should check the Veteran Benefits Administration’s Beneficiary Identification Records Locator Subsystem (BIRLS) to determine veteran and service-disability status and record that BIRLS was checked in their internal database. Although CVE staff must check BIRLS for each applicant, we found about 16 percent of files lacked information on whether staff had checked the system to determine veteran or service-disability eligibility. Additionally, we found 15 percent of files lacked information on whether CVE staff had checked the Excluded Parties List System (EPLS)––which is used to determine whether the business owner is eligible to receive federal contracts. Also, 3 percent of the files lacked a completed or signed verification application (VA Form 0877), and 5 percent lacked documentation that a quality review had taken place. According to the verification procedures, staff must check each VA Form 0877 for completeness at the beginning of the process, and each file should undergo a quality review at the end of the process. Additionally, our file review found that in an estimated 39 percent of cases, staff obtained information from a public database but failed to record in the file what information they had reviewed to determine whether control and ownership requirements had been met. According to CVE’s verification procedures, staff are to review publicly available, primarily self-reported information about control and ownership for each business. For example, staff are to check for previous federal contracts by reviewing information available on USAspending.gov, check for certifications by reviewing the Online Representations and Certifications Application (ORCA), and review company history through Dun & Bradstreet reports. In addition, staff are to review information about each business in the following databases: VetBiz.gov, Central Contractor Registration (CCR), and Dynamic Small Business Search (DSBS)––all of which contain information self-reported by business owners. According to the verification procedures, staff are required to record business status or discrepancies about information obtained through each public database searched. Finally, based on our file review sample, for an estimated 14 percent of cases, the files were missing evidence that a risk assessment had taken place, or staff incorrectly assigned a risk level lower than warranted. For example, 4 percent of cases in this group were missing risk levels, and 8 percent of cases incorrectly were assigned a low- or moderate-risk level—they had missing business licenses, which according to the risk guidelines warranted assigning an elevated-risk level. According to VA, staff received on-the-job training about the risk guidelines and assigned risk levels are checked for accuracy during the quality review, but VA officials also have observed incorrectly assigned risk levels. VA officials told us that the staff have been learning how to better assign the risk levels, and errors have been reduced since the agency hired a full-time staff person as a risk manager in February 2009. Incorrectly assigning risk levels reduces the chance that the agency is accurately identifying businesses for site visits, which, in turn, may lead to some businesses not receiving a site visit when it otherwise would be warranted. We found that data system limitations appear to be contributing factors to weaknesses identified in our review of files. For example, data entry into CVE’s internal database is largely done manually, which can result in missing information or data entry errors. Furthermore, CVE’s internal database does not contain controls to ensure that only complete applications that have received a quality review move forward. Internal control standards for federal agencies require that agencies effectively use information technology in a useful, reliable, and continuous way. According to agency officials, two efforts are under way to enhance CVE’s data systems. First, CVE plans to enhance its data systems to automatically check BIRLS for veteran status and EPLS for good character, and to store the information obtained. According to CVE, these changes will require outside contractor assistance. On March 18, 2010, VA released a solicitation for a contract that closed on April 16, 2010. Once a contract is awarded, CVE staff told us that the upgrades will be ready to implement in about 12 months. Second, CVE plans to adopt case- management software—as recommended in the contractor’s report—to help manage its verification program files. According to VA officials, CVE is considering a software application currently used by another VA department. The new system will allow CVE to better track new and renewal verification applications and manage the corresponding case files. Furthermore, the new software will ensure that quality reviews take place by not allowing an application to move forward if it contains any missing information. However, as we have previously discussed, VA does not have specific time frames for putting the case-management system in place. Furthermore, CVE’s verification procedures do not provide guidance for staff to follow in the event that they determine information is missing or discrepancies exist after reviewing public databases. Staff do not have specific guidance to follow about the circumstances under which they might need to request additional information directly from business owners. Based on our file review, we found in 79 percent of cases, staff relied solely on information from the public databases but asked for documentation from a business owner in the remaining cases. In these examples, we found staff requested copies of active business licenses, articles of incorporation, operating agreements, stock certificates, or tax documents for further review. The verification procedures instruct staff to “request a copy of all required documents needed to make a sound decision” but do not provide examples of conditions under which staff should request documents as evidence to support control or ownership determinations. Furthermore, the procedures do not require staff to document their assessments of whether eligibility requirements had been met. Internal control standards for federal agencies require that agencies collect and maintain documentation to confirm information in support of their programs. According to VA officials, staff verbally discuss assessments during a daily meeting but do not document these discussions. According to our file review, in the 21 percent of cases in which staff did request information because they may have found a discrepancy in the publicly available information, staff made the request directly to the business owners, instead of using third-party sources to validate information. Publicly available, primarily self-reported information may not be reliable to determine whether control and ownership requirements have been met. In October 2009, our investigators reported on the governmentwide SDVOSB procurement program (administered by SBA, along with federal procuring activities) and found fraud and abuse among some SDVOSBs. For example, in 10 case studies, we showed that SDVOSBs fraudulently received sole-source and set-aside contracts––and that 5 of the 10 businesses receiving VA contracts were found ineligible because of issues with management and control. While CVE’s process to review publicly available, primarily self-reported information may be consistent with SBA’s process for the governmentwide SDVOSB program, these 5 cases provide evidence that self-reported information may not always be reliable for determining control of a business. Without timely improvements to CVE’s data systems and controls in place to ensure the completeness and accuracy of information, the verification program remains at higher risk for error, lacks quality control, and makes it difficult to know whether eligibility requirements were met. Furthermore, the verification procedures do not include guidance that would help staff to assess control and ownership, particularly in examples of missing information or discrepancies among public databases or within self-reported information. Without enhancements to its verification procedures that include clear guidance for staff to follow when reviewing applications and require an assessment of each eligibility requirement, it is difficult to know whether eligibility requirements have been met and whether verified businesses legitimately qualified as VOSBs or SDVOSBs. VA started verifying businesses in May 2008 but did not start conducting site visits until October 2009. As of April 8, 2010, VA had used contractors to conduct 71 site visits but an additional 654 high- and elevated-risk businesses awaited visits. Because of this delay, VA currently has a large backlog of businesses awaiting site visits and some higher-risk businesses have been verified months before their site visit occurred or were scheduled to occur. According to VA officials, the agency plans to use contractors to conduct an additional 200 site visits between May and October, 2010. However, the current backlog will grow over future months. According to site visit reports, approximately 40 percent of the visits resulted in evidence that control or ownership requirements had not been met, but, as of April 2010, CVE had not canceled any business’ verification status. The verification program rules contain procedures for cancellation of verified status. Also, according to VA officials, CVE will follow the cancellation procedures for any business for which the site visit findings contradict the original verification determination. Because some businesses are verified months before their site visits occurred and findings were developed, it is difficult to know whether the businesses actually met control and ownership requirements when they were verified. By not incorporating site visit findings in a timely manner and canceling verification status as necessary, some businesses receive an unwarranted verified status and may receive veteran preferences contracts, thereby taking contracting opportunities away from businesses that, in fact, are owned and controlled by veterans or service-disabled veterans. We also found that businesses received veteran preferences contracts after they had been denied verification. According to VA data, 154 businesses had been denied verification as of March 4, 2010. According to our analysis of these data, the key reasons for denial of applications included business owners failed to submit the required documentation (44 percent), control requirements were not met (30 percent), ownership requirements were not met (12 percent), and other eligibility requirements were not met (14 percent). As we have previously stated in this report, the 2006 Act provided VA with unique authority to award veteran preferences contracts, and, under the VAAR, contracting officers must only use these preferences with firms listed in the VetBiz.gov database (from Jan. 1, 2012, only with verified businesses). However, according to our analysis of FPDS-NG data, we found that 11 (of 154) denied businesses had received veteran preferences contracts. According to these data, VA contracting officers had awarded contracts totaling almost $4 million using the veteran preferences authorities––after CVE had denied these businesses verification. According to VA officials, denied businesses should be removed from the VetBiz.gov database, and contracting officers are required to check the database before awarding a contract to ensure that the business is listed as either verified or self-certified. However, according to VA officials, contracting officers may not be diligently checking the VetBiz.gov database before using the veteran preferences authorities to award contracts. According to VA officials, contracting officers received guidance in June 2007 and received training on the 2006 Act’s authorities between January and March, 2010. While contracting officers have been trained in the veteran preferences authorities and are required to check the VetBiz.gov database prior to making an award, they still have incorrectly used veteran preferences authorities with denied businesses. According to VA, there is no function within the agency’s electronic contract management system to stop a contracting officer from awarding veteran preferences contracts to denied businesses. Without a more effective system in place to ensure that contracting officers only use veteran preferences authorities with verified or self-certified businesses, VA will continue to make awards to ineligible businesses (those denied verification), thereby taking contracting opportunities away from eligible businesses. As we have previously stated, approximately 40 percent of businesses that received site visits did not meet ownership or control eligibility requirements and may have misrepresented themselves. Contractors that performed the site visits were required to submit reports on the results to VA within 7 business days of the site visits. According to these reports, evidence of misrepresentation dates to October 2009, but VA had not taken actions against these businesses as of April 9, 2010. According to VA’s Office of Inspector General, it has received one referral (on Apr. 5, 2010) as a result of the verification program. Staff have made no requests for debarment as a result of verification program determinations as of April 9, 2010. Under the 2006 Act, any “business concern that is determined by the Secretary to have misrepresented the status of that concern as a small business concern owned and controlled by veterans or as a small business concern owned and controlled by service-disabled veterans … shall be debarred from contracting with the Department for a reasonable period of time.” The VAAR states that VA may debar businesses that have misrepresented themselves for up to 5 years. Additionally, under the verification program rules, whenever CVE determines that a business owner submitted false information, the matter will be referred to the Office of Inspector General for review, and CVE will request that debarment proceedings be initiated. However, beyond the directive to staff to make a referral and request debarment proceeding, VA does not have detailed guidance in place (either in the verification program procedures or the site visit protocol) that would instruct staff under which circumstances to make a referral or a debarment request. Such guidance would help to ensure that VA complies with this provision of the 2006 Act. Without detailed guidance in place to help staff determine whether businesses have misrepresented themselves, enforcement actions for misrepresentation will not occur and businesses will continue to abuse the program. VA has developed a mechanism to review prime contractors’ subcontracts with VOSBs and SDVOSBs, but the agency has not yet implemented it. VA currently focuses its oversight of subcontracting activities on prime contractors with subcontracting plans, mainly by reviewing their electronic reports of subcontracting activity. Large businesses with federal contracts of $550,000 or more ($1 million for construction) generally must have subcontracting plans that include goals for subcontracting with VOSBs, SDVOSBs, and other types of small businesses. The 2006 Act requires that VA “establish a review mechanism to ensure that, in the case of a subcontract of a Department contract that is counted for purposes of meeting a goal established pursuant to this section, the subcontract was actually awarded to a business concern that may be counted for purposes of meeting that goal.” For FY07, VA set agencywide goals for all subcontracts awarded of 7 percent for VOSBs and 3 percent for SDVOSBs; for FY08 and FY09, VA set goals of 10 percent for VOSBs and 7 percent for SDVOSBs. According to SBA data, VA has not met its own goals for subcontracts awarded to VOSBs and SDVOSBs since FY07 (see table 4). VOSB and SDVOSB subcontractor participation did not exceed 1 percent of all subcontracts awarded in FY08 and FY09. In July 2009, VA’s top leadership acknowledged that the agency had fallen far short of its subcontracting goals and publicly committed to take more aggressive measures to improve its subcontracting record with VOSBs and SDVOSBs. VA has created a form—VA Form 0896a—that it plans to use to collect subcontracting information from its prime contractors. OMB approved the form on January 15, 2010. Initially, VA plans to use a hard-copy version of VA Form 0896a and ultimately collect data from prime contractors through the Internet. At the close of each fiscal year, VA staff will provide the form to prime contractors with approved subcontracting plans. Once prime contractors complete and return the form, VA staff will then review the form and compare it with the information reported by prime contractors in their subcontracting plans. VA staff also will contact the subcontractors listed on the form to confirm that the subcontracting activity occurred as well as confirm the dollar amount expended. VA staff then will determine whether discrepancies exist and the reasons for the discrepancies. Specifically, VA will attempt to determine instances in which valid reasons for a discrepancy exist versus instances in which prime contractors may not have made a good-faith effort to comply with their subcontracting plans. VA plans to centralize the subcontractor review function in its OSDBU. Although contractors self-reported information into the SBA-maintained Electronic Subcontracting Reporting System prior to development of this subcontracting review mechanism, VA had not collected or confirmed the accuracy of information on the specific dollar amount or percentage of the contract value attributable to individual subcontractors. Finally, VA’s OSDBU plans to develop standard operating procedures by September 2010 for its staff to ensure consistent implementation of the review mechanism. According to VA, no additional regulatory action is required to implement VA Form 0896a and the review process. According to VA, the use of the form will improve the subcontractor data that the agency uses to calculate its goal accomplishments. VA also expects to see increases in performance toward subcontracting goal attainment as a result of improved data collection. Additionally, VA will count subcontracting accomplishments only with verified businesses starting on January 1, 2012. As of March 26, 2010, VA planned to use VA Form 0896a on a sampling of contracts resulting from solicitations issued after January 7, 2010. According to VA, SBA will have to certify FY10 subcontracting data before OSDBU performs an analysis of information for contracts resulting from these solicitations. In previous years, SBA’s data certification had taken several months or up to a year to be available. VA officials have raised concerns that certain challenges may slow implementation of the review mechanism. These challenges include the limited staff resources that OSDBU has to implement the program. VA estimated that more than 300 prime contractors may be required to supply data, which OSDBU must analyze as we have previously described. In FY09, VA reported that it had approved 198 new subcontracting plans. However, VA hired one full-time employee to help one existing staff person working on this program. According to an agency official, OSDBU will determine after implementation of the new form whether additional personnel will be required. Furthermore, VA has expressed concerns that prime contractors and subcontractors initially may resist providing, or may not realize they have to provide, information. According to VA officials, they have not pretested the review mechanism with prime contractors but plan outreach to prime contractors and subcontractors about the new program. VA also plans to motivate prime contractors to complete the form and increase subcontracting efforts with VOSBs and SDVOSBs by adopting a new evaluation factor in addition to those factors VA currently uses to award contracts. For example, VA’s procurement staff plans to use prime contractors’ records in meeting goals detailed in subcontracting plans when awarding future VA contracts. Finally, OSDBU plans to use the data collected to annually provide findings to VA leadership. Because VA has not yet implemented the review mechanism, it is too early to assess its effectiveness. More than 3 years after it was enacted, VA has not fully implemented significant requirements of the 2006 Act. The 2006 Act provided VA with unique authority to award contracts to VOSBs and SDVOSBs on a priority basis to increase contracting opportunities for these businesses. In this regard, VA has been highly successful. Since FY07, VA has established and exceeded its contracting goals for VOSBs and SDVOSBs, primarily by using authorities established under the 2006 Act. However, the agency faces continuing challenges, and diminished achievement, in meeting other small business goals. VA also faces challenges in monitoring interagency agreements to ensure that other agencies are making efforts to achieve its contracting goals, to the maximum extent feasible, as required by an amendment to the 2006 Act’s provisions. VA does not have an effective process in place to ensure that all interagency agreements include the mandated language addressing VA’s contracting goals and preferences or to monitor the extent to which agencies comply with the requirements. By putting such a process in place, VA could help ensure that statutory requirements are met and that the contracting activities of other agencies also meet VA’s goals and preferences for VOSBs and SDVOSBs, to the maximum extent feasible. The agency has been slow to implement a comprehensive program to verify the veteran status, ownership, and control of small businesses and maintain a database of such businesses, also required by the 2006 Act. Verification is a vital control to ensure that only eligible veteran-owned businesses benefit from the preferential contracting authorities. VA has faced several challenges in implementing its verification program, including a lack of leadership and a limited number of staff positions with which to conduct verifications. VA plans to implement recommendations that an outside contractor made to improve the program and its data systems. However, we identified several weaknesses in the verification program, and the agency has been slow to fill staff vacancies and enhance its technology. By expeditiously filling its vacant leadership and staff positions within OSDBU, VA could better ensure that the verification program will operate effectively and planned improvements will be achieved. Many of the weaknesses in the files we reviewed appeared to be the result of limitations in the software and the associated extensive reliance on manual data entry. VA has not yet put software improvements in place. Other weaknesses stemmed from gaps in the verification guidance and procedures. For example, VA does not have guidance requiring staff to document their assessment that each eligibility requirement had been met or explaining under what circumstances to request documentation from business owners or instances in which third- party data may be necessary to validate self-reported information. By developing a plan to address leadership and staff vacancies, hire additional staff as necessary, achieve timely implementation of enhancements to data systems, revise procedures to include additional guidance for staff, and provide training to staff on the revised procedures, VA could make the verification process more effective. Timely improvements in these areas also would likely help the agency reduce backlogs––which have continued to grow. VA also faces other challenges with respect to ensuring that veteran preferences authorities are only used to award contracts to eligible businesses (those that have not been denied verification) and taking action against businesses that have misrepresented themselves during the verification process. According to the 2006 Act, VA must use the veteran preferences authorities only with verified businesses. However, VA contracting officers used the authorities to award contracts––totaling almost $4 million––to 11 businesses that had been denied verification. According to VA officials, contracting officers received training on the veteran preferences authorities, but the agency does not have an effective process in place to ensure that the authorities are used correctly. Without such a system, VA lacks assurance that it will not continue to make awards to ineligible businesses (those denied verification), thereby taking contracting opportunities away from eligible businesses. Moreover, findings from the initial site visits indicated a high rate of misrepresentation by VOSBs and SDVOSBs, coupled with a lack of detailed guidance about how to handle such cases (which would be the precursor to any investigations and enforcement actions), further suggest that the agency will be challenged to conduct effective oversight in a program vulnerable to fraud. Specifically, 40 percent of site visits resulted in evidence that control and ownership requirements had not been met. An effective process to make determinations and referrals that may result in enforcement actions against businesses misrepresenting themselves is of vital importance for the integrity of the program. Thus, to conduct an effective verification program, VA’s processes would need to include not only robust reviews to ensure that only eligible businesses are verified and therefore benefit from contracting preferences, but also clear and detailed guidance to ensure that ineligible businesses do not benefit from contracting preferences by taking the appropriate enforcement actions. Finally, the 2006 Act requires VA to establish subcontracting goals for VOSBs and SDVOSBs and to develop a mechanism to review prime contractors’ subcontracts with these businesses. While the agency has developed a mechanism, it has not yet implemented it. VA’s subcontracting accomplishments also have fallen short of goals for the past 3 years. The agency has acknowledged the shortcomings in this area and agency leadership has publicly committed to take measures to improve VA’s subcontracting record. VA intends to start using the review mechanism in FY10 and expects to see increases in performance toward subcontracting goal attainment as a result. However, it is too early to assess the effectiveness of VA’s subcontracting efforts. To facilitate the Department of Veterans Affairs’ progress in meeting and complying with the requirements of the 2006 Act, we recommend that the Secretary of Veterans Affairs take the following four actions: To ensure compliance with the 2006 Act, as its provisions were amended by the 2008 Act (Pub. L. No. 110-389), VA should develop an effective process to ensure that agreements it enters into with other federal agencies for contracting on its behalf to acquire goods or services include the required language and monitor other agencies’ contracting performance under those agreements. To help address the requirement in the 2006 Act to maintain a database of verified veteran-owned businesses, VA should develop and implement a plan that ensures a more thorough and effective verification program. Specifically, the plan should address actions and milestone dates for achieving the following: promptly filling vacant positions within OSDBU, including the two leadership positions, and hiring additional staff positions as necessary; improving its verification processes and procedures to ensure greater completeness, accuracy, and consistency in verification reviews, including updating data systems to reduce the amount of manual data entry by staff and revising the verification procedures to include additional guidance for staff on maintaining the appropriate documentation, requesting documentation from business owners or third parties under specific circumstances, and conducting an assessment that addresses each eligibility requirement; and conducting timely site visits at businesses identified as higher risk and taking actions based on site visit findings, including taking prompt action to cancel business’ verification status as necessary. To better ensure that VA meets the requirement to use veteran preferences authorities with verified businesses only, as required by the 2006 Act, VA should develop a more effective system to ensure that contracting officers do not use veteran preferences authorities to award contracts to businesses that have been denied verification, and provide additional guidance and training to contracting officers as necessary. To ensure that VA takes enforcement actions against businesses that have misrepresented themselves, as required by the 2006 Act, VA should develop detailed guidance that would instruct staff under which circumstances to make a referral or a debarment request as a result of the verification program. We requested the Department of Veterans Affairs’ comments on a draft of this report, and the Chief of Staff from VA’s Office of the Secretary provided written comments that are presented in appendix IV. VA also provided a technical comment that we incorporated in this report where appropriate. VA agreed with the four recommendations and provided information about steps that VA has already taken and some additional actions that are under way. For example, VA stated that it provided training from January through March, 2010, to all of its acquisition professionals regarding the language that must be included in all interagency agreements entered into on VA’s behalf. VA also indicated that it has made progress in filling vacant OSDBU positions, including filling all leadership positions as of April 12, 2010, and that all remaining vacant positions will be filled and staff will be on board no later than the end of July 2010. VA stated that its OSDBU anticipates requesting a significant number of additional full-time-equivalent authorizations in the near future to support the verification program. Additionally, VA stated that it provided training to contracting officers on the use of veteran preferences authorities from January through March, 2010, and will periodically rebroadcast the training through March 2011. Finally, VA stated that it is currently developing the process and procedures to use when referring businesses for debarment and plans to have this in place by October 31, 2010. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Veterans Affairs and other interested parties. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your offices have any questions about this report, please contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V. Our report objectives were to review (1) the extent to which the Department of Veterans Affairs (VA) met its prime contracting goals for veteran-owned small businesses (VOSB) and service-disabled veteran- owned small businesses (SDVOSB) in fiscal years (FY) 2007, 2008, and 2009, and what, if any, challenges VA faced in meeting these goals; (2) VA’s progress in implementing procedures to verify the ownership, control, and, if applicable, service-disability status of firms in its mandated database of VOSBs and SDVOSBs; and (3) VA’s progress in establishing a review mechanism of prime contractors’ subcontracts with VOSBs and SDVOSBs. To respond to these objectives, we reviewed agency documents related to VA’s implementation of the Veterans Benefits, Health Care, and Information Technology Act of 2006 (Pub. L. No. 109-461, sections 502 and 503), which requires VA to give priority to VOSBs and SDVOSBs when it uses veteran preferences to award contracts. Additionally, we reviewed regulations implementing the act, including the Veterans Affairs Acquisition Regulation, which is the final rule implementing the unique contracting preferences, and the final rule implementing the verification program. We interviewed VA officials within the Office of Acquisition and Logistics (OAL); Office of Small and Disadvantaged Business Utilization (OSDBU); Center for Veterans Enterprise (CVE); and Office of Inspector General (OIG). Finally, we obtained information from OSDBU and CVE about authorized staffing levels and current allocations for staff working on the verification and subcontracting review programs. To determine the extent to which VA met its prime contracting goals for VOSBs and SDVOSBs and to what extent contracts awarded to VOSBs and SDVOSBs were on a set-aside and sole-source basis, we reviewed VA’s agencywide contracting activity for which small businesses were eligible and analyzed SBA’s Goaling Reports for FY06 through FY08. Because SBA’s official Goaling Report was unavailable for FY09, we obtained and analyzed Federal Procurement Data Systems-Next Generation (FPDS-NG) data for VA contracting activities. Additionally, to assess the extent to which VA awarded set-aside and sole-source contracts to verified VOSBs and SDVOSBs, we compared those that were self-certified in FY09 with a list of businesses verified by the end of FY09 (provided by CVE). We compared the list provided by CVE with FPDS-NG data to determine VA’s level of contracting with verified firms. Finally, we conducted reasonableness checks on the FPDS-NG data and identified any missing, erroneous, or outlying data and had an independent analyst review all programming. We also obtained and reviewed VA’s FY09 FPDS-NG Data Quality Report, as submitted to the Office of Management and Budget, which stated that VA’s FPDS-NG data are 86 percent accurate and 95.8 percent complete. Based on this review, we determined the FPDS-NG data to be sufficiently reliable for the purposes of this report. To determine the extent to which VA agreements with other federal agencies has language that referred to VA’s contracting goals and preferences for VOSBs and SDVOSBs as mandated by Pub. L. No. 109-461, and amended by Pub. L. No. 110-389, we interviewed VA officials from OAL to obtain information on any policies, procedures, responsibilities, and oversight efforts in place to monitor compliance with the Pub. L. No. 110-389 requirement. To determine the extent to which these agencies awarded contracts to VOSBs and SDVOSBs, we evaluated FPDS-NG data to obtain information about contracts awarded by federal agencies on VA’s behalf and subject to Pub. L. No. 109-461 provisions. We evaluated the accuracy and completeness of this analysis by obtaining data from VA on contracting dollars awarded to the Department of the Interior, the General Services Administration, the Department of the Navy’s Space and Naval Warfare Systems Center, and the U.S. Army Corps of Engineers. To evaluate the challenges, if any, VA faced in meeting its prime contracting goals for VOSBs and SDVOSBs, we reviewed previous congressional hearing transcripts that discussed VA’s challenges in meeting its contracting goals as well as emerging challenges. We also conducted several interviews with officials from OSDBU and members of veteran service organizations, including representatives from the National Veterans Business Development Corporation, Association for Service Disabled Veterans, Disabled Veteran Americans, American Legion, Veterans of Foreign Wars, Vietnam Veterans of America, and National Veteran-Owned Business Association. To determine VA’s progress in implementing procedures to verify firms in its mandated database, we reviewed the agency’s verification guidelines and risk guidelines as well as procedures for reviewing applications and conducting site visits. Additionally, we conducted a file review of a sample of verified businesses to determine the extent to which VA followed procedures and to identify any deficiencies in the verification process. The study population for our review consisted of all 1,723 businesses that had been verified between May 2008 and the end of FY09 (Sept. 30, 2009). We obtained a list of these businesses from CVE and selected a probability sample of 112 businesses, which would allow us to estimate characteristics of all applications verified by CVE during this period. This sample contained approximately the same proportion of SDVOSBs as did the full study population. We conducted the file review at CVE’s offices in Washington, D.C., during the week of November 16, 2009, and reviewed both electronic and paper files. Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as 95 percent confidence internal (plus or minus 10 percentage points). This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. All percentage estimates from our sample have 95 percent confidence intervals within plus or minus 10 percentage points of the estimate. We created a data collection instrument based on requirements from CVE’s verification procedures, pretested the instrument on sample businesses, and then reviewed each business’ file according to the finalized instrument. For example, for each business, we reviewed the following: the verification application (VA Form 0877), quality control form (Control Folder Signature Sheet), the business’ entry within the agency’s internal Microsoft Access database (veteran status and eligibility to receive contracts from the federal government), notes about public databases checked for control and ownership information (Control Folder Review Sheet), screenshots of information obtained from public databases searched, and the approval letter. To determine risk levels assigned to each business, CVE provided a comprehensive list of all verified businesses and their assigned risk level. We used this list to obtain risk levels for the 112 businesses in our random sample. Our random sample produced estimates with margins of error of 9 percentage points or less at the 95 percent confidence level. Based on findings from our file review sample, we calculated percentage estimates with 95 percent confidence intervals within plus or minus 10 percentage points of the estimated percentage. The results of our sample are generalizable to the entire population of applications verified by the end of FY09. We performed the appropriate data reliability procedures for our sample. For example, to ensure consistency in how the data collection instrument was completed, we randomly selected 30 percent of files (34 out of 112) for which a second independent analyst peer reviewed the information collected. We determined, based on this 30 percent random sample, that there were very few discrepancies in how the data collection instrument was completed, and that the data were sufficient for the purposes of this report. To determine why CVE denied applications, we obtained information on the number of businesses denied verification and the reasons for denial. CVE provided us with information for each application denied between May 2008 and March 4, 2010, which we summarized in this report. We also compared the denied businesses to FPDS-NG data to determine whether any denied business had received a VOSB or SDVOSB set-aside in FY09 or in FY10 (through Mar. 23, 2010) from VA after it had been denied verification by CVE. We also obtained 10 (of 45) site visit reports from CVE that contractors had prepared. We reviewed the 10 reports to determine whether any businesses failed to meet eligibility requirements based on evidence prepared by the contractor that conducted the site visit. Finally, we requested information and interviewed agency officials from OAL, CVE, and VA’s OIG to discuss any processes and procedures in place to determine whether businesses had misrepresented themselves or to refer businesses for a investigation or debarment. To determine the extent to which VA met its own subcontracting goals for VOSBs and SDVOSBs and the governmentwide statutory goal for SDVOSBs, we reviewed data from SBA Goaling Reports and the Electronic Subcontracting Reporting System for FY07 through FY09. We reviewed Pub. L. No. 109-461, section 502, to identify the statutorily mandated requirement that VA set its own goals for VOSB and SDVOSB subcontracting activities, and to identify the requirement that VA confirm reported subcontracting activity. We conducted interviews with OSDBU to assess VA’s progress in establishing a review mechanism of prime contractors’ subcontracts with SDVOSBs and other VOSBs. Finally, we obtained and reviewed VA Form 0896a––which is the form that VA intends to use to implement its subcontracting review mechanism. We conducted this performance audit from October 2007 through May 2010, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The VetBiz.gov database allows business owners to submit applictions for verification and is also a searchable database for contracting officers and the public (see fig. 11). Businesses that have been verified appear with a verified logo (see fig. 12). In addition to the individual named above, Harry Medina, Assistant Director; Paola Bobadilla; Julianne Dieterich; Beth Ann Faraguna; Julia Kennon; John Ledford; Jonathan Meyer; Amanda Miller; Marc Molino; Mark Ramage; Barbara Roesmann; Kathryn Supinski; Paul Thompson; Julie Trinder; and William Woods made significant contributions to this report.

Summary: The Veterans Benefits, Health Care, and Information Technology Act of 2006 (the 2006 Act) requires the Department of Veterans Affairs (VA) to give priority to veteran-owned and service-disabled veteran-owned small businesses (VOSB and SDVOSB) when awarding contracts to small businesses. The 2006 Act also requires GAO to conduct a 3-year study of VA's implementation of the act. GAO evaluated (1) the extent to which VA met its prime contracting goals for VOSBs and SDVOSBs in fiscal years 2007-2009; (2) VA's progress in implementing procedures to verify the ownership, control, and status of VOSBs and SDVOSBs in its mandated database; and (3) VA's progress in establishing a review mechanism of prime contractors' subcontracts with VOSBs and SDVOSBs. GAO obtained and analyzed data on VA's prime and subcontracting accomplishments, and reviewed a sample of verified businesses to identify any deficiencies in VA's verification program. While VA exceeded its contracting goals with VOSBs and SDVOSBs for the past 3 years, it faces challenges in continuing to meet its other small business contracting goals and monitoring agreements with other agencies that conduct contract activity on VA's behalf. While VA was able to exceed its contracting goals for VOSBs and SDVOSBs, its contracting with women-owned small businesses and HUBZone firms fell short of its goals during this period. In addition, GAO's review of interagency agreements found that VA lacked an effective process to ensure that interagency agreements include required language that the other agency comply, to the maximum extent feasible, with VA's contracting goals and preferences for VOSBs and SDVOSBsand to monitor the extent to which agencies comply with the requirements. VA has made limited progress in implementing an effective verification program. While the 2006 Act requires VA to use the veteran preferences authorities only to award contracts to verified businesses, VA's regulation does not require that this take place until January 1, 2012. In fiscal year 2009, 25 percent of the contracts awarded using veteran preferences authorities went to verified businesses. To date, VA has verified about 2,900 businesses--approximately 14 percent of businesses in its mandated database of VOSBs and SDVOSBs. Among the weaknesses GAO identified in VA's verification program were files missing required information and explanations of how staff determined that control and ownership requirements had been met. In addition, VA's procedures call for site visits to further investigate the ownership and control of higher-risk businesses, but the agency has a large and growing backlog of businesses awaiting site visits. Furthermore, VA contracting officers awarded contracts to businesses that had been denied verification. Finally, although site visit reports indicate a high rate of misrepresentation, VA has not developed guidance for referring cases of misrepresentation for investigation and enforcement action. Such businesses would be subject to debarment under the 2006 Act. To ensure a thorough and effective verification program, VA needs robust procedures for reviewing businesses, an effective system to ensure that contracting officers do not use veteran preferences authorities with denied businesses, and clear guidance for referring businesses potentially abusing the program. VA has developed a mechanism to review prime contractors' subcontracts with VOSBs and SDVOSBs, but the agency has not yet implemented it. For the past 3 years, VA fell substantially short of achieving subcontracting goals for VOSBs and SDVOSBs. The agency acknowledged shortcomings in this area and intends to use a review mechanism to confirm all subcontracting activities by prime contractors with approved subcontracting plans for a sampling of contracts awarded in fiscal year 2010. VA expects increased performance for subcontracting goal attainment as a result. It is too soon to assess the effectiveness of VA's subcontracting efforts.