SBA’s organizational structure comprises headquarters and regional, district, and area field offices. At the headquarters level, SBA is divided into several key functional areas that manage and set policy for the agency’s programs. Seventeen headquarters offices report to the Office of the Administrator. SBA provides its services to small businesses through a network of regional and district offices that are led by the Office of Field Operations (OFO) and area offices, led by OGCBD, as discussed in greater detail later in this report. Regional offices oversee the district offices and promote the President’s and SBA Administrator’s messages throughout the region. District offices serve as the point of delivery for most SBA programs and services. Four program offices at the headquarters level manage the agency’s programs that provide capital, contracting, counseling, and disaster assistance services to small businesses: the Office of Capital Access, the Office of Entrepreneurial Development, the Office of Disaster Assistance, and OGCBD. OGCBD promotes small business participation in federal contracting through a variety of programs, including programs that provide small businesses with contracting preferences based on socioeconomic designations—the 8(a) Business Development (8(a)), Historically Underutilized Business Zone (HUBZone), women-owned small business (WOSB), and service-disabled veteran-owned small business (SDVOSB) programs. The 8(a) program provides business development assistance to small, disadvantaged businesses and helps them participate in the federal contracting market through sole-source and competitive 8(a) set-aside contracts. The HUBZone program aims to stimulate economic development in economically distressed areas by helping urban and rural small businesses that are located in designated economically distressed areas to access federal procurement opportunities. The SDVOSB program helps service-disabled veteran-owned small businesses acquire federal contracts. The WOSB Federal Contracting program helps women-owned small businesses acquire federal contracts. In addition, SBA administers a prime contracts program, subcontracting assistance program, certificate of competency program, and size determination program to increase federal contracting opportunities for small businesses. These programs, among other things, seek to maximize federal contracting opportunities for small businesses, HUBZone small businesses, women-owned small businesses, and any other firm participating in an OGCBD program. OGCBD has four main offices at the headquarters level: Office of Business Development (which includes the new All Small Mentor-Protégé program), Office of Government Contracting, Office of HUBZone Program, and Office of Policy, Planning and Liaison. The Office of Business Development administers the 8(a) business development program and includes the new Office of All Small Mentor-Protégé which was established in summer 2016 to provide mentor-protégé services to all eligible small businesses. The Office of Government Contracting administers SBA’s prime contracts, subcontracting assistance, WOSB Federal Contracting program, certificate of competency, and size determination programs. The Office of HUBZone Program administers the HUBZone program. The Office of Policy, Planning, and Liaison is responsible for implementing small business government contracting legislation and policy through SBA regulations. SBA’s field-office structure consists of 6 area offices, 68 district offices, and 10 regional offices. Area offices may sometimes be co-located with regional and district offices but differ in mission and function. Area offices report to OGCBD and while headquartered in six cities across the country, cover multiple SBA regional geographic areas encompassing a number of states where contracting activity is most prevalent. The primary function of these offices is to manage government buying activities throughout the country, which includes reviewing potential agency requirements and making recommendations to agency contracting officers on the portion of contracts to set aside for qualified small businesses. This also includes working with federal agencies and small businesses after contracts have been awarded to adjudicate size protests and conduct subcontracting compliance reviews, among other functions. District offices report to OFO and are located in at least one city for each state. The primary functions of these offices are (1) to market all SBA programs and services such as the aforementioned contracting programs, entrepreneurial development programs, and programs that facilitate loans from lenders to small business or capital access; (2) to provide business development assistance to entrepreneurs and small business owners; and (3) to support compliance and oversight responsibilities across capital and economic development programs. They also have geographic-specific contracting compliance responsibilities for local businesses in their portfolio. Branch offices and Alternative Work Sites serve as an extension of district offices and are in areas where local business needs require an additional SBA presence. Regional offices report to OFO and are responsible for marketing SBA and its programs to businesses and local government. Regional offices provide oversight of all district offices in their region and are often located in the same physical location as a district office. OGCBD sets policy for SBA’s government contracting and 8(a) business development programs and coordinates with OFO to implement its programs in field offices. OGCBD creates policies for field staff implementing its programs that include defining district office staff responsibilities and identifying counseling procedures that govern how district staff are to service firms. OGCBD also coordinates with OFO through weekly management calls to exchange information and provide updates on changes to policies and procedures. OGCBD has also coordinated with OFO to evaluate and update position descriptions for staff in field offices implementing its programs, most recently in 2016. SBA’s Office of Policy, Planning and Liaison (OPPL) is responsible for implementing small business government contracting laws and policy through SBA regulations. Executive branch agencies involved in rule making, including SBA, have authority and responsibility for developing and issuing regulations to implement laws. Many laws, regulations, and executive actions govern the federal rule-making process, including the following: Administrative Procedure Act (APA): The APA was enacted in 1946 and established the basic framework of administrative law governing federal agency action, including rule making. The APA governs “notice-and-comment” rule making, also referred to as “informal” or “APA rule making.” This act generally requires (1) publication of a notice of proposed rule making, (2) opportunity for public participation in the rule making by submission of written comments, and (3) publication of a final rule and accompanying statement of basis and purpose not less than 30 days before the rule’s effective date. Congresses and presidents have taken a number of actions to refine and reform this regulatory process since the APA was enacted. Executive Order 12866. Under Executive Order 12866, the Office of Information and Regulatory Affairs (OIRA), within OMB, reviews agencies’ significant regulatory actions (including both proposed and final rules) and is generally required to complete its review within 90 days after an agency formally submits a draft regulation. Each agency is to provide OIRA a list of its planned regulatory actions, indicating those that the agency believes are significant. For each rule identified by the agency as, or determined by the Administrator of OIRA to be, a significant regulatory action, the agency submits the rule to OIRA for formal review—including the coordination of interagency review. After receipt of this list, the Administrator of OIRA may also notify the agency that OIRA has determined that a planned regulation is a significant regulatory action within the meaning of the executive order. The order defines significant regulatory actions as those that are likely to result in a rule that may: 1. have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy; a sector of the economy; productivity; competition; jobs; the environment; public health or safety; or state, local, or tribal governments or communities; 2. create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; 3. materially alter the budgetary effect of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or 4. raise novel legal or policy issues arising out of legal mandates, the President’s priorities, or the principles set forth in Executive Order 12866. Federal Acquisition Regulation (FAR). Certain acquisition regulations must go through a separate OMB process after the final rule has been published before being added to the FAR. The FAR is a regulation that generally governs acquisitions of goods and services by executive branch agencies. It addresses various aspects of the acquisition process, from acquisition planning to contract formation to contract management. Part 19 of the FAR governs small business contracting programs. Federal Register notices proposing or announcing amendments to the FAR are generally issued jointly by the Department of Defense, General Services Administration, and National Aeronautics and Space Administration (NASA), though these items typically receive the concurrence of OMB’s FAR Council. After receiving a memorandum from an agency proposing to amend the FAR, the FAR Council refers potential changes to standing FAR teams for review. The process of amending the FAR can take anywhere from months to years. There are three phases in the federal rule-making process: initiation of rule-making actions, development of proposed rules, and development of final rules. During the initiation phase agency officials identify sources of potential rule makings. Potential rule makings may result from statutory requirements or issues identified through external sources (for example, public hearings or petitions from the regulated community) or internal sources (for example, management agendas). During this phase, agencies gather information that would allow them to determine whether a rule making is needed and to identify potential regulatory options. The second phase of the rule-making process starts when an agency begins developing the proposed rule. During this phase, the agency drafts the rule and begins to address analytical and procedural requirements. Also built into this phase are opportunities for internal and external deliberations and reviews, including official management approval. OIRA may be involved informally at any point during the process. After OIRA completes its review and the agency incorporates resulting changes, the agency publishes the proposed rule in the Federal Register for public comments. In the third phase of the process, the development of the final rule, the agency receives and reviews public comments, finalizes the language, and sends the rule through internal and external agency reviews, among other things. Once the comment period closes, the agency responds to the comments either by modifying the rule to incorporate the comments or by otherwise addressing the comments in the final rule. This phase also includes opportunities for internal and external review. Again, if the agency determines that the rule is significant or at OIRA’s request, the agency submits the rule to OIRA for review before final publication. If OIRA’s review results in a change to the final rule, the agency revises the rule before publication. After all changes are made, the final rule as published in the Federal Register includes the date that the rule becomes effective. An agency has certain options to expedite the rule-making process, and Congress has the ability to compel agencies to take action on a rule making if it believes there have been unreasonable delays. The APA includes exceptions to notice and comment procedures for certain categories of rules, such as those dealing with military or foreign affairs and agency management or personnel. Further, APA requirements to publish a proposed rule generally do not apply when an agency finds, for “good cause,” that those procedures are “impracticable, unnecessary, or contrary to the public interest.” Agencies often invoke “good cause,” for example, when Congress prescribes the content of a rule by law, such that prior notice and public comment could not influence the agency’s action and would serve no useful function. If an agency finds that notice and comment would be “impracticable, unnecessary, or contrary to the public interest,” the agency may issue a rule without prior notice and comment and instead solicit public comments after the rule has been promulgated. The agency may then choose to revise the rule in light of these post-promulgation comments. An agency also has the option of issuing an “interim final rule” to expedite the rule-making process. Other sources of exceptions to notice-and-comment rule making exist, such as specific statutory provisions that may direct agencies to expedite issuance of final rules. While agencies could be compelled to take action if they have “unreasonably delayed” a regulation or FAR amendment, Congress has seldom, if ever, compelled an agency to do so. OGCBD headquarters sets policies for SBA’s business development and government contracting programs, and SBA staff in field offices and other locations help to implement these programs at the local level. These field staff perform a variety of activities, depending on the program they are supporting. The reporting relationships between field staff and SBA headquarters also vary depending on the program. For example, field staff who implement government contracting programs report to OGCBD, while staff who manage the local portfolio-driven 8(a) business development program report to OFO, which oversees the field offices. Prime contracts and subcontracting assistance programs. At the headquarters level, the Office of Government Contracting within OGCBD manages SBA’s prime contracts, subcontracting assistance, certificate of competency, and size determination programs, which are implemented by staff who report to six area offices across the country. The Office of Government Contracting oversees the implementation of these programs by area offices and monitors the performance of and develops training for the staff who implement these programs. In the field, staff known as procurement center representatives (PCR) implement SBA’s prime contracts program, and these staff report through area offices to OGCBD. As noted in SBA’s standard operating procedure (SOP) for the prime contracts program, PCRs work to help ensure that small businesses have a fair and equitable opportunity to compete for federal procurement opportunities and that a fair proportion of the total sales of federal government property is made to small business concerns. PCRs recommend the set-aside of selected acquisitions, recommend new qualified small business sources, appeal contracting officer’s decisions which they deem adverse to small business, and provide advice to large business concerns to facilitate maximum practicable subcontracting opportunities for the small business community. Staff known as commercial market representatives (CMR) implement SBA’s subcontracting assistance program; CMRs also report through area offices to OGCBD. CMRs, among other things, work to facilitate the matching of large prime contractors with small business concerns, counsel large prime contractors on their responsibilities to maximize subcontracting opportunities for small business concerns, and counsel small business concerns on how to market themselves to large prime contractors. Staff known as Industrial Specialists are assigned to manage the Certificate of Competency and the Size Protest determination program cases. Certificate of Competency’s Industrial Specialists analyze the responsibility and capability of small businesses that have been tentatively selected for a contract, to help ensure that any of the contracting officer’s concerns about the firm’s ability to successfully perform can be overcome. Size Industrial Specialists analyze protests of awards when there is a question as to whether the recipient is in fact a small business. Both of these decisional responsibilities affect the awarding of contracts to individual small businesses. 8(a) Business Development program. At the headquarters level, the Office of Business Development within OGCBD is responsible for administering services available through the 8(a) Business Development program by issuing program policy and plans, evaluating program implementation, and rendering final decisions on program eligibility, among other responsibilities. The Office of Business Development is comprised of three departments, which collectively support the 8(a) program. The Office of Certification and Eligibility (OCE) has staff at both headquarters and two field offices who perform similar activities. OCE staff process initial certifications of eligibility for the 8(a) program and conduct continuing eligibility reviews for firms deemed to be high risk or complex, among other duties. OCE staff in field offices report to OGCBD via OCE. The Office of Management and Technical Assistance administers most services provided to 8(a) participants that are not provided by the district offices, such as administering the 8(a) Mentor-Protégé program, servicing sole-source, competitive, and multiple award contracts; analyzing and processing termination waivers; reaching out to prime contractors, federal agencies, and the 8(a) business development community; and overseeing the execution of national and local seminars and conferences, among other things. The Office of Program Review supports headquarters and field office staff administering the program by evaluating and responding to external reviews, creating marketing products for the 8(a) program, and preparing the annual report to Congress on program participation and contracting, among other things. At the local level, about 160 district office staff members known as Business Opportunity Specialists support the 8(a) program by interacting directly with small businesses. Business Opportunity Specialists are responsible for implementing the 8(a) program within the geographical area serviced by their district office, and each specialist has a portfolio of firms that they are responsible for supporting throughout the firms’ participation in the 8(a) program. Their activities include assisting firms as they prepare to apply to the program, hosting webinars about SBA’s government contracting and business development programs, and conducting training for firms on how to strengthen elements necessary for participation in these programs, such as a creating a strong business plan. Business Opportunity Specialists are also responsible for conducting annual reviews, which assess a firm’s progress in the 8(a) program. Further, they conduct continuing eligibility reviews, which help ensure that firms are still eligible to participate in the program after initial certification. In contrast with the field staff in area offices who implement SBA’s government contracting programs and report to OGCBD headquarters, Business Opportunity Specialists in district offices report to OFO via the district director, and their caseloads are determined by OFO. District directors manage the district offices and prepare a comprehensive District Office Strategic Plan outlining the methodology to achieve or exceed district goals by fiscal year end. The plan is specific to the district’s economic climate and encompasses goals related to OGCBD programs. Business Opportunity Specialists are responsible for executing goals of their district office’s plan that are specific to their position. In addition to supporting OGCBD programs, Business Opportunity Specialists support other SBA programs and assist with district office administration and local market initiatives. According to agency officials, the time specialists spend working on their 8(a) portfolios ranges from 55 percent to 100 percent. As a result, specialists who do not support 8(a) full time may also support other OGCBD programs, as discussed in the following sections, and assist with other district office activities, such as developing a marketing and outreach plan specific to their district office. HUBZone program. At the headquarters level, the Office of HUBZone within OGCBD administers the HUBZone program by certifying businesses as eligible to receive HUBZone contracts, maintaining a list of qualified HUBZone small businesses that federal agencies can use to locate vendors, adjudicating protests of HUBZone eligibility, decertifying firms that no longer meet eligibility requirements, and conducting marketing outreach and training. In the field, each district office has a HUBZone liaison who serves as the program expert at the local level. Because Business Opportunity Specialists are responsible for marketing OGCBD’s other programs in addition to their 8(a) duties, some of them also work with or serve as the HUBZone liaison to help ensure that the HUBZone program is implemented according to internal operating procedures and statute and help ensure that relevant HUBZone program goals and objectives are accomplished. The HUBZone liaison is also responsible for completing site visits or program examinations for firms, and conducting program marketing outreach to and training for state and local acquisition, economic development, and small business communities. WOSB and SDVOSB programs. At the headquarters level, the Office of Government Contracting within OGCBD publishes regulations for the WOSB program, conducts eligibility examinations of businesses that have received contracts, decides protests related to eligibility for a WOSB contract, conducts studies to determine eligible industries, and works with other federal agencies in assisting participating firms. The Office of Government Contracting also conducts SDVOSB eligibility protest reviews to help ensure that only eligible SDVOSBs receive contracts set aside for this group. The Office of Policy, Planning and Liaison issues regulations for the SDVOSB program and reports progress on the program’s set-aside goals. Because both programs are currently functioning as self-certifying programs, in which firms attest to their own eligibility to participate or obtain third-party certification, OGCBD does not make any determinations regarding firms’ eligibility prior to firms’ receiving contract awards. In the field, Business Opportunity Specialist responsibilities for these programs are largely limited to marketing these programs to the community and working with local resource partners, such as women’s business centers and veteran’s business centers, to educate firms and contractors about the programs. Figure 1 illustrates the lines of reporting for field staff who implement SBA’s government contracting and business development programs. SBA officials we spoke to in OFO and OGCBD described benefits of the current field-office and reporting structure. For example, they told us that the current field-office structure provides a national presence that allows firms to engage with staff in district offices across the country. As previously mentioned, at least one district office is located in each state, with multiple offices in some states. In addition, OFO officials said the reporting structure, in which Business Opportunity Specialists who implement the 8(a) program report to OFO rather than to OGCBD, allows for staff to also support the goals of their district office, which may require them to support local market duties and other SBA programs, in addition to supporting the firms in their 8(a) portfolio. Finally, SBA officials stated that the current structure helps to ensure that staff know their local market and can be responsive to local market needs as determined by their district director. However, OGCBD officials told us that the current reporting structure can result in inconsistent program delivery for business development programs. They described efforts taken recently to improve program delivery by improving OGCBD’s communication with OFO and field staff, including the following: Weekly management calls now occur between headquarters-level staff from OGCBD and OFO. These calls mostly address policy changes or changes to OGCBD’s standard operating procedures. Monthly conference calls including Business Opportunity Specialists and OGCBD management have been instituted to address any updates to the program. Monthly training refresher calls sponsored by the Office of Business Development have been implemented to provide training refreshers in addition to an opportunity to discuss program concerns or suggestions. Monthly HUBZone calls occur to monitor site visits and discuss complex fact patterns that may arise in connection with eligibility compliance. Business Opportunity Specialists were invited to attend a Department of Defense government contracting training session alongside OGCBD staff. However, information from SBA’s 2015 and 2016 Field Accountability Reviews indicate that communication issues may be ongoing. For example, one deputy district director said that conference calls are confusing, lack consistency, and do not provide up-to-date process changes. This deputy district director also noted that the calls did not cover all OGCBD programs and said that district field office staff were unaware of changes to WOSB and SDVOSB programs. Another district director said that communication breakdowns can occur when program offices schedule webinars, conference calls, and training activities that conflict with one another. Because the communications changes were implemented recently, it may be too soon to tell if they are having the intended effect. In September 2015, we issued a report that was based on a broad review of management challenges at SBA, including OGCBD. In this 2015 report, we found that working relationships between headquarters and field offices that differ from reporting relationships can potentially pose programmatic challenges. At that time, SBA told us it had committed to assessing its organizational structure but had not yet completed those efforts. We recommended that SBA document the assessment of the agency’s organizational structure, including any necessary changes to, for example, better ensure that areas of authority, responsibility, and lines of reporting are clear and defined. As of May 2017, SBA had not provided documentation of such an assessment or of its decision making about the need for changes to its organizational structure. We maintain that such an assessment is needed to help ensure that SBA’s structure supports its mission efficiently and effectively. Over the past decade, we and SBA’s OIG have identified a number of weaknesses in the processes SBA uses to certify and recertify businesses as being eligible to participate in its HUBZone, 8(a), and WOSB programs and have made recommendations to SBA to address them. SBA has addressed a number of these recommendations; however, some remain outstanding. SBA has made some improvements to address problems we identified with the HUBZone program’s certification and recertification processes. For example, in June 2008 we reported that, for its HUBZone certification process, SBA relied on data that firms entered in the online application system and performed limited verification of the self-reported information. Although agency staff had the discretion to request additional supporting documentation, SBA did not have specific guidance or criteria for such requests. Consequently, we recommended that SBA develop and implement guidance to more routinely and consistently obtain supporting documentation upon application. In response to that recommendation, SBA revised its certification process, and since 2009 has required firms to provide documentation, which SBA officials review to determine the firms’ eligibility for the HUBZone program. SBA then performs a full-document review on all applications as part of its initial certification process to determine firms’ eligibility for the program. We have closed this recommendation as implemented. We have also identified a number of concerns with SBA’s HUBZone recertification process. For example, in February 2015 we reported that SBA relied on firms’ attestations of continued eligibility and generally did not request supporting documentation as part of the recertification process. SBA only required firms to submit a notarized recertification form stating that their eligibility information was accurate. SBA officials did not believe they needed to request supporting documentation from recertifying firms because all firms in the program had undergone a full document review, either at initial application or during SBA’s review of its legacy portfolio in fiscal years 2010–2012. However, as we found, the characteristics of firms and the status of HUBZone areas—the bases for program eligibility—often can change and need to be monitored. As a result, we concluded that SBA lacked reasonable assurance that only qualified firms were allowed to continue in the HUBZone program and receive preferential contracting treatment. We recommended that SBA reassess the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information. In following up on this recommendation for our March 2016 report on opportunities to improve HUBZone oversight, we found that SBA had not yet implemented guidance for when to request supporting documents) for the recertification process because SBA officials believed that any potential risk of fraud would be mitigated by site visits to firms. According to data that SBA provided, the agency visited a fraction of certified firms each year during fiscal years 2013 through 2015. SBA’s reliance on site visits alone did not mitigate the recertification weaknesses that were the basis for our recommendation. The officials also cited resource limitations. In recognition of SBA’s resource constraints, we reiterated in our March 2016 report that SBA could apply a risk-based approach to its recertification process to review and verify information from firms that appear to pose the most risk to the program. In addition, as of February 2017, SBA officials told us that the agency had begun implementing a technology-based solution to address some of the ongoing challenges with the recertification process. The officials expected that the new solution would help them better assess firms and implement risk-based controls by the end of calendar year 2017. As of May 2017, this recommendation remains open. We also found in June 2008 and again in February 2015 that the recertification process was backlogged—that is, firms were not being recertified within the required 3-year time frame. In 2015, we reported that as of September 2014, SBA was recertifying firms that had been first certified 4 years previously. While SBA initially eliminated the backlog following our 2008 report, according to SBA officials the backlog recurred due to limitations with the program’s computer system and resource constraints. Consequently, in February 2015 we again recommended that SBA take steps to ensure that significant backlogs would not recur. In response to the recommendation, SBA made some changes to its recertification process. For example, instead of manually identifying firms for recertification twice a year, SBA automated the notification process, enabling notices to be sent daily to firms (to respond to and attest that they continued to meet the eligibility requirements for the program). According to SBA officials, as of February 2017 this change had not yet eliminated the backlog. SBA has made improvements to address problems we identified with the 8(a) program’s process to help ensure firms’ continuing eligibility. In a March 2010 report, we made six recommendations to improve SBA’s monitoring of and procedures used in assessing the continuing eligibility of firms to participate in and benefit from the 8(a) program. SBA has taken steps to address the six recommendations, and we have closed all six as implemented. For example, we recommended that SBA monitor and provide additional guidance and training to district offices on the procedures used to determine continuing eligibility. In response to this recommendation, SBA issued revised regulations that provided additional 8(a) program eligibility requirements and criteria related to size standards, indicators of economic disadvantage, and other thresholds businesses must meet to maintain eligibility. In addition, SBA indicated that under its Field Accountability Review program it conducts oversight of SBA district offices using audit-like steps to measure performance and compliance regarding federal statutory mandates, regulations, and SBA policy and procedures. According to SBA, one of the areas covered by the Field Accountability Review on-site visits is the 8(a) annual compliance reviews of participating firms. In April 2016, SBA’s OIG reported that SBA failed to properly document that 8(a) firms admitted into the program met all eligibility criteria. SBA’s OIG evaluated SBA’s eligibility determination process for admitting 48 applicants in the 8(a) program between January 1, 2015, and May 31, 2015, and found that 30 of the participants did not meet all of the eligibility criteria. SBA’s OIG found that SBA managers had overturned lower-level reviewers’ recommendations for denial without fully documenting how all of the identified areas of eligibility concerns were resolved. SBA’s OIG recommended that SBA (1) clearly document its justification for approving or denying applicants into the 8(a) program, particularly when those decisions differed from lower-level recommendations, and (2) provide documentation showing how eligibility concerns raised by lower-level reviewers were resolved for the 30 firms not documented. In response to the first recommendation, SBA noted in a written response to us that it had established a practice of noting a statement of difference in cases where decisions differed; however, the SBA OIG had yet to close this recommendation as of May 2017. According to the SBA OIG, this recommendation will remain open until this practice is documented in an SOP or desk guide for the program. In response to the second recommendation, SBA’s OIG noted that SBA provided the SBA OIG with documentation showing how the eligibility concerns were resolved for the 30 firms not documented, and this recommendation was closed as implemented. SBA OIG officials told us that they plan to issue a report that summarizes their analysis of the documentation provided by SBA in June 2017. SBA considers WOSB a self-certification program because firms self- certify their eligibility to participate by uploading documentation into an online repository or seeking approval from a third-party certifier. In October 2014, we found that SBA performed minimal oversight of third- party certifiers for the WOSB program and had not developed procedures that provide reasonable assurance that only eligible businesses obtain WOSB set-aside contracts. As a result, we found that SBA cannot provide reasonable assurance that certifiers fulfill the requirements of their role and that firms that attest that they are eligible for the program are actually eligible. We made two recommendations in this report: SBA should establish and implement comprehensive procedures to monitor and assess performance of certifiers in accord with the requirements of the third-party certifier agreement and program regulations; and SBA should enhance examination of businesses that register to participate in the WOSB program, including actions such as developing and implementing procedures to conduct annual eligibility examinations, analyzing examination results and individual businesses found to be ineligible to better understand the cause of the high rate of ineligibility in annual reviews, and implementing ongoing reviews of a sample of all businesses that have represented their eligibility to participate in the program. In response to our recommendations, SBA has taken some actions. For example, SBA created an SOP stating that third-party certifiers are subject to a compliance review by SBA at any time, and SBA has completed a review of the four authorized third-party certifiers. We continue to monitor SBA actions to address our recommendations. SBA’s OIG has also identified weaknesses in the WOSB program. In May 2015, SBA’s OIG reported that contract awards were made to potentially ineligible firms based on documentation in the WOSB online repository. SBA’s OIG reviewed 34 contract awards and found that 9 did not have documentation in the repository. In addition, SBA’s OIG found that of the 25 awards that did have some documentation in the repository, a number did not include all of the required documentation or sufficient documentation to prove that the firm was controlled by women. SBA’s OIG recommended that SBA perform eligibility examinations on the firms identified in the report as potentially ineligible. According to SBA OIG officials, SBA completed the eligibility examinations on the firms identified as potentially ineligible and determined that 40 percent of these firms were not eligible to receive contracts under the WOSB program at the time of award. According to the SBA OIG, all recommendations from this report were closed as implemented. The National Defense Authorization Act for Fiscal Year 2015 eliminated the self-certification process for the WOSB program and required SBA to give more authority to contracting officers to award sole-source contracts—that is, contracts that do not require competition. SBA completed a rule-making process to allow the program to award sole- source contracts. Although SBA has provided an advanced notice of proposed rule making for the certification program, it has not implemented a process to eliminate self-certification as of May 2017. As a result of inadequate monitoring and controls, such as not implementing a full certification program, potentially ineligible businesses may continue to incorrectly certify themselves as WOSBs, increasing the risk that they may receive contracts for which they are not eligible. Even with this change in the NDAA, we maintain that recommendations related to strengthening oversight of third-party certifiers and enhancing examinations of WOSB firms are needed to help ensure that only eligible businesses participate in the WOSB program. The timeliness of SBA’s rule-making process can vary due to the legal requirements that govern this process, among other factors. While agencies must adhere to the federal laws and executive actions that govern the federal rule-making process, each agency also has its own guidance and process for rule making. SBA relies on two SOP documents that outline procedures and responsibilities for rule making at the agency. One SOP on Federal Register documents identifies the procedures and responsibilities for obtaining internal clearance (the agreement of various offices within SBA and ultimately the signature of the Administrator) before publishing documents to the Federal Register, and includes details on how to format Federal Register proposed and final rules and the offices involved in reviewing documents. This SOP does not include specific information on required timelines for this process. The other SOP on SBA’s Office of Executive Secretariat includes, in part, additional information on clearance procedures before documents can be published in the Federal Register. This SOP includes limited information on internal deadlines, including that documents must be cleared by this office within 15 days of being initiated in SBA’s internal tracking system, with any documents needing re-clearance requiring an additional 5 days. SBA’s Office of Policy, Planning and Liaison (OPPL) works with SBA’s Office of General Counsel (OGC) and other internal subject-matter experts to draft and promulgate rules. OPPL has one director and two other staff members dedicated to rule making, and one of the two staff members is solely responsible for working with OMB’s FAR Council. SBA officials described their rule-making process as follows: OPPL relies on staff from OGC to draft the rule and then prepares the rule for OGCBD clearance and ultimately for agency-wide clearance by the Administrator. After receiving comments from SBA’s Office of Advocacy, SBA’s OIG, and other offices, OPPL prepares a memorandum to the Administrator for the Administrator’s review and clearance. Then, if the rule is determined by OIRA to be a significant regulatory action as defined by Executive Order 12866, the rule must go to OMB for an interagency review process managed by OMB, in which other federal agencies can provide comments and questions on SBA’s rule. This interagency review period requires 90 days, but the actual amount of time for this review varies. Sometimes the rule may be sent back to SBA where the process starts over again. According to SBA officials, if other agencies have no comments, the interagency review period can take 4 to 5 months. After the proposed rule passes interagency review, it goes back through OGCBD clearance and agency-wide clearance by the Administrator before being added to the Federal Register for public comment. OGC summarizes the public comments and drafts the final rule, and the final rule goes back to OGCBD and then the SBA Administrator for review before it is again sent to OMB for an additional review process. After these reviews are completed, the rule is then published in the Federal Register. Rules that only apply to SBA (and that do not need to go to OMB to amend the FAR) have an effective date 30 days after issuance. For rules that amend the FAR, a statement is drafted by OPPL and the FAR team drafts proposed and final rules. It takes the FAR Council at least a year between proposed and final rule to complete a FAR amendment, according to SBA staff. For SBA and the federal government more broadly, certain stages of the rule-making process have mandated time periods, as shown in figure 2. For example, the public comment period recommended by Executive Order 12866 is 60 days. In addition, the interagency comment period managed by OMB requires 90 days, and this review can occur prior to the publishing of both the proposed rule and the final rule. Other stages have no time requirements but also add to the overall length of the process, such as the time required to research, analyze, and draft a proposed rule. Timelines for promulgating rules varied across four finalized SBA rules we reviewed. We selected four statutory provisions requiring SBA to promulgate rules from the NDAAs for fiscal years 2013, 2014, 2015, and 2016 (out of a possible 47 provisions requiring rule making) for review to better understand SBA’s rule-making process. All four of these rules have been finalized by SBA. Table 1 identifies the four rules we reviewed and some basic time frames for each rule. For these four rules, the rule-making process resulted in longer time frames than the required minimums along several metrics. Interagency Review. Three of the four rules we reviewed were identified as requiring the OMB interagency review process, which lasted longer than 90 days in some cases. Of these three rules, one (the Lower Tier Subcontracting rule) was under review with OMB for less than the required 90 day review period (86 days); the other two required 107 and 156 days for this review process. Further, these three rules also underwent an additional interagency review process after SBA had obtained public comments, which required an additional 68 to 75 days each. Public comment period. In addition, SBA officials noted that the public comment period varied in some cases, with extended comment periods being added as necessary. For example, for the All Small Mentor-Protégé rule, SBA initially provided a 60-day comment period, but extended it by an additional 30 days in response to public request. Likewise, for the Limitations on Subcontracting rule, SBA reopened the initial 60-day comment period for an additional 30 days starting about a week after the initial comment period ended. Statutory deadlines. Finally, three of the four rules arose from statutes that required the final rule to be issued within a set period of time. Both the All Small Mentor-Protégé rule and the Advisory Size Decisions rule were required to be issued as final within 270 days of the law’s enactment, while the Lower Tier Subcontracting rule required a final rule to be issued by 18 months after the date of enactment. The All Small Mentor-Protégé rule took 1,300 days from the date of the law’s enactment to the issuance of the final rule, which was 1,030 days past the statutory deadline. The Advisory Size Decisions rule took 770 days, which was 500 days past the statutory deadline. The Lower Tier Subcontracting rule took almost exactly 18 months longer than the statutory deadline. SBA officials noted some factors that may have contributed to certain rules taking longer than anticipated in recent years. They explained that the volume of rule making required of SBA has increased in recent years. Agency officials said they were used to receiving such legislation in stand-alone bills every couple of years until Congress began including rule-making requirements for SBA in NDAAs in fiscal year 2013. In written responses to our questions on the four selected rules, SBA officials noted that the three rules required by NDAA for Fiscal Year 2013 came at a time when they were busy completing rules required by the Small Business Jobs Act of 2010, thereby delaying the start of their work on the new set of rules. In a congressional testimony in February 2016, the Associate Administrator of OGCBD stated that SBA had implemented over 25 provisions from the Small Business Jobs Act of 2010 and was making progress on the remaining provisions. OMB officials stated that the timeliness of SBA’s rule makings is not unusual and has not raised any concerns. Additionally, SBA officials noted that some of the rules contained other statutory requirements that required additional work. Specifically, the All Small Mentor-Protégé program and the Limitations on Subcontracting rules included changes that affected Indian tribes, Alaska Native corporations, and Native Hawaiian organizations, which required SBA to consult with these groups in accordance with Executive Order 13175. Also, the Lower Tier Subcontracting rule required SBA, the General Services Administration, and the Department of Defense to submit a plan for implementing the rule to both House and Senate committees; the agencies were required to complete planned actions within 1 year after enactment, and SBA was required to issue any regulations necessary, including the completion of a FAR amendment, within 18 months after enactment. However, SBA officials said that the FAR Council generally will not open a FAR case until SBA has issued a final rule, making the accomplishment of this statutory deadline impracticable. SBA officials also cited some delays in rule making as a result of the recent presidential administration transition. Generalizing about time frames in the rule-making process is difficult because the process varies from rule to rule. In an April 2009 report on the effect of procedural and analytical requirements on federal agencies’ rule-making processes, we found variation in the length of time required for the development and issuance of final rules, both within and across agencies. We identified several factors, including the complexity of the issues addressed; priorities set by agency management that can change; and the amount of internal and external review required. Additionally, SBA officials noted that some rules receive many more comments than others, which can add significantly to the timeline. Various approaches exist for measuring the length of time required to develop and issue final rules, but they have limitations. Initiation to final publication. The most complete measure of the length of time for a rule making is to measure the period from initiation of the rule to final publication, but this approach is limited by disagreement as to when a rule-making process begins. According to our prior work, while agency officials generally agreed that the publication of a final rule marked the end of the rule-making process, identifying when a rule making begins is less definite. Specifically, while each agency identifies milestones that mark the initiation of a rule making, they may not factor in the time spent researching the rule makings or developing policy for the rule, as well as time spent researching rule makings related to the rule in question. Publication in Federal Register to final publication. Another approach to measuring the time required for a rule making is to use two rule-making milestones common among federal agencies: (1) publication of a proposed rule in the Federal Register and (2) publication of a final rule. However, this measurement is incomplete, as it ignores the potentially substantial length of time necessary for regulatory development, according to our April 2009 report. In that report, our case study of 16 rules suggested that this time frame ranged from approximately 6 months to 5 years, while the total rule- making time for the two rules on either end of that range varied from slightly over 1 year to 13 years, respectively. For our current review of four selected SBA rules, the time between the publication of proposed and final rules ranged from 7.5 months to 17.5 months. Mandated timeline. Finally, another approach is to evaluate each rule against its mandated timeline, although this requirement does not exist for all rules. However, the various factors that can affect rule- making timeliness can limit the meaningfulness of this analysis. For example, although our April 2009 report found that rules that are a management priority or that have a statutory or judicial deadline may move more quickly through the rule-making process while other rules are set aside, this analysis must factor in the overall volume of required rule makings and the relative priorities and rule-making caseload for the agency. We are not making new recommendations in this report and maintain that SBA should implement our prior reports’ recommendations. We provided a draft of this report to SBA for review and comment. The agency provided technical comments that we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Administrator of the Small Business Administration, and the Director of the Office of Management and Budget. The report is also available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix III. This report examined (1) the field-office and reporting structure the Small Business Administration (SBA) uses to implement government contracting and business development and the benefits and challenges posed by these structures; (2) progress SBA has made to strengthen its certification processes; and (3) the timeliness of SBA’s rule-making process. To examine SBA’s field-office and reporting structure for implementing its government contracting and business development programs, we reviewed SBA documentation on its organizational structure. In addition, we obtained and reviewed a March 2015 study on SBA’s organizational structure conducted by a third-party consultant. We also reviewed academic literature on organizational theory to provide context for understanding SBA’s organizational structure and leading practices for implementing changes to organizational structure. We conducted this literature search on organizational structure and theory and reviewed these articles to determine the extent to which they were relevant to our engagement and appropriate as evidence for our purposes. We also observed two online webinars hosted by SBA on government contracting for small businesses to better understand SBA’s communications to firms about its government contracting services. Further, we reviewed prior GAO and SBA Office of Inspector General (OIG) reports from 2008 through 2016 for findings related to SBA’s organizational structure and the benefits and challenges posed by its current structure. In addition, we interviewed SBA staff from the following headquarters offices: Office of Government Contracting and Business Development, Office of Certification Eligibility, Office of Field Operations, Office of the Chief Human Capital Officer, and Office of Policy, Planning, and Liaison, as well as the Administrator’s Chief of Staff. We interviewed SBA staff to obtain their perspectives on SBA’s current organizational structure with respect to government contracting and business development programming. To examine the progress SBA has made to strengthen its processes for certifying small businesses as eligible to participate in its programs, we reviewed relevant laws, regulations, and agency guidance. We specifically examined SBA’s certification processes for its 8(a) Business Development and Historically Underutilized Business Zone (HUBZone) programs, as well as its self-certification processes for the Women- Owned Small Business (WOSB) and Service-Disabled Veteran-Owned Small Business (SDVOSB) programs. We also interviewed SBA headquarters staff to understand these different certification processes and to obtain their perspective on the progress that has been made to strengthen these processes. In addition, we reviewed prior GAO and SBA OIG work related to SBA’s certification processes to identify progress that has been made as well as opportunities to further strengthen these processes. See appendix II for more information on the status of selected prior GAO recommendations to SBA. To examine the timeliness of SBA’s rule making, we reviewed relevant laws, regulations, executive actions, and SBA guidance. We also reviewed four statutorily mandated SBA rules, selected from a possible 47 provisions in the National Defense Authorization Acts of fiscal years 2013, 2014, 2015, and 2016 that potentially required SBA to draft and implement rules. We selected these rules as examples of mandatory rule making. We reviewed the public documentation for each rule, including any proposed or final rules, as well as the timelines associated with each rule. We also interviewed SBA staff and staff from the Federal Acquisition Regulatory (FAR) Council within the Office of Management and Budget (OMB) to understand SBA’s regulatory drafting process, the Federal Acquisition Regulation (FAR) process, and the coordination between SBA and the FAR Council. Finally, we reviewed prior GAO reports on rule making to understand the federal rule-making process and factors affecting the timeliness of agency rule making. We conducted this performance audit from August 2016 to June 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following table summarizes the status of our recommendations from HUBZone, 8(a), and WOSB performance audits and investigations as of May 2017. We classify each recommendation as either open (the agency has not taken steps to implement the closed, not implemented (the agency decided not to take action to implement the recommendation). The recommendations are listed by report. In addition to the individual named above, Marshall Hamlett (Assistant Director), Nathan Gottfried (Analyst In Charge), JoAnna Berry, Tim Bober, Farrah Graham, Jennifer Kamara, Jessica Sandler, Jennifer Schwartz, and Jena Sinkfield made major contributions to this report.

Summary: SBA's OGCBD administers a business development program and further promotes small business participation in federal contracting through a variety of other programs. A House Committee Report accompanying the National Defense Authorization Act for Fiscal Year 2017 included a provision for GAO to examine the operations of SBA's OGCBD. GAO examined (1) the field-office and reporting structure OGCBD uses to implement its government contracting and business development programs, (2) progress OGCBD has made to strengthen its processes for certifying small businesses as eligible to participate in its programs, and (3) the timeliness of SBA's rule-making process. GAO reviewed documentation related to SBA's organizational structure and certification processes; relevant laws and regulations; SBA program guidance; and previous GAO reports. GAO interviewed SBA and OMB officials. GAO reviewed four statutorily mandated SBA rules, which were selected from 47 provisions in the National Defense Authorization Acts for fiscal years 2013, 2014, 2015, and 2016 as examples of mandatory rule making. GAO makes no new recommendations in this report, and maintains that SBA should implement prior recommendations. SBA's technical comments on GAO's draft report are incorporated as appropriate. The Office of Government Contracting and Business Development (OGCBD) at Small Business Administration (SBA) headquarters sets policies for SBA's business development and government contracting programs, and SBA field office staff help to implement these programs at the local level. The reporting relationships between field staff and SBA headquarters vary depending on the program. For example, field staff who implement government contracting programs report to OGCBD, while most staff who implement the 8(a) business development program report to the Office of Field Operations (OFO), which oversees SBA's field offices. SBA officials told GAO that this reporting structure, in which some field staff implement OGCBD programs but report to OFO, offers some benefits—for example, it allows these staff to support the goals of OGCBD programs as well as those of the individual field offices. However, officials also said the reporting structure can result in inconsistent program delivery. They described recent steps to improve communication between OGCBD and field staff, but it is too soon to tell if these steps will be effective. SBA has taken some steps to address weaknesses GAO and the SBA Office of Inspector General (OIG) have identified in its processes for certifying small businesses as eligible to participate in SBA programs, but some recommendations remain open. For example, GAO found in 2015 that SBA had not required firms seeking recertification for the Historically Underutilized Business Zone (HUBZone) program to submit any information to verify continued eligibility and instead relied on firms' attestations of continued eligibility. GAO recommended that SBA assess the HUBZone recertification process and add additional controls; SBA had not yet implemented this recommendation as of May 2017. SBA's OIG also found in 2016 that SBA managers overturned lower-level reviewers' decisions to deny firms admission to the 8(a) program without documenting in the information system how eligibility concerns were resolved. SBA's OIG recommended that SBA clearly document the justification for approving or denying firms. In response, SBA stated that managers are now required to document decisions in the system that differ from those of lower-level reviewers. A number of legal requirements and the volume of required rule makings, among other factors, affect the timeliness of SBA's rule-making process. Certain stages of the rule-making process have mandated time periods, such as the required 90-day interagency review process for certain rules. Various approaches exist for measuring the length of time required to develop and issue final rules, but they have limitations. For example, in measuring the period from rule initiation to final publication, agencies may differ on when they mark initiation. For four finalized SBA rules GAO reviewed, the time from publication of the proposed rule to publication of the final rule varied from 7.5 months to 17.5 months. SBA officials noted that an increase in the number of statutorily mandated rules in recent years has contributed to delays in the agency's ability to promulgate rules in a more timely fashion. Office of Management and Budget (OMB) officials GAO spoke with stated that the length of time for SBA's rule makings is not unusual and has not raised any concerns.