The HUBZone Act of 1997 (which established the HUBZone program) identified HUBZones as (1) qualified census tracts, which are determined generally by area poverty rate or household income; (2) qualified nonmetropolitan counties, which are determined generally by area unemployment rate or median household income; and (3) lands meeting certain criteria within the boundaries of an Indian reservation. Congress subsequently expanded the criteria for HUBZones to add former military bases, counties in difficult development areas outside the continental United States, and certain areas affected by disasters. According to SBA officials, 5,306 firms were HUBZone certified as of July 1, 2018. As of that date, there were 20,154 HUBZone qualified census tracts, 834 HUBZone qualified non-metropolitan counties, 125 HUBZone base realignment and closure areas, 593 HUBZone Native American lands (Indian lands), and 95 HUBZone qualified disaster areas (87 qualified disaster census tracts and 8 qualified disaster non-metropolitan counties). The HUBZone program provides certified small businesses located in designated areas with contracting opportunities in the form of set-asides, sole-source awards, and price-evaluation preferences. A set-aside restricts competition for a federal contract to specified contractors. For example, competition may be restricted to SBA-certified HUBZone businesses if there is a reasonable expectation of at least two SBA- certified HUBZone bidders and a fair market price. A sole-source award is a federal contract awarded, or proposed for award, without competition. Also, in any full and open competition for a federal contract, the HUBZone price evaluation preference allows the price that a HUBZone firm offers to be deemed lower than the price of another offeror (if the HUBZone firm’s offer is not more than 10 percent higher than the other offer and the other offeror is not a small business concern). To be certified to participate in the HUBZone program, a firm must meet the following criteria: when combined with its affiliates, be small by SBA size be at least 51 percent owned and controlled by U.S. citizens, or owned by an Indian Tribal Government, Alaska Native Corporation, Community Development Corporation, or small agricultural cooperative; have its principal office—the location where the greatest number of employees perform their work—in a HUBZone; and have at least 35 percent of its employees reside in a HUBZone. In a 2008 report, we found that SBA had relied on information that firms entered into an online application system called the HUBZone Certification Tracking System to indicate they met the size, ownership, location, and employee residence standards. At the time, SBA performed limited verification of the self-reported information. Although agency staff could request additional supporting documentation, SBA did not have specific guidance or criteria for such requests. Thus, we recommended that SBA develop and implement guidance to more routinely and consistently obtain supporting documentation from applicant firms. SBA agreed with the recommendation and changed its certification procedures. Since fiscal year 2009, SBA has required all firms applying for HUBZone certification to provide supporting documentation about their size, ownership, location, and employees’ residence, which the agency then is to review to verify the firm’s eligibility for the program. According to SBA officials, the current initial certification process has two components: (1) submission and review of an online application, which is processed by SBA through the HUBZone Certification Tracking System; and (2) submission of corroborative documentation, which SBA processes through a document review. The tracking system contains information on firms that apply to the HUBZone program, as well as on certified firms that apply for recertification. Firms wishing to remain in the program must recertify their continued eligibility to SBA every 3 years. The tracking system automatically identifies firms that are due for recertification and sends notifications to those firms. In 2015, we reported that SBA implemented controls for certification, but generally did not require firms seeking recertification to submit any information to verify continued eligibility. Instead, the agency relied on firms’ attestations of continued eligibility. According to SBA officials at the time, they did not believe they needed to request supporting documentation from recertifying firms because all firms in the program had undergone a full document review. We noted that SBA could apply a risk-based approach to its recertification process to review and verify information from firms that appeared to pose the most risk to the program. We concluded that recertification essentially remained a self-certification process. We recommended that SBA reassess its recertification process and add additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information. SBA agreed with our recommendation and noted it would assess the process. In March 2017, we reported that SBA planned to address our recommendation using a technology solution. According to federal internal control standards and GAO’s fraud risk framework, managers in executive branch agencies are responsible for managing fraud risks and implementing practices for combating those risks. When fraud risks can be identified and mitigated, fraud may be less likely to occur. Federal internal control standards call for agency management officials to assess the internal and external risks their entities face as they seek to achieve their objectives. The standards state that management should consider the potential for fraud when identifying, analyzing, and responding to risks. Risk management is a formal and disciplined practice for addressing risk and reducing it to an acceptable level. In July 2015, we issued the fraud risk framework, which provides a comprehensive set of key components and leading practices that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The Fraud Reduction and Data Analytics Act of 2015 required the Office of Management and Budget to establish guidelines for federal agencies to create controls to identify and assess fraud risks and design and implement antifraud control activities. In July 2016, the Office of Management and Budget issued guidelines that, among other things, affirm managers should adhere to the leading practices identified in GAO’s fraud risk framework. The National Defense Authorization Act for Fiscal Year 2018 includes a number of provisions relating to the HUBZone program. For example, the act requires SBA (by January 1, 2020) to verify the accuracy of documentation provided by a HUBZone firm seeking recertification to determine whether the firm remains qualified for HUBZone certification. The act also requires SBA to begin conducting examinations of qualified HUBZone firms by January 1, 2020, using a risk-based analysis to select firms to be examined. According to the act, these risk-based examinations are intended to ensure that each firm examined meets the program requirements for certification. The act also specifies that any small business that SBA determines to have misrepresented its status as a qualified HUBZone firm be subject to liability for fraud. On June 16, 2016, SBA announced it had revised the definition of qualified census tracts eligible to be designated as HUBZones to provide more opportunities for firms in Puerto Rico. Previously, in addition to poverty rate and income, SBA applied a statutory population cap that limited the number of eligible census tracts. According to the announcement, SBA had determined that the 20 percent population cap was not in keeping with the spirit and intent of the HUBZone program. On June 30, 2016, PROMESA authorized an exemption to the 20 percent cap for HUBZone designations in Puerto Rico for a limited time (10 years or until the date on which the Financial Oversight and Management Board for Puerto Rico ceased to exist, whichever came first). It also required SBA to promulgate regulations to implement the exemption. SBA promulgated the regulations, which became effective December 22, 2017. By lifting the population cap in June 2016, SBA increased the number of eligible census tracts in Puerto Rico by 516 (from 260 to 776). As a result, nearly all of Puerto Rico now qualifies as a HUBZone (see fig.1). In 2017, two major hurricanes (Irma and Maria) hit Puerto Rico. Hurricane Irma skirted Puerto Rico and left more than 1 million people without power. Hurricane Maria, a Category 4 hurricane, made landfall and caused catastrophic damage. For instance, Hurricane Maria wiped out the power grid, resulting in outages across Puerto Rico that continued for months after the storm. The majority of the island had its power restored by April 4, 2018, according to the Department of Energy. However, the power grid remains fragile. For example, Puerto Rico experienced an island-wide outage on April 18, 2018. In response to the PROMESA provision to implement a risk-based approach to HUBZone certification and recertification, SBA adopted certification and recertification criteria and guidance on March 27, 2017, for requesting and verifying information. Since 2009 and in response to a prior GAO recommendation, SBA has required and reviewed documentation from all small businesses seeking initial certification to show compliance with HUBZone eligibility requirements. The criteria and guidance adopted by SBA in March 2017 did not change the HUBZone certification process. SBA’s internal guidance directs staff to review and confirm the accuracy of all documentation provided by the firms applying for HUBZone certification. However, the 2017 guidance and criteria introduced some documentation requirements to the recertification process. (Before March 2017, firms seeking HUBZone recertification were not required to submit documentation to demonstrate continued compliance with eligibility requirements.) Currently, any certified firm seeking recertification that received $1 million or more in HUBZone contract dollars since its last certification or recertification has to demonstrate compliance with the 35 percent HUBZone employee residency and principal office requirements. More specifically, under the March 2017 guidance and criteria, certified HUBZone small business concerns that have received $1 million or more in HUBZone contract dollars since their initial certification or most recent recertification must submit (1) a list of all current employees, identifying the name of the employees, their addresses, the number of hours they worked per month, and the location at which they performed their work; and (2) payroll documentation. HUBZone firms seeking recertification that have not received $1 million in HUBZone contract dollars are not required to submit documentation supporting continual eligibility for the program. SBA officials stated that they had completed a risk assessment of their HUBZone recertification process to develop the March 2017 guidance and criteria. In our 2015 report, we found SBA did not require firms to submit supporting documentation as part of the recertification process—in effect, firms self-certified. We recommended that SBA conduct an assessment of the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information. However, as of July 31, 2018, SBA had not provided documentation of when the risk assessment was performed or of what risks were identified and considered in developing the criteria and guidance. SBA officials stated that out of necessity, given their current information system and staffing resources, they chose the $1 million threshold as the only criterion for their risk-based approach. As of July 31, 2018, SBA also had not provided documentation of what analysis was performed to establish the $1 million threshold. According to SBA officials, the threshold was determined based on the belief that, when a firm received contract awards over $1 million, it increased opportunity for the firm to fall out of compliance with HUBZone requirements. SBA officials noted that they plan to review the current threshold at the end of fiscal year 2018 and that the threshold amount will likely decrease because a relatively small number of firms have exceeded the $1 million threshold. Based on our analysis of Federal Procurement Data System- Next Generation data, we estimated that from fiscal year 2015 through fiscal year 2017 about 9 percent of HUBZone firms nationally exceeded the $1 million threshold. SBA officials also noted that the agency has been developing a new information system to replace the current certification tracking system. According to SBA officials, the new system will help simplify the application process and allow firms to submit additional documentation more easily. SBA officials said the 2017 criteria and guidance will be built into the parameters of the new information system, which will allow SBA to expand the review of documentation submitted by firms seeking recertification. Officials have stated that subject to funding and resources, the HUBZone Certification Tracking System is scheduled to be decommissioned in fiscal year 2019. In the past, SBA has implemented a number of actions to better ensure that only eligible firms participate in the HUBZone program and to address internal control weaknesses that we have identified in previous GAO reports. However, in 2015, we found that SBA lacked key controls for its recertification process. Specifically, SBA did not require firms to submit supporting documentation as part of the recertification process—in effect, firms self-certified. We reported that by not routinely requiring and reviewing key supporting documentation from recertification applicants, SBA was missing an additional opportunity to reduce the risk that ineligible firms obtain HUBZone contracts. We recommended that SBA conduct an assessment of the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information. Standards for Internal Control in the Federal Government state that management should identify, analyze, and respond to risks related to achieving the defined objectives of the program. Additionally, the standards state that management should use a risk assessment to identify and analyze risks related to achieving the defined objectives to form a basis for designing risk responses. Once identified, management can analyze the identified risks to estimate their significance and design responses to the analyzed risks. Similarly, according to GAO’s fraud risk framework, leading practices for managing fraud risk include identifying inherent fraud risks affecting the program, assessing the likelihood and impact of inherent fraud risks, and examining the suitability of existing fraud controls. The Fraud Reduction and Data Analytics Act of 2015 states that agencies shall conduct an evaluation of fraud risks using a risk-based approach, and then design and implement financial and administrative control activities to mitigate identified fraud risks. Additionally, as discussed above, the National Defense Authorization Act for Fiscal Year 2018 requires that SBA perform examinations of HUBZone firms using a risk-based selection process. As we reported in 2015, the characteristics of firms and the status of HUBZone areas—the bases for program eligibility—can often change, and need to be monitored. We continue to believe that conducting a risk assessment of the recertification process would help inform a risk-based approach to reviewing and verifying information from firms that appear to pose the most risk to the program. For example, a risk assessment could help inform SBA’s planned review of the current threshold for requesting and verifying information from firms seeking HUBZone recertification. Our review of 12 case files for Puerto Rican firms that recently received HUBZone certification found incomplete documentation for certification reviews (and by extension, recertification reviews) and undocumented procedures. SBA also did not consistently follow its procedures to complete three distinct levels of review when approving the 12 firms for certification. Representatives of firms in Puerto Rico with whom we spoke said certification was generally straightforward, but identified some challenges, including with providing documentation. We found that all 12 cases we reviewed in a non-generalizable sample of Puerto Rican firms that had received HUBZone certification between March 2017 and March 2018 had complete documentation to demonstrate that the primary office was located in a HUBZone. However, we also found that documents were missing, illegible, or did not corroborate the information claimed regarding employees’ residency for 9 of 12 firms that we reviewed. We focused on the document review process for the principal office location and the employee residency requirements because, according to SBA’s March 2017 guidance for the certification and recertification processes, firms must corroborate their compliance with these requirements at both certification and recertification. In addition, SBA officials told us that the document review process is essentially the same for firms seeking certification as it is for firms seeing recertification. We also reviewed the files of two HUBZone firms in Puerto Rico that were subject to recertification between March 2017 and March 2018, but neither met the threshold to trigger a document review under the updated criteria and guidance. SBA’s guidance for the certification process requires firms to submit documentation so that SBA can verify that a firm meets the employee residency and principal location requirements. The documentation must show that each individual is an employee of the firm (payroll documentation), each individual asserted to be a HUBZone resident lives at the address they claim (proof of address, such as a driver’s license), and the address is in a HUBZone (copy of a HUBZone map indicating the employee and his or her address), and the firm’s primary office is located in a HUBZone (such as a copy of a lease or rental agreement and list of employees who work there). Additionally, SBA’s internal policy manuals describe procedures that analysts are to follow in reviewing and verifying these documents, including the types of documents that firms may submit to demonstrate eligibility, and scenarios in which analysts should request additional information or clarification from the firm (for example, if a driver’s license is expired). For 9 of 12 cases we reviewed, SBA lacked complete documentation to verify that every employee asserted to be a HUBZone resident lived in a HUBZone. That is, although SBA analysts contacted firms during the certification process to obtain additional documentation, and firms responded to the requests, SBA analysts still had incomplete information for 9 of the 12 cases at the time they approved the firms. In 5 of these 9 cases, the firm would not be eligible for HUBZone certification if the SBA analyst had not counted employees for which documentation was missing or did not corroborate the information claimed regarding an employee’s address. Specifically, in 3 cases, the address on the employee’s identification for at least one employee did not match the address at which the firm claimed the employee lived. in 3 cases, the identification for at least one employee was expired. in 1 case, the copies of the HUBZone maps did not indicate to which employees they referred. in 1 case, payroll documentation demonstrating that individuals were employees of the firm was missing. in the other 4 cases, the firm still would be eligible for HUBZone certification (would meet the 35 percent residency requirement) even if the analyst had not counted the employee for which documentation was missing or illegible (1 case) or for which identification did not match the claimed residency address (4 cases). We also identified an inconsistency when reviewing the case files for the only Puerto Rican HUBZone firm recertified between June 2017 and May 2018. Specifically, the firm reported on its application that it had zero employees, but also claimed 19 of its employees lived in a HUBZone. The firm did not provide any supporting documentation because it did not meet the threshold in the new recertification criteria to require a document review. SBA officials said this likely resulted from a display error in the online system. SBA officials said that they did not contact the recertifying firm because the firm was not required to submit corroborating documentation. However, without confirmation of the correct total number of employees, SBA analysts would not be able to determine the firm’s compliance with the employee residency requirement (35 percent living in a HUBZone) and therefore would not be able to determine the firm’s eligibility to continue HUBZone participation. SBA officials explained how they handled incomplete information provided by firms by describing other procedures that analysts followed in these cases. For example, if any employee’s address did not match across the firm’s employee list, the employee’s identification, or the HUBZone map, the analyst reviewing the firm’s application would request clarification and enter the address from the identification into the current HUBZone map. Or if the address could not be plotted, the analyst would presume the employee lived in a HUBZone if the broader geographic area on their identification (such as zip code) was clearly in a HUBZone. SBA officials said this approach is useful for applications from firms in Puerto Rico, because of difficulties with mapping addresses in the territory. SBA officials also said that if a firm did not provide documentation for an employee or SBA could not verify it, but the firm clearly met the 35 percent resident requirement, the analyst would not follow up with additional documentation requests and not count that employee as a HUBZone resident. However, these procedures are not documented in SBA’s internal written policies for certifying HUBZone firms and analysts did not document their use of these procedures in the case files we reviewed. Specifically, the policy manuals do not include certain procedures SBA officials explained to us they used for the document review process, such as assumptions of eligibility for addresses located in a broader geographic area that is clearly a HUBZone. SBA has not updated its three internal policy manuals since 2014, 2010 and 2007, respectively. According to SBA officials, analysts rely on oral direction from the HUBZone program director or deputy to review and process HUBZone certifications and recertifications to supplement outdated policy documents. Internal control standards state that management should document in policies the internal control responsibilities of the organization. Because SBA has not updated its internal policy manuals, analysts who review applications for HUBZone certification and recertification may not be consistently following applicable internal policies and procedures. As a result, management does not have reasonable assurance that analysts are following procedures correctly to obtain and review all of the required documents from firms. Without such review, SBA may not have reasonable assurance that firms meet the eligibility criteria for HUBZone participation—which increases the risk of ineligible firms participating in the program. Because SBA officials told us that firms seeking recertification that meet the threshold for additional document review undergo essentially the same reviews as firms seeking certification, the gaps in certification cases that we observed suggest that gaps are possible in recertification as well. SBA did not consistently follow its quality review procedures to complete three distinct levels of review when approving the 12 Puerto Rican firms in our non-generalizable sample for certification. In 4 of 12 cases, one person reviewed the application for two levels of review; in the other 8 cases, three different analysts reviewed the application. We found that SBA notified all 12 firms of their approval in writing, in accordance with its policy. SBA’s internal policy states that the certification process has three levels of review: (1) an analyst reviews the application documents and makes a recommendation to approve or deny the firm, (2) a senior analyst reviews the application and the first analyst’s recommendation, and (3) the program director or deputy finalizes the approval or denial and notifies the firm of the decision. The three levels of review are intended to provide quality assurance. For example, the second analyst reviews the case file and the first analyst’s recommendation for completeness, accuracy, and consistency with eligibility criteria. SBA officials told us that, in some cases, one individual’s review may count as two of the three levels of reviews in order to make the most efficient use of available analyst capacity. SBA officials said the deputy director reviewed several applications from Puerto Rican firms, including the four cases we identified, as part of work to develop an application screening tool and to engage the Puerto Rico district office when processing applications from firms in Puerto Rico. These reviews were counted as two of the three levels of review. Officials said that in these cases, the program director completes the final review and should annotate the case file notes about the quality assurance actions that were taken. In three of the four cases, the program director noted that she completed the final review and approval but not what quality assurance actions were taken; the deputy director completed both the second and final review in the other case. SBA officials described the third-level review (final approval or denial) as a high-level review to ensure no questions or unresolved matters are outstanding in order to approve or deny the application. Therefore, it is not likely that the program director would be reviewing supporting documents to identify any problems that could be identified if an additional analyst conducted a second-level, quality assurance review. Internal control standards state that management should design control activities at various levels with a segregation of duties, and periodically review its procedures and associated internal control activities for effectiveness. Management should also monitor its internal control system through ongoing monitoring to assess the quality and effectiveness of the internal control system’s performance over time. SBA provided an assurance letter prepared in response to the Federal Managers Financial Integrity Act that stated the agency evaluated the Office of HUBZone’s internal controls and concluded the controls were effective. However, it is not known to what extent SBA reviewed staff’s compliance with certification and recertification quality review procedures as part of this assessment, because the letter does not describe what steps SBA took to conduct the evaluation. Without reviewing staff compliance with certification and recertification procedures, SBA lacks reasonable assurance that analysts follow such procedures and that internal controls function effectively. This increases the risk that ineligible firms could receive HUBZone certification and thus contracting preferences to which they are not entitled. Representatives of nine HUBZone firms we interviewed in Puerto Rico were not aware of changes made to the recertification process, but said that the certification process they followed was straightforward and generally easy. However, they reported some challenges, including with documentation. Representatives of most of the firms said that the most difficult part of the certification process was documenting the address for their primary office location and employees’ residences to show they are located in a HUBZone. They said this is time-consuming and tedious, especially for firms with many employees. Although they felt that SBA’s HUBZone mapping software had improved, they said the formatting of addresses in Puerto Rico creates a challenge, consistent with what we reported in 2017. One representative described having to pinpoint locations manually in Google Maps to obtain geographic coordinates, and then enter the coordinates into SBA’s HUBZone map instead of street addresses. Other representatives noted that some of their employees have informal living arrangements and cannot easily provide proof of address. Some representatives said that they struggled with the specific time frames that payroll documentation must cover. SBA requires firms to submit payroll documentation for the pay period that includes the date of their application and a sufficient number of preceding payrolls to cover a 4-week period, but firms said it was difficult to submit payroll reports at exactly the right time to meet this requirement. According to representatives from HUBZone firms and two economic development organizations we interviewed, some challenges with certification may be unique to firms in Puerto Rico, including the address format issue described above. Representatives from one firm and the economic development organizations said that some firms in Puerto Rico may face language barriers if Spanish is their primary language, or if they lack formal documentation required for certification, such as not having computerized records. The 2017 hurricanes also created several challenges for firms. For example, some firms did not have electricity and closed for several months. Firms that closed while trying to obtain HUBZone certification could not respond to follow-up requests from SBA immediately or provide documentation of their business operations for the time period in which they were affected. Representatives from firms we interviewed said they had little contact with SBA other than in relation to compliance. Although some have attended SBA events, representatives said they generally worked with SBA partner organizations, such as the Federal Contracting Center and Small Business and Technology Development Center to obtain assistance with gaining HUBZone certification and applying for federal contracts. Representatives from three firms we interviewed said that officials from SBA visited their offices to provide technical assistance support. According to SBA officials in Washington, D.C., they have improved their communications with firms and increased outreach for the HUBZone program in recent years. For example, the HUBZone tracking system automatically generates emails to firms, such as reminders that they are due for recertification, which according to SBA officials, has eliminated the backlog of recertifications on which we reported in February 2017. Representatives from the Puerto Rico District Office also said they increased promotion of the HUBZone program in recent years through monthly events and seminars on all SBA programs across Puerto Rico, including a seminar on obtaining HUBZone certification. Representatives from the district office said they are not involved with the certification and recertification processes, but provide support by conducting from three to six site visits to HUBZone firms annually in Puerto Rico and the U.S. Virgin Islands. An increase in HUBZone set-aside contracts could theoretically help deliver economic impact to Puerto Rico, but it is likely too soon to assess larger-scale economic benefits resulting from HUBZone program expansion in Puerto Rico as of June 2018. From fiscal years 2006 through June 2018, the share of HUBZone set-aside contracts as a percentage of small business contracts in Puerto Rico has remained low despite sharp increases in the number of HUBZone firms and overall federal contracting in Puerto Rico. Over this period, small businesses in Puerto Rico have been winning a large and increasing percentage of total federal contracting obligations in Puerto Rico. Firms, economic development organizations, and SBA representatives said any impacts of HUBZone expansion in Puerto Rico may not yet be observable due to hurricane-related setbacks. They also identified longer-standing challenges that Puerto Rican firms have faced in obtaining HUBZone set- aside contracts consistent with those we identified in 2017. In 2018, SBA established a procurement center representative (PCR) in Puerto Rico, which the agency expects will help address some of those challenges. Based on our analysis as of June 30, 2018, it appears that larger-scale economic benefits from HUBZone expansion have not been realized (it may be too early to assess the impact of program expansion). While HUBZone certification alone likely would not have a direct economic impact (such as on job creation) in Puerto Rico, the expansion of HUBZones in Puerto Rico, which now cover nearly the entire island, gives opportunities to more firms to qualify for and pursue preferential contracting opportunities. The number of HUBZone firms has risen since the expansion—from 20 in September 2016 to 101 as of June 30, 2018. The program could help deliver economic impacts if HUBZone firms received contract awards as a result of contract preferences such as set- aside or sole-source contracts. For instance, employees hired to fulfill HUBZone set-aside contracts could represent jobs created in Puerto Rico (if those contracts otherwise would have been awarded to a firm outside Puerto Rico). However, if the contract otherwise would have been awarded to another Puerto Rican firm, the new jobs would represent an economic transfer, not jobs created. Our analysis of HUBZone set-aside contracts in Puerto Rico indicated that a few, newly certified HUBZone firms received set-aside contracts, which can be a source of job creation. Six of the nine firms that received HUBZone set-aside contracts in fiscal years 2017 and 2018 (through June 2018), totaling $5.1 million, were certified after the 2016 program expansion. One newly certified HUBZone firm that we interviewed said that program expansion resulted in the firm becoming HUBZone- eligible. The firm’s representative said that it obtained a 5-year HUBZone set-aside contract for $700,000, which resulted in the firm hiring six employees to fulfill the contract. But HUBZone set-aside contract obligations have remained largely unchanged in recent years, and firms face both temporary and longer- standing challenges in accessing and winning contract awards, as we discuss later in this section. For a description of contracting trends in Puerto Rico, see appendix II. Based on our analysis, federal contracts to businesses in Puerto Rico increased from $355 million in fiscal year 2015 to $841 million in fiscal year 2018 (through June 2018). Similarly, federal contracts to small businesses in Puerto Rico increased from $244 million to $688 million in the same period (see fig. 2). Although HUBZone set-aside contract obligations have remained largely unchanged in recent years, small businesses in Puerto Rico also have been winning a large and increasing percentage of total federal contracting obligations in Puerto Rico. Specifically, federal contract obligations to small businesses located in Puerto Rico as a percentage of total federal contract obligations in Puerto Rico increased from 69 percent in fiscal year 2015 to 82 percent in fiscal year 2018 (through June 2018). A significant portion of the increase in overall contracting and small business contracting to Puerto Rican firms in fiscal year 2018 (through June 2018) was related to hurricane relief. Specifically, we calculated that 55 percent of total federal contracting obligations in Puerto Rico and 64 percent of obligations awarded to Puerto Rican small businesses in fiscal 2018 were associated with hurricane relief. While the obligations for federal contracting to small businesses in Puerto Rico sharply increased in recent years, as did the number of HUBZone firms, the share of HUBZone set-asides as a percentage of small business contracts in Puerto Rico remained low and relatively unchanged (see fig. 3). HUBZone set-aside contract obligations increased from negative $20,881 in fiscal year 2016 to $3.8 million in fiscal year 2017 (1 percent of the total value of small business contracts in Puerto Rico). The set-aside obligations dropped to $1.7 million through June 2018 (0.2 percent of the total value of small business contracts in Puerto Rico). Representatives of two economic development organizations that we interviewed stated that continued low use of HUBZone set-aside contracts by contracting agencies could subsequently decrease firms’ willingness to participate in the HUBZone program in Puerto Rico. Representatives of firms and two economic development organizations noted that the process of monitoring, identifying, and applying for HUBZone set-aside contracts is time consuming and without the availability of set-aside contracts program participation may not be worthwhile for firms in Puerto Rico. Representatives of firms and two economic development organizations and SBA officials in Washington D.C. and the Puerto Rico District Office told us that use of HUBZone set-aside contracts and any resulting economic impacts of HUBZone expansion in Puerto Rico may not yet be observable because of temporary challenges, such as advance contracts and outmigration due to the 2017 hurricanes. One temporary challenge they cited was the use of advance contracts by agencies in response to the 2017 hurricanes. In advance contracts, an agency establishes contracts before a disaster for goods and services typically needed during a disaster response. Such contracts may prevent contracting officers from establishing a HUBZone set-aside on contracts awarded for disaster response and recovery. For example, a representative from one firm we interviewed said that in the wake of the 2017 hurricanes it had ample supplies of a vaccine in high demand on the island. The firm’s representative thought that contracting officers previously established an advance contract with a company in the continental United States to supply the vaccine. Therefore, contracting officers were unable to contract the Puerto Rican HUBZone firm to supply the vaccine to the island. However, SBA officials in the Puerto Rico District Office told us that once advance contracts are completed, the contracting agency can replace the contract with another contract to perform those services, which could be a HUBZone set-aside contract. Representatives of firms and one economic development organization and SBA officials in the Puerto Rico District Office told us that outmigration from Puerto Rico after the 2017 hurricanes reduced the amount of talent and workers available to fulfill contracts. Representatives of one firm said that contracting officers may be concerned that the defection of talent from Puerto Rico could limit firms’ abilities to complete contracts, limiting the contracting officers’ willingness to set aside contracts. However, representatives of firms and one economic development organization said that contracts can be fulfilled by multiple Puerto Rican firms if necessary. Also, representatives of firms and one economic development organization said that people who left the island have started returning and replenishing the workforce. Representatives of firms and two economic development organizations and SBA officials in Washington D.C. and the Puerto Rico District Office also identified longer-standing challenges to increased use of HUBZone set-aside contracts in Puerto Rico, including difficulty meeting procurement requirements, limited knowledge of the federal contracting process, lack of access to contracting officers, and award of contracts to firms outside Puerto Rico. These concerns are similar to those we recognized in our 2017 report on SBA contracting program in Puerto Rico. Representatives of some firms we interviewed stated that procurement requirements for federal contracts (such as performance history for construction contracts) posed challenges for small businesses in Puerto Rico. Representatives of some firms said that as an island, Puerto Rico faces specific challenges in meeting procurement requirements. For example, one firm’s representative said that the construction of a school required a business to demonstrate experience in developing several schools in the past. According to this representative, opportunities to construct schools are limited in Puerto Rico and many Puerto Rican firms would be capable of fulfilling these contracts, but relevant experience constructing similar buildings is not considered as meeting this requirement. In 2017, we reported that the experience of construction businesses in Puerto Rico does not match procurement requirements, which are often standardized to mainland building standards and do not consider unique conditions in Puerto Rico. As a result, firms and associations that we interviewed in 2017 said that agencies’ contracting officers may not consider the experience of Puerto Rican businesses as qualifying. Representatives from four associations that we interviewed in 2017 stated that construction businesses in Puerto Rico demonstrate in their construction plans greater understanding of building requirements in Puerto Rico, such as accounting for tropical climate or the risk of seismic activity, but these factors were not incorporated into federal procurement requirements. Representatives of firms and two economic development organizations and SBA officials in the Puerto Rico District Office said that limited knowledge of the federal contracting process can be a challenge for HUBZone firms in Puerto Rico. One firm’s representative explained that responding to agencies’ requests for information was important because to create a HUBZone set-aside contract a federal agency must demonstrate that at least two firms could compete for the contract. Another firm’s representative said that because it was unaware of the importance of responding to the requests for information, it had not responded to requests for information for any contract opportunities. Firms’ representatives also noted that the process of responding to requests for information and requests for proposals is time consuming and often infeasible because they lack the financial and personnel resources of larger businesses. Firms can obtain information about federal and small business contracting from several sources. Firms’ representatives we interviewed said that they generally seek assistance from SBA partner organizations, such as the Federal Contracting Center and Small Business and Technology Development Center, to gain a better understanding of the contracting process. Officials from SBA’s Puerto Rico District Office said that they hold regular training on contracting programs and how to navigate the contracting process. The District Office also holds one-on-one appointments with businesses to help them navigate the federal contracting process and has offered training on proposal writing. Representatives of firms we interviewed said that obtaining HUBZone set- aside contracts was difficult for small businesses in Puerto Rico partially because of a lack of access to contracting officers. Most firms’ representatives we interviewed said that, similar to obtaining assistance in navigating the contracting process, they seek assistance from SBA partner organizations, such as the Federal Contracting Center and Small Business and Technology Development Center, to identify HUBZone contract opportunities and connect with contracting officers. Firms’ representatives also said that they attend conferences and matchmaking events at which they meet contracting officers; however, they said that this approach has not yet helped them to obtain increased HUBZone set-aside contracts in Puerto Rico. One firm’s representative said that the advice at networking events is that firms should approach contracting officers, but small businesses do not have the contacts to approach contracting officers. Representatives of some firms said that SBA should act as an advocate or facilitator to provide connections between small businesses and contracting officers. Some of the firms’ representatives noted that in the absence of HUBZone set-aside contracts, they tend to pursue subcontracts with companies that have prime federal contracts. Representatives of two economic development organizations we interviewed said that most HUBZone set-aside contracts and most of the hurricane relief-related contracts performed in Puerto Rico were awarded to firms outside Puerto Rico. In 2017, we similarly reported that representatives from four associations stated that challenges such as lack of access to contracting officers and difficulty meeting procurement requirements led to concerns about contracts being awarded to businesses located outside of Puerto Rico for work to be performed in Puerto Rico. Representatives of firms and one economic development organization also pointed out that for some industries, work does not need to be physically performed at the contract location; therefore, Puerto Rican HUBZone firms could be competitive for contracts located in other states. According to firms and one economic development organization, this is especially true in the technology industry, which is well represented in Puerto Rico with multiple HUBZone firms. However, representatives of the Puerto Rican technology firms we contacted noted that they have experienced great difficulty obtaining HUBZone contracts. One firm’s representative suggested that this challenge might be partially due to Puerto Rican firms having less experience than firms outside of Puerto Rico in competing for HUBZone set-aside contracts. To compete for contracts, one firm said that its chief executive officer permanently moved to Washington, D.C., and another firm said its staff travels to Washington, D.C., once a month. In 2018, SBA established a PCR in Puerto Rico and SBA officials said the agency expects that the PCR will help address some of the challenges discussed previously. SBA PCRs work with federal agencies and small businesses to identify contracting opportunities for small businesses. The Puerto Rico PCR said that she plans to hold events for HUBZone firms to help them better understand and navigate the federal contracting process. For example, she plans to hold a Federal Acquisition Regulation “boot camp,” a 40-hour training to educate firms on the federal contracting process. She also stated that through regular interaction with other PCRs and with contracting officers, she can identify and discuss opportunities for HUBZone set-aside contracts for Puerto Rican small businesses. One economic development organization we interviewed said that it is too early to see an effect of the new Puerto Rico PCR, but that they have met with her and have been encouraged by her efforts to date. In 2017, we reported that several stakeholders identified the lack of an SBA PCR in Puerto Rico as a disadvantage for small businesses in Puerto Rico seeking contracts with the federal government. According to a representative from the Federal Contracting Center that we interviewed in 2017, having a PCR in Puerto Rico is important because the PCR can advocate for small businesses there. For example, the PCR can work with contracting officers to determine small business set-asides, make adjustments to procurement requirements, and make agency contracting officers more aware of businesses in Puerto Rico. According to one economic development organization’s representative, the PCR could assist local businesses and promote businesses located in Puerto Rico to federal agencies. Our review of a sample of 12 case files for Puerto Rican firms certified between March 2017 and March 2018 found that SBA lacked complete documentation for one of two requirements we reviewed and did not consistently follow its own procedures for quality control reviews when approving firms. This suggests potential gaps in internal controls for both the certification and recertification processes, as SBA reviews firms’ compliance with program requirements at both certification and recertification. Although SBA policy includes documentation reviews and a quality control process, its internal policy manuals do not reflect all document review procedures, and analysts did not always follow procedures for quality control reviews. SBA has not updated its policy manuals and, it is not known to what extent it has reviewed staff compliance with the quality review procedures. Although SBA provided an assurance letter stating its internal controls are effective, the letter did not describe steps taken in the evaluation. Documenting all procedures would help ensure that analysts consistently follow policy when certifying and recertifying firms. Documented reviews of staff compliance also could serve to identify and remediate any noncompliance with certification and recertification processes. Both actions would serve to strengthen the verification function in the HUBZone program, which is necessary to help ensure that only eligible firms participate in the program. We are making two recommendations to SBA. Specifically: The Administrator of SBA should update the agency’s internal policy manuals for certification and recertification reviews to reflect existing policies and procedures not currently in written guidance. (Recommendation 1) The Administrator of SBA should conduct and document reviews of staff compliance with procedures associated with HUBZone certification and recertification. (Recommendation 2) We provided a draft of this report for review and comment to SBA. In response, SBA provided written comments, which are reproduced in appendix III. SBA also provided technical comments, which we incorporated as appropriate. SBA generally agreed with both of our recommendations. However, SBA disagreed with three of our findings in the draft report. In the draft report, we stated that SBA’s guidance for the certification process requires firms to submit documentation so that SBA can verify that a firm meets the employee residency requirement, including documentation showing that each employee’s address is located in a HUBZone, for employees claimed to be HUBZone residents. We noted that documents were missing, illegible, or did not corroborate the information claimed regarding at least one employee’s residency for 9 of 12 certifying firms that we reviewed. We also stated that in 5 of these 9 cases, the firm would not be eligible for HUBZone certification if the SBA analyst had not counted such employees. In its comments, SBA stated that it is only required to verify that no fewer than 35 percent of a HUBZone firm’s employees reside in a HUBZone. SBA asserted that it had sufficient documentation to conclude that at least 35 percent of each firm’s employees resided in a HUBZone for each of the 12 firms we reviewed. While SBA analysts may have addressed insufficient documentation by following additional procedures, which are described in the report, we found that these procedures were not documented in SBA’s internal written policies for certifying HUBZone firms and analysts did not document their use of these procedures in the case files we reviewed. Therefore, we were not able to verify that SBA took such steps to verify the employees’ addresses. In the draft report, we identified an inconsistency when reviewing the case files for the only Puerto Rican HUBZone firm recertified between June 2017 and May 2018. Specifically, the firm reported on its application that it had zero employees, but also claimed 19 of its employees lived in a HUBZone. In its comments, SBA stated that these numbers came from a program examination system that is no longer used by the agency and therefore would not have been administratively correct to use in the 2017 recertification process. However, the file we received from SBA’s HUBZone Certification Tracking System asks for such information and had a response date noted as December 26, 2017. We recognize and noted that the firm was not required to submit corroborating documentation to verify employee information, because it was under the $1 million threshold. However, SBA policy states that recertifying firms must represent that the circumstances relative to their eligibility at the time of certification have not materially changed. In this instance, SBA recertified the firm when basic information obtained for the firm appeared to be erroneous and did not indicate that the firm was in compliance with the employee residency requirement. In the draft report, we stated that SBA did not consistently follow its quality review procedures to complete three distinct levels of review when approving the 12 Puerto Rican firms in our non-generalizable sample for certification. In its comments, SBA stated that while its legacy system, the HUBZone Certification Tracking System, requires three levels of review, its internal policies do not require that each level of review be performed by different staff. However, SBA internal policies that we reviewed state that the three levels of review should be conducted by different people, specifically an analyst, a senior analyst, and the program director. Furthermore, internal control standards state that management should design control activities at various levels with a segregation of duties, and periodically review its procedures and associated internal control activities for effectiveness. We are sending copies of this report to congressional committees, the Small Business Administration, and other interested parties. In addition, this report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Our objectives in this report were to (1) examine the Small Business Administration’s (SBA) development of criteria and guidance on using a risk-based approach for certifying and recertifying Historically Underutilized Business Zone (HUBZone) firms, (2) examine SBA’s implementation of the revised policies and procedures for firms located in Puerto Rico, and (3) describe any economic impacts of HUBZone expansion and recent trends in federal small business contracting in Puerto Rico. To examine SBA’s development of its criteria and guidance for HUBZone certification and recertification, we reviewed SBA’s policies and procedures for certifying and monitoring HUBZone firms. To learn about SBA’s risk-based approach, we interviewed officials at the headquarters level responsible for certifying and recertifying HUBZone firms. We reviewed prior GAO and SBA Office of Inspector General reports, applicable statutes and regulations, and SBA documents. We also compared the development of SBA’s certification and recertification processes with federal internal control standards and relevant federal guidance and statutes for managing fraud risk. To examine SBA’s implementation of the revised recertification processes in Puerto Rico, we used SBA’s Dynamic Small Business Search database to identify HUBZone firms located in Puerto Rico that received HUBZone certification after March 27, 2017. We examined SBA’s document review process for Puerto Rican firms that received HUBZone certification or were due for recertification between March 2017 and March 2018. We reviewed the case files for a non-generalizable sample of 12 firms that received initial certification and two firms that were due for recertification during this time period. We reviewed documents submitted by firms to SBA as part of the initial certification process. But we were unable to examine the document review component of recertification directly. According to SBA officials, only two firms in Puerto Rico recertified between March 27, 2017, and May 30, 2018, when we received the applicant case files from SBA, and neither met the threshold of $1 million in contract awards to trigger a full document review. From SBA’s small business database, we identified 443 firms in Puerto Rico that had had HUBZone certification at any point as of March 12, 2018, and removed 350 firms that exited the program in order to review only currently certified firms (leaving 93 certified firms). From this universe, we identified 47 HUBZone-certified firms located in Puerto Rico with a certification date later than March 27, 2017, after removing duplicates. We chose a judgmental sample of 12 firms that we randomly selected from the total of 47 firms using a random number generator. We checked the city and industry of each of the 12 firms to confirm the firms provided some geographical and industry variation. Results from this sample are not generalizable to all HUBZone-certified firms. We examined the contents of the case files for each of the 12 firms, which included the application the firm submitted through SBA’s HUBZone Certification Tracking System and supporting documents that firms submitted to corroborate their eligibility, including proof of office location, payroll documentation, HUBZone maps, and employees’ identification such as driver’s licenses. We compared the case file contents to SBA’s guidance on which documents firms must submit and internal guidance for analysts reviewing applications. To determine which documents to review, we compared SBA’s list of required documents for certification to those required at recertification and identified which are similar. We reviewed SBA analysts’ notes, which are recorded in the HUBZone tracking system to verify that they reviewed the documents to determine the firms’ eligibility. We also reviewed any emails exchanged between SBA and the applicant to identify cases in which SBA requested follow-up from the firm. We reviewed the name of the SBA analyst who completed each level of review, as indicated in the tracking system file, to determine whether SBA followed its policy of completing three levels of review. We also reviewed the tracking system files to verify the final approval and whether SBA sent the certification notice to the firm. We compared these files to SBA’s internal policy manuals. To describe any economic impacts of the expansion of the HUBZone program in Puerto Rico, and to describe recent federal contracting trends, we used SBA’s small business database and federal procurement data from the Federal Procurement Data System-Next Generation. We analyzed the number of firms in designated HUBZones in Puerto Rico and the amount of federal contract obligations awarded to the firms from fiscal year 2006 through June of fiscal year 2018—that is, from the starting point for the analysis we used in our 2017 report to the most recent available data at the time of our current review. We assessed the reliability of the two databases by reviewing database guides and prior GAO work, and determined them to be reliable for the purposes of that analysis. For all of the objectives, we also interviewed SBA officials in Washington, D.C., and Puerto Rico and representatives from the Puerto Rico Chamber of Commerce and the Federal Contracting Center. In addition, we conducted a site visit to San Juan, Puerto Rico, in May 2018. There, we conducted two discussion groups and one interview with representatives from nine HUBZone firms located in Puerto Rico to obtain their perspectives on the HUBZone certification process, federal contracting opportunities, economic impacts of HUBZone expansion in Puerto Rico, and economic impacts of the 2017 hurricanes. We invited every Puerto Rican HUBZone firm to participate in the discussion groups and met with the nine firms that responded to our email. The views of representatives from these firms are not generalizable. We conducted this performance audit from February 2018 to September 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. This appendix provides information, based on our analysis of federal procurement data, on small business contracting in Puerto Rico, including the use of socioeconomic set-aside contracts and contracting by sector and agency. Annual federal contract obligations to small businesses in Puerto Rico more than doubled from fiscal year 2015 through June 2018. Small businesses in Puerto Rico also won a larger percentage of total federal contracting obligations in Puerto Rico. Although federal contract obligations to small businesses in Puerto Rico sharply increased in recent years, obligations through set-aside contracts for the Historically Underutilized Business Zone (HUBZone), 8(a) Business Development, Women-Owned Small Business, and Service- Disabled Veteran-Owned Small Business programs remained relatively unchanged (see fig. 4). The increases in federal contract obligations to small businesses in fiscal years 2017 and 2018 came mostly through free and open competition and awards reserved for small businesses that excluding those for the 8(a), HUBZone, Women-Owned Small Business, and Service-Disabled Veteran-Owned Small Business programs. HUBZone set-aside contract obligations increased from negative $20,881 in fiscal year 2016 to $3.8 million in fiscal year 2017 (1 percent of the total value of small business contracts in Puerto Rico), but dropped to $1.7 million through June 2018 (0.2 percent of the total value of small business contracts in Puerto Rico). Furthermore, 17.3 percent of the $21.9 million in contract obligations awarded to Puerto Rican HUBZone firms in fiscal year 2017 were through HUBZone set-aside contracts, and 3.3 percent of the $50.5 million awarded in fiscal year 2018 (see fig. 5). Other socioeconomic set-asides accounted for the highest share of obligations awarded (76.6 percent in 2017 and 80.1 percent in 2018) and free and open competition accounted for the rest (6.1 percent in 2017 and 16.6 percent in 2018). The fiscal year 2017 increase in federal contracting obligations in Puerto Rico were not substantially tied to hurricane relief since Hurricane Irma and Hurricane Maria hit Puerto Rico in September, the last month of the fiscal year. One percent of total federal contracting obligations in Puerto Rico and 1 percent of obligations awarded to Puerto Rican small businesses were associated with hurricane relief (see table 1). However, a significant portion of the increase in overall contracting and small business contracting to Puerto Rican firms in fiscal year 2018 (through June 2018) was related to hurricane relief. Specifically, 55.3 percent of total federal contracting obligations in Puerto Rico and 64.3 percent of obligation awarded to Puerto Rican small businesses were associated with hurricane relief. Furthermore, 16.1 percent of HUBZone set-aside contract obligations awarded to Puerto Rican firms were hurricane-related through June 2018. In fiscal years 2017 and 2018, overall federal prime contracting obligations in Puerto Rico and those awarded to small businesses in Puerto Rico were concentrated in the construction sector (about 25 percent in 2018), the manufacturing sector (about 20 percent in 2018), and the administrative and support and waste management sector (about 36 percent in 2018). For contracts awarded using HUBZone set-asides in Puerto Rico, the construction sector (about 52 percent in 2018), the information sector (about 11 percent in 2018), and the health care sector (about 37 percent in 2018) were most represented (see table 2). Among federal agencies, the Department of Defense has awarded the greatest percentage of overall federal prime contracting obligations, obligations to small businesses, and HUBZone set-aside contract obligations to firms located in Puerto Rico. Specifically, in fiscal year 2018, Department of Defense contract obligations represented 58 percent of total obligations, 64 percent of obligations to small businesses, and 84 percent of HUBZone set-aside obligations to Puerto Rican firms (see table 3). Although, Department of Homeland Security contract obligations in Puerto Rico typically have represented less than 3 percent of total obligations and less than 5 percent of obligations to small businesses in Puerto Rico, those percentages increased to 21 percent and 23 percent, respectively, in fiscal year 2018 due to hurricane-related contracts awarded to Puerto Rican firms. William B. Shear, (202) 512-8678 or shearw@gao.gov. In addition to the contact named above, Harry Medina (Assistant Director), Chris Ross (Analyst in Charge), Tarik Carter, Lilia Chaidez, Pamela Davidson, Erika Huber, Julia Kennon, John McGrail, John Mingus, Barbara Roesmann, and Jena Sinkfield made key contributions to this report.

Summary: The HUBZone program is intended to stimulate economic development in economically distressed areas. Certified HUBZone firms are eligible for federal contracting benefits, including limited competition awards such as set-aside contracts, and are required to be recertified every 3 years. The Puerto Rico Oversight, Management, and Economic Stability Act of 2016 required SBA to develop criteria and guidance for a risk-based approach to verify firm eligibility for the program and included a provision for GAO to review SBA's development and implementation of the required criteria and guidance. This report examines, among other objectives, (1) SBA's development of criteria and guidance on using a risk-based approach for certifying and recertifying HUBZone firms, and (2) SBA's implementation of the revised policies and procedures for firms located in Puerto Rico. GAO analyzed SBA documents and reviewed files of a non-generalizable sample of 12 firms located in Puerto Rico that received certification between March 2017 and March 2018. GAO also interviewed SBA officials, representatives from HUBZone-certified firms in Puerto Rico, and local economic development agencies in Puerto Rico. The Small Business Administration (SBA) adopted criteria and guidance for a risk-based approach to certifying and recertifying firms for the Historically Underutilized Business Zone (HUBZone) program in March 2017, but the extent to which it conducted a risk assessment to inform its approach is unclear. In 2009, in response to GAO's prior recommendations to address weaknesses in the HUBZone certification process, SBA increased documentation requirements for certification, but not recertification (which every 3 years determines continued program eligibility). In March 2017, SBA changed its recertification criteria and guidance to require firms with $1 million or more in HUBZone contract awards to provide documentation to support continuing eligibility. SBA officials stated they completed a risk assessment of the HUBZone recertification process, but as of July 2018, had not provided GAO with documentation on when they performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold. GAO previously found SBA lacked key controls for its recertification process and recommended in 2015 that SBA assess the process. GAO continues to believe that an assessment of the recertification process would help inform a risk-based approach to reviewing and verifying information from firms that appear to pose the most risk to the program. Based on GAO's review of case files for a non-generalizable sample of 12 firms in Puerto Rico that received HUBZone certification in March 2017–March 2018, SBA did not consistently document or follow its policies and procedures for certification reviews. SBA did not have complete documentation in 9 of 12 cases. SBA officials described alternative procedures they used to determine firms' eligibility, but SBA has not updated its internal policy manuals to reflect these procedures and analysts did not document use of such procedures in the files GAO reviewed. In 4 of 12 cases, SBA did not follow its policy to conduct three levels of review (by an analyst, a senior analyst, and the program director or deputy) when determining to approve or deny a firm. It is not known to what extent SBA reviewed staff compliance with certification and recertification review procedures. SBA provided an assurance letter stating it evaluated the Office of HUBZone's internal controls and concluded the controls were effective, but the letter did not specify what steps SBA took for the evaluation. Standards for internal control state management should document its control policies and conduct periodic reviews to ensure controls are effective. Because SBA has not updated its internal policy manuals or conducted a documented review of staff compliance with its quality review procedures, it lacks reasonable assurance that firms are eligible or its review process is effective. In turn, this increases the risk of ineligible firms participating in the HUBZone program and receiving contracting preferences to which they are not entitled. GAO recommends that SBA (1) update internal policy manuals to reflect current policies and procedures, and (2) review and document staff compliance with procedures for certification and recertification reviews of firms. SBA generally agreed with GAO's recommendations.