Federal regulations set requirements for a small business to qualify as an SDVOSB. SDVOSB eligibility regulations mandate that a firm must be a small business and at least 51 percent-owned by one or more service- disabled veterans who control the management and daily business operations of the firm. Federal statutes and the Federal Acquisition Regulations (FAR) require all prospective contractors to update the ORCA to state whether their firm qualifies as an SDVOSB. Additionally, the SDVOSB, as a contractor, is required to register in CCR. Contracting officials are required to check CCR, which includes information such as a firm’s status as an SDVOSB, prior to awarding most federal contracts, including an SDVOSB set-aside or sole-source contract. Once an SDVOSB receives a contract, SDVOSB regulations also place restrictions on the amount of work that can be subcontracted. Once CVE verifies a business, it sends an approval letter to the firm. Under regulations first promulgated in 2008, firms retained their eligibility status for 1 year from the date of the letter. However, on June 27, 2012, VA issued updated regulations extending the eligibility period to 2 years before reverification is required. SDVOSB status are required by law to be debarred from contracting with VA for a reasonable period of time, as determined by VA. Additionally, VA regulations state that if a firm or owner is currently debarred or suspended, or is delinquent or in default on significant financial obligations owed to the federal government, then the firm or owner is ineligible for VA’s VetBiz verification program. Federal law has established government-wide goals for specific types of small businesses to receive a percentage of the total value of all prime- contract and subcontract awards for each fiscal year. The statutorily- of all mandated goal for SDVOSB participation is not less than 3 percent federal contract dollars awarded each fiscal year. SBA stated in its most recent report that, in fiscal year 2010, $10.8 billion in small-business obligations were awarded to firms that self-certified themselves in the CCR as SDVOSBs. DOD SDVOSB contracts accounted for $5.3 billion or 49 percent of government-wide SDVOSB contracts during fiscal year 2010, and VA SDVOSB contracts accounted for $3.2 billion, or 30 percent during the same period. Figure 1 summarizes the federal contracts awarded in fiscal year 2010 by federal agencies. Since 2009, GAO has issued nine reports or testimonies on the SDVOSB program, focusing on its vulnerability to fraud and abuse, and agencies’ actions to prevent contracts from going to firms that misrepresent themselves as SDVOSBs. When discussing the SDVOSB program, we have shown that a well-designed fraud-prevention system should consist of three crucial elements: (1) up-front preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. Figure 2 below outlines the key aspects of an effective fraud-prevention framework. The most effective and most efficient part of a fraud-prevention framework involves the institution of rigorous controls at the beginning of the process. At a minimum, preventive controls for the SDVOSB program should be designed to verify that a firm seeking SDVOSB status is eligible for the program. Even with effective prevention controls, there is residual risk that firms that appeared to meet SDVOSB program requirements initially will violate program rules once they obtain contracts. This fact makes effective monitoring and detection controls essential in a robust fraud-prevention framework. Detection and monitoring efforts include activities such as periodic reviews of suspicious firms and evaluating firms to provide reasonable assurance that they continue to meet program requirements. Finally, fraud-prevention controls are not fully effective unless identified fraud is aggressively prosecuted or companies are suspended, debarred, or otherwise held accountable, or both. VA has made numerous conflicting statements about its progress verifying firms listed in VetBiz under the more-thorough process the agency implemented in response to the 2010 Act. These statements indicate that VA has taken an inconsistent approach to prioritizing the verification of firms and has been unable to accurately track the status of its efforts. Specifically, at the close of our audit work, documentation provided by VA indicated that thousands of SDVOSBs listed as eligible in VetBiz received millions of dollars in SDVOSB sole-source and set-aside contract obligations even though they had not been verified under the more-thorough process implemented in response to the 2010 Act. At that time, VA told us it planned to remove all firms that had their 1-year verification period expired and had not provided documentation for reverification under the 2010 Act process. Since then, on June 27, 2012, VA implemented an interim final rule that extends the eligibility of verified firms to 2 years, including firms for which the eligibility period had expired but that had not yet been reverified. Extending the eligibility period may allow VA to focus its efforts on more thoroughly verifying firms that were previously verified under VA’s less-stringent 2006 Act process. However, the extension also allows thousands of firms to continue to be eligible for contracts even though they have not undergone the more-thorough process. With regard to our previous work, VA has taken some positive action to enhance its fraud prevention efforts by establishing processes in response to 6 of 13 recommendations we issued in October 2011. VA has also begun action on some remaining recommendations. VA has provided a number of conflicting statements and explanations related to the status of its verification program, indicating that it is having difficulty tracking its inventory of firms and whether they were verified under the process implemented to carry out the 2010 Act. As we previously stated, the process VA implemented to review firms under the 2006 Act consisted of checking whether a firm’s owner was listed in VA’s database of service-disabled veterans and conducting searches on publicly available websites such as the EPLS, which lists firms that have been debarred from doing business with the federal government. In contrast, VA stated that it implemented a more-thorough verification process under the 2010 Act that included unannounced and announced site visits and a review and analysis of company documentation. Although the 2010 Act did not include a date by which VA must complete the verification of firms, within 60 days of the law’s enactment VA was required to notify all unverified firms listed in its VetBiz database about the need to apply for verification by submitting documents to establish veteran ownership and control. Firms were required to do so within 90 days of receipt of the notification in order to avoid removal of the firm from VetBiz. VA officials told us that the agency prioritized its verification under the process implemented in response to the 2010 Act by reviewing (1) new applications for firms that had previously only self-certified in VetBiz (i.e., firms that had not been reviewed under the processes VA created for the 2006 Act or 2010 Act); (2) new firms that had initially applied for verification after the 2010 Act, to include reprocessing any firms that were denied through the new requirements and subsequently requested reconsideration; and (3) applications for firms initially verified in VetBiz under the process VA chose to implement for the 2006 Act. However, our review of information provided by VA raises concerns about the status of this process and whether VA knows how many of its firms have actually been verified under the processes implemented in response to the 2010 Act. In one communication, VA stated that as of February 2011, VA’s 2006 Act verification process had been discontinued, and all new verifications would use the process implemented in response to the 2010 Act going forward. Because firms would need to reverify 1 year later, this meant that only firms verified under the 2010 Act process should have been in VetBiz as of February 2012. In November 2011, VA reported that it had removed all unverified firms from its database on September 4, 2011. Subsequently, while reviewing new cases involving firms that had received VA SDVOSB contracts, we found instances where firms were not verified under VA’s 2010 Act process, but rather were verified under its 2006 Act process. When we met with VA in February 2012 to discuss our new cases, officials confirmed that there were still firms in VetBiz that had not been through the processes implemented in response to the 2010 Act, but did not explain how many firms still had not gone through the new process. Then, on April 23, 2012, officials told us that they had recently removed thousands of firms from VetBiz because these firms had not supplied the supporting documentation that VA decided was required for verification under the process implemented in response to the 2010 Act; VA indicated that it planned to remove hundreds of additional firms for the same reason. VA has provided conflicting statements about whether these firms received the December 2010 request to supply documentation. Further, over the next month, VA officials provided us with at least seven differing accounts of the number of SDVOSBs verified under the processes implemented for the 2006 Act and 2010 Act, the number of SDVOSBs they planned to remove, and the timing of the removals. VA’s conflicting statements create uncertainty about the status of the agency’s efforts to verify firms under the process implemented for the 2010 Act. Without a clear inventory and methods designed to track the verification process firms have undergone, VA cannot provide reasonable assurance that all firms appearing in VetBiz have been verified as owned and controlled by a veteran or service-disabled veteran.