Our proactive testing found ineffective HUBZone program eligibility controls, exposing the federal government to fraud and abuse. In a related report and testimony released concurrently with this testimony, we reported that SBA generally did not verify the data entered by firms in its online application system. We found that SBA was therefore vulnerable to certifying firms based on fraudulent application information. Our use of bogus firms, fictitious employees, and fabricated explanations and documents to obtain HUBZone certification demonstrated the ease with which HUBZone certification could be obtained by providing fraudulent information to SBA’s online application system. In all four instances, we successfully obtained HUBZone certification from SBA for the bogus firms represented by our applications. See figure 1 for an example of one of the acceptance letters we received. Although SBA requested documentation to support one of our applications, the agency failed to recognize the information we provided in all four applications represented bogus firms that actually failed to meet HUBZone requirements. For instance, the principal office addresses we used included a virtual office suite from which we leased part-time access to office space and mail delivery services for $250 a month, two different retail postal service centers from which we leased mailboxes for less than $24 a month, and a Starbucks coffee store. An Internet search on any of the addresses we provided would have raised “red flags” and should have led to further investigation by SBA, such as a site visit, to determine whether the principal office address met program eligibility requirements. Because HUBZone certification provides an opening to billions of dollars in federal contracts, approval of ineligible firms for participation in the program exposes the federal government to contracting fraud and abuse, and moreover, can result in the exclusion of legitimate HUBZone firms from obtaining government contracts. We provide specific details regarding each application below. Fictitious Application One: Our investigators submitted this fictitious application and received HUBZone certification 3 weeks later. To support the application, we leased, at a cost of $250 a month, virtual office services from an office suite located in a HUBZone and gave this address as our principal office location. Specifically, the terms of the lease allowed us to schedule use of an office space up to 16 hours per month and to have mail delivered to the suite. Our HUBZone application also indicated that our bogus firm employed two individuals with one of the employees residing in a HUBZone. Two business days after submitting the application, an SBA official emailed us requesting a copy of the lease for our principal office location and proof of residency for our employee. We created the documentation using publicly available hardware and software and faxed copies to SBA to comply with the request. SBA then requested additional supporting documentation related to utilities and cancelled checks. After we fabricated this documentation and provided it to SBA, no further documentation was requested before SBA certified our bogus firm. Fictitious Application Two: Four weeks after our investigators submitted this fictitious application, SBA certified the bogus firm to participate in the HUBZone program. For this bogus firm, our “principal office” was a mailbox located in a HUBZone that our investigators leased from a retail postal service provider for less than $24 a month. The application noted that our bogus firm had nine employees, four of which lived in a HUBZone area. SBA requested a clarification regarding a discrepancy in the application information, but no further contact was made before we received our HUBZone certification. Fictitious Application Three: Our investigators completed this fictitious application and received HUBZone certification 2 weeks later. For the principal office address, our investigators used a Starbucks coffee store located in a HUBZone. In addition, our investigators indicated that our bogus firm employed two individuals with one of the employees residing in a HUBZone area. SBA did not request any supporting documentation or explanations for this bogus firm prior to granting HUBZone certification. Fictitious Application Four: Within 5 weeks of submitting this fictitious application, SBA certified our bogus firm. As with fictitious application two, our investigators used the address for a mailbox leased from a retail postal service provider located in a HUBZone for the principal office. Our monthly rental cost for the “principal office” was less than $10 per month. Our application indicated that two of the three employees that worked for the bogus firm lived in a HUBZone. SBA requested a clarification regarding a small discrepancy in the application information, but no further contact was made before receiving the HUBZone certification. We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Since 2006, federal agencies have obligated a total of more than $105 million to these firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both the principal office and employee residency requirements while 4 met the principal office requirement but significantly failed the employee residency requirement. We also found other HUBZone firms that use virtual office suites to fulfill SBA’s principal office requirement. We investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. According to HUBZone regulations, persons or firms are subject to criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program including failure to correct “continuing representations” that are no longer true. During the application process, applicants are not only reminded of the program requirements, but are required to agree to the statement that anyone failing to correct “continuing representations” shall be subject to fines, imprisonment, and penalties. Further, the Federal Acquisition Regulation (FAR) requires all prospective contractors to update ORCA— the government’s Online Representations and Certifications Application— which includes certifying whether the firm is currently a HUBZone firm and that there have been “no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA.” However, we found that all 10 of these case-study firms continued to represent themselves to SBA, ORCA, GAO, and the general public as eligible to participate in the HUBZone program. Because the 10 case study examples clearly are not eligible, we consider each firm’s continued representation indicative of fraud. We referred the 10 firms to SBA OIG for further investigation. We determined that 10 case study examples from the Washington, D.C., metropolitan area failed to meet the program’s requirements. Specifically, we found that 6 out of the 10 failed both HUBZone requirements to operate a principal office in a HUBZone and to ensure that 35 percent or more of employees resided in a HUBZone. Our review of payroll records also found that the remaining four firms failed to meet the 35 percent HUBZone employee residency requirement by at least 15 percent. In addition, all 10 of the case study examples continued to represent themselves to SBA, ORCA, GAO, and the general public as HUBZone program–eligible. One HUBZone firm self-certified in ORCA that it met HUBZone requirements in March 2008 despite the fact that we had spoken with its owner about 3 weeks before about her firm’s noncompliance with both the principal office and HUBZone residency requirements. Table 1 highlights the 10 case-study firms we investigated. Case 1: Our investigation clearly showed that this firm represented itself as HUBZone-eligible even though it did not meet HUBZone requirements at the time of our investigation. This firm, which provided business management, engineering, information technology, logistics, and technical support services, self-certified in July 2007 in ORCA that it was a HUBZone firm and that there had been “no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA.” We also interviewed the president in March 2008 and she claimed that her firm met the HUBZone requirements. However, the firm failed the principal office requirement. Our site visits to the address identified by the firm as its principal office found that it was a small room that had been rented on the upper floor of a dentist’s office where no more than two people could work comfortably. No employees were present, and the only business equipment in the rented room was a computer and filing cabinet. The building owner stated that the president of the firm used to conduct some business from the office, but that nobody had worked there “for some time.” Moreover, the president indicated that instead of paying rent at the HUBZone location, she provided accounting services to the owner at a no-cost exchange for use of the space. See figure 2 for a picture of the building the firm claimed as its principal office (arrow indicates where the office is located). Further investigation revealed that the firm listed its real principal office (called the firm’s “headquarters” on its Web site) at an address in McLean, Virginia. In addition to not being a HUBZone, McLean, Virginia, is in one of the wealthiest jurisdictions in the United States. Our site visit to this second location revealed that the majority of the firm’s officers in addition to about half of the qualifying employees worked there and indicated this location was the firm’s actual principal office. When we interviewed the president, she claimed that the McLean, Virginia, office was maintained “only for appearance.” See figure 3 for a picture of the McLean, Virginia, building where the firm rented office space. Based on our review of payroll documents we received directly from the firm, we also determined the firm failed the 35 percent HUBZone residency requirement. The payroll documents indicated that only 15 of the firm’s 72 employees (21 percent) lived in a HUBZone as of December 2007.