The HUBZone program was established by the HUBZone Act of 1997 to stimulate economic development by providing federal contracting preferences to small businesses operating in economically distressed communities known as HUBZones. The SBA is responsible for administering the program and certifying applicant firms that meet HUBZone program requirements. To be certified, in general, firms must meet the following criteria: 1) the company must be small by SBA size standards; 2) the company’s principal office—where the greatest number of employees perform their work—must be located in a HUBZone; 3) the company must be at least 51 percent owned and controlled by U.S. citizens; and 4) at least 35 percent of the company’s full-time (or full-time equivalent) employees must reside in a HUBZone. As of March 2010, approximately 9,300 firms were listed in the SBA’s Dynamic Small Business database as participating in the HUBZone program. A certified HUBZone firm is eligible for a variety of federal contracting benefits, such as sole source contracts and set-aside contracts. Contracting officers may award a sole source contract to a HUBZone firm if, among other things, the officer does not have a reasonable expectation that two or more qualified HUBZone firms will submit offers and the anticipated award price of the proposed contract, including options, will not exceed $5.5 million for manufacturing contracts or $3.5 million for all other contracts. Once a qualified firm receives a HUBZone contract, the firm is required to spend at least 50 percent of the personnel costs of the contract on its own employees. The company must also represent, as provided in the application, that it will ‘‘attempt to maintain’’ having 35 percent of its employees reside in a HUBZone during the performance of any HUBZone contract it receives. The SBA must ensure that both applicant and participant firms meet and maintain eligibility criteria at the time of application and, if they are granted certification, throughout their tenure in the program. During the application process, firms attest to the authenticity of the information that they submit to the SBA regarding their eligibility. Subsequent to certification, SBA regulations require firms to immediately notify the agency if any material changes occur that affect their eligibility, such as changes to the number of employees residing in a HUBZone or the location of the firm’s principal office. Moreover, certified HUBZone firms competing for government contracts must verify in the government’s Online Representations and Certifications Application (ORCA) that there have been “no material changes in ownership and control, principal office, or the percentage of employee’s living in a HUBZone since it was certified by the SBA.” Firms and individuals who misrepresent their eligibility during the application process or while participating in the program are subject to civil and criminal penalties; decertification from the HUBZone program; or debarment from all federal contracts. The SBA continues to struggle with reducing fraud risks in its HUBZone certification process despite reportedly taking steps to bolster its controls. The agency certified three of our four bogus firms based on fraudulent information, including fabricated explanations and supporting documentation. The SBA lost documentation for our fourth application on multiple occasions, forcing us to abandon our application. Our testing revealed that the SBA does not adequately authenticate self-reported information—especially as it pertains to information regarding whether a firm’s principal office location meets program requirements. For example, for our successful firms, we used the addresses of the Alamo, a public storage facility in Florida, and a city hall in Texas as our principal office locations—locations that a simple Internet search could have revealed as ineligible for the program. While ensuring that a HUBZone applicant’s principal office is legitimately located in a HUBZone is a complicated process, the SBA’s failure to verify principal office locations leaves the program vulnerable to firms misrepresenting the locations of their principal offices and thus, benefits of the program not going to areas that are economically disadvantaged. Figure 1 below shows one of the acceptance letters we received. In contrast to our last test of the HUBZone certification process, the SBA considerably increased the amount of documentation it requested to support each application and its attempts to contact and communicate with the owners we represented in our applications. However, the SBA also increased the amount of time it takes to certify firms and, by all indications, suspended the use of agency processing time guidelines as indicated by an e-mail that we received from an SBA official and information that the agency posted on its Web site. The SBA took at least 7 months to process each of the three applications from our bogus companies that it certified. In our previous test, the SBA certified our firms in as little as 2 weeks, with minimal requests for documentary evidence. SBA’s increased processing times failed to prevent our fraudulent firms from being certified. As we indicated in our March 2009 report, the SBA initiated a process of reengineering the HUBZone program in response to our findings and recommendations. Though we did not assess the effectiveness of the actions that the SBA undertook to strengthen its internal controls, we were still able to exploit those weaknesses in order to obtain program certification for our bogus firms. Specific details about each of our fraudulent applications are reported below. Fictitious Application 1: We received HUBZone certification about 7 months after submitting this application to the SBA. For the principal office location, we used the address of the Alamo, a National Historic Landmark in Texas. We claimed that both the firm’s employees were HUBZone residents. Nearly 3 months after submission, we received an e- mail from the SBA requesting a copy of the HUBZone maps that we used to verify the residency of our employees, birth certificates, copies of tax returns for the last 3 years, corporate documents, and a copy of our firm’s rental agreement and a recent utility bill. We fabricated these documents using publicly available materials and software and submitted them to the SBA. The SBA then requested a copy of the firm’s most recent official payroll records and sought clarification between the number of employees who worked at our firm’s principal office and those who worked off site. We were also required to provide additional payroll records and corresponding banking statements with the line-by-line transactions that supported the payments that we claimed to make to our fictitious employees. After all of the requested information was provided, we were approved for HUBZone certification. Figure 2 provides a timeline highlighting the major interactions that occurred with the SBA during the processing of this application. Fictitious Application 2: The SBA certified this bogus company 14 months after our investigators applied for HUBZone certification. The address we used for our principal office was the same as a rental storage unit in Florida. We claimed the firm was a partnership that employed two individuals who both resided in a HUBZone. To substantiate our firm’s principal address, the agency requested that we submit a lease, a recent utility and telephone bill, and a copy of our firm’s business registration. To verify the firm’s business activity and ownership, the SBA requested copies of our firm’s federal business income tax returns for the last 3 years and birth certificates of the two owners, and a copy of our firm’s partnership agreement. To verify employee information, the SBA requested copies of each of the HUBZone resident employees’ driver’s licenses or voter registration cards, a copy of our firm’s quarterly unemployment tax filings, and certified copies of the firm’s quarterly payroll. SBA also requested tax information and a copy of our firm’s most recent payroll documents, which we fabricated and provided to the SBA. Several months thereafter, our bogus firm was granted HUBZone certification. Fictitious Application 3: After 7 months of processing, SBA approved this bogus firm for HUBZone participation. The address of this firm’s principal office was a city hall in Texas. We indicated that two of the firm’s employees who worked for the bogus firm lived in a HUBZone. Several months after processing our application, the SBA requested documentary evidence of the firm’s location, business activity, ownership, and employee information. After the SBA deemed the fabricated information that we submitted regarding payroll as insufficient to determine our employee information, the agency put our application on hold until we provided further documentation. We then provided SBA with a sworn statement to support information regarding payroll. SBA requested clarification about the frequency that our bogus employees worked from the principal office and granted HUBZone certification soon after. Fictitious Application 4: After 4 months of processing, the SBA withdrew this application after we abandoned it. We abandoned this application because the SBA claimed that it did not receive supplementary documentation that we repeatedly provided. Two months after the initial submission of this application, we followed up with the SBA to inquire about its status. At the point of inquiry, SBA indicated that our application was being assigned to an analyst for processing. Two months after our inquiry, we received a request for supporting documentation that was similar to those we received in our previous applications. We provided the requested information 3 days after receiving the request. Two weeks later, we followed up to confirm receipt of our documents. The SBA indicated that it did not receive the information that we provided, so we resent the information and requested that the agency confirm receipt. Three weeks later, after failing to receive confirmation on the receipt of our documentation, we inquired about the status of our application. Again, the agency told us that it did not receive the documentation and subsequently gave us one day to resubmit it. If not provided, the agency indicated, our application would be withdrawn. We decided to abandon the application and our application was withdrawn from the program.