The HUBZone Act of 1997 (which established the HUBZone program) identified HUBZones as (1) qualified census tracts, which are determined generally by area poverty rate or household income; (2) qualified nonmetropolitan counties, which are determined generally by area unemployment rate or median household income; and (3) lands meeting certain criteria within the boundaries of an Indian reservation. Congress subsequently expanded the criteria for HUBZones to add former military bases and counties in difficult development areas outside the continental United States. The number of HUBZones increased from about 8,000 in 2000 to more than 14,000 in 2006. SBA generally updates HUBZone designations at least twice a year based on whether they meet statutory criteria (such as having certain income levels or poverty or unemployment rates). SBA generally uses data from other federal agencies to determine if areas still qualify for the HUBZone program. As a result of the updates, additional areas are designated for inclusion while other areas lose their designation. Census tracts and nonmetropolitan counties that lose their designation begin a 3- year “redesignation” period during which firms in those areas can continue to apply to and participate in the program and receive contracting preferences. For instance, about 3,400 HUBZones redesignated in 2012 lost their designations in 2015. Another approximately 2,500 census tracts and nonmetropolitan counties are scheduled to lose their designation by January 2020. After the 3 years, firms in these areas lose their certified status and the associated federal contracting award preferences. To be certified to participate in the HUBZone program, a firm must meet the following criteria: when combined with its affiliates, be small by SBA size standards; be at least 51 percent owned and controlled by U.S. citizens; have its principal office—the location where the greatest number of employees perform their work—in a HUBZone; and have at least 35 percent of its employees reside in a HUBZone. SBA recertifies firms (that is, determines that firms continue to meet HUBZone eligibility requirements to participate in the program) every 3 years. Since 2008, GAO has reported on weaknesses in the HUBZone program and SBA’s efforts to address those vulnerabilities. GAO made 11 recommendations intended to address identified problems associated with the program’s certification and recertification processes, communication with firms, and the program’s susceptibility to fraud and abuse (see app. I for a summary and status of our recommendations). The following sections discuss the weaknesses we previously identified and the program revisions and improvements SBA subsequently implemented in response to our recommendations. We reported in June 2008 that, for its certification process, SBA relied on data that firms entered in the online application system and performed limited verification of the self-reported information. Although agency staff had the discretion to request additional supporting documentation, SBA did not have specific guidance or criteria for such requests. Consequently we recommended that SBA develop and implement guidance to more routinely and consistently obtain supporting documentation upon application. In response to that recommendation, SBA revised its certification process, and since 2009 has required firms to provide documentation, which SBA officials review to determine the firms’ eligibility for the HUBZone program. SBA then performs a full-document review on all applications as part of its initial certification process to determine firms’ eligibility for the program. However, we also found in 2015 that the revised process SBA implemented resulted in delays in processing applications—81 percent of the 4,809 initial applications submitted between fiscal year 2009 and 2013 that we reviewed exceeded SBA’s processing goal of 90 days. Additional recommendations from our June 2008 report are discussed below. We previously found that SBA’s challenges with its certification process made the HUBZone program vulnerable to fraud and abuse. For example, in July 2008 we testified that 10 HUBZone firms in the Washington, D.C., area had made fraudulent or inaccurate representations to get into or remain in the HUBZone program, and in a March 2009 report we found that another 19 firms in four other metropolitan areas had made fraudulent representations. We also reported in June 2010 that although SBA had increased documentation requirements for the application process, SBA still was not adequately authenticating self-reported information. We demonstrated this by obtaining HUBZone certification for three bogus firms using the addresses of the Alamo in Texas, a public storage facility in Florida, and a city hall in Texas as principal office locations. When we revisited this issue in 2015, SBA officials told us that the agency conducted site visits on 10 percent of its portfolio of certified firms annually to help address these vulnerabilities. SBA selects the firms to receive site visits based on established criteria (such as the amount of HUBZone contract awards the firm has received) or on an as-needed basis in connection with the review of an initial certification application or after receipt of a protest. In 2008 and 2015, we identified a number of concerns with SBA’s HUBZone recertification process. Generally, SBA relied on self-reported information to make its recertification decisions and had a backlog of firms waiting to be recertified. As a result, SBA lacked reasonable assurance that only qualified firms were allowed to continue in the program and receive preferential contracting treatment. In February 2015, we reported that SBA relied on firms’ attestations of continued eligibility and generally did not request supporting documentation as part of the recertification process. SBA only required firms to submit a notarized recertification form stating that their eligibility information was accurate. SBA officials did not believe they needed to request supporting documentation from recertifying firms because all firms in the program had undergone a full document review, either at initial application or during SBA’s review of its legacy portfolio in fiscal years 2010–2012. However, as we found, the characteristics of firms and the status of HUBZone areas—the bases for program eligibility— often can change and need to be monitored. As a result, we concluded that SBA lacked reasonable assurance that only qualified firms were allowed to continue in the HUBZone program and receive preferential contracting treatment. We recommended that SBA reassess the recertification process and implement additional controls, such as developing criteria and guidance on using a risk-based approach to requesting and verifying firm information. In March 2016, we found that SBA had not yet implemented additional controls (such as guidance for when to request supporting documents) for the recertification process because SBA officials believed that any potential risk of fraud would be mitigated by site visits to firms. The officials also cited resource limitations. Based on data that SBA provided, the agency visited about 10 percent of certified firms each year during fiscal years 2013–2015. SBA’s reliance on site visits alone would not mitigate the recertification weaknesses that were the basis for our recommendation. In recognition of SBA’s resource constraints, we stated in our 2015 report and reiterated in 2016 that SBA could apply a risk- based approach to its recertification process to review and verify information from firms that appear to pose the most risk to the program. We concluded that a lack of risk-based criteria and guidance for staff to request and verify firm information during the recertification process increased the risk that ineligible firms could obtain HUBZone contracts. We also reiterated that the characteristics of firms and the status of HUBZone areas—the bases for program eligibility—often can change, and needed to be monitored. As of February 2017, SBA officials told us that the agency had begun implementing a technology-based solution to address some of the ongoing challenges with the recertification process. The officials expected that the new solution would help them better assess firms and implement risk-based controls by the end of calendar year 2017. In 2008 and again in 2015, we found that the recertification process was backlogged—that is, firms were not being recertified within the 3-year time frame. In 2015, we reported that as of September 2014, SBA was recertifying firms that had been first certified 4 years previously. While SBA initially eliminated the backlog following our 2008 report, according to SBA officials the backlog recurred due to limitations with the program’s computer system and resource constraints. Consequently, in 2015 we again recommended that SBA take steps to ensure that significant backlogs would not recur. In response to the recommendation, SBA made some changes to its recertification process. For example, instead of manually identifying firms for recertification twice a year, SBA automated the notification process, enabling notices to be sent daily to firms (to respond to and attest that they continued to meet the eligibility requirements for the program). According to SBA officials, as of February 2017 this change has not yet eliminated the backlog. In 2008 and 2015, we reported on challenges some firms had faced or might have faced in understanding their eligibility status for the program. Generally, SBA relied on information posted on its website to communicate with interested parties about the HUBZone program. SBA’s HUBZone website includes links to the HUBZone map, which firms can use to determine if an address or a particular area is designated as a HUBZone. In our June 2008 report, we found that SBA’s HUBZone map contained ineligible areas and had not been updated to include currently eligible areas. As a result, ineligible small businesses had participated in the program, and eligible businesses had not been able to participate. Consequently, we recommended that SBA take steps to correct and update the map used to identify HUBZone areas and implement procedures to help ensure that the map would be updated with the most recently available data on a more frequent basis. In response to our recommendation, SBA subsequently contracted with its mapping vendor in 2008 to enable more frequent updating of the HUBZone map (at least annually).