HUBZone Program

Fraud and Abuse Identified in Four Metropolitan Areas Gao ID: GAO-09-440 March 25, 2009

The Small Business Administration's (SBA) Historically Underutilized Business Zone (HUBZone) program provides federal contracting assistance to small firms located in economically distressed areas, with the intent of stimulating economic development. In July 2008, GAO identified substantial vulnerabilities in SBA's application and monitoring process that demonstrated the HUBZone program is vulnerable to fraud and abuse. GAO also investigated 10 case studies of HUBZone firms in the Washington, D.C., area that misrepresented their eligibility. GAO was asked to determine (1) whether additional cases of fraud and abuse exist outside of the Washington, D.C., area; (2) what actions, if any, SBA has taken to establish an effective fraud prevention program for the HUBZone program; and (3) what actions, if any, SBA took against the 10 case study firms in GAO's July 2008 testimony. To meet these objectives, GAO identified selected HUBZone firms based on certain criteria, such as magnitude of HUBZone contracts and firm location. GAO also interviewed SBA officials and reviewed SBA data.

GAO found that fraud and abuse in the HUBZone program extends beyond the Washington, D.C., area. GAO identified 19 firms in Texas, Alabama, and California participating in the HUBZone program that clearly do not meet program requirements (i.e., principal office location or percentage of employees in HUBZone and subcontracting limitations). For example, one Alabama firm listed its principal office as "Suite 19," but when GAO investigators performed a site visit they found the office was in fact trailer 19 in a residential trailer park. The individual living in the trailer had no relationship to the HUBZone firm. In fiscal years 2006 and 2007, federal agencies obligated nearly $30 million to these 19 firms for performance as the prime contractor on HUBZone contracts and a total of $187 million on all federal contracts. Although SBA has initiated steps in strengthening its internal controls as a result of GAO's 2008 testimonies and report, substantial work remains for incorporating a fraud prevention system that includes effective fraud controls consisting of (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) the aggressive pursuit and prosecution of individuals committing fraud. In addition, SBA did not adequately field test its interim process for processing applications. If it had done so, SBA would have known that it did not have the resources to effectively carry out its review of applications in a timely manner. As a result, SBA had a backlog of about 800 HUBZone applications as of January 2009. At that time, SBA's interim application process was taking about 6 months--well over its 1-month goal set forth in SBA regulations. SBA has taken some enforcement steps on the 10 firms previously identified by GAO that knowingly did not meet HUBZone program requirements. However, SBA's failure to promptly remove firms from the HUBZone program and examine some of the most egregious cases from GAO's July 2008 testimony has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone contracts to these firms. For example, a construction firm from the July 2008 testimony admitted that it did not meet HUBZone requirements and was featured in several national publications by name. It has continually represented itself as HUBZone certified and has received $2 million in HUBZone obligations and a $23 million HUBZone set-aside contract since the July 2008 testimony.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone:


GAO-09-440, HUBZone Program: Fraud and Abuse Identified in Four Metropolitan Areas This is the accessible text file for GAO report number GAO-09-440 entitled 'HubZone Program: Fraud and Abuse Identified in Four Metropolitan Areas' which was released on March 25, 2009. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Chairwoman, Committee on Small Business, House of Representatives: United States Government Accountability Office: GAO: March 2009: HubZone Program: Fraud and Abuse Identified in Four Metropolitan Areas: GAO-09-440: GAO Highlights: Highlights of GAO-09-440, a report to Chairwoman, Committee on Small Business, House of Representatives. Why GAO Did This Study: The Small Business Administration‘s (SBA) Historically Underutilized Business Zone (HUBZone) program provides federal contracting assistance to small firms located in economically distressed areas, with the intent of stimulating economic development. In July 2008, GAO identified substantial vulnerabilities in SBA‘s application and monitoring process that demonstrated the HUBZone program is vulnerable to fraud and abuse. GAO also investigated 10 case studies of HUBZone firms in the Washington, D.C., area that misrepresented their eligibility. GAO was asked to determine (1) whether additional cases of fraud and abuse exist outside of the Washington, D.C., area; (2) what actions, if any, SBA has taken to establish an effective fraud prevention program for the HUBZone program; and (3) what actions, if any, SBA took against the 10 case study firms in GAO‘s July 2008 testimony. To meet these objectives, GAO identified selected HUBZone firms based on certain criteria, such as magnitude of HUBZone contracts and firm location. GAO also interviewed SBA officials and reviewed SBA data. What GAO Found: GAO found that fraud and abuse in the HUBZone program extends beyond the Washington, D.C., area. GAO identified 19 firms in Texas, Alabama, and California participating in the HUBZone program that clearly do not meet program requirements (i.e., principal office location or percentage of employees in HUBZone and subcontracting limitations). For example, one Alabama firm listed its principal office as ’Suite 19,“ but when GAO investigators performed a site visit they found the office was in fact trailer 19 in a residential trailer park. The individual living in the trailer had no relationship to the HUBZone firm. In fiscal years 2006 and 2007, federal agencies obligated nearly $30 million to these 19 firms for performance as the prime contractor on HUBZone contracts and a total of $187 million on all federal contracts. The map below illustrates the geographical locations for the cases we examined. Figure: GAO Case Study Locations of Fraud and Abuse in the HUBZone Program: [Refer to PDF for image: maps] Locations: Huntsville, Alabama; San Diego, California; Dallas, Texas. Source: GAO. [End of figure] Although SBA has initiated steps in strengthening its internal controls as a result of GAO‘s 2008 testimonies and report, substantial work remains for incorporating a fraud prevention system that includes effective fraud controls consisting of (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) the aggressive pursuit and prosecution of individuals committing fraud. In addition, SBA did not adequately field test its interim process for processing applications. If it had done so, SBA would have known that it did not have the resources to effectively carry out its review of applications in a timely manner. As a result, SBA had a backlog of about 800 HUBZone applications as of January 2009. At that time, SBA‘s interim application process was taking about 6 months”well over its 1-month goal set forth in SBA regulations. SBA has taken some enforcement steps on the 10 firms previously identified by GAO that knowingly did not meet HUBZone program requirements. However, SBA‘s failure to promptly remove firms from the HUBZone program and examine some of the most egregious cases from GAO‘s July 2008 testimony has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone contracts to these firms. For example, a construction firm from the July 2008 testimony admitted that it did not meet HUBZone requirements and was featured in several national publications by name. It has continually represented itself as HUBZone certified and has received $2 million in HUBZone obligations and a $23 million HUBZone set-aside contract since the July 2008 testimony. What GAO Recommends: GAO makes four recommendations to improve SBA‘s ability to screen, monitor, and investigate fraud and abuse within the HUBZone program. SBA agreed with three of them. To view the full product, including the scope and methodology, click on [hyperlink, http://www.gao.gov/products/GAO-09-440]. For more information, contact Greg Kutz at (202) 512-6722 or kutzg@gao.gov. [End of section] Contents: Letter: Background: Selected Case Studies of Fraud and Abuse Outside the Washington, D.C., Metro Area: SBA Has Initiated Steps to Address Internal Control Deficiencies but Has Not Incorporated Effective Fraud Controls: SBA Has Initiated Some Enforcement Actions Against 10 HUBZone Firms Previously Investigated by GAO: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Additional Case Studies of HUBZone Firms That Did Not Meet Program Eligibility Requirements: Appendix II: Comments from the Small Business Administration: Appendix III: GAO Contact and Staff Acknowledgments: Tables: Table 1: HUBZone Firms Making Fraudulent or Inaccurate Representations: Table 2: SBA Actions on 10 HUBZone Firms Previously Investigated by GAO: Table 3: HUBZone Firms Making Fraudulent or Inaccurate Representations: Figures: Figure 1: Locations of Selected HUBZone Firms That Do Not Meet Program Requirements: Figure 2: Principal Office for Case Study 2 Firm: Figure 3: Mailbox of Purported Principal Office for Case Study 2 Firm: Figure 4: Fraud Prevention Model: Figure 5: Reproduction of Web Site Banner for Firm SBA Has Yet to Investigate: Abbreviations: CCR: Central Contractor Registration: FAR: Federal Acquisition Regulation: FPDS-NG: Federal Procurement Data System-Next Generation: HUBZone: Historically Underutilized Business Zone: ORCA: Online Representations and Certifications Application: SBA: Small Business Administration: SDO: Suspension and Debarment Official: [End of section] United States Government Accountability Office: Washington, DC 20548: March 25, 2009: The Honorable Nydia M.Velazquez: Chairwoman: Committee on Small Business: House of Representatives: Dear Madam Chairwoman: Created in 1997, the Historically Underutilized Business Zone (HUBZone) program provides federal contracting assistance to small businesses in economically distressed communities, or HUBZone areas, with the intent of stimulating economic development in those areas. In fiscal year 2007, federal agencies awarded contracts valued at about $8 billion to HUBZone firms. The Small Business Administration (SBA) administers the HUBZone program, one of several contracting assistance programs that the agency oversees. Firms that participate in the program must be located in a HUBZone and employ residents of HUBZones to facilitate the goal of bringing capital and employment opportunities to distressed areas. On July 17, 2008, we testified before this Committee that SBA's lack of controls over the HUBZone program exposed the government to fraud and abuse[Footnote 1] and that SBA's mechanisms to certify and monitor HUBZone firms provide limited assurance that only eligible firms participate in the program.[Footnote 2] In our testimony, we identified 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Of the 10 firms, 6 did not meet both principal office and employee residency requirements while 4 met the principal office requirements but significantly failed the employee residency requirement. We reported in our July 2008 testimony, that federal agencies had obligated a total of nearly $26 million in HUBZone contract obligations to these 10 firms since 2006. In addition, federal agencies obligated more than $105 million to these 10 firms for performance as the prime contractor on all federal contracts since 2006. Subsequent to the hearing, you requested that we perform a follow-on investigation. Specifically, you asked us to determine (1) whether cases of fraud and abuse in the program exist outside of the Washington, D.C. metropolitan area; (2) what actions, if any, SBA has taken to establish an effective fraud prevention system for the HUBZone program; and (3) what actions, if any, SBA has taken on the 10 firms that we found misrepresented their HUBZone status in July 2008. To determine whether cases of fraud and abuse exist for firms located outside of the Washington, D.C. metropolitan area, we first obtained and analyzed a list of HUBZone firms from the SBA's Dynamic Small Business Search database as of September 2008.[Footnote 3] We then obtained federal procurement data from the Federal Procurement Data System-Next Generation (FPDS-NG) for fiscal years 2006 and 2007. [Footnote 4] We assessed the reliability of the data and determined that they were sufficiently reliable for the purposes of our investigation. We analyzed the data to identify (1) geographical locations that have both small fragments of HUBZone areas within a metropolitan area, and (2) high concentrations of HUBZone firms that reported obligations on HUBZone prime contracts totaling more than $250,000 during fiscal years 2006 and 2007. Using the above criteria, we selected four geographical areas for analysis: Dallas, Texas; Huntsville, Alabama; San Antonio, Texas; and San Diego, California. Within those four geographical areas, there were 36 firms that met our criteria for further investigation. The firms selected as case studies and the federal obligations associated with those firms did not include subcontracts that they may have received. Such information was not readily available. We conducted site visits for all 36 selected firms and used investigative methods --such as interviewing firm managers, analyzing firm payroll documents, and reviewing information from investigative databases --to gather information about the firms and to determine whether the firms met HUBZone requirements for principal office and 35 percent residency. We also reviewed information about each firm from the Online Representations and Certifications Application (ORCA) Web site.[Footnote 5] In the course of our investigations, we found instances of HUBZone firms that did not expend at least 50 percent of the personnel costs of a contract on their own personnel. Although our review was not designed to evaluate this requirement, we did report those instances that we discovered in this report. To determine what actions, if any, SBA has taken to reduce fraud and abuse in the program as well as the actions SBA has taken on the 10 firms that we found misrepresented their HUBZone status, we interviewed SBA officials from the Office of Inspector General, HUBZone Program Office, and the SBA General Counsel. We obtained and reviewed supporting documentation where appropriate. We also reviewed SBA's Dynamic Small Business Web site to determine the current HUBZone status of the 10 firms we identified in our July 2008 testimony. Our work was not designed to identify all fraud and abuse in the HUBZone program or estimate its full extent for the entire population of HUBZone firms. In addition, our work was not designed to determine whether the selected firms we investigated committed fraud when originally applying for HUBZone status or receiving a HUBZone contract award, but rather if selected HUBZone firms are currently meeting HUBZone requirements. We conducted our investigation from September 2008 through March 2009 in accordance with quality standards for investigations as set forth by the President's Council on Integrity and Efficiency. Background: The HUBZone program was established by the HUBZone Act of 1997 to stimulate economic development through increased employment and capital investment by providing federal contracting preferences to small businesses in economically distressed communities.[Footnote 6] These areas, which are designated based on certain economic and census data, are known as HUBZones. As of January 2009, there were approximately 9,300 firms listed in the Central Contractor Registration database as participating in the HUBZone program.[Footnote 7] To ensure HUBZone areas receive the economic benefit from the program, SBA is responsible for determining whether firms meet HUBZone program requirements. To participate in the HUBZone program, small business firms generally must meet certain criteria established by the SBA, most notably: (1) the firm must be at least 51 percent owned and controlled by one or more U.S. citizens; (2) at least 35 percent of its employees must live in a HUBZone; (3) the principal office (i.e., the location where the greatest number of qualifying employees perform their work) must be located in a HUBZone; and (4) the firm must qualify as a small business under the size standard that corresponds with its primary industry classification. In addition, once a firm receives a HUBZone contract, the firm is required to abide by certain subcontracting limitations, which for most firms is to expend at least 50 percent of the personnel costs of a contract on their own employees or employees of other qualified HUBZone small business concerns.[Footnote 8] The SBA is legally responsible for ensuring that program participants meet program requirements.[Footnote 9] If a HUBZone firm does not meet program requirements or fails to notify the SBA of material changes that affect the firm's HUBZone eligibility, the SBA may use a variety of enforcement tools against the firm. Depending on the severity of the infraction, SBA can (1) decertify and remove the firm from the list of qualified HUBZone firms, (2) suspend and/or debar the firm from all federal contracts, and/or (3) refer the firm to the Department of Justice for civil and/or criminal prosecution. In July 2008, we testified that SBA's lack of controls over the HUBZone program exposed the government to fraud and abuse.[Footnote 10] Specifically, we identified substantial vulnerabilities in SBA's application and monitoring process by demonstrating the ease of obtaining HUBZone certification. For example, by using fictitious employee information and fabricated documentation, we easily obtained HUBZone certification for four bogus firms. In addition, we also identified 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. In June 2008, we reported that the Small Business Administration needed to take additional actions to certify and monitor HUBZone firms as well as to assess the results of the HUBZone program.[Footnote 11] Specifically, we found that the map SBA used to publicize qualified HUBZone areas was inaccurate. In addition, we found that the mechanisms that SBA used to certify and monitor HUBZone firms did not meet federal internal control standards and provided limited assurance that only eligible firms participated in the program. For example, SBA verified the information reported by firms on their application or during recertification--its process for monitoring firms--in limited instances and did not follow its own policy of recertifying all firms every 3 years. In the report, we made five recommendations designed to improve SBA's administration and oversight of the HUBZone program. We recommended that SBA correct and update its HUBZone map, develop and implement guidance to ensure more routine verification of application data, eliminate its backlog of recertifications, formalize and adhere to a specific time frame for decertifying ineligible firms, and further assess the effectiveness of the program. In responding to a draft of this report, SBA agreed with these recommendations and outlined steps that it plans to take to address them. Selected Case Studies of Fraud and Abuse Outside the Washington, D.C., Metro Area: HUBZone program fraud and abuse continues to be problematic for the federal government. We identified 19 firms in the states of Texas, Alabama, and California participating in the HUBZone program even though they clearly do not meet program requirements.[Footnote 12] Although we cannot conclude whether this is a systemic problem based on these cases, as shown in figure 1 below, the issue of misrepresentation clearly extends beyond the Washington, D.C., metropolitan area. In fiscal years 2006 and 2007, federal agencies had obligated a total of nearly $30 million to these firms for performance as the prime contractor on federal HUBZone contracts.[Footnote 13] Figure 1: Locations of Selected HUBZone Firms That Do Not Meet Program Requirements: [Refer to PDF for image: map of the United States] Locations: Huntsville, Alabama; San Diego, California; Dallas, Texas. Source: GAO. [End of figure] HUBZone regulations also place restrictions on the amount of work that can be subcontracted to non-HUBZone firms. Specifically, HUBZone regulations generally require firms to expend at least 50 percent of the personnel costs of a contract on its own employees. As part of our investigative work, we found examples of service firms that subcontracted a substantial majority of HUBZone contract work to other non-HUBZone firms and thus did not meet this program requirement. When a firm subcontracts the majority of its work to other non-HUBZone firms it is undermining the HUBZone program's stated purpose of stimulating development in the economically distressed areas, as well as evading eligibility requirements for principal office and 35 percent residency requirement. According to HUBZone regulations, persons or firms are subject to criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program including failure to correct "continuing representations" that are no longer true. During the application process, applicants are not only reminded of the program eligibility requirements, but are required to agree to the statement that anyone failing to correct "continuing representations" shall be subject to fines, imprisonment, and penalties. Further, the Federal Acquisition Regulation (FAR) requires all prospective contractors to update the government's Online Representations and Certifications Application (ORCA), which includes a statement certifying whether the firm is currently a HUBZone firm and that there have been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." Of the 19 firms that did not meet HUBZone eligibility requirements, we found that all of them continued to represent themselves as eligible HUBZone interests to SBA. Because the 19 case examples clearly are not eligible, we consider each firm's continued representation indicative of fraud and/or abuse related to this program. Table 1 highlights 10 firms that we found to be egregiously out of compliance with HUBZone program requirements. Appendix I provides details on the other 9 cases that we examined. We will be referring all 19 firms to SBA for further investigation and consideration for removal from the program. Table 1: HUBZone Firms Making Fraudulent or Inaccurate Representations: Case: 1; Location: Fort Worth, TX; Primary product or service: Environmental Consulting; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $2,310,000; (Department of the Army); Case details: * Firm subcontracted the majority of the work to non-HUBZone firms. Although HUBZone firms are required to expend at least 50 percent of personnel costs performing HUBZone contracts, we determined that this firm has performed between 11 percent and 29 percent of the work on its various contracts to date; * Firm bid on and accepted large HUBZone set-aside contracts even though it did not have the capability to perform them without significant subcontracting; * Owner stated that HUBZone firms are being used as "contract vehicles" for large contracts. Case: 2; Location: Jacksonville, AL; Primary product or service: Furniture/Grounds Maintenance; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $920,000; (Department of the Army); Case details: * Firm did not meet principal office requirement; * Site visit to listed principal office found a residential trailer located in a trailer park. No employees were present. Utility and mail forwarding records indicate that no employees worked or lived at the listed principal office for over a year; * Firm did not meet 35 percent residency requirement because none of the employees live in a HUBZone; * Firm president admitted that his firm subcontracted the majority of work to other firms or individuals, violating the requirement to expend at least 50 percent of personnel costs using its own employees; * Firm self-certified that it met the HUBZone requirements in ORCA in February 2008. Case: 3; Location: Arlington, TX; Primary product or service: General Contractor; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $1,240,000; (Department of Housing and Urban Development); Case details: * Firm did not meet principal office requirement; * Multiple site visits to listed principal office revealed only 1 out of the firm's 33 employees were working at that location; * Company provided documents confirmed that the majority of employees worked at non-HUBZone locations; * Firm met 35 percent residency requirement; * Firm self-certified that it met the HUBZone requirements in ORCA in April 2008. Case: 4; Location: Huntsville, AL; Primary product or service: Information Technology; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $5,020,000; (Departments of the Army and Navy); Case details: * Firm did not meet principal office requirement; * Site visit to listed principal office revealed no employees were working at the location; * The office where the majority of employees worked was not in a HUBZone; * President of firm admitted that they were not in compliance with the principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 18 of the firm's 116 employees (16 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 5; Location: Huntsville, AL; Primary product or service: Information Technology/General Contractor; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $2,450,000; (Department of the Army); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 8 of the firm's 74 employees (11 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 6; Location: Dallas, TX; Primary product or service: Janitorial; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $560,000; (Department of the Army and General Services Administration); Case details: * Firm did not meet principal office requirement because multiple site visits to the listed principal office revealed firm no longer occupied this location; * Firm met 35 percent residency requirement; * Firm self-certified that it met the HUBZone requirements in ORCA in April 2008. Case: 7; Location: San Antonio, TX; Primary product or service: Medical Laboratories; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $250,000; (Department of the Air Force); Case details: * Firm did not meet principal office requirement; * Visit to the company's listed principal office revealed that the location was operated by the principal, but was a study lab operating under a different name. Company website indicates this location is a "satellite" lab; * Company maintains another, larger lab that is not located in a HUBZone; * Firm did not meet 35 percent residency requirement because payroll records show that only 2 of the firm's 7 employees (29 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in October 2007. Case: 8; Location: Birmingham, AL; Primary product or service: Medical Services and Support; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $2,220,000; (Department of the Air Force); Case details: * Firm did not meet principal office requirement; * Site visit to listed principal office revealed no employees were working at the location; * The office where the majority of employees worked was not in a HUBZone; * Manager admitted that listed principal office is only used for proposal writing and that the majority of their time is spent in an office which is not located in a HUBZone area; * Manager admitted that they only keep listed principal office to meet HUBZone requirements; * Firm did not meet 35 percent residency requirement because payroll records show that only 1 of the firm's 11 employees (9 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in October 2008. Case: 9; Location: Huntsville, AL; Primary product or service: Military Logistics and Maintenance; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $580,000; (Department of the Army); Case details: * Firm did not meet principal office requirement because the majority of company staff worked in an office that was not located in a HUBZone; * Firm did not meet 35 percent residency requirement because payroll records show that only 13 of the firm's 53 employees (25 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 10; Location: San Antonio, TX; Primary product or service: Support Services for Facility; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $350,000; (Departments of the Army and Air Force); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because the firm's president, who was the only employee, did not live in a HUBZone. President of firm stated that the firm does not have employees to carry out its work but instead uses "leased employees." SBA's regulations state that leased employees do not count as employees for purposes of the HUBZone program[B]; * Firm does not have a current ORCA certification. Source: GAO analysis of FPDS, ORCA, CCR and contractor data. [A] Obligation amounts are rounded to the nearest $10,000. [B] 13 C.F.R. § 126.103. [End of table] The following is a more detailed description of fraud and abuse from 3 of the cases that we investigated. Case Study 1: Our investigation clearly showed that this firm was being used as a front company because it was subcontracting the majority of its work to other firms. This firm is located in Fort Worth, Texas, and violated HUBZone program requirements because it did not expend at least 50 percent of personnel costs on its own employees or by using the personnel of other HUBZone firms as required by federal regulations. [Footnote 14] This firm, which consists of 8 employees, has obtained millions of dollars in HUBZone contracts to provide environmental consulting services. At the time of our investigation, company documents showed that the company was subcontracting between 71 and 89 percent of its total contract obligations to other non-HUBZone firms--in some cases, large firms. The principal admitted that her firm was not meeting contract performance requirements required by HUBZone regulations. Further, the principal stated that the firm made bids on HUBZone contracts knowing that the company would have to subcontract work to other firms after the award. The principal added that other large firms use HUBZone firms in this manner, referring to these HUBZone firms as "contract vehicles." By subcontracting the majority of its HUBZone work to non-HUBZone firms, this firm is clearly abusing its HUBZone designation and undermining the HUBZone program's stated purpose of stimulating small business development in economically distressed areas. Likewise, because the subcontracting is being conducted by non-HUBZone firms this firm is also evading eligibility requirements for principal office and the 35 percent residency requirement. This firm has been obligated over $2.3 million in HUBZone set-asides during fiscal years 2006 and 2007. Case Study 2: Our investigation demonstrated that this firm continued to misrepresent itself as HUBZone-eligible while failing to meet HUBZone requirements.[Footnote 15] This firm, which is a two-person-- father and son--ground maintenance services company located in Jacksonville, Alabama, did not meet the principal office requirement, failed the 35 percent residency requirement, and served as a front company--subcontracting most of its HUBZone work to non-HUBZone firms. Our investigation found that the purported principal office was in fact a residential trailer in a trailer park. As shown in figure 2 below, the "suite number" of the principal office provided to SBA was actually the trailer number. Figure 2: Principal Office for Case Study 2 Firm: [Refer to PDF for image: photograph] Photo of trailer number 19. Source: GAO. [End of figure] The president of the company claimed that the trailer is the principal office and that an employee lived at that trailer. However, our investigation found that the president knowingly misrepresented and concealed material facts to a GAO investigator. We found that both employees live in non-HUBZone areas that are located about 90 miles from the trailer. Additionally, we verified that the trailer is occupied by someone not associated with the company. Further, our investigation found that neither employee lived in, nor worked at, the residential trailer since August 2007.[Footnote 16] Specifically, the U.S. Postal Service provided us a copy of the change of address form dated August 2007 that instructed the Postal Service to forward all mail from the trailer to another office in Birmingham, Alabama, which is not located in a HUBZone area. In addition, we obtained utility bill information that indicated that the last utility bill was paid by the firm in August 2007. According to DSBS, SBA most recently certified the firm at this address in April 2008.[Footnote 17] During the course of our investigation, this firm provided investigators with questionable documents in an attempt to make the residential trailer appear to be their actual principal office. As figure 3 shows, after our original interview with the president, we found that a new mailbox with the company name had been installed next to other mailboxes in the trailer park to give the perception that the firm resided at this trailer park. Figure 3: Mailbox of Purported Principal Office for Case Study 2 Firm: [Refer to PDF for image: photograph] Line of mailboxes with number 32 highlighted. Source: GAO. [End of figure] Despite the evidence that this firm had not paid utility bills or received mail at this location for over a year, the firm president also provided us with a "rental agreement" stating that their company was renting the trailer until June 2009. The authenticity of this "rental agreement" is highly suspicious given the evidence we gathered and our confirmation that an individual not related to the company was living in the trailer. For fiscal years 2006 and 2007, this firm received more than $900,000 in HUBZone set-aside obligations. Case Study 4: We determined that during the period of our investigation this firm represented itself as HUBZone certified while failing to meet both the 35 percent residency and principal office HUBZone eligibility requirements. This firm, which is located in Huntsville, Alabama, and provides information technology services, self-certified in ORCA in July 2008 that it was a HUBZone firm and that there had been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." The firm was certified by the SBA as a HUBZone firm in June 2002. Based on our review of payroll records and written correspondence that we received from the firm, we determined that the firm failed the 35 percent HUBZone residency requirement. These documents indicated that only 18 of 116 (16 percent) of the firm's employees who were employed in December 2007, lived in HUBZone-designated areas. To have met the 35 percent residency requirement, the firm would have needed at least 41 employees residing in HUBZone-designated areas, thus, the firm did not meet this requirement by 23 employees. In addition, we investigated the location that the firm purported to the SBA as its "principal office." Our investigation found that no employees were located at this office. Additional investigative work revealed that the firm's primary office was not located in a HUBZone. During the interview, the firm's president acknowledged that he "had recently become aware" that he was not in compliance with HUBZone requirements and was taking "corrective actions." However, the firm continued to represent itself as a HUBZone firm even after the firm's president acknowledged his company did not meet the program requirements. Based on our analysis of FPDS-NG data, between fiscal years 2006 and 2007 federal agencies obligated over $5.0 million in HUBZone awards to this firm, consisting mainly of 2 HUBZone set-aside contracts by the Department of the Navy. SBA Has Initiated Steps to Address Internal Control Deficiencies but Has Not Incorporated Effective Fraud Controls: Our June 2008 report and July 2008 testimony clearly showed that SBA did not have effective internal controls related to the HUBZone program. In response to our findings and recommendations, SBA initiated a process of reengineering the HUBZone program. SBA officials stated that this process is intended to make improvements to the program that are necessary for making the program more effective while also minimizing fraud and abuse. To that end, SBA has hired business consultants as well as reached out to GAO in an attempt to identify control weaknesses in the HUBZone program and to strengthen its fraud prevention controls. Although SBA has initiated steps to address internal control deficiencies we identified in our June 2008 report, SBA has not yet incorporated effective controls for preventing, detecting, and investigating fraud and abuse within the HUBZone program. Internal controls comprise the plans, methods, and procedures used to meet missions, goals, and objectives and also serve as the first line of defense in safeguarding assets and preventing and detecting errors and fraud.[Footnote 18] Fraud prevention, on the other hand, requires a system of rules, which, in their aggregate, minimize the likelihood of fraud occurring while maximizing the possibility of detecting any fraudulent activity that may transpire. Fraud prevention systems set forth what actions constitute fraudulent conduct and specifically spell out who in the organization handles fraud matters under varying circumstances. The potential of being caught most often persuades likely perpetrators not to commit the fraud. Because of this principle, the existence of a thorough fraud prevention system is essential to fraud prevention and detection.[Footnote 19] As of the end of our field work, SBA does not have in place the key elements of an effective fraud prevention system. As shown in figure 4 below, a well-designed fraud prevention system (which can also be used to prevent waste and abuse) should consist of three crucial elements: (1) upfront preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. For the HUBZone program this would mean (1) front-end controls at the application stage, (2) fraud detection and monitoring of firms already in the program, and (3) the aggressive pursuit and prosecution of individuals committing fraud. In addition, as shown in figure 4, the organization should also use "lessons learned" from its detection and monitoring controls and investigation and prosecutions to design more effective preventive controls. Figure 4: Fraud Prevention Model: [Refer to PDF for image: illustration] Fraud Prevention Model: Potential fraud, waste, and abuse: Preventive controls: Potential fraud, waste, and abuse (smaller amount): Detection and monitoring (lessons learned influence future use of preventive controls): Potential fraud (smaller amount): Investigations and prosecutions (lessons learned influence future use of preventive controls). Source: GAO. [End of figure] We explain the three major fraud prevention elements in this model and how SBA is attempting to address them, in further detail below. Preventive Controls: We have previously reported that fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse.[Footnote 20] Thus, controls that prevent fraudulent firms and individuals from entering the program in the first place are the most important element in an effective fraud prevention program. The most crucial element of effective fraud prevention controls is a focus on substantially diminishing the opportunity for fraudulent access into the system through front-end controls. Preventive controls should be designed to include, at a minimum, a requirement for data validation, system edit controls, and fraud awareness training. Prior to implementing any new preventive controls, agencies must adequately field test the new controls to ensure they are operating as intended. SBA officials stated that as part of their interim process they are now requesting, from all firms that apply to the HUBZone program, documentation that demonstrates their eligibility. SBA stated that, in the past, it only requested additional information when it encountered obvious "red flags." Although requiring additional documentation has some value as a deterrent, the most effective preventive controls involve the verification of information, such as verifying a principal office location through an unannounced site visit. If SBA verified purported principal offices by conducting unannounced site visits, such as we did for our investigation, SBA would likely find similar instances of firms attempting to defraud the HUBZone program. In addressing one of our prior recommendations, the SBA issued a Desktop Manual for processing HUBZone applications. [Footnote 21] The manual provides guidance that alerts SBA staff of circumstances that warrant the need for supporting documentation. Although the Desktop Manual provides discretion to the analyst about the need to conduct a site visit, the Desktop Manual does not provide criteria when such site visits are warranted. In addition, SBA does not screen firms or individuals to ensure that they are not affiliated with prior firms that failed program eligibility reviews. As a result, an owner can change the name of a company that was removed from the HUBZone program to a new business name and be accepted back into the HUBZone program. Further, SBA did not adequately field test its interim process for processing applications. If it had done so, SBA would have known that it did not have the resources to effectively carry out its review of applications in a timely manner. As a result, SBA had a backlog of about 800 HUBZone applications as of January 2009. At that time, SBA officials stated that it would take about 6 months to process each HUBZone application--well over the 1 month goal set forth in SBA regulations. Detection and Monitoring: Although preventive controls are the most effective way to prevent fraud, continual monitoring is an important component in detecting and deterring fraud. Monitoring and detection within a fraud prevention program involve actions such as data-mining for fraudulent and suspicious applicants and evaluating firms to provide reasonable assurance that they continue to meet program requirements. As demonstrated in our July 2008 testimony, SBA's fraud control vulnerabilities in its application process make detection and monitoring particularly important for the HUBZone program. As a result of SBA's control vulnerabilities, there are likely hundreds and possibly thousands of firms in the HUBZone program that fail to meet program requirements. Although monitoring and detection is an important component of a fraud prevention system, we reported in June 2008 that the mechanisms SBA used to monitor HUBZone firms provided limited assurance that only eligible firms participate in the program.[Footnote 22] Specifically, we reported that a firm could be in the HUBZone program for years without being examined.[Footnote 23] In addition, although a HUBZone firm is supposed to be recertified every 3 years, we reported that more than 40 percent of the firms in the program for over 3 years had not been recertified. To address these weaknesses, SBA officials stated that during this fiscal year, they will be conducting program examinations on all HUBZone firms that received contracts in fiscal year 2007 to determine whether they still meet HUBZone requirements. In addition, SBA officials stated that as of September 2008, SBA had eliminated their backlog of recertifications. Although SBA has initiated several positive steps, SBA will need to make further progress to achieve an effective fraud monitoring program. For example, SBA has not found an effective and efficient way to verify the validity of a stated principal office during its recertification and application processes. In addition, SBA officials stated that although they modified their approach for conducting program examinations of HUBZone firms this fiscal year, they have not established a streamlined and risk-based methodology for selecting firms for program examinations going forward. Further, in order to determine whether firms meet eligibility requirements, SBA needs to incorporate an "element of surprise" into its program examinations such as using random, unannounced site visits to verify a stated principal office. Finally, SBA does not evaluate all HUBZone program requirements during program examinations; specifically, SBA does not review whether HUBZone firms are expending at least 50 percent of the personnel costs of a contract on their own personnel. As a result, as shown by several of our case studies, certain firms are allowed to act as "front" companies, whereby they subcontract the large majority of their work to non-HUBZone firms. This undermines the program's stated purpose of increasing employment opportunities, investment, and economic development in HUBZone areas. Investigation and Prosecution: The final element of an effective fraud prevention system is the aggressive investigation and prosecution of individuals who commit fraud against the federal government. However, SBA currently does not have an effective process for investigating fraud and abuse within the HUBZone program. Although SBA's Desktop Manual for Processing HUBZone Applications states that an analyst may refer a HUBZone application to the Office of Inspector General or the Office of General Counsel, SBA has not established specific criteria or a process for referring firms that knowingly do not meet program requirements. To date, other than the firms identified by our prior investigation, the SBA program office has never referred any firms for debarment and/or suspension proceedings based on their findings from their program eligibility reviews. By failing to hold firms accountable, SBA has sent a message to the contracting community that there is no punishment or consequences for committing fraud or abusing the intent of the HUBZone program. However, as noted below, the SBA has started the debarment process on 7 of the 10 firms we found to have fraudulently or inaccurately misrepresented its HUBZone status in our earlier work. SBA Has Initiated Some Enforcement Actions Against 10 HUBZone Firms Previously Investigated by GAO: SBA has taken some enforcement steps on the 10 firms that we found did not meet HUBZone program requirements as of July 2008. According to SBA, as of January 2009, two of the firms have been removed from the program and two others are in the process of being removed.[Footnote 24] However, SBA's failure to examine some of the most egregious cases we previously identified[Footnote 25] has resulted in an additional $7.2 million in HUBZone obligations and about $25 million in HUBZone set-aside or price preference contracts to these firms. For example, a construction firm identified in our July 2008 testimony admitted that it did not meet HUBZone requirements and was featured in several national publications by name. It has continually represented itself as HUBZone certified and has received $2 million in HUBZone obligations and a $23 million HUBZone set-aside contract since our testimony. See figure 5 for a reproduction of the continual representation this firm makes on the top banner of its Web site. Figure 5: Reproduction of Web Site Banner for Firm SBA Has Yet to Investigate: [Refer to PDF for image: illustration] Banner indicates "8(a) HUBZone Certified." Source: Company website. [End of figure] In the written statement for the July 2008 hearing, the Acting Administrator of SBA stated that the SBA would take "immediate steps to require site visits for those HUBZone firms that have received HUBZone contracts and will be instituting suspension and debarment proceedings against firms that have intentionally misrepresented their HUBZone status." SBA has referred 7 of these firms to its General Counsel for suspension and debarment. However, as of February 2009, according to SBA's Dynamic Small Business Web site, 7 of the 10 firms that we investigated were still HUBZone certified. Table 2 highlights the 10 firms that we noted at the July 2008 hearing that clearly did not meet the HUBZone program requirements, new HUBZone obligations and contracts these firms received, as well as the actions the SBA has taken against these firms as of January 2009. Table 2: SBA Actions on 10 HUBZone Firms Previously Investigated by GAO: Previous GAO case[A]: 1; Primary product or service: Information technology (IT), engineering, logistics, technical support services, and business management services; Case details: * Multiple GAO site visits to listed principal office revealed that no employees were working at the location and the only business equipment we found was a computer and filing cabinet; * Firm maintained its actual principal office in McLean, Virginia, which is not in a HUBZone, where most of firm's qualifying employees, including the management staff, worked; * According to payroll records, only 21 percent of the firm's employees lived in a HUBZone as of December 2007; SBA compliance actions and additional contract actions through January 2009: * Firm has received nearly $3 million in HUBZone obligations since our July 2008 testimony; * SBA has not yet performed a program examination; * SBA program officials referred firm to Suspension and Debarment Official (SDO) in January 2009; * SDO submitted a notice of proposal to debar to the company in January 2009.[B] Previous GAO case[A]: 2; Primary product or service: General construction; Case details: * GAO site visit to the firm's listed principal office during normal business hours revealed it was one-half of a residential duplex building with no employees present; * Vice president of firm admitted to certifying the firm met HUBZone requirements even though no employees worked at their principal office location; * According to payroll records, only 12 percent of the firm's employees lived in a HUBZone as of December 2007; * Although the firm admitted to failing to meet the HUBZone requirement, as of June 2008 the firm's Web site has a large lettered statement that the firm is HUBZone-certified; SBA compliance actions and additional contract actions through January 2009: * Firm received HUBZone preference contract in September 2008 worth $23 million, which includes base and all options; * Firm has received over $2 million in HUBZone obligations since our July 2008 testimony; * SBA has not yet performed a program examination; * SBA program officials referred firm to SDO in January 2009; * SDO submitted a notice of proposal to debar to the company in January 2009. Previous GAO case[A]: 3; Primary product or service: Design and installation of fire alarm systems; Case details: * President admitted that his firm "technically" did not meet HUBZone requirements; * GAO site visit to the firm's listed principal office during normal business hours revealed that it was a virtual office; * Firm operated its actual principal office in McLean, Virginia, not in a HUBZone, where most of firm's qualifying employees, including the management staff, worked; * According to payroll records, only 8 percent of the firm's employees lived in a HUBZone area as of December 2007; SBA compliance actions and additional contract actions through January 2009: * SBA removed firm from HUBZone program in November 2008 because firm did not respond to SBA's program examination inquiry; * SBA program officials referred firm to SDO in December 2008; * SDO submitted a notice of proposal to debar to the company in January 2009. Previous GAO case[A]: 4; Primary product or service: Engineering and construction management services; Case details: * GAO site visit to the listed principal office during normal business hours found no employees present, the door locked, and mail stuffed under the door; * Firm operated its actual principal office in Beltsville, Maryland, which is not in a HUBZone, an indication that its daily operation is conducted out of this non-HUBZone office; * According to payroll records, only 30 percent of the firm's employees lived in a HUBZone as of December 2007; SBA compliance actions and additional contract actions through January 2009: * Firm received HUBZone set-aside contract in September 2008 worth $8,500; * SBA has not yet performed a program examination; * SBA program officials referred firm to SDO in January 2009; * SDO submitted a notice of proposal to debar to the company in January 2009. Previous GAO case[A]: 5; Primary product or service: IT consulting; Case details: * GAO site visit to the firm's listed principal office found the firm's president and one employee; * According to the president, between 80 to 90 full-time employees worked at a non-HUBZone location in Lanham, Maryland. A GAO site visit confirmed the existence of this location, indicating that the listed principal office does not meet HUBZone requirements; * According to payroll records, only 29 percent of the firm's employees lived in a HUBZone area as of December 2007; SBA compliance actions and additional contract actions through January 2009: * Firm received about $1.7 million in HUBZone obligations since our July 2008 testimony; * SBA completed program examination in November 2008 and notified firm that it was scheduled for removal from the HUBZone program; * SBA program officials referred firm to SDO in December 2008; * SDO submitted a notice of proposal to debar to the company in January 2009. Previous GAO case[A]: 6; Primary product or service: Mechanical engineering; Case details: * Federal agencies obligated more than $27 million on government contracts that were not HUBZone contracts for the firm; * Multiple GAO site visits revealed no employees present at the principal office in Washington, D.C.; * Firm operated from an office in Hyattsville, Maryland, not in a HUBZone, where most qualifying employees worked; * President stated that she believed SBA defined "principal office" as "where the principal" (e.g., president) worked; * President also stated that she typically worked at the principal office, but that investigators happened to find her at the non-HUBZone office location; * According to payroll records, only 4 of 78 employees (about 5 percent) lived in a HUBZone as of December 2007; SBA compliance actions and additional contract actions through January 2009: * SBA completed program examination and notified firm in November 2008 that it was scheduled for removal from the HUBZone program; * SBA program officials referred firm to SDO in January 2009; * SDO submitted a notice of proposal to debar to the company in January 2009; * SBA has still not removed firm from the HUBZone program 3 months after it found the firm was not eligible for the program. Previous GAO case[A]: 7; Primary product or service: Acquisition and project management; Case details: * Firm met principal office requirement; * Payroll documents indicate less than 6 percent of the firm's employees lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in May 2008; SBA compliance actions and additional contract actions through January 2009: * SBA removed firm from HUBZone program in November 2008 because firm voluntarily withdrew from the program; * SBA program officials referred firm to SDO in December 2008; * SDO submitted a notice of proposal to debar to the company in January 2009. Previous GAO case[A]: 8; Primary product or service: Construction management; Case details: * Firm met principal office requirement; * Payroll documents showed only about 17 percent of the firm's employees lived in a HUBZone as of December 2007; SBA compliance actions and additional contract actions through January 2009: * SBA concluded firm met HUBZone program requirements based on an SBA program examination.[C] Previous GAO case[A]: 9; Primary product or service: IT products and services; Case details: * Firm met principal office requirement; * Payroll documents showed that the firm's only employee did not live in a HUBZone as of December 2007; SBA compliance actions and additional contract actions through January 2009: * Firm received HUBZone set-aside contract in September 2008 worth $1.8 million; * Firm has received over $20,000 in HUBZone obligations since our July 2008 testimony; * SBA concluded firm met HUBZone program requirements based on an SBA program examination.[C] Previous GAO case[A]: 10; Primary product or service: IT and logistics management; Case details: Firm met principal office requirement; Payroll documents show only about 15 percent of the firm's employees lived in a HUBZone as of December 2007; SBA compliance actions and additional contract actions through January 2009: Firm has received over $500,000 in HUBZone obligations since our July 2008 testimony; SBA concluded firm met HUBZone program requirements based on an SBA program examination.[C] Source: GAO analysis of SBA information. Note: See: GAO, HUBZone Program: SBA's Control Weaknesses Exposed the Government to Fraud and Abuse, [hyperlink, http://GAO-08-964T] (Washington, D.C.: July 17, 2008). [A] Cases are arranged in the same order as in [hyperlink, http://GAO-08-964T]. [B] SBA officials stated that they are giving each company 30 days to reply to the notice of proposal to debar. Within 30 days after receipt of the notice, the contractor may submit information and argument in opposition to the proposed debarment. [C] We maintain that the three cases SBA examined and determined to meet HUBZone program requirements were out of HUBZone compliance at the time of our review. In January 2009, we asked the SBA for documentation related to its review, but no documentation was provided to us. [End of table] As noted in the table above, as of January 2009 SBA has conducted program evaluations on 7 of the 10 firms to determine whether the firms meet the eligibility requirements for the HUBZone program. Based on these evaluations, SBA has removed 2 firms from the HUBZone program and is in the process of providing due process to 2 additional firms to determine whether they should be removed.[Footnote 26] SBA officials stated that no action will be taken on 3 firms because SBA's program evaluations concluded that these firms met all the eligibility requirements of the HUBZone program. We attempted to verify SBA's work, but were not provided with the requested documentation to support their conclusion that the firms moved into compliance after our July 2008 testimony. SBA officials said they have not yet performed program evaluations for 3 of the most egregious firms because they are experiencing technical problems with SBA's caseload system. As such, these 3 firms remain eligible to receive HUBZone set-aside contracts. SBA is also pursuing suspension and debarment actions for 7 of these firms, and the Department of Justice considering civil actions on 5 of the 10 cases. Conclusions: Our work on the HUBZone program to date has shown that numerous ineligible firms have taken advantage of the opportunity to commit fraud against the federal government. The SBA has initiated steps to correct internal control deficiencies, but it still falls short in developing measures to prevent, detect, and prosecute fraud within the HUBZone program. Our work demonstrates that SBA's fraud controls lack important elements needed to screen and monitor firms which has led to HUBZone awards to firms that did not meet program requirements. For example, SBA's failure to verify principal office locations through unannounced site visits has led to firms operating their businesses from locations that are far from economically disadvantaged. In addition, a lack of oversight for monitoring all of the program requirements has allowed HUBZone firms to subcontract large portions of HUBZone work to non-HUBZone firms thereby failing to meet the program requirement that at least 50 percent of the personnel costs of a contract be expended on its own employees. Lastly, SBA's lack of enforcement within the HUBZone program has not had the effect of deterring fraudulent actors from entering or remaining in the program. Going forward, SBA must develop and incorporate effective fraud controls into its overall internal control process that will minimize fraud and abuse in the HUBZone program. Recommendations for Executive Action: To establish an effective fraud prevention system for the HUBZone program, the Administrator of the Small Business Administration should expeditiously implement the recommendations from our June 2008 report and take the following four actions: * Consider incorporating a risk-based mechanism for conducting unannounced site visits as part of the screening and monitoring process. * Consider incorporating policies and procedures into SBA's program examinations for evaluating if a HUBZone firm is expending at least 50 percent of the personnel costs of a contract using its own employees. * Ensure appropriate policies and procedures are in place for the prompt reporting and referral of fraud and abuse to SBA's Office of Inspector General as well as SBA's Suspension and Debarment Official. * Take appropriate enforcement actions on the 19 HUBZone firms we found to violate HUBZone program requirements to include, where applicable, immediate removal or decertification from the program, and coordination with SBA's Office of Inspector General as well as SBA's Suspension and Debarment Official. Agency Comments and Our Evaluation: We received written comments on a draft of this report from SBA's Deputy Associate Administrator of the Office of Business Development and Government Contracting. In the response, SBA agreed with three of our four recommendations. SBA stated that it is in the process of re- engineering the entire HUBZone certification and eligibility process, and SBA believes that our recommendations are useful in making necessary program changes to minimize program risk and ensure that only eligible firms received HUBZone program benefits. SBA's written comments are provided in appendix II. SBA disagreed with our recommendation to consider incorporating policies and procedures into SBA's program examinations for evaluating if a HUBZone firm is complying with the performance-of-work requirements by expending at least 50 percent of the personnel costs of a contract using its own employees. SBA stated that although this requirement is included in SBA HUBZone regulations, it is not a criterion for HUBZone program eligibility but rather a mandatory contract term. SBA stated that contracting officers are required by the Federal Acquisition Regulations to insert such clauses regarding subcontracting limitations. If firms submit bids that indicate that they will not meet this requirement or fail to meet this requirement during performance of the contract, the contracting officer has the authority to reject a firm's bid or terminate the contract for default. SBA stated that it will continue to work with contracting officers to ensure that this requirement is monitored. While we recognize that contracting officers have a responsibility for monitoring the subcontracting limitation, SBA also has this responsibility. In order to receive HUBZone certification, a firm must certify to SBA that it will abide by this performance requirement, and SBA is required by statute to establish procedures to verify such certifications. In addition, verification that a firm is meeting the performance-of-work requirements is one of the subjects that SBA may review during its program examinations. Since SBA is not performing this review, it is possible that many firms may be receiving the benefits of the HUBZone program while evading the program requirements. Therefore, we continue to believe that SBA should consider incorporating policies and procedures into SBA's program examinations for evaluating if a HUBZone firm is meeting the performance-of-work requirements. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Administrator of the Small Business Administration and other interested parties. The report will also be available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. If you or your staff have any questions about this report, please contact me at (202) 512- 6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who contributed to this report are listed in appendix III. Sincerely yours, Signed by: Gregory Kutz: Managing Director, Forensic Audits and Special Investigations: [End of section] Appendix I: Additional Case Studies of HUBZone Firms That Did Not Meet Program Eligibility Requirements: This appendix presents summary information on 9 of 19 firms that clearly did not meet the program eligibility requirements of the HUBZone program. Table 3 shows the remaining case studies that we investigated. As with the 10 cases discussed in the body of this report, these 9 firms continued to represent themselves as eligible HUBZone interests to SBA. Because these 9 case examples clearly are not eligible, we consider each firm's continued representation indicative of fraud and/or abuse related to this program. Table 3: HUBZone Firms Making Fraudulent or Inaccurate Representations: Case: 11; Location: San Antonio, TX; Primary product or service: Construction; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $2,770,000; (Department of the Air Force); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 6 of the firm's 31 employees (19 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 12; Location: San Diego, CA; Primary product or service: Construction; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $3,530,000; (Department of the Navy); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 5 of the firm's 38 employees (13 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 13; Location: Huntsville, AL; Primary product or service: Engineering; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $920,000; (Department of the Air Force); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 19 of the firm's 100 employees (19 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 14; Location: San Diego, CA; Primary product or service: Engineering and Information Technology; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $960,000; (Department of the Navy); Case details: * Firm did not meet principal office requirement because the firm's principal office was not located in HUBZone area[B]; * Firm met 35 percent residency requirement; * Firm self-certified that it met the HUBZone requirements in ORCA in September 2008. Case: 15; Location: San Antonio, TX; Primary product or service: Facilities Support Services/Construction; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $1,840,000; (multiple agencies); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 8 of the firm's 76 employees (11 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in May 2008. Case: 16; Location: San Antonio, TX; Primary product or service: Food Service Contractors; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $830,000; (Department of the Navy); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 62 of the firm's 239 employees (26 percent) lived in a HUBZone as of December 2007; * Firm does not have a current ORCA certification. Case: 17; Location: San Diego, CA; Primary product or service: Information Technology; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $2,090,000; (multiple agencies); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 10 of the firm's 43 employees (23 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Case: 18; Location: Waco, TX; Primary product or service: Janitorial; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $440,000; (Department of Veterans Affairs); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that only 4 of the firm's 16 employees (25 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in November 2008. Case: 19; Location: San Antonio, TX; Primary product or service: Temporary Help Services; Fiscal Year 2006-2007 Obligations on HUBZone contracts[A] (reporting agencies): $350,000; (Departments of the Navy and Army); Case details: * Firm met principal office requirement; * Firm did not meet 35 percent residency requirement because payroll records show that this firm's only employee did not live in a HUBZone as of December 2007[C]; * Firm self-certified that it met the HUBZone requirements in ORCA in July 2008. Source: GAO analysis of FPDS, ORCA, CCR and contractor data. [A] Net obligation amounts are rounded to the nearest $10,000. [B] We checked this firm's principal office address using both the current HUBZone map located on SBA's Web site as well as a HUBZone map as it would have appeared in December 2007 and in both instances the firm's principal office was not located in a HUBZone area. [C] Earlier in 2007, a total of 16 people were employed by this company, however at no time did any of the employees live in a HUBZone. [End of table] [End of section] Appendix II: Comments from the Small Business Administration: U.S. Small Business Administration: Washington, D.C. 20416: March 13, 2009: Greg Kutz, Managing Director: Forensic Audits and Special Investigations: U.S. Government Accountability Office: Washington, DC 20548: Dear Mr. Kutz: Thank you for allowing the U.S. Small Business Administration (SBA) the opportunity to comment on your Draft Government Accountability Office (GAO) Report Number: GAO 09-440, entitled, "HUBZone Program: Fraud and Abuse Identified in Four Metropolitan Areas." SBA has reviewed GAO's four recommendations for executive action and is submitting the following responses: Recommendation #1: Consider incorporating a risk-based mechanism for conducting unannounced site visits as part of the screening and monitoring process. Response: SBA agrees with the recommendation. SBA will develop risk- based procedures for conducting site visits to ensure HUBZone program eligibility. Recommendation #2: Consider incorporating policies and procedures into SBA's program examinations for evaluating if a IT HUBZone firm is expending at least 50 percent of the personnel costs of a contract using its own employees. Response: SBA disagrees with the recommendation to revise program examination polices and procedures for evaluating if a HUBZone firm is expending at least 50 percent of the personnel cost of a contract using its own employees. Although the 50 percent requirement is included SBA HUBZone regulations, it is not a criteria for HUBZone program eligibility hut rather a mandatory contract term. When awarding HUBZone set-aside contracts, HUBZone sole source contracts, or contracts with a HUBZone price evaluation preference, contracting officers are required by the Federal Acquisition Regulations to insert such clauses. If firms submit bids that indicate that they will not meet this requirement or fail to meet this requirement during performance of the contract, the contracting officer has the authority to reject a firm's bid or terminate the contract for default. SBA will continue to work with contracting officers to ensure that this requirement is monitored. Recommendation #3: Ensure appropriate policies and procedures are in place for the prompt reporting and referral of fraud and abuse to SBA's Office of Inspector General as well as SBA's Suspension and Debarment Official. Response: SBA agrees with the recommendation. SBA is developing policies and standard operating procedures for prompt reporting and referral of cases of fraud and abuse to SBA's Office of Inspector Genera] and Suspension and Debarment Official. Recommendation #4: Take appropriate enforcement actions on the 19 HUBZone firms we found to violate HUBZone program requirements to include, where applicable, immediate removal or decertification from the program. and coordination with SBA's Office of Inspector General as well as SBA's Suspension and Debarment Official. Response: SBA agrees with the recommendation. Once GAO provides the names of the 19 firms, the HUBZone office will confirm their ineligibility and if appropriate initiate decertification action and make referral to SBA's Office of Inspector General and SBA's Suspension and Debarment Official for action. As indicated in the draft report, SBA is in the process of re- engineering the entire HUBZone certification and eligibility process, and we believe that the GAO's recommendations are useful in making necessary program changes to minimize program risk and ensure that only eligible firms received HUBZone program benefits. Again, thank you for the opportunity to comment. If you have any questions or require additional information. please contact Ms. Tiffani Cooper, GAO Liaison at (202) 205-6700. Sincerely, Signed by: Calvin Jenkins: Deputy Associate Administrator: Office of Business Development and Government Contracting: [End of section] Appendix III GAO Contact and Staff Acknowledgments: GAO Contact: Gregory D. Kutz, Managing Director, (202) 512-6722, kutzg@gao.gov: Staff Acknowledgments: In addition to the individual named above, Erika Axelson, Gary Bianchi, Donald Brown, Bruce Causseaux, Eric Eskew, Dennis Fauber, Craig Fischer, Robert Graves, Betsy Isom, Jason Kelly, Julia Kennon, Barbara Lewis, Olivia Lopez, Jeff McDermott, Andrew McIntosh, John Mingus, Andy O'Connell, Mary Osorno, Chris Rodgers, and Matt Valenta also provided assistance on this report. [End of section] Footnotes: [1] GAO, HUBZone Program: SBA's Control Weaknesses Exposed the Government to Fraud and Abuse, [hyperlink, http://www.gao.gov/products/GAO-08-964T] (Washington, D.C.: July 17, 2008). [2] GAO, Small Business Administration: Additional Actions Are Needed to Certify and Monitor HUBZone Businesses and Assess Program Results, [hyperlink, http://www.gao.gov/products/GAO-08-975T] (Washington, D.C.: July 17, 2008). [3] The Dynamic Small Business Search is part of the Central Contractor Registration (CCR) database. If a firm indicates it is a small business in CCR, its business information will be populated in SBA's database and can be accessed through the Dynamic Small Business Search. [4] The FPDS-NG is the central repository for capturing information on federal procurement actions. Dollar amounts reported by federal agencies to FPDS-NG represent the net amount of funds obligated or deobligated as a result of procurement actions. Because we did not obtain disbursement data, we were unable to identify the actual amounts received by firms. [5] ORCA was established as part of the Business Partner Network, an element of the Integrated Acquisition Environment, which is implemented under the auspices of White House Office of Management and Budget, Office of Federal Procurement Policy, and the Chief Acquisition Officers Council. ORCA is "the primary Government repository for contractor submitted representations and certifications required for the conduct of business with the Government." [6] HUBZone Act of 1997, Pub. L. No. 105-135, Title VI, § 602(a), 111 Stat. 2592, 2627 (1997). [7] We previously reported that, as of February 2008, SBA had about 13,000 firms in the HUBZone program. SBA officials stated that they did not maintain data on the reason why there was a 3,700 decrease in the number of firms in the HUBZone program. According to SBA officials, a possible cause for this decrease was that SBA eliminated a backlog of its HUBZone recertifications. SBA officials said that many of these firms were removed from the HUBZone program because the firms either voluntarily withdrew or did not respond to SBA's recertification inquiry after giving them due process. [8] There are different means of fulfilling this requirement, depending on the type of contract. 13 C.F.R. § 126.700. [9] 15 U.S.C. § 657a. [10] GAO, HUBZone Program: SBA's Control Weaknesses Exposed the Government to Fraud and Abuse, [hyperlink, http://www.gao.gov/products/GAO-08-964T] (Washington, D.C.: July 17, 2008). [11] GAO, Small Business Administration: Additional Actions Are Needed to Certify and Monitor HUBZone Businesses and Assess Program Results, [hyperlink, http://www.gao.gov/products/GAO-08-643] (Washington, D.C.: June, 2008). [12] These firms had principal offices in or near 4 metropolitan areas: Dallas, Texas; Huntsville, Alabama; San Antonio, Texas; and San Diego, California. [13] These 19 firms received a total of $187 million in federal obligations in fiscal years 2006 and 2007. [14] See 13 C.F.R. § 126.700. [15] This firm attested in ORCA in February 2008 that it made "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by SBA." [16] We were unable to verify if this trailer was ever used as the firm's principal office. [17] HUBZone companies must re-certify with SBA every 3 years. [18] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] Standards for Internal Control in the Federal Government. [19] Association of Certified Fraud Examiners, Fraud Examiners Manual, U.S. Edition (2007). [20] GAO, Hurricanes Katrina and Rita Disaster Relief: Prevention is the Key to Minimizing Fraud, Waste and Abuse in Recovery Efforts, [hyperlink, http://www.gao.gov/products/GAO-07-418T] (Washington, D.C.: Jan. 29, 2007); and Individual Disaster Assistance Programs: Framework for Fraud Prevention, Detection, and Prosecution, [hyperlink, http://www.gao.gov/products/GAO-06-954T] (Washington, D.C.: July 12, 2006). [21] We did not test the extent to which SBA personnel are following the instruction in the Desktop Manual. [22] GAO, Small Business Administration: Additional Actions Are Needed to Certify and Monitor HUBZone Businesses and Assess Program Results, [hyperlink, http://www.gao.gov/products/GAO-08-643] (Washington, D.C.: June, 2008). [23] Since fiscal year 2004, SBA's policy was to conduct program examinations on 5 percent of firms each year. According to SBA, a program examination involves a review of the following criteria: 1) 51 percent ownership by a U.S. citizen; 2) qualification as a small business under the size standard corresponding to primary industry classification; 3) the firm's principal office must be located in a HUBZone; and 4) at least 35 percent of the firm's employees must reside in a HUBZone. [24] As of February 2009, 7 of the 10 firms were still HUBZone certified according to SBA's Dynamic Small Business Search. One of the two firms in the process of being removed was no longer listed as HUBZone certified. [25] GAO, HUBZone Program: SBA's Control Weaknesses Exposed the Government to Fraud and Abuse, [hyperlink, http://www.gao.gov/products/GAO-08-964T] (Washington, D.C.: July 17, 2008). [26] A firm that SBA has decertified may seek certification no sooner than one year from the date of decertification. If the firm was decertified for failure to notify SBA of a material change affecting its eligibility, it must include with its application for certification a full explanation of why it failed to notify SBA of the material change. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO‘s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO‘s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.