Assessing the Small Business Administration’s Pandemic Programs: Not Good Enough, Even for Government Work

To be sure, the federal government faced an extraordinary challenge. Due to the very nature of the government’s policy of quickly aiding those affected by COVID-19 and its economic effects, federal relief programs were at an increased risk of improper payments. It may be that some level of waste is acceptable in an emergency, but the Small Business Administration’s (SBA’s) performance nevertheless undermines the case for “big government.”

Both the Paycheck Protection Program and the Economic Injury Disaster Loan program reflect gross expansions of frameworks that were already troubled before the pandemic. And then Congress and the SBA removed safeguards to hasten funds out the door. Despite the absence of upfront controls, the SBA failed to monitor against improper payments and fraud until after most of these programs’ loans and guarantees had been disbursed. There is a steep taxpayer cost to this mismanagement: government watchdogs have identified more than $250 billion in potentially improper payments.

The SBA operates several subsidies for small businesses, including “section 7(a)” loan guarantees—named after the statutory provision that created the program.¹ The SBA itself doesn’t lend the money but instead “backs” loans that the lender provides to afford the borrower better terms. If the borrower defaults, the taxpayer is on the hook up to the percentage guaranteed by the SBA. The SBA’s Office of Credit Risk Management administers the program with guidance from the Treasury Department regarding third-party lenders.²

In response to the pandemic, Congress modified the section 7(a) framework to create the Paycheck Protection Program (PPP).³ Under the PPP, the federal government guaranteed 100 percent of the loan, set at a low interest rate (1 percent), and the loan could be forgiven if the borrower spent a certain percentage (about two-thirds) on payroll. Further, Congress expanded eligibility to include virtually any business or nonprofit with fewer than 500 employees. The maximum PPP loan amount is a function of the borrower’s payroll costs during the prior year, so it varies for each loan, although no loan could exceed $10 million.⁴

The SBA administered the PPP in two phases. The program initially ended August 8, 2020, after the SBA exhausted $521 billion in loan authorizations (about 85 percent of which were made during the program’s first two months, approximately April 3 through June 4, 2020).⁵ A few months later, Congress authorized additional loans.⁶ The SBA relaunched the program January 11, 2021, and small businesses could apply for a PPP loan through March 31, 2021.⁷ On August 10, 2020, the SBA began accepting loan forgiveness applications.⁸

All told, Congress authorized the SBA to guarantee $813.7 billion worth of loans.⁹ As of April 4, 2021, the SBA had backed about 9.1 million PPP loans from 5,460 lenders, totaling about $746 billion.¹⁰ To put these numbers into perspective, from fiscal years 2000–2019, the SBA made about 1.2 million section 7(a) loans totaling $333 billion, an annual average of about 62,000 loans totaling $16.7 billion.¹¹

After the program initially closed, the SBA Office of the Inspector General warned that it had “identified trends that indicate widespread fraudulent activity in the program.”¹² In the media, anecdotal evidence has been mounting that scammers “ran wild” with the PPP.¹³ For example, the New York Times reported that one lender participating in the program was “frustrated with humanity” by the extent of attempted fraud he had witnessed.¹⁴

By the end of September 2020, the inspector general’s office had received more than 77,000 hotline complaints of potential fraud, and since then, “the numbers continue to rise.”¹⁵ From April through October 2020, financial institutions filed more than 21,000 suspicious activity reports related to the PPP involving indicators such as rapid movement of funds, identity theft, and forgeries.¹⁶

In addition to the risks posed by scammers, there is the related risk posed by administrative inefficiency at the SBA. In December 2020, an independent financial statement auditor (KPMG) flagged as potentially improper payments more than 2 million approved PPP loan guarantees, with an approximate value of $189 billion.¹⁷ KPMG flagged the loans for one or more of 35 reasons (such as borrower with criminal record or inactive business).

The SBA has yet to estimate how much waste is associated with the PPP. However, there are such serious data quality issues—KPMG found 896,000 lender reporting errors¹⁸—that it’s uncertain whether it’s even possible to calculate the level of waste associated with the PPP.¹⁹

SBA section 7(a) loan guarantees were troubled even before the pandemic, having been an annual presence on the Office of Management and Budget’s list of “high priority” programs.²⁰ Moreover, since 2014, the SBA Office of the Inspector General has considered the section 7(a) program to be “high risk,” warranting greater attention to protect program dollars.²¹

From this suboptimal baseline, Congress loosened safeguards that are part of the SBA’s regular framework for backing loans, such as not requiring a personal guarantee and allowing borrower self-certification of eligibility.²² Also, by increasing the loan guarantee to 100 percent, Congress reduced the risk to lenders, who, as a result, may have had less incentive to perform due diligence in originating loans.

Then the SBA relaxed internal controls even further by limiting underwriting requirements for lenders. Under the SBA’s section 7(a) program, borrowers must provide documentation, including financial statements and income tax returns; for the PPP, however, the SBA waived these evidentiary requirements for the program’s first phase.²³ Because of the limited loan underwriting, lenders and the SBA had less information from applicants to detect errors or fraud. The SBA further deflated lenders’ incentive to vet loans by holding them harmless for borrower error.

The outcome is that an already troubled program loosened its existing safeguards to process its unprecedented workload. This is a recipe for disaster and, predictably, the results were dire.

KPMG, the independent auditor contracted to review the SBA’s performance, found that “material weaknesses”—its harshest assessment—plagued every aspect of the program, including “approval of PPP loan guarantees,” “reporting of PPP loan guarantees,” and “service entities used for loan guarantee programs.” According to KPMG, these deficiencies resulted from “an inadequate entity wide control environment to implement processes, and procedures to account for new and expanded programs under the [Coronavirus Aid, Relief, and Economic Security] Act and related legislation with sufficiently designed, implemented, and effectively operating controls.”²⁴

The Government Accountability Office corroborated KPMG’s assessment in a report whose blunt title speaks volumes: “COVID-19 Loans Lack Controls and Are Susceptible to Fraud.”²⁵ Perhaps the most alarming alert came from the SBA inspector general, who reported that the agency, in order to diminish its backlog, temporarily “turned off system controls to allow faster approval times.”²⁶

When it comes to ongoing oversight, the SBA was caught flatfooted without a plan. For almost a year, the agency resisted calls from government watchdogs to implement a plan to proactively manage the related risks of fraud and improper payments.²⁷ The agency relented only after Congress forced its hand in the Consolidated Appropriations Act of 2021, which requires the SBA to submit to the Senate and House Small Business Committees an audit plan that details the policies and procedures for conducting forgiveness reviews and audits of PPP loans.²⁸

Only after most of the loan authorizations had been exhausted did the SBA start to formally estimate improper payments, conduct a fraud risk assessment, or develop a strategy to monitor and manage fraud risks in the PPP on a continuous basis.²⁹

Equally troubling, the agency has been uncooperative with third-party oversight. Throughout 2020, both the Government Accountability Office and the SBA Office of the Inspector General repeatedly reported that the SBA had failed to provide key data and documents.³⁰ Again, the agency’s recalcitrance ended only after Congress intervened.³¹

The Economic Injury Disaster Loan (EIDL) program provides loans to small businesses after disasters.³² Whereas the SBA backs third-party loans under the section 7(a) program, the agency directly issues EIDLs up to $2 million each.³³ The SBA’s Office of Disaster Assistance administers the program.

In response to the pandemic, Congress modified the EIDL program by expanding eligibility and improving benefits.³⁴ To fund the expanded program, Congress appropriated about $50 billion in loan credit subsidy costs to support approximately $367 billion in EIDLs.³⁵ Congress appropriated an additional $40 billion for the SBA administrator to provide up to $10,000 as an advance payment, which applicants were not required to repay, even if subsequently denied an EIDL.³⁶

To put these figures in perspective, the SBA had approved 2.2 million disaster loans for $66.7 billion over the agency’s entire 67-year history prior to the pandemic.³⁷ As of April 1, 2021, the SBA had approved about 3.8 million EIDLs totaling about $202 billion (or an average of about $53,500 per loan) and about $20 billion in funding for advances.³⁸

Last July, the SBA Office of the Inspector General warned that its preliminary investigation suggested “rampant fraud” in the EIDL program.³⁹ Between May and October 2020, over 900 U.S. financial institutions filed more than 20,000 suspicious activity reports related to the EIDL program, involving suspected identity theft, the rapid movement of funds, and forgeries. As of January 2021, SBA investigators had received nearly 750,000 referrals related to identity theft and over 585,000 referrals related to other potentially fraudulent activities associated with the EIDL program.⁴⁰

Last October, the SBA Office of the Inspector General conducted an informal assessment and flagged $77 billion in approved loans that evinced “strong fraud indicators”—or almost 46 percent of the EIDL applications that had been approved up to that point ($169 billion). Of course, the SBA continued to make loans, and accordingly, the SBA inspector general cautioned that “the potential fraud in the COVID-19 EIDL Program has continued to grow.”⁴¹

Ultimately, we don’t know the potential for waste in the EIDL program because the SBA has yet to perform a formal estimate of its improper payments.

Long before the pandemic, government auditors had sounded alarms about core aspects of the EIDL program, including the SBA’s assessment of creditworthiness and ensuring applicant eligibility.⁴² Despite these repeated warnings, the agency’s performance has worsened. For the fiscal year prior to its expanded responsibilities, the SBA reported its highest ever improper payment rate of 11.98 percent,⁴³ among the worst rates in government.⁴⁴ The EIDL program, therefore, was troubled before the stress of having to operate a vastly expanded loan portfolio almost overnight. Further, to hasten loans out the door, Congress removed the SBA’s most important internal control by blocking the agency from seeking borrower tax transcripts directly from the IRS.⁴⁵

Even allowing that Congress made the SBA’s job much more difficult, the agency’s stewardship of the expanded EIDL program nonetheless proved to be a debacle. Days into its administration, an overwhelmed SBA suffered a significant data breach, so the agency turned to a contractor. But the contractor had no experience with a job of this magnitude, so it turned to a subcontractor.⁴⁶ Under this arrangement, the subcontractor reviewed EIDL applications and then transmitted recommendations to SBA personnel, who were responsible for making the final decisions.

In processing applications, the subcontractor used a computer system that relies on public data to verify a borrower’s eligibility. As designed, the subcontractor’s system was supposed to flag applications with potential problems and thereby alert an SBA loan officer that more research was necessary. In practice, however, this on-the-fly review process was prone to serious flaws. For example, the subcontractor estimated that 40 percent of banks do not collect enough information for its system to verify a bank account.⁴⁷

But even if the subcontractor’s system had been foolproof and flagged every suspicious application, it wouldn’t have mattered, because the SBA failed to implement a process to take these warnings into account.⁴⁸ Worse, the SBA “ignored” certain subcontractor flags for months, according to the inspector general.⁴⁹ More generally, the inspector general determined that the SBA “lowered the guardrails,” which “significantly increase[ed] the risk of fraud.”

KPMG, the independent auditor, found “material weaknesses” in the SBA’s processing of EIDLs and contractor oversight. In its discussion of these weaknesses, the auditor noted deficiencies within all components of the SBA’s internal control.⁵⁰

As was the case with the PPP, the SBA had no plan for ongoing oversight, despite the absence of upfront controls.⁵¹ And again, the SBA resisted calls from government watchdogs to implement a framework to identify and mitigate taxpayer waste. And yet again, the agency stonewalled data requests from third-party watchdogs, thus impeding their oversight too.⁵²

For both programs (EIDL and PPP), the SBA’s response to criticism has been illustrative. Over the past year, various public and private watchdogs have issued a raft of reports that are all in agreement that the SBA’s management failures have placed huge sums of taxpayer money at risk.⁵³ In response, the agency effectively buried its head in the sand. Last October, for example, the Office of the Inspector General observed that “SBA’s management continues to insist that its controls are robust despite overwhelming evidence to the contrary.”⁵⁴ Similarly, the agency did not concur on the independent auditors’ finding of material weaknesses.⁵⁵ These responses call into question the extent to which the agency is capable of the self-reflection necessary for improvement.

For the SBA’s pandemic programs, a troubling pattern emerged. In responding to the pandemic, Congress sought to scale up already troubled programs while also rolling back internal controls. The SBA, in turn, lowered safeguards further. In terms of oversight, the agency had no plan at the outset, despite the lack of upfront controls; further, the agency dragged its feet on ongoing oversight. Due to this maelstrom of mismanagement, hundreds of billions of taxpayer dollars have been placed at undue risk.