This is the accessible text file for GAO report number GAO-08-964T entitled 'Hubzone Program: SBA's Control Weaknesses Exposed the Government to Fraud and Abuse' which was released on July 17, 2008. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Committee on Small Business, House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery: Expected at 10:00 a.m. EST: Thursday, July 17, 2008: Hubzone Program: SBA's Control Weaknesses Exposed the Government to Fraud and Abuse: Statement of Gregory D. Kutz, Managing Director: Forensic Audits and Special Investigations: Bruce A. Causseaux, Senior Level Specialist: Forensic Audits and Special Investigations: GAO-08-964T: GAO Highlights: Highlights of GAO-08-964T, a testimony before the Committee on Small Business, House of Representatives. Why GAO Did This Study: The Historically Underutilized Business Zone (HUBZone) program is intended to provide federal contracting opportunities to qualified small business firms in order to stimulate development in economically distressed areas. As manager of the HUBZone program, the Small Business Administration (SBA) is responsible for certifying whether firms meet HUBZone program requirements. To participate in the HUBZone program, small business firms must certify that their principal office (i.e., the location where the greatest number of employees work) is located in a HUBZone and that at least 35 percent of the firm’s employees live in HUBZones. Given the Committee’s concern over fraud and abuse in the HUBZone program, GAO was asked to (1) proactively test whether SBA’s controls over the HUBZone application process were operating effectively to limit program certification to eligible firms and (2) identify examples of selected firms that participate in the HUBZone program even though they do not meet eligibility requirements. To perform its proactive testing, GAO created four bogus businesses with fictitious owners and employees and applied for HUBZone certification. GAO also selected 17 HUBZone firms based on certain criteria, such as receipt of HUBZone contracts, and investigated whether they met key program eligibility requirements. What GAO Found: GAO identified substantial vulnerabilities in SBA’s application and monitoring process, clearly demonstrating that the HUBZone program is vulnerable to fraud and abuse. Considering the findings of a related report and testimony issued today, GAO’s work shows that these vulnerabilities exist because SBA does not have an effective fraud- prevention program in place. Using fictitious employee information and fabricated documentation, GAO easily obtained HUBZone certification for four bogus firms. For example, to support one HUBZone application, GAO claimed that its principal office was the same address as a Starbucks coffee store that happened to be located in a HUBZone. If SBA had performed a simple Internet search on the address, it would have been alerted to this fact. Further, two of GAO’s applications used leased mailboxes from retail postal services centers. A post office box clearly does not meet SBA’s principal office requirement. See the graphic below for an example of a HUBZone certification letter GAO received for one of its bogus firms. Figure: HUBZone Certification from SBA for Bogus Firm: [See PDF for image] This figure is an illustration of a HUBZone Certification from SBA for Bogus Firm, containing the following text: "...your application for certification as a 'qualified HUBZone small business concern' has been approved." Source: SBA. [End of figure] We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Since 2006, federal agencies have obligated a total of more than $105 million to these 10 firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both principal office and employee residency requirements while 4 met the principal office requirements but significantly failed the employee residency requirement. For example, one firm that failed both principal office and employee residency requirements had initially qualified for the HUBZone program using the address of a small room above a dentist’s office. GAO’s site visit to this room found only a computer and filing cabinet. No employees were present, and the building owner told GAO investigators that nobody had worked there “for some time.” During its investigation, GAO also found that some HUBZone firms used virtual office suites to fulfill SBA’s principal office requirement. GAO investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. For example, one firm continued to certify it was a HUBZone firm even though its lease only provided mail forwarding services at the virtual office suite. To view the full product, including the scope and methodology, click on [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-964T]. For more information, contact Gregory Kutz at (202) 512-6722 or kutzg@gao.gov. [End of section] Madam Chairwoman and Members of the Committee: Thank you for the opportunity to discuss our investigation of the Historically Underutilized Business Zone (HUBZone) program. Created in 1997 and managed by the Small Business Administration (SBA), the HUBZone program is intended to provide federal contracting opportunities to qualified small business firms in order to stimulate development in the economically distressed areas in which the firms are located. These areas, which are designated based on certain economic and census data, are known as HUBZones. To ensure HUBZone areas receive the economic benefit from the program, SBA is responsible for determining whether firms meet HUBZone program requirements and then later monitoring whether the firms maintain their eligibility. To participate in the HUBZone program, small business firms generally must satisfy three main requirements: (1) the firm must be owned and controlled by one or more U.S. citizens; (2) at least 35 percent of its full-time employees must live in a HUBZone; and (3) the principal office (i.e., the location where the greatest number of qualifying employees perform work) must be located in a HUBZone.[Footnote 1] Small business firms in the HUBZone program are eligible to bid on federal prime contracts and subcontracts available exclusively to program participants, in addition to benefiting from other contracting preferences. According to procurement data from the Federal Procurement Data System-Next Generation (FPDS-NG), in fiscal year 2007 federal agencies reported about $8 billion in obligations on prime contracts with HUBZone firms.[Footnote 2] In awarding prime contracts and subcontracts, both federal contracting officials and prime contractor officials rely on SBA's controls to provide assurance that only eligible firms participate in the program. When applying for HUBZone status, firms are required to verify that the information they submit to SBA is true and correct. If SBA approves an application and grants a firm HUBZone certification, that firm is then required to notify SBA of any material changes affecting the firm's eligibility, such as changes in principal office location or number of employees residing in a HUBZone.[Footnote 3] Further, to compete for government contracts, HUBZone firms must verify in the government's Online Representations and Certifications Application (ORCA)[Footnote 4] that they are a HUBZone firm and that there have been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." There are criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program, including failure to correct "continuing representations" that are no longer true.[Footnote 5] Although the HUBZone program can have positive economic outcomes for small business firms and economically distressed communities, in January 2003 the SBA Office of Inspector General (OIG) reported that SBA's internal controls were inadequate to ensure that only eligible firms were allowed to participate in the HUBZone program.[Footnote 6] Given your concern over program fraud and abuse, you requested that we perform an investigation to (1) proactively test whether SBA's controls over the HUBZone application process were operating effectively to limit program certification to eligible firms and (2) identify examples of selected firms that participate in the HUBZone program even though they do not meet eligibility requirements. To proactively test whether SBA's controls over the HUBZone application process were operating effectively, we set up four bogus firms and submitted applications to SBA. Our applications contained fictitious employee information and bogus principal office addresses. We used publicly available guidance provided by SBA in preparing our applications. When necessary, we fabricated documents to support our applications using commercially available hardware and software. To identify examples of firms that participate in the HUBZone program even though they do not meet eligibility requirements, we first obtained and analyzed a list of HUBZone firms from the SBA's Certification Tracking System as of January 2008. We then obtained federal procurement data from FPDS-NG for fiscal years 2006 and 2007. We analyzed these data to identify HUBZone firms with a principal office located in the Washington, D.C., metropolitan area for which federal agencies reported obligations on HUBZone prime contracts totaling more than $450,000 between fiscal years 2006 and 2007. Based on this process, we selected 16 firms for further investigation. We selected an additional firm for investigation based on a referral to GAO's FraudNet hotline. For the 17 selected firms, we then used investigative methods, such as interviewing firm managers and reviewing firm payroll documents, to gather information about the firms and to determine whether they met HUBZone requirements. We also reviewed information about each firm in ORCA. While performing our proactive testing and investigative work, we found other HUBZone firms using virtual office suites[Footnote 7] to fulfill SBA's principal office requirement. We investigated two of these virtual office suites to identify additional examples of firms that participate in the HUBZone program even though they do not meet eligibility requirements. Our work was not designed to identify all fraudulent activity in the HUBZone program or estimate its full extent. In addition, our work was not designed to determine whether the selected firms we investigated committed fraud when applying for HUBZone status or receiving a HUBZone contract award. We conducted our investigation from January 2008 through June 2008 in accordance with quality standards for investigations as set forth by the President's Council on Integrity and Efficiency. Additional details on our scope and methodology are included in appendix I. Summary: We identified substantial vulnerabilities in SBA's application and monitoring process, clearly demonstrating that the HUBZone program is vulnerable to fraud and abuse. Considering the findings of a related report and testimony we are issuing today,[Footnote 8] our work shows that these vulnerabilities exist because SBA does not have an effective fraud prevention program in place. Using fictitious employee information and bogus documentation, we easily obtained HUBZone certification for four bogus firms. For example, to support one HUBZone application, we claimed that our principal office was the same address as a Starbucks coffee store that happened to be located in a HUBZone. If SBA had performed a simple Internet search on the address, it would have been alerted to this fact. Further, two of our applications used retail postal service center addresses where we leased mailboxes for less than $24 per month. A post office box clearly does not meet SBA's principal office requirement. To meet employee residency requirements on all four applications, we represented that we had employees working for us who lived in HUBZones. In the one instance where SBA asked for supporting documentation to verify the address of a fictitious employee, we easily created a fake identification card. Without basic fraud prevention controls in place for the HUBZone application process, SBA is at great risk of certifying ineligible firms that have applied using false information--just as we did with our four bogus firms. We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements.[Footnote 9] Since 2006, federal agencies have obligated a total of more than $105 million to these 10 firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both the principal office and employee residency requirements while 4 met the principal office requirement but significantly failed the employee residency requirement. For example, one firm that failed both principal office and employee residency requirements had initially qualified for the HUBZone program using the address of a small room above a dentist's office. Our site visit to this room found only a computer and filing cabinet. No employees were present, and the building owner told our investigators that nobody had worked there "for some time." According to its Web site, this firm identified an address in McLean, Virginia, as its headquarters. A site visit to this building, which was not located in a HUBZone, revealed that all of the firm's officers in addition to about half of the qualifying employees worked there. The fact that this firm continued to represent in ORCA, on its Web site, and to our investigators that it is a HUBZone firm is indicative of fraud. During our investigation, we also found that some HUBZone firms used virtual office suites to fulfill SBA's principal office requirement. We investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. For example, one firm continued to certify it was a HUBZone firm even though its lease only provided mail forwarding services at the virtual office suite. We briefed SBA officials on the results of our work. They were concerned about the vulnerabilities to fraud and abuse demonstrated by our work and expressed interest in improving fraud prevention controls over the HUBZone program. Ineffective Program Eligibility Controls Enabled GAO to Obtain HUBZone Certification for Bogus Firms: Our proactive testing found ineffective HUBZone program eligibility controls, exposing the federal government to fraud and abuse. In a related report and testimony[Footnote 10] released concurrently with this testimony, we reported that SBA generally did not verify the data entered by firms in its online application system. We found that SBA was therefore vulnerable to certifying firms based on fraudulent application information. Our use of bogus firms, fictitious employees, and fabricated explanations and documents to obtain HUBZone certification demonstrated the ease with which HUBZone certification could be obtained by providing fraudulent information to SBA's online application system. In all four instances, we successfully obtained HUBZone certification from SBA for the bogus firms represented by our applications. See figure 1 for an example of one of the acceptance letters we received. Figure 1: HUBZone Certification Letter from SBA for One of Four Bogus Firms: [See PDF for image] This figure is an illustration of a HUBZone Certification from SBA for Bogus Firm, containing the following excerpted text: "...your application for certification as a 'qualified HUBZone small business concern' has been approved." The complete text is as follows: U.S. Small Business Administration: Washington, DC 20416: I am pleased to advise you that effective [redacted] your application for certification as a 'qualified HUBZone small business concern' has been approved." Your firm is now eligible to receive HUBZone contracting opportunities, and one small business concerns found on the Internet at [hyperlink, http://www.sba.gov/hubzone]. The HUBZone Certification will continue provided that your firm remains in compliance with continuing program eligibility requirements and re- certifies to SBA, that it remains a qualified HUBZone SBC. Prior to your three year anniversary date, SBA will contact you to initiate the re-certification process. Failure to respond to this request for re- certification will result in SBA proposing the de-certification of your firm (13 CFR 126.100-500). Please be advised, at any time during your firm's participation in the HUBZone Program, SBA may conduct a program examination to validate program eligibility and/or continued program compliance (13 CFR Part 126.402). To apply for HUBZone Program certification, your firm had to be registered in the Central Contractor Registration (CCR/SBA Registration Information) systems. For your firm to receive benefit from the HUBZone Program, that is, to be identified by contracting officers as eligible to receive HUBZone contracts and to be paid under any such contracts, it is essential that you update your CCR/SBA Registration Information records at least annually, and more frequently if there have been material changes in your firm. If you need assistance in updating your CCR/SBA Registration Information records, please contact the CCR Assistance Center for US at 888-227-2423 and for outside US at 1-616- 961-4725. Although your concern was approved under the North American Industry Classification System (NAICS) Code found in your firm's Small Dynamic Business Profile (SDBS) and the Central Contractor Registry (CCR) Profiles, this does not prevent your concern from being awarded contracts under other NAICS Codes, as long as the concern is qualified to and eligible as a small business. In this regard, please note that you are responsible for researching and identifying potential contracts that may be available through the HUBZone Program. However, the SBA can assist you in this effort through our Government Contracting web-site at www.sba.gov/GC. This site provides a wide array of valuable Federal contract marketing material, including identification of specific contracting opportunities and points of contact at SBA and Federal acquisition agencies. I encourage you to make full use of the very valuable information on this web-site. Also, although your status as a certified HUBZone concern greatly improves your access to Federal contracts, this certification does not guarantee contract awards. Your ability to research opportunities and bid competitively will be the key to your success in this program. In addition to welcoming you to the HUBZone Program, I would also like to supply you with this helpful link to a useful contracting tool. It is the U.S. Small Business Administration's e-learning course Steps to Accessing Contracts & Subcontracts." The purpose of this course is to provide 7(j) eligible business owners and this is a group that includes HUBZone certified small business concerns -- with the keys to success for developing strategies to expand their markets to the Federal contracting sector. Through this course you will learn about: 1. Extensive business opportunities that exist with the Federal Government. 2. Strategies for selecting specific products or services to market to the Federal Government and how to find potential government customers. 3. How the Federal Government procures products and services, and strategies for winning contracts. 4. Managing a contract once it is awarded and building a solid performance record for your company. Sincerely, [Redacted] Source: SBA. [End of figure] Although SBA requested documentation to support one of our applications, the agency failed to recognize the information we provided in all four applications represented bogus firms that actually failed to meet HUBZone requirements. For instance, the principal office addresses we used included a virtual office suite from which we leased part-time access to office space and mail delivery services for $250 a month, two different retail postal service centers from which we leased mailboxes for less than $24 a month, and a Starbucks coffee store. An Internet search on any of the addresses we provided would have raised "red flags" and should have led to further investigation by SBA, such as a site visit, to determine whether the principal office address met program eligibility requirements. Because HUBZone certification provides an opening to billions of dollars in federal contracts, approval of ineligible firms for participation in the program exposes the federal government to contracting fraud and abuse, and moreover, can result in the exclusion of legitimate HUBZone firms from obtaining government contracts. We provide specific details regarding each application below. * Fictitious Application One: Our investigators submitted this fictitious application and received HUBZone certification 3 weeks later. To support the application, we leased, at a cost of $250 a month, virtual office services from an office suite located in a HUBZone and gave this address as our principal office location. Specifically, the terms of the lease allowed us to schedule use of an office space up to 16 hours per month and to have mail delivered to the suite. Our HUBZone application also indicated that our bogus firm employed two individuals with one of the employees residing in a HUBZone. Two business days after submitting the application, an SBA official emailed us requesting a copy of the lease for our principal office location and proof of residency for our employee. We created the documentation using publicly available hardware and software and faxed copies to SBA to comply with the request. SBA then requested additional supporting documentation related to utilities and cancelled checks. After we fabricated this documentation and provided it to SBA, no further documentation was requested before SBA certified our bogus firm. * Fictitious Application Two: Four weeks after our investigators submitted this fictitious application, SBA certified the bogus firm to participate in the HUBZone program. For this bogus firm, our "principal office" was a mailbox located in a HUBZone that our investigators leased from a retail postal service provider for less than $24 a month. The application noted that our bogus firm had nine employees, four of which lived in a HUBZone area. SBA requested a clarification regarding a discrepancy in the application information, but no further contact was made before we received our HUBZone certification. * Fictitious Application Three: Our investigators completed this fictitious application and received HUBZone certification 2 weeks later. For the principal office address, our investigators used a Starbucks coffee store located in a HUBZone. In addition, our investigators indicated that our bogus firm employed two individuals with one of the employees residing in a HUBZone area. SBA did not request any supporting documentation or explanations for this bogus firm prior to granting HUBZone certification. * Fictitious Application Four: Within 5 weeks of submitting this fictitious application, SBA certified our bogus firm. As with fictitious application two, our investigators used the address for a mailbox leased from a retail postal service provider located in a HUBZone for the principal office. Our monthly rental cost for the "principal office" was less than $10 per month. Our application indicated that two of the three employees that worked for the bogus firm lived in a HUBZone. SBA requested a clarification regarding a small discrepancy in the application information, but no further contact was made before receiving the HUBZone certification. Selected HUBZone Firms Do Not Meet Program Eligibility Requirements: We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements.[Footnote 11] Since 2006, federal agencies have obligated a total of more than $105 million to these firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both the principal office and employee residency requirements while 4 met the principal office requirement but significantly failed the employee residency requirement. We also found other HUBZone firms that use virtual office suites to fulfill SBA's principal office requirement. We investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. According to HUBZone regulations, persons or firms are subject to criminal penalties for knowingly making false statements or misrepresentations in connection with the HUBZone program including failure to correct "continuing representations" that are no longer true. During the application process, applicants are not only reminded of the program requirements, but are required to agree to the statement that anyone failing to correct "continuing representations" shall be subject to fines, imprisonment, and penalties. Further, the Federal Acquisition Regulation (FAR) requires all prospective contractors to update ORCA--the government's Online Representations and Certifications Application--which includes certifying whether the firm is currently a HUBZone firm and that there have been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA."[Footnote 12] However, we found that all 10 of these case-study firms continued to represent themselves to SBA, ORCA, GAO, and the general public as eligible to participate in the HUBZone program. Because the 10 case study examples clearly are not eligible, we consider each firm's continued representation indicative of fraud. We referred the 10 firms to SBA OIG for further investigation. Case Studies of HUBZone Firms That Do Not Meet Program Eligibility Requirements: We determined that 10 case study examples from the Washington, D.C., metropolitan area failed to meet the program's requirements. Specifically, we found that 6 out of the 10 failed both HUBZone requirements to operate a principal office in a HUBZone and to ensure that 35 percent or more of employees resided in a HUBZone. Our review of payroll records also found that the remaining four firms failed to meet the 35 percent HUBZone employee residency requirement by at least 15 percent. In addition, all 10 of the case study examples continued to represent themselves to SBA, ORCA, GAO, and the general public as HUBZone program-eligible. One HUBZone firm self-certified in ORCA that it met HUBZone requirements in March 2008 despite the fact that we had spoken with its owner about 3 weeks before about her firm's noncompliance with both the principal office and HUBZone residency requirements. Table 1 highlights the 10 case-study firms we investigated. Table 1: HUBZone Firms Making Fraudulent or Inaccurate Representations: Case: 1; Primary product or service: Information Technology (IT), engineering, logistics, technical support services, and business management services; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $3.9 million (Departments of the Army and Air Force); Case details: * Multiple site visits to listed principal office revealed that no employees were working at the location and the only business equipment we found was a computer and filing cabinet; * Firm maintained its actual principal office in McLean, Virginia, which is not in a HUBZone, where most of firm's qualifying employees, including the management staff, worked; * According to payroll records, only 21 percent of the firm's employees lived in a HUBZone as of December 2007; * Firm last self-certified and represented that it met the HUBZone requirements in ORCA in July 2007. Case: 2; Primary product or service: General construction; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $4.1 million (Department of the Air Force); Case details: * Site visit to the firm's listed principal office during normal business hours revealed it was one-half of a residential duplex building with no employees present; * Vice president of firm admitted to certifying the firm met HUBZone requirements even though no employees worked at their principal office location; * According to payroll records, only 12 percent of the firm's employees lived in a HUBZone as of December 2007; * Although the firm admitted to failing to meet the HUBZone requirement, as of June 2008 the firm's Web site has a large lettered statement that the firm is HUBZone-certified; * The firm self-certified that it met the HUBZone requirements in ORCA in September 2007. Case: 3; Primary product or service: Design and installation of fire alarm systems; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $463,000 (Department of Veterans Affairs); Case details: * President admitted that his firm "technically" did not meet HUBZone requirements; * Site visit to the firm's listed principal office during normal business hours revealed that it was a virtual office; * Firm operated its actual principal office in McLean, Virginia, not in a HUBZone, where most of firm's qualifying employees, including the management staff, worked; * According to payroll records, only 8 percent of the firm's employees lived in a HUBZone area as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in May 2007. Case: 4; Primary product or service: Engineering and construction management services; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $6.1 million (Department of the Army and the Smithsonian Institution); Case details: * Site visit to the listed principal office during normal business hours found no employees present, the door locked, and mail stuffed under the door; * Firm operated its actual principal office in Beltsville, Maryland, which is not in a HUBZone, an indication that its daily operation is conducted out of this non-HUBZone office; * According to payroll records, only 30 percent of the firm's employees lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in May 2008, 7 weeks after we spoke to officials. Case: 5; Primary product or service: IT consulting; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $1.8 million (Department of the Army); Case details: * Site visit to the firm's listed principal office found the firm's president and one employee; * According to the president, between 80 to 90 full-time employees worked at a non-HUBZone location in Lanham, Maryland. A site visit confirmed the existence of this location, indicating that the listed principal office does not meet HUBZone requirements; * According to payroll records, only 29 percent of the firm's employees lived in a HUBZone area as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in May 2007. Case: 6; Primary product or service: Mechanical engineering; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): n.a.[B]; Case details: * Federal agencies obligated more than $27 million on government contracts that were not HUBZone contracts for the firm; * Multiple site visits revealed no employees present at the principal office in Washington, D.C.; * Firm operated from an office in Hyattsville, Maryland, not in a HUBZone, where most qualifying employees worked; * President stated that she believed SBA defined "principal office" as "where the principal" (e.g., president) worked; * President also stated that she typically worked at the principal office, but that investigators happened to find her at the non-HUBZone office location; * According to payroll records, only 4 of 78 employees (about 5 percent) lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in March 2008, less than a month after we spoke to officials. Case: 7; Primary product or service: Acquisition and project management; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $3.2 million (Defense Information Systems Agency); Case details: * Firm met principal office requirement; * Payroll documents indicate less than 6 percent of the firm's employees lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in May 2008. Case: 8; Primary product or service: Construction management; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $4.9 million (Public Buildings Service and others); Case details: * Firm met principal office requirement; * Payroll documents showed only about 17 percent of the firm's employees lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in September 2007. Case: 9; Primary product or service: IT products and services; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $712,000 (Department of the Army); Case details: * Firm met principal office requirement; * Payroll documents showed that the firm's only employee did not live in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in October 2007. Case: 10; Primary product or service: IT and logistics management; Fiscal year 2006-07 obligations on HUBZone contracts[A] (reporting agencies): $515,000 (Department of Health and Human Services); Case details: * Firm met principal office requirement; * Payroll documents show only about 15 percent of the firm's employees lived in a HUBZone as of December 2007; * Firm self-certified that it met the HUBZone requirements in ORCA in March 2008. Source: GAO analysis of data from FPDS-NG, ORCA, and firms. [A] Obligations on prime contracts with HUBZone firms according to procurement data from FPDS-NG. [B] n.a. = not applicable. While federal agencies did not report to FPDS-NG any obligations on HUBZone contracts for this firm during fiscal years 2006 and 2007, the nature of the allegation was as such to warrant our investigation. [End of table] Case 1: Our investigation clearly showed that this firm represented itself as HUBZone-eligible even though it did not meet HUBZone requirements at the time of our investigation. This firm, which provided business management, engineering, information technology, logistics, and technical support services, self-certified in July 2007 in ORCA that it was a HUBZone firm and that there had been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." We also interviewed the president in March 2008 and she claimed that her firm met the HUBZone requirements. However, the firm failed the principal office requirement. Our site visits to the address identified by the firm as its principal office found that it was a small room that had been rented on the upper floor of a dentist's office where no more than two people could work comfortably. No employees were present, and the only business equipment in the rented room was a computer and filing cabinet. The building owner stated that the president of the firm used to conduct some business from the office, but that nobody had worked there "for some time." Moreover, the president indicated that instead of paying rent at the HUBZone location, she provided accounting services to the owner at a no-cost exchange for use of the space. See figure 2 for a picture of the building the firm claimed as its principal office (arrow indicates where the office is located). Figure 2: Principal Office for Case Study 1 Firm: [See PDF for image] Photograph of principal office for Case Study 1 firm in a residential townhome, arrow indicating a second floor location. Source: GAO. [End of figure] Further investigation revealed that the firm listed its real principal office (called the firm's "headquarters" on its Web site) at an address in McLean, Virginia. In addition to not being a HUBZone, McLean, Virginia, is in one of the wealthiest jurisdictions in the United States. Our site visit to this second location revealed that the majority of the firm's officers in addition to about half of the qualifying employees worked there and indicated this location was the firm's actual principal office. When we interviewed the president, she claimed that the McLean, Virginia, office was maintained "only for appearance." See figure 3 for a picture of the McLean, Virginia, building where the firm rented office space. Figure 3: Headquarters for Case Study 1 Firm: [See PDF for image] Photograph of building housing headquarters for Case Study 1 firm. Source: GAO. [End of figure] Based on our review of payroll documents we received directly from the firm, we also determined the firm failed the 35 percent HUBZone residency requirement. The payroll documents indicated that only 15 of the firm's 72 employees (21 percent) lived in a HUBZone as of December 2007. We also found that in January 2007 during SBA's HUBZone recertification process the president self-certified that 38 percent of the firm's employees lived in a HUBZone. However, the payroll documents received directly from firm showed only 24 percent of the firm's employees lived in a HUBZone at that time. In 2006 the Department of the Army, National Guard Bureau, awarded a HUBZone set-aside contract with a $40 million ceiling to this firm based on its HUBZone status. Although only $3.9 million have been obligated to date on the contract, because the firm remains HUBZone- certified, it can continue to receive payments up to the $40 million ceiling based on its HUBZone status until 2011. We referred this firm to SBA OIG for further investigation. Case 2: Our investigation determined that this firm, a general contractor specializing in roofing and sheet metal, continued to represent itself as HUBZone-eligible even though it did not meet HUBZone requirements. While he self-certified to the firm's HUBZone status in ORCA in September 2007, the vice president admitted during our interview in April 2008 that the firm did not meet HUBZone requirements. Nonetheless, after our interview, the firm continued actively to represent that it was a HUBZone firm--including a message in large letters on its Web site and business cards declaring that the firm was "HUBZone certified." The firm's vice-president self-certified during the SBA's HUBZone certification process in March 2007 that, as shown in figure 4, the firm's principal office was one-half of a residential duplex in Landover, Maryland. Figure 4: Principal Office for Case Study 2 Firm: [See PDF for image] Photograph of residential duplex containing principal office for Case Study 2 firm. Source: GAO. [End of figure] We visited this location during normal business hours and found no employees present. Our investigative work also found that the vice president owned another firm, which did not participate in the HUBZone program. A visit to this firm, which was located in Capitol Heights, Maryland--not in a HUBZone--revealed that both it and the HUBZone firm operated out of the same location. Further, payroll documents we received from the HUBZone firm indicated that it had 34 employees but that only 4 employees (or 12 percent) lived in a HUBZone as of December 2007. Based on our analysis of FPDS- NG data, between fiscal years 2006 and 2007 federal agencies obligated about $12.2 million for payment to the firm. Of this, about $4 million in HUBZone contracts were obligated by the Department of the Air Force. Because this firm clearly did not meet either principal office or employee HUBZone requirements at the time of our investigation but continued to represent itself as HUBZone-certified we referred this firm to SBA OIG for further investigation. Case 3: Our investigation demonstrated that this firm continued to represent itself as HUBZone-eligible while failing to meet HUBZone requirements. This firm, which specializes in the design and installation of fire alarm systems, self-certified in May 2007 in ORCA that it was a HUBZone firm and that there had been "no material changes in ownership and control, principal office, or HUBZone employee percentage since it was certified by the SBA." However, when we interviewed the president in April 2008, he acknowledged that the firm "technically" did not meet the principal office requirement. For its HUBZone certification in April 2006, an address in a HUBZone in Rockville, Maryland, was identified as its principal office location. We visited this location during normal business hours and found the address was for an office suite that provided virtual office services. According to the lease between the HUBZone firm and the office suite's management, the firm did not rent office space, but paid $325 a month to use a conference room on a scheduled basis for up to 4 hours each month. Absent additional services provided by the virtual office suite, it would be impossible for this firm to meet the principal office requirement under this lease arrangement. Moreover, the president of the firm told us that no employees typically worked at the virtual office. Additional investigative work revealed that the firm's Web site listed a second address for the firm in McLean, Virginia, which as noted above is not in a HUBZone. Our site visit determined this location to be where the firm's president and all qualifying employees worked. In addition, the payroll documents we received from the firm revealed that the percentage of employees living in a HUBZone during calendar year 2007 ranged from a low of 6 percent to a high of 15 percent--far below the required 35 percent. Based on our analysis of FPDS-NG data, between fiscal years 2006 and 2007 federal agencies obligated about $3.3 million for payment to the firm. Of this, over $460,000 in HUBZone contracts were obligated by the Department of Veterans Affairs. Further, in addition to admitting the firm did not meet the principal office requirement, the president was also very candid about having received subcontracting opportunities from large prime contracting firms based solely on the firm's HUBZone certification. According to the president, the prime contractors listed the HUBZone firm as part of their "team" to satisfy their HUBZone subcontracting goals. However, he contended that these teaming arrangements only occasionally resulted in the prime contractor purchasing equipment from his firm. Because it continued to represent itself as HUBZone-eligible, we referred it to SBA OIG for further investigation. Some HUBZone Firms Using Virtual Office Services Do Not Meet Program Requirements: Virtual offices are located nationwide and provide a range of services for individuals and firms, including part-time use of office space or conference rooms, telephone answering services, and mail forwarding. During our proactive testing discussed above, we leased virtual office services from an office suite located in a HUBZone and fraudulently submitted this address to SBA as our principal office location. The terms of the lease allowed us to schedule use of an office space for up to 16 hours per month, but did not provide permanent office space. Even though we never used the virtual office space we rented, we still obtained HUBZone certification from SBA. Our subsequent investigation of two virtual office suites located in HUBZones--one of which we used to obtain our certification--found that other firms had retained HUBZone certification using virtual office services. Based on our review of lease agreements, we found that, absent additional services provided by the virtual office suites, some of these firms could not possibly meet principal office requirements. For example: * One HUBZone firm that claimed its principal office was a virtual office address had a lease agreement providing only mail-forwarding services. The mail was forwarded to a different address not located in a HUBZone. Absent additional services provided by the virtual office suite, it would be impossible for this firm to perform any work at the virtual office location with only a mail-forwarding agreement. * Five HUBZone firms that claimed their principal office was a virtual office address leased less than 10 hours of conference room usage per month at the same time they maintained at least one other office outside of a HUBZone. Absent additional services provided by the virtual office suite, it would be impossible for these firms to meet principal office requirements with only 10 hours of conference room time per month, leading us to conclude that the majority of work at these companies was performed in the other office locations. * Five other firms claimed their principal office was a virtual office address but leased office space for less than 20 hours a month. These firms simultaneously maintained at least one other office outside of a HUBZone. Absent additional services provided by the virtual office suite, it would be impossible for these firms to meet principal office requirements with only 20 hours of rented office time per month, leading us to conclude that the majority of work at these companies was performed in the other office locations. The virtual office arrangements we investigated clearly violate the requirements of the HUBZone program and, in some cases, exemplify fraudulent representations. Corrective Action Briefing: We briefed SBA officials on the results of our investigation on July 9, 2008. They were concerned about the vulnerabilities to fraud and abuse we identified. SBA officials expressed interest in pursuing action, including suspension or debarment, against our 10 case study firms and any firm that may falsely represent their eligibility for the HUBZone program. They were also open to suggestions to improve fraud prevention controls over the HUBZone application process, such as performing steps to identify addresses of virtual office suites and mailboxes rented from postal retail centers. Madam Chairwoman and Members of the Committee, this concludes my statement. I would be pleased to answer any questions that you or other Members of the Committee may have at this time. Contacts and Acknowledgments: For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. [End of section] Appendix I: Objective, Scope, and Methodology: To proactively test whether the Small Business Administration's (SBA) controls over the Historically Underutilized Business Zone (HUBZone) application process were operating effectively, we applied for HUBZone certification using bogus firms, fictitious employees, fabricated explanations, and counterfeit documents to determine whether SBA would certify firms based on fraudulent information. We used publicly available guidance provided by SBA to create four applications. We did the minimal work required to establish the bogus small business firms represented by our applications, such as obtaining a Data Universal Numbering System (DUNS) number from Dun & Bradstreet and registering with the Central Contractor Registration database. We then applied for HUBZone certification with our four firms using SBA's online HUBZone application system. Importantly, the principal office addresses we provided to SBA, although technically located in HUBZones, were locations that would appear suspicious if investigated by SBA. When necessary (e.g., at the request of SBA application reviewers), we supplemented our applications with fabricated explanations and counterfeit supporting documentation created with publicly available computer software and hardware and other material. To identify examples of firms that participate in the HUBZone program even though they do not meet eligibility requirements, we first obtained and analyzed a listing of HUBZone firms from the SBA's Certification Tracking System as of January 2008 and federal procurement data from the Federal Procurement Data System-Next Generation (FPDS-NG) for fiscal years 2006 and 2007. We then performed various steps, including corresponding with SBA officials and testing the data elements used for our work electronically, to assess the reliability of the data. We concluded that data were sufficiently reliable for the purposes of our investigation. To develop our case studies, we limited our investigation to certified HUBZone firms with a principal office located in the Washington, D.C., metropolitan area and for which federal agencies reported obligations on HUBZone preference contracts--HUBZone sole source, HUBZone set-aside, and HUBZone price preference--totaling more than $450,000 for fiscal years 2006 and 2007. We selected 16 for further investigation based on indications that they either failed to operate a principal office in a HUBZone or ensure that at least 35 percent of employees resided in a HUBZone, or both. We also investigated one firm referred through GAO's FraudNet Hotline.[Footnote 13] For the selected 17 firms, we then used investigative methods, such as interviewing firm managers and reviewing firm payroll documents, to gather information about the firms and to determine whether the firms met HUBZone requirements. We also reviewed information about each firm in the Online Representations and Certifications Application system (ORCA).[Footnote 14] During our investigation, we also identified a couple of addresses for virtual office suites in the Washington, D.C., metropolitan area where several different HUBZone firms claimed to have their principal office.[Footnote 15] We investigated two of these virtual office suites to determine whether HUBZone firms at these locations met program eligibility requirements. For the selected virtual office suites, we obtained and reviewed the lease agreements between the HUBZone firms and the virtual office suite management and verified any of the HUBZone firms' other business addresses. [End of section] Footnotes: [1] For service and construction firms, determination of principal office excludes employees who perform the majority of their work at job site locations to fulfill specific contract commitments. For this testimony, we define qualifying employees as those who do not work at job site locations to fulfill specific contract commitments. [2] The FPDS-NG is the central repository for capturing information on federal procurement actions. Dollar amounts reported by federal agencies to FPDS-NG represent the net amount of funds obligated or deobligated as a result of procurement actions. Because we did not obtain disbursement data we were unable to identify the actual amounts received by firms. [3] 13 C.F.R. §126.501. [4] ORCA was established as part of the Business Partner Network, an element of the Integrated Acquisition Environment, which is implemented under the auspices of White House Office of Management and Budget, Office of Federal Procurement Policy, and the Chief Acquisition Officers Council. ORCA is "the primary Government repository for contractor submitted representations and certifications required for the conduct of business with the Government." [5] 13 C.F.R. § 126.900. [6] SBA OIG, Audit of the Eligibility of 15 HUBZone Companies and a Review of the HUBZone Empowerment Contracting Program's Internal Controls, 3-05 (Jan. 22, 2003). [7] Virtual offices are located nationwide and provide a range of services for individuals and firms, including part-time use of office space or conference rooms, telephone answering services, and mail forwarding. [8] GAO, Small Business Administration: Additional Actions Are Needed to Certify and Monitor HUBZone Businesses and Assess Program Results, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-643] (Washington, D.C.: June 17, 2008) and Small Business Administration: Additional Actions Are Needed to Certify and Monitor HUBZone Businesses and Assess Program Results, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08- 975T] (Washington, D.C.: July 17, 2008). [9] As noted previously, we selected 17 total firms for investigation. Of the 17 firms, 6 did not meet both the principal office requirement and HUBZone residency requirement and 4 more significantly did not meet the HUBZone residency requirement. These 10 firms are discussed in the body of this report. With percentages ranging between 30 percent and 33 percent, another 4 firms nearly met the HUBZone residency requirement. The remaining 3 firms appeared to meet both requirements at the time of our investigation. [10] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-643] and [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-975T]. [11] As noted previously, we selected 17 total firms for investigation. Of the 17 firms, 6 did not meet the principal office requirement and HUBZone residency requirement and 4 significantly did not meet the HUBZone residency requirement. These 10 firms are discussed in the body of this report. With percentages ranging between 30 percent and 33 percent, another 4 firms nearly met the HUBZone residency requirement. The remaining 3 firms appeared to meet both requirements at the time of our investigation. [12] 48 C.F.R. § 4.1201. [13] While federal agencies did not report to FPDS any obligations on HUBZone contracts for this firm during fiscal years 2006 and 2007 the nature of the allegation was as such to warrant our investigation. [14] ORCA was established as part of the Business Partner Network, an element of the Integrated Acquisition Environment, which is implemented under the auspices of White House Office of Management and Budget, Office of Federal Procurement Policy, and the Chief Acquisition Officers Council. ORCA is "the primary Government repository for contractor submitted representations and certifications required for the conduct of business with the Government." [15] Virtual offices are located nationwide and provide a range of services for individuals and firms, including part-time use of office space or conference rooms, telephone answering services, and mail forwarding. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office: 441 G Street NW, Room LM: Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: