This is the accessible text file for GAO report number GAO-13-70R entitled 'Small Business Research Programs: Agencies Are Implementing New Fraud, Waste, and Abuse Requirements' which was released on November 15, 2012. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO-13-70R: United States Government Accountability Office: Washington, DC 20548: November 15, 2012: Congressional Committees: Subject: Small Business Research Programs: Agencies Are Implementing New Fraud, Waste, and Abuse Requirements: For 30 years, federal agencies have made awards to small businesses for technology research and development through the Small Business Innovation Research (SBIR) program and, more recently, through the Small Business Technology Transfer (STTR) program. Over the past 6 years, agencies have obligated about $2.4 billion annually for these two programs. Federal agencies with a budget of more than $100 million for extramural research or research and development--which is conducted by nonfederal employees outside of federal facilities--must establish and operate an SBIR program. Eleven federal agencies currently participate in the SBIR program: the departments of Agriculture, Commerce, Defense (DOD), Education, Energy, Health and Human Services, Homeland Security, and Transportation; the Environmental Protection Agency (EPA); the National Aeronautics and Space Administration (NASA); and the National Science Foundation. Federal agencies with a budget of more than $1 billion for extramural research or research and development must establish and operate an STTR program, in addition to their SBIR program. Five of the 11 federal agencies that participate in the SBIR program also participate in the STTR program: DOD, the departments of Energy and of Health and Human Services, NASA, and the National Science Foundation. Each participating agency must manage its SBIR and STTR programs in accordance with program laws, regulations, and policy directives issued by the Small Business Administration (SBA), whose Office of Technology oversees and coordinates agency efforts for the programs by setting overarching policy and issuing policy directives, collecting program data, reviewing agency progress, and reporting annually to Congress, among other responsibilities. Each participating agency has considerable flexibility to design and manage the specifics of these programs, such as determining research topics, selecting award recipients, and administering funding agreements. The National Defense Authorization Act for Fiscal Year 2012 (the act), [Footnote 1] enacted on December 31, 2011, reauthorized the SBIR and STTR programs through September 30, 2017.[Footnote 2] Among other things, the act required SBA to make certain changes by March 30, 2012, to its SBIR and STTR policy directives to prevent fraud, waste, and abuse.[Footnote 3] The act did not specify time frames for agencies to implement the revised policy directives. According to the SBIR and STTR policy directives, potential fraud, waste, and abuse in the programs include, among others, misrepresentation of the use of funds expended under an award, misuse of award funds, falsification in reporting results from an award, or extravagant or needless spending of an award. In addition to reauthorizing the programs, the act directed GAO to establish a baseline of changes made to the SBIR and STTR programs to fight fraud, waste, and abuse by December 31, 2012, and identified additional areas for future evaluation.[Footnote 4] In this context, this report summarizes (1) the status of the revised SBIR and STTR policy directives; information regarding fraud, waste, and abuse included in the revised directives; and steps taken to revise the directives and (2) participating agencies' plans for implementing the new fraud, waste, and abuse requirements in the revised policy directives, including whether participating agencies anticipate challenges to implementing the changes. To determine the status of the revised SBIR and STTR policy directives, information included in the revised directives, and steps taken to revise the directives, we tracked the directives through the revision process and, once the directives were issued, we reviewed the information contained in the directives, with a particular focus on the new fraud, waste, and abuse requirements. We compared the revised policy directives with GAO's fraud-prevention framework to determine the extent to which the revised directives included elements of the framework.[Footnote 5] We also interviewed SBIR and STTR program managers from SBA and the 11 agencies that participate in one or both of the SBIR and STTR programs, as well as representatives from a working group of the Council of the Inspectors General on Integrity and Efficiency that has been discussing fraud in these programs. [Footnote 6] To determine agencies' plans for implementing changes to the revised policy directives and potential challenges to implementing the changes, we reviewed documentation from SBA about changes to the policy directives and expected time frames for implementing the new fraud, waste, and abuse requirements. Additionally, we interviewed SBIR and STTR program managers and representatives from the Offices of Inspectors General at SBA and the 11 agencies that participate in one or both of the SBIR and STTR programs. To the extent possible, we corroborated information on the changes that agencies have implemented--as well as tools agencies already had in place--by reviewing relevant agency documents, such as agency websites and SBIR and STTR funding solicitations. We conducted this performance audit from March 2012 to November 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Results in Brief: SBA issued revised policy directives for the SBIR and STTR programs in August 2012 that included new requirements designed to help agencies identify and prevent potential fraud, waste, and abuse in the SBIR and STTR programs--changes that SBA developed in consultation with agencies that participate in the programs and a working group of inspectors general. Among other changes, the revised SBIR and STTR policy directives each include a new section on preventing fraud, waste, and abuse in the programs. They also include 10 minimum requirements related to fraud, waste, and abuse that the 11 participating agencies must meet, such as providing information on how to report fraud, waste, and abuse on their program websites and in solicitations. The revised policy directives include elements of our fraud-prevention framework. Based on our prior work, an effective fraud-prevention framework should include up-front preventive controls, detection and monitoring, and investigations and prosecutions. The 10 requirements in the revised directives include elements of the framework, but the effectiveness of the requirements in helping agencies identify and prevent potential fraud, waste, and abuse will depend on how participating agencies implement the requirements. SBA incorporated input from key stakeholders, specifically the SBIR and STTR program managers and representatives from an inspectors general working group, when developing the revised policy directives. Additionally, SBA chose to solicit comments through a 60-day public comment period on the revised directives. Agencies that participate in the SBIR and STTR programs vary in their plans to implement the new fraud, waste, and abuse requirements; however, none of the agencies anticipate challenges in doing so. Each of the participating agencies already had in place some tools to address or partially address the new fraud, waste, and abuse requirements in the revised policy directives before SBA issued them. According to our analysis of the requirements and the tools agencies had in place, each of the agencies needs to modify some existing tools and implement additional tools to meet all of the requirements in the revised policy directives. The act and revised directives do not establish time frames by which agencies must implement the new requirements. At the time of our review, most agencies were in the process of determining their planned time frames for implementing the new requirements. Program managers at each of the agencies that participate in one or both of the programs told us that they do not anticipate significant challenges to implementing most of the new fraud, waste, and abuse requirements. Background: The SBIR program was initiated in 1982 and has four purposes: to use small businesses to meet federal research and development needs, to stimulate technological innovation, to increase commercialization of innovations derived from federal research and development efforts, and to encourage participation in technological innovation by small businesses owned by disadvantaged individuals and women. The 11 agencies that participate in the SBIR program reported obligating more than $2.2 billion for about 5,500 awards in fiscal year 2011.[Footnote 7] The purpose of the STTR program--initiated in 1992--is to stimulate a partnership of ideas and technologies between innovative small businesses and research institutions through federally funded research or research and development.[Footnote 8] A key difference between the SBIR and STTR programs is the requirement that small businesses receiving STTR awards must partner with a nonprofit research institution that must perform at least 30 percent of the research and development for the project. The five agencies that participated in the STTR program reported obligating about $250 million for more than 700 awards in fiscal year 2011. Agencies follow the same general process to obtain proposals from and make awards to small businesses for both the SBIR and STTR programs. At least annually, each participating agency issues a solicitation requesting proposals for projects in topic areas determined by the agency. Each agency uses its own process to review proposals and determine which proposals should receive awards. Also, each agency determines whether the funding for awards will be provided as grants or contracts. In August 2009, the Senate Committee on Commerce, Science, and Transportation held a hearing on fraud, waste, and abuse in the SBIR program.[Footnote 9] In that hearing, Members of the Committee raised concerns about a prior case of fraud in the SBIR program, as well as the potential for additional fraud, waste, and abuse in the programs. Shortly after that hearing, the Council of the Inspectors General on Integrity and Efficiency's Misconduct in Research Working Group began to discuss fraud in the SBIR and STTR programs and coordinate efforts related to these programs among the inspectors general from SBA and each of the 11 participating agencies. The working group also established a separate subgroup of investigative agents from SBA, the 11 participating agencies, and the Department of Justice to share information on ongoing cases, lessons learned, and best practices related to SBIR investigations. We have issued several reports on various aspects of the SBIR program dating back to the 1980s. In our August 2009 testimony before the Senate Committee on Commerce, Science, and Transportation, we summarized our previous findings related to the SBIR program, including our finding that the SBIR program could be improved by collecting better data and establishing a database so that SBA and participating agencies can share information and enhance their efforts to monitor and evaluate the program.[Footnote 10] More recently, we reported on the availability of data to evaluate progress in increasing commercialization (e.g., sales) of SBIR technologies. [Footnote 11] SBA Issued Revised Policy Directives with New Fraud, Waste, and Abuse Requirements after Consulting Key Stakeholders: SBA issued revised policy directives for the SBIR and STTR programs in August 2012 that included new requirements designed to help agencies identify and prevent potential fraud, waste, and abuse in the SBIR and STTR programs--changes that SBA developed in consultation with agencies that participate in the program and a working group of inspectors general. The revised policy directives include elements of our fraud-prevention framework; however, the effectiveness of these requirements in preventing potential fraud, waste, and abuse will depend on how participating agencies implement the requirements. In developing the revised directives, SBA incorporated input from SBIR and STTR program managers and an inspectors general working group, and SBA later sought public comments on the revised directives. SBA Issued Revised SBIR and STTR Policy Directives That Include New Fraud, Waste, and Abuse Requirements: SBA published revised policy directives for the SBIR and STTR programs in the Federal Register on August 6, 2012; the directives took effect that day. Among other changes, the revised policy directives each include a new section on preventing fraud, waste, and abuse in the programs. The fraud, waste, and abuse sections contain the same information and requirements for both programs. The revised policy directives include 10 new minimum requirements related to identifying and preventing potential fraud, waste, and abuse that the 11 participating agencies must implement, but the directives do not specify deadlines by which agencies must implement the changes. To meet the requirements, each agency participating in the programs must, at a minimum, take the 10 actions summarized below: 1. Require certifications from award recipients that they are in compliance with specific program requirements at the time of the award, as well as after the award and during the life cycle of the funding agreement. 2. Include information explaining how an individual can report fraud, waste, and abuse on the agency's respective program website and in each funding solicitation using the method provided by the agency's Office of the Inspector General, such as publishing the agency's fraud hotline number. 3. Designate at least one individual in the agency to, at a minimum, serve as the liaison for the SBIR or STTR program, the Office of the Inspector General, and the agency's suspension and debarment official, and ensure that inquiries regarding fraud, waste, and abuse are referred to the appropriate offices. 4. Include on its program website information concerning successful prosecutions of fraud, waste, and abuse in the programs. 5. Establish a written policy requiring all personnel involved with the program to notify the Office of the Inspector General if anyone suspects fraud, waste, and/or abuse and ensure the policy is communicated to all personnel. 6. Create or ensure there is an adequate system to enforce accountability by developing standardized templates for referrals to the Office of the Inspector General and the suspension and debarment official, as well as a process for tracking such referrals. 7. Ensure compliance with program eligibility requirements and terms of funding agreements. 8. Work with the agency's Office of the Inspector General in its efforts to establish fraud detection indicators; coordinate sharing of information on fraud, waste, and abuse between federal agencies; and improve education and training to program officials, applicants, and award recipients. 9. Develop policies and procedures to avoid funding essentially equivalent work already funded by another agency. 10. Consider enhanced reporting requirements during the funding agreement. According to SBA officials, these requirements--along with other information in the revised directives--were designed to address the changes required by the act regarding fraud, waste, and abuse. For example, the act required SBA to include in the revised directives definitions or descriptions of fraud, waste, and abuse. The fraud, waste, and abuse sections of each of the revised directives define these terms and provide examples of what would constitute fraud, waste, and abuse by award recipients or agency personnel. Additionally, the act required SBA to establish guidelines for monitoring and overseeing applicants for and recipients of SBIR or STTR awards. According to SBA officials, the fraud, waste, and abuse section of the revised directives collectively addresses this requirement in the act. SBA officials expect that other changes incorporated into the revised directives will also help agencies identify and prevent potential fraud, waste, and abuse in the programs. For example, the policy directives require agencies and small businesses to submit information to seven databases to satisfy additional reporting requirements included in the act. Six of the seven databases will be part of Tech- Net, SBA's database for tracking information on SBIR and STTR awards. According to SBA, one of the new databases--the Company Registry--will help prevent fraud, waste, and abuse because a company must register itself and use the same name and registration number each time when applying for awards. Program managers told us that they expect this registry will help them determine whether a small business has received an award for similar work in the past. Additionally, this registry is expected to include information on eligibility requirements for the programs to ensure that businesses understand the program requirements before applying for an award. SBA's Revised Directives Include Elements of GAO's Fraud-Prevention Framework: In analyzing the revised policy directives, we found that they include elements of our fraud-prevention framework. We developed this framework and have applied it in our past work on fraud prevention in various federal programs, including other small business programs and disaster payments.[Footnote 12] The framework consists of three crucial elements: (1) up-front preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. (See figure 1.) Figure 1: GAO's Fraud-Prevention Framework: [Refer to PDF for image: illustration] Potential fraud, waste, and abuse: Implementation of prevention controls: leads to: Smaller amount of potential fraud, waste, and abuse: Implementation of detection and monitoring: leads to: Smaller amount of Potential fraud, waste, and abuse: Implementation of investigations and prosecutions. Lessons learned at each step influence future use of prevention controls. Source: GAO. [End of figure] Our past work has shown that the most effective and efficient part of a fraud-prevention framework involves the institution of rigorous controls to prevent fraud. Such preventive controls can include efforts such as verifying that a business is eligible for the program. Even with effective preventive controls, there is a residual risk for fraud, waste, and abuse, which makes detection and monitoring an essential part of the framework. Detection and monitoring can include activities such as conducting periodic reviews of suspicious businesses and evaluating businesses to provide reasonable assurance that they continue to meet program requirements. Finally, we have previously reported that fraud-prevention controls are not fully effective unless identified fraud is aggressively prosecuted or businesses are suspended, debarred, or otherwise held accountable for committing fraud. SBA included in the revised SBIR and STTR policy directives requirements for agencies to put in place tools that include elements of our fraud-prevention framework and the associated controls we have identified in our past work. However, the effectiveness of the minimum requirements in helping agencies identify and prevent potential fraud, waste, and abuse will depend on how participating agencies implement the requirements, as discussed below. * Preventive controls: One preventive control identified in our prior work is performing system checks to identify potential duplication before payments are made. The revised SBIR and STTR policy directives require participating agencies to develop policies and procedures to avoid funding essentially equivalent work already funded by another agency. The revised directives include a number of examples of procedures that agencies can implement, and the directives give agencies flexibility in implementing procedures to satisfy the requirement. However, the effectiveness of the agencies' efforts to identify potentially duplicative awards will depend in large part on the procedures that the agencies choose to implement. * Detection and monitoring: One detection and monitoring control identified in our prior work is for agencies to perform periodic reviews of eligibility for programs. The SBIR and STTR policy directives require agencies to require firms to self-certify their compliance with program regulations--including eligibility--at the time of an award and throughout the life cycle of the associated funding agreement. However, the effectiveness of the certifications required in the revised SBIR and STTR policy directives will depend, in part, on how agencies implement the certifications, and specifically whether agencies implement verification processes to supplement the required certifications. * Investigations and prosecutions: One prosecution control identified in our prior work is to maximize the deterrent value of successful prosecutions and disbarments. The revised SBIR and STTR policy directives require agencies to include on their program websites information on successful prosecutions of fraud, waste, and abuse in the programs. However, program managers and representatives from the Offices of the Inspectors General at 8 of the 11 participating agencies told us that they are not aware of any prosecutions for fraud, waste, or abuse in the SBIR or STTR programs in their agencies. Additionally, the minimum requirements in the policy directives may not fully address the vulnerabilities of the programs to fraud, waste, and abuse. For example, the revised directives include a requirement for small businesses to certify their compliance with certain program requirements and another requirement allows agencies to rely on the small business to certify that it has not received funding for essentially equivalent work already funded by another agency. However, the revised policy directives do not require agencies to take steps to verify the accuracy of the information in these certifications. We have previously reported that a different small business program that relied exclusively on self-certification of eligibility was particularly vulnerable to fraud and abuse and that the self- certification process did not prevent ineligible firms from receiving contracts.[Footnote 13] Additionally, in our past work we identified the conduct of unannounced site visits to locations where contracted work is performed as an element of an effective fraud-prevention framework.[Footnote 14] The revised policy directives require agencies to ensure compliance with the terms of funding agreements, but they do not specify how agencies should implement this requirement. We have previously reported that instituting elements, such as unannounced site visits, can help minimize the likelihood of fraud occurring while maximizing the possibility of detecting fraudulent activity that may occur.[Footnote 15] Because agencies have not yet implemented the requirements included in the revised policy directives, it is too early for us to determine the effectiveness of these requirements in helping agencies address the vulnerabilities in the program and identify and prevent potential fraud, waste, and abuse. We plan to evaluate the changes to the policy directives as part of our future reviews of fraud, waste, and abuse in the SBIR and STTR programs. SBA's Process for Revising the Policy Directives Included Input from Key Stakeholders: According to officials from SBA and participating agencies, SBA sought input from key stakeholders when revising the SBIR and STTR policy directives. Starting in January 2012, SBA met with the SBIR and STTR program managers at the 11 participating agencies and representatives from the Council of the Inspectors General on Integrity and Efficiency's Misconduct in Research working group to discuss the changes to the policy directives, including changes to help prevent fraud, waste, and abuse. In addition to attending these meetings, program managers and representatives from the inspectors general working group provided comments on multiple drafts of the revised policy directives. Program managers and members of the Inspectors General working group said that they were satisfied with the process SBA used to update the SBIR and STTR policy directives, particularly with the amount of input that SBA requested from these stakeholders. Furthermore, we have previously reported that early and frequent communication with stakeholders and two-way communication that allows stakeholders to provide feedback can be an effective strategy when implementing changes in a program.[Footnote 16] Although SBA began working to incorporate changes to the policy directives required by the act in January 2012, officials told us that the agency had begun discussing fraud, waste, and abuse and potential changes to the directives with SBIR and STTR program managers and representatives from the Inspectors General working group in August 2009. According to the SBA officials, the August 2009 hearing before the Senate Committee on Commerce, Science, and Transportation led to several meetings and discussions about fraud, waste, and abuse in the SBIR and STTR programs, which resulted in many of the ideas for updates and revisions to the policy directives. In addition to incorporating input from program managers and the inspectors general working group before issuing the revised directives, SBA chose to solicit comments from the public on the policy directives. Specifically, SBA published the revised directives in the Federal Register, which started a 60-day public comment period that ended on October 5, 2012. SBA was not required by the act to obtain public comments on the revised directives; however, SBA officials chose to solicit comments. The officials said they plan to incorporate the comments that they receive into future revisions to the directives. In addition, SBA held two webinar sessions to explain the changes to the revised policy directives and answer questions from session participants on the changes to the policy directives. Partly on the basis of questions asked at these sessions, SBA posted on its program website a list of "frequently asked questions" and answers about the revised directives. This list covers questions and answers on a variety of topics, including the new fraud, waste, and abuse requirements. Agencies' Plans to Implement New Requirements in the Policy Directives Vary, and Officials Do Not Anticipate Implementation Challenges: Agencies that participate in the SBIR and STTR programs vary in their plans to implement the new fraud, waste, and abuse requirements in the policy directives; however, none of the agencies anticipate challenges in doing so. The variation in the agencies' plans is due to differences in the tools that agencies already have in place for identifying and preventing potential fraud, waste, and abuse, as well as differences in when they plan to complete implementation of the changes to the policy directives. Agency officials do not anticipate significant challenges in making the changes, either because of the tools they already have in place or because the changes seem straightforward. Agencies' Plans to Implement New Fraud, Waste, and Abuse Requirements Vary: Participating agencies vary in their plans to implement new requirements designed to help agencies identify and prevent potential fraud, waste, and abuse in the revised SBIR and STTR policy directives. The agencies vary in part because some agencies already have some tools in place that address or partially address the requirements included in the revised policy directives. As discussed below, these tools were either in place before SBA began revising the policy directives or were put in place while SBA was in the process of revising the directives. However, our analysis of the requirements in the revised policy directives and the tools agencies have in place indicates that each of the agencies still needs to modify some existing tools and implement additional tools to meet all of the new requirements. Even before SBA began revising the policy directives in January 2012, each of the 11 participating agencies already had in place some tools that addressed or partially addressed the new fraud, waste, and abuse requirements in the revised policy directives. These tools differed among agencies, in part because of the flexibility each agency has in designing and managing its own SBIR and STTR programs. For example, before SBA revised the directives, EPA required small businesses to certify compliance with eligibility requirements when they received their award and when they submitted the final report on their research- -as is now required in the revised policy directives; the previous versions of the policy directives required small businesses to certify compliance only at the time of the proposal. Additionally, with the revisions to the policy directives, agencies are now required to ensure compliance with program eligibility criteria and terms of funding agreements. At least two agencies had in place tools that addressed or partially addressed this requirement before SBA issued the revised directives. For example, to help ensure they are complying with program regulations and the terms of their funding agreements, NASA has performed "virtual site visits" through the internet for certain new award recipients, and the Department of Education has held quarterly meetings with each of its SBIR award recipients. While agencies were not required to do so, 8 of the 11 agencies began to use additional tools to address expected requirements in the revised directives between the time SBA began drafting the revised directives in January 2012 and the time SBA issued them in August 2012. For example, six of the participating agencies that had begun to use additional tools--the National Institute of Standards and Technology within the Department of Commerce, the Department of Homeland Security, the Department of Transportation, DOD, EPA, and NASA--updated their program websites to include information on how an individual can report fraud, waste, and abuse while SBA was revising the directives. Program managers at the three remaining agencies that decided to wait until SBA issued the revised policy directives before implementing the new fraud, waste, and abuse requirements--the departments of Agriculture, Education, and Health and Human Services-- indicated that they chose to wait until SBA issued the final policy directives because they wanted to avoid making unnecessary revisions to agency procedures if there were significant changes between the draft and final directives. Table 1 shows when the agencies began to use additional tools designed to help agencies identify and prevent potential fraud, waste, and abuse, as well as their planned time frames for completing implementation of the requirements in the policy directives. Table 1: Participating Agencies' Approaches to and Time Frames for Implementing New Fraud, Waste, and Abuse Requirements in the SBIR and STTR Policy Directives: Agency: Department of Agriculture; Agency began implementing changes before SBA issued revised policy directives: [Empty]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Check]; Anticipated time frame for completing implementation of changes: [A]. Agency: Department of Commerce; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: [B]. Agency: DOD; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: [A]. Agency: Department of Education; Agency began implementing changes before SBA issued revised policy directives: [Empty]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Check]; Anticipated time frame for completing implementation of changes: Before next SBIR solicitation[C]. Agency: Department of Energy; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: [A]. Agency: Department of Health and Human Services; Agency began implementing changes before SBA issued revised policy directives: [Empty]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Check]; Anticipated time frame for completing implementation of changes: [A]. Agency: Department of Homeland Security; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: [A]. Agency: Department of Transportation; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: Before next SBIR solicitation[C]. Agency: EPA; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: Before next SBIR solicitation[C]. Agency: NASA; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: No later than October 1, 2013. Agency: National Science Foundation; Agency began implementing changes before SBA issued revised policy directives: [Check]; Agency waited until SBA issued revised policy directives to begin implementing changes: [Empty]; Anticipated time frame for completing implementation of changes: [D]. Source: GAO analysis of agency responses. [A] Agency was in the process of determining the time frames for implementing the new fraud, waste, and abuse requirements at the time of our review. [B] The National Institute of Standards and Technology plans to implement the new fraud, waste, and abuse requirements before its next SBIR solicitation, which is expected to be issued in mid-November 2012. The National Oceanic and Atmospheric Administration was in the process of determining the time frames for implementing the new fraud, waste, and abuse requirements at the time of our review. [C] Agencies differ in when they expect to issue their next SBIR solicitations. The Department of Education expects to issue its solicitation for one organization within the agency that participates in the program by the end of 2012 and the other organization that participates in the program early in 2013.The Department of Transportation expects to issue its solicitation in December 2012. EPA expects to issue its solicitation in March 2013. [D] Agency was awaiting guidance on the time frames for implementing the new fraud, waste, and abuse requirements from SBA at the time of our review. [End of table] As shown in table 1, agencies also vary in when they plan to complete implementation of the new fraud, waste, and abuse requirements. While the policy directives took effect immediately, not all of the changes are expected to be implemented immediately, according to SBA. For example, SBA set a goal of October 1, 2012, for agencies to include information on reporting fraud, waste, and abuse on their program websites and in their solicitations and to begin requiring awardees to certify they are complying with specific program requirements during the life cycle of the funding agreement. As of October 4, 2012, 10 of the 11 participating agencies had implemented or had begun implementing these changes.[Footnote 17] Similarly, SBA set a goal of October 1, 2013, for agencies to fully implement their life cycle certification processes. As shown in table 1, three agencies--the departments of Education and of Transportation and EPA--plan to implement all of the required changes before they issue their fiscal year 2013 solicitations for SBIR proposals, and NASA plans to implement all of the changes no later than the beginning of fiscal year 2014. However, as of August 2012, most of the program managers were in the process of determining time frames for implementing the changes to the revised policy directives. Agency Officials Do Not Anticipate Significant Challenges to Implementing Most Changes to the Revised Policy Directives: Program managers at the 11 participating agencies told us that they do not anticipate significant challenges to implementing most of the new fraud, waste, and abuse requirements for two reasons. First, program managers told us that they already have some tools in place that either meet or require minimal modification to meet requirements in the revised policy directives. For example, according to the National Science Foundation program manager, the only change needed to the agency's existing certification process, which has been in place for several years, will be a revision to the language on the certification form because the agency already requires award recipients to certify their compliance with program requirements at several points throughout the life cycle of the funding agreement. Second, some program managers told us that some changes that agencies have not yet implemented seem straightforward. For example, NASA program officials stated that they have not yet published examples of successful prosecutions of fraud, waste, and abuse on their SBIR and STTR website, but that posting this information should be easy because NASA has had several such successful prosecutions. While program officials do not anticipate significant challenges in implementing most of the changes to the policy directives, agencies have sought guidance and information from several sources, including those listed below, on how to minimize potential challenges. * The agencies' own inspectors general: Several of the participating agencies have worked with or plan to work with their Office of Inspector General to implement the new fraud, waste, and abuse requirements. Some program managers we spoke with stated that enhanced coordination with their Office of Inspector General should generate benefits in identifying fraud, waste, and abuse in the SBIR and STTR programs. For example, the Department of Transportation's SBIR program manager and officials from the department's Office of Inspector General met about a month before SBA issued the revised policy directives to discuss anticipated changes to the revised directives, particularly changes to help agencies identify and prevent potential fraud, waste, and abuse. The program manager told us that representatives from the Office of Inspector General provided information and examples that the program manager used to implement some of the requirements in the revised directives, including updating the agency's SBIR website and solicitations with information on reporting fraud, waste, and abuse. * The Council of the Inspectors General on Integrity and Efficiency's Misconduct in Research Working Group: Representatives from each participating agency's Office of Inspector General attend this working group. Officials told us this working group provided a forum for the members to share information and best practices related to identifying and preventing fraud, waste, and abuse in the SBIR and STTR programs. The working group also sponsored a conference in 2011 on fraud, waste, and abuse in the programs that officials told us was attended by representatives from the Offices of Inspectors General and program officials. * Other agencies with experience using tools to identify and prevent fraud, waste, and abuse: Some program officials told us they obtained information about implementing the requirements in the revised policy directives from other agencies that already use some of the tools. For example, program officials from the Department of Energy and the National Oceanic and Atmospheric Administration within the Department of Commerce met with National Science Foundation program officials on their life cycle certification process to understand and implement a similar certification process at their own agencies. * SBA working groups: Officials anticipate that two SBA-sponsored working groups will be useful in sharing information on and best practices for implementing all of the changes to the policy directives, including the new fraud, waste, and abuse requirements. One group is the SBIR and STTR program managers group, which meets quarterly to discuss a variety of issues that affect the SBIR and STTR programs. SBA officials and program managers expect that this group will be used to discuss experiences in implementing changes to the policy directives, among the other issues that the group discusses. The second group, which SBA recently established, is a separate implementation working group comprising SBIR and STTR program managers that will focus exclusively on issues related to implementing the revised policy directives, including the new fraud, waste, and abuse requirements. Some program managers expect that this group will provide a forum to discuss and resolve questions about implementing the revised policy directives. While program officials are in the process of implementing the new fraud, waste and abuse requirements, some program officials identified potential limitations to certain tools that are currently available for this purpose. Specifically, the revised policy directives require agencies to develop policies and procedures to avoid funding essentially equivalent work already funded by another agency, also referred to as "duplicate" awards. All of the agencies already have in place some procedures to try to avoid funding duplicate awards, such as searching Tech-Net or other agency databases or requiring small businesses to certify that they have not submitted the same proposal to another agency. However, officials, including program managers and some representatives from the Office of the Inspector General at most of the participating agencies, raised three key issues about using Tech-Net as currently implemented to identify duplicate awards. * First, officials stated that Tech-Net does not always include up-to- date award information. These officials told us that before the revision to the policy directives, agencies were required to update award information in Tech-Net annually. As a result, information on recent awards for some agencies might not be included in Tech-Net when a program manager searched the database for duplicate awards. Without up-to-date information on awards, program managers could not ensure that a proposal they were considering funding had not recently received an award from another agency. The revised policy directives require agencies to update most award information in Tech-Net quarterly, rather than annually. * Second, according to officials, Tech-Net contains incomplete or inaccurate data for some awards. For example, program managers at two agencies told us they found errors in their own agencies' data when reviewing the data in Tech-Net within the past year. Similarly, some program managers stated it can be difficult to determine whether small businesses with similar names are the same company or different companies. Officials expect that the new Company Registry database within Tech-Net, which SBA expects to implement after finalizing the updated eligibility requirements for the programs in early 2013, will help address this issue. * Third, officials told us that the previous interface used to access Tech-Net had limited search capabilities, making it difficult for agencies to search for potentially duplicative awards in the system. Within the past year, SBA installed a new interface to access Tech- Net, referred to as "SBIR.gov." Officials said they have not yet had much opportunity to use the new interface to search for duplicate awards but expect that the changes will make such searches easier. It is too early to assess the effectiveness of the recent and planned changes to Tech-Net and other tools designed to help agencies identify and prevent potential fraud, waste, and abuse in the SBIR and STTR programs. We plan to further review these tools in our future work on fraud, waste, and abuse in the programs, as required by the act. Agency Comments and Our Evaluation: We requested comments from SBA and the 11 participating agencies on a draft of this report. In its written comments, reproduced in enclosure I, SBA generally agreed with the information and findings in our report. SBA believed that we suggested in the report that self- certification for SBIR and STTR program eligibility is not sufficient and SBA should require agencies to verify the information in the self certifications. We note in the report that it is too early for us to assess the effectiveness of the new fraud, waste, and abuse requirements and we do not draw any conclusions in this report about whether the self certification requirements for SBIR and STTR program eligibility are sufficient. As we reported, we plan to evaluate the changes to the policy directives in our future reviews. The Departments of Commerce, Education, and Homeland Security and the National Science Foundation provided technical comments that we incorporated, as appropriate. The remaining agencies--the Departments of Agriculture, Energy, Health and Human Services, and Transportation; DOD; EPA; and NASA--had no comments on our draft report. We are sending copies of this report to the Secretaries of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, and Transportation; the Administrators of EPA, NASA, and SBA; the Director of the National Science Foundation; the appropriate congressional committees; and other interested parties. In addition, this report is available at no charge on the GAO website at [hyperlink, http://www.gao.gov/]. If you or your staff have any questions about this report, please contact me at (202) 512-3841 or ruscof@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report were Tim Minelli, Assistant Director; Hilary Benedict; Antoinette Capaccio; Jennifer Costello; Cynthia Norris; and Rajneesh Verma. Signed by: Frank Rusco: Director: Natural Resources and Environment: List of Committees: The Honorable Mary L. Landrieu: Chairman: The Honorable Olympia J. Snowe: Ranking Member: Committee on Small Business and Entrepreneurship: United States Senate: The Honorable Ralph M. Hall: Chairman: The Honorable Eddie Bernice Johnson: Ranking Member: Committee on Science, Space, and Technology: House of Representatives: The Honorable Sam Graves: Chairman: The Honorable Nydia M. Velázquez: Ranking Member: Committee on Small Business: House of Representatives: [End of section] Enclosure I: Comments from the Small Business Administration: U.S. Small Business Administration: Washington, DC 20416: October 29, 2012: Mr. Frank Rusco: Director: Natural Resources and Environment: U.S. Government Accountability Office: Washington, DC 20548: Dear Mr. Rusco: Administrator Mills has asked me to the request for comment on the draft Government Accountability Office (GAO) report titled "Small Business Research Programs: Agencies Are Implementing New Fraud, Waste, and Abuse Requirements." The principal finding of the report is that the effectiveness of the new requirements SBA has set for the SBIR and STIR Programs to guard against fraud, waste and abuse will be determined ultimately by their implementation. The U.S Small Business Administration (SBA) generally agrees with the information and findings provided in the GAO report. However, with regard to the self-certification procedure, GAO makes a suggestion that we believe is unsubstantiated. On page 11, GAO writes: "The revised policy directives do not require agencies to take steps to verify the accuracy of the information in these certifications. We have previously reported that a different small business program that relied exclusively on self-certification of eligibility was particularly vulnerable to fraud and abuse and that the self- certification process did not prevent ineligible firms from receiving contracts." [Emphasis added] GAO suggests that self-certification for SBIR and STIR Program eligibility is not sufficient and that SBA should require agencies to verify the information in the self-certifications. We do not agree with this suggestion for several reasons. First, we note that the statute does not require SBA or the participating agencies to create a certification program for SBIR and STIR. Second, the statute actually requires self-certification. Third, requiring validation checks on all applications would explode the administrative costs of the program. Both programs have an exceptionally good record and reputation with respect to fraud, waste and abuse issues to date, and therefore the net benefits to the program and to the taxpayer of such a change are not clear. Finally, SBA believes the new requirements put forth in the policy directives sufficiently address any concerns regarding fraud, waste and abuse issues at this time. In fact, the policy directives provide agencies flexibility in establishing measures to ensure compliance with the eligibility requirements of the program and the terms of the funding agreement. With regard to award duplication, the GAO mentions several limitations of the old SBIR data system for identifying and avoiding duplicate awards. It notes that changes to the system are currently underway and that GAO plans to review the system further in the future. SBA has assessed the adequacy of the system for avoiding duplicate awards and will be addressing the issue through the new program information system currently under development. Thank you for the opportunity to comment on this report and for taking our views into consideration. Sincerely, Signed by: Sean J. Greene: Associate Administrator for Investment: Office of Investment and Innovation: [End of section] Footnotes: [1] Pub. L. No. 112-81. [2] Pub. L. No. 112-81, Div. E. [3] Other provisions of the act required SBA to make changes to other sections of the policy directives, such as increasing the maximum dollar value of awards and revising requirements for agencies to report certain information to SBA, by June 28, 2012. SBA decided to revise the policy directives to incorporate all of the changes required by the act at one time, rather than issuing multiple revisions to the directives. [4] Pub. L. No. 112-81 § 5143(b). [5] We identified the elements of the fraud prevention framework in GAO, Service-Disabled Veteran-Owned Small Business Program: Vulnerability to Fraud and Abuse Remains, [hyperlink, http://www.gao.gov/products/GAO-12-697] (Washington, D.C.: Aug. 1, 2012). [6] The Council of the Inspectors General on Integrity and Efficiency was statutorily established as an independent entity within the executive branch by the Inspector General Reform Act of 2008 to address integrity, economy, and effectiveness issues that transcend individual government agencies and increase the professionalism and effectiveness of personnel by developing policies, standards, and approaches to aid in the establishment of a well-trained and highly skilled workforce in the offices of the Inspectors General. Pub. L. No. 110-409, §7, 122 Stat. 4302, 4305-4313 (codified at 5 U.S.C. App. 3, § 11 (2006)). [7] We are reviewing agencies' compliance with required expenditure amounts for the SBIR and STTR programs, among other requirements, as part of a separate review required by Pub. Law No. 112-81 § 5136. [8] Research institutions include nonprofit colleges or universities, domestic nonprofit research organizations, and federally funded research and development centers. [9] Hearing before the Committee on Commerce, Science, and Transportation, United States Senate; Waste, Fraud, and Abuse in the SBIR Program; August 6, 2009. [10] GAO, Small Business Innovation Research: Observations on Agencies' Data Collection and Eligibility Determination Efforts, [hyperlink, http://www.gao.gov/products/GAO-09-956T] (Washington, D.C.: Aug. 6, 2009). [11] GAO, Small Business Innovation Research: SBA Should Work with Agencies to Improve the Data Available for Program Evaluation, [hyperlink, http://www.gao.gov/products/GAO-11-698] (Washington, D.C.: Aug. 15, 2011). [12] See, for example, [hyperlink, http://www.gao.gov/products/GAO-12-697]. [13] [hyperlink, http://www.gao.gov/products/GAO-12-697]. [14] GAO, Service-Disabled Veteran-Owned Small Business Program: Additional Improvements to Fraud Prevention Controls Are Needed, [hyperlink, http://www.gao.gov/products/GAO-12-152R] (Washington, D.C.: Oct. 26, 2011) and Hubzone Program: Fraud and Abuse Identified in Four Metropolitan Areas, [hyperlink, http://www.gao.gov/products/GAO-09-519T] (Washington, D.C.: March 25, 2009). [15] [hyperlink, http://www.gao.gov/products/GAO-09-519T]. [16] GAO, Results-Oriented Cultures: Implementation Steps to Assist Mergers and Organizational Transformations, [hyperlink, http://www.gao.gov/products/GAO-03-669] (Washington, D.C.: July 2, 2003). [17] A Department of Agriculture official said that the agency had not yet implemented the changes. [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E-mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548. [End Of Document]