For the Spanish translation of the one-page English Highlights for this document, see GAO-19-203.

The Historically Underutilized Business Zone program is intended to increase employment and development in distressed areas. Businesses operating in these areas may qualify for federal contracting benefits such as limited competition for contracts.

A 2017 law

required the Small Business Administration to do more to address fraud risk when vetting firms seeking to participate or remain in the program

allowed more HUBZones in Puerto Rico.

We reviewed 12 newly certified firms in Puerto Rico, and found SBA did not consistently follow its risk management policies. We recommended SBA boost staff compliance with its policies and take other actions.

After a 2016 change in the qualifications for the Historically Underutilized Business Zone program, nearly every Census tract in Puerto Rico now qualifies.

This graphic shows two maps of Puerto Rico and the vast expansion of areas that qualify for the program after 2016.

• View Highlights

For the Spanish translation of the highlights page for this document, see GAO-19-203.

What GAO Found

The Small Business Administration (SBA) adopted criteria and guidance for a risk-based approach to certifying and recertifying firms for the Historically Underutilized Business Zone (HUBZone) program in March 2017, but the extent to which it conducted a risk assessment to inform its approach is unclear. In 2009, in response to GAO's prior recommendations to address weaknesses in the HUBZone certification process, SBA increased documentation requirements for certification, but not recertification (which every 3 years determines continued program eligibility).

In March 2017, SBA changed its recertification criteria and guidance to require firms with $1 million or more in HUBZone contract awards to provide documentation to support continuing eligibility.

SBA officials stated they completed a risk assessment of the HUBZone recertification process, but as of July 2018, had not provided GAO with documentation on when they performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold.

GAO previously found SBA lacked key controls for its recertification process and recommended in 2015 that SBA assess the process.

GAO continues to believe that an assessment of the recertification process would help inform a risk-based approach to reviewing and verifying information from firms that appear to pose the most risk to the program.

Based on GAO's review of case files for a non-generalizable sample of 12 firms in Puerto Rico that received HUBZone certification in March 2017–March 2018, SBA did not consistently document or follow its policies and procedures for certification reviews.

SBA did not have complete documentation in 9 of 12 cases. SBA officials described alternative procedures they used to determine firms' eligibility, but SBA has not updated its internal policy manuals to reflect these procedures and analysts did not document use of such procedures in the files GAO reviewed.

In 4 of 12 cases, SBA did not follow its policy to conduct three levels of review (by an analyst, a senior analyst, and the program director or deputy) when determining to approve or deny a firm.

It is not known to what extent SBA reviewed staff compliance with certification and recertification review procedures. SBA provided an assurance letter stating it evaluated the Office of HUBZone's internal controls and concluded the controls were effective, but the letter did not specify what steps SBA took for the evaluation.

Standards for internal control state management should document its control policies and conduct periodic reviews to ensure controls are effective. Because SBA has not updated its internal policy manuals or conducted a documented review of staff compliance with its quality review procedures, it lacks reasonable assurance that firms are eligible or its review process is effective. In turn, this increases the risk of ineligible firms participating in the HUBZone program and receiving contracting preferences to which they are not entitled.

Why GAO Did This Study

The HUBZone program is intended to stimulate economic development in economically distressed areas. Certified HUBZone firms are eligible for federal contracting benefits, including limited competition awards such as set-aside contracts, and are required to be recertified every 3 years. The Puerto Rico Oversight, Management, and Economic Stability Act of 2016 required SBA to develop criteria and guidance for a risk-based approach to verify firm eligibility for the program and included a provision for GAO to review SBA's development and implementation of the required criteria and guidance. This report examines, among other objectives, (1) SBA's development of criteria and guidance on using a risk-based approach for certifying and recertifying HUBZone firms, and (2) SBA's implementation of the revised policies and procedures for firms located in Puerto Rico.

GAO analyzed SBA documents and reviewed files of a non-generalizable sample of 12 firms located in Puerto Rico that received certification between March 2017 and March 2018. GAO also interviewed SBA officials, representatives from HUBZone-certified firms in Puerto Rico, and local economic development agencies in Puerto Rico.

What GAO Recommends

GAO recommends that SBA (1) update internal policy manuals to reflect current policies and procedures, and (2) review and document staff compliance with procedures for certification and recertification reviews of firms. SBA generally agreed with GAO's recommendations.

For more information, contact William B. Shear at (202) 512-8678 or ShearW@gao.gov.