	Ineffective Program Eligibility Controls Enabled GAO to Obtain HUBZone Certification for Bogus Firms

Our proactive testing found ineffective HUBZone program eligibility  controls, exposing the federal government to fraud and abuse. For the  principal office address, our investigators used a Starbucks coffee store  located in a HUBZone. Selected HUBZone Firms Do Not Meet Program Eligibility Requirements

We were also able to identify 10 firms from the Washington, D.C., metro  area that were participating in the HUBZone program even though they  clearly did not meet eligibility requirements. Since 2006, federal agencies  have obligated a total of more than $105 million to these firms for  performance as the prime contractor on federal contracts. Of the 10 firms,  6 did not meet both the principal office and employee residency  requirements while 4 met the principal office requirement but significantly  failed the employee residency requirement. We also found other HUBZone  firms that use virtual office suites to fulfill SBA’s principal office  requirement. We investigated two of these virtual office suites and  identified examples of firms that could not possibly meet principal office  requirements given the nature of their leases. Further, the Federal Acquisition  Regulation (FAR) requires all prospective contractors to update ORCA— the government’s Online Representations and Certifications Application— which includes certifying whether the firm is currently a HUBZone firm  and that there have been “no material changes in ownership and control,  principal office, or HUBZone employee percentage since it was certified  by the SBA.” However, we found that all 10 of these case-study firms  continued to represent themselves to SBA, ORCA, GAO, and the general  public as eligible to participate in the HUBZone program. Case 1: Our investigation clearly showed that this firm represented itself  as HUBZone-eligible even though it did not meet HUBZone requirements  at the time of our investigation. Our site visits to the address  identified by the firm as its principal office found that it was a small room  that had been rented on the upper floor of a dentist’s office where no more  than two people could work comfortably. No employees were present, and  the only business equipment in the rented room was a computer and filing  cabinet. The building owner stated that the president of the firm used to  conduct some business from the office, but that nobody had worked there  “for some time.” Moreover, the president indicated that instead of paying  rent at the HUBZone location, she provided accounting services to the  owner at a no-cost exchange for use of the space. Our site visit determined this location to be where the  firm’s president and all qualifying employees worked. For example:    One HUBZone firm that claimed its principal office was a virtual office  address had a lease agreement providing only mail-forwarding services. They were concerned about the vulnerabilities to fraud and abuse we  identified. They  were also open to suggestions to improve fraud prevention controls over  the HUBZone application process, such as performing steps to identify  addresses of virtual office suites and mailboxes rented from postal retail  centers. Appendix I: Objective, Scope, and Methodology

To proactively test whether the Small Business Administration’s (SBA)  controls over the Historically Underutilized Business Zone (HUBZone)  application process were operating effectively, we applied for HUBZone  certification using bogus firms, fictitious employees, fabricated  explanations, and counterfeit documents to determine whether SBA would  certify firms based on fraudulent information. We selected 16 for further investigation based  on indications that they either failed to operate a principal office in a  HUBZone or ensure that at least 35 percent of employees resided in a  HUBZone, or both.
Why GAO Did This Study

The Historically Underutilized Business Zone (HUBZone) program is intended to provide federal contracting opportunities to qualified small business firms in order to stimulate development in economically distressed areas. As manager of the HUBZone program, the Small Business Administration (SBA) is responsible for certifying whether firms meet HUBZone program requirements. To participate in the HUBZone program, small business firms must certify that their principal office (i.e., the location where the greatest number of employees work) is located in a HUBZone and that at least 35 percent of the firm's employees live in HUBZones. Given the Committee's concern over fraud and abuse in the HUBZone program, GAO was asked to (1) proactively test whether SBA's controls over the HUBZone application process were operating effectively to limit program certification to eligible firms and (2) identify examples of selected firms that participate in the HUBZone program even though they do not meet eligibility requirements. To perform its proactive testing, GAO created four bogus businesses with fictitious owners and employees and applied for HUBZone certification. GAO also selected 17 HUBZone firms based on certain criteria, such as receipt of HUBZone contracts, and investigated whether they met key program eligibility requirements.

What GAO Found

GAO identified substantial vulnerabilities in SBA's application and monitoring process, clearly demonstrating that the HUBZone program is vulnerable to fraud and abuse. Considering the findings of a related report and testimony issued today, GAO's work shows that these vulnerabilities exist because SBA does not have an effective fraud-prevention program in place. Using fictitious employee information and fabricated documentation, GAO easily obtained HUBZone certification for four bogus firms. For example, to support one HUBZone application, GAO claimed that its principal office was the same address as a Starbucks coffee store that happened to be located in a HUBZone. If SBA had performed a simple Internet search on the address, it would have been alerted to this fact. Further, two of GAO's applications used leased mailboxes from retail postal services centers. A post office box clearly does not meet SBA's principal office requirement. We were also able to identify 10 firms from the Washington, D.C., metro area that were participating in the HUBZone program even though they clearly did not meet eligibility requirements. Since 2006, federal agencies have obligated a total of more than $105 million to these 10 firms for performance as the prime contractor on federal contracts. Of the 10 firms, 6 did not meet both principal office and employee residency requirements while 4 met the principal office requirements but significantly failed the employee residency requirement. For example, one firm that failed both principal office and employee residency requirements had initially qualified for the HUBZone program using the address of a small room above a dentist's office. GAO's site visit to this room found only a computer and filing cabinet. No employees were present, and the building owner told GAO investigators that nobody had worked there "for some time." During its investigation, GAO also found that some HUBZone firms used virtual office suites to fulfill SBA's principal office requirement. GAO investigated two of these virtual office suites and identified examples of firms that could not possibly meet principal office requirements given the nature of their leases. For example, one firm continued to certify it was a HUBZone firm even though its lease only provided mail forwarding services at the virtual office suite.