In addition to the requirements for the  participating agencies, the reauthorization act included requirements for  the participating agencies’ OIGs. Implementation of Agency Fraud, Waste, and Abuse Prevention Requirements Has Varied, and SBA Has Provided Limited Oversight of the Implementation

Agencies have varied in their implementation of the SBIR and STTR  fraud, waste, and abuse prevention requirements in SBA’s policy  directives, although some agencies have taken actions beyond those  required in the policy directives. For 6 other requirements, more than half of the  agencies had fully implemented the requirements while the other  agencies had partially or not implemented them. For the remaining 2  requirements, 3 agencies had fully implemented 1, while only 1 agency  had fully implemented the other. Site visits allow officials to view,  either in person or remotely, the awardee’s research efforts and can  confirm that the necessary facilities exist for technical R&D work. SBA officials  told us that they believe that they have fulfilled their role to oversee  agencies’ implementation of the fraud, waste, and abuse prevention  requirements by convening the group of program managers and OIG  officials to develop and issue the requirements. The Majority of OIG Requirements Have Been Implemented by Most Offices, but DOD Military Services’ OIGs Are Not Implementing These Requirements

Most OIGs for the 11 participating agencies have implemented the  majority of their SBIR and STTR fraud, waste, and abuse prevention  requirements, as specified in the reauthorization act, with 2 OIGs  engaging in additional activities to prevent and address fraud. Between 5 and 11 OIGs have  fully implemented each of the requirements. Each of the 11 agencies’ OIGs submitted reports for each of the 4  years. Specifically, we found that none of the three military services’ OIGs had  taken actions to implement their SBIR fraud, waste, and abuse prevention  requirements, although the DOD OIG had taken some steps to implement  these requirements. The division of duties between the military services’ OIGs and their  respective investigative services makes it difficult to track DOD’s  implementation of the requirements. Without the three military services’ OIGs implementing the requirements  themselves or delegating the implementation of the requirements to the  investigative services, the DOD OIGs may not be able to detect fraud,  waste, and abuse in DOD’s SBIR and STTR programs, which have the  largest budgets for these programs. Without confirming that  participating agencies are implementing the minimum fraud, waste, and  abuse prevention requirements in the policy directives by, for example,  requesting documentation, SBA does not have reasonable assurance that  each agency has a fraud, waste, and abuse prevention system in place to  help reduce their vulnerability to fraud, waste, and abuse. However, the  three military services’ OIGs within DOD have not implemented all of the  requirements or delegated them to the investigative services. To help ensure that DOD is implementing the fraud, waste, and abuse  prevention requirements to the OIGs, we recommend that the Inspectors  General of the Army, Navy, and Air Force implement the requirements  themselves or delegate the implementation of the requirements to the  investigative services. Specifically, DOD stated that it concurred  with our recommendation that the Army, Navy, and Air Force OIGs  implement the fraud, waste, and abuse requirements themselves or  delegate the implementation of the requirements to the investigative  services, but provided no additional details. Appendix I: Objectives, Scope and Methodology

This report examines the extent to which (1) participating agencies and  the Small Business Administration (SBA) have implemented fraud, waste,  and abuse prevention requirements in the Small Business Innovation  Research (SBIR) and Small Business Technology Transfer (STTR)  programs and (2) OIGs have implemented fraud, waste, and abuse  prevention requirements in the SBIR and STTR programs. We requested and reviewed documentation from the  11 participating agencies’ OIGs on their actions to address the fraud,  waste, and abuse prevention requirements and compared this information  to the requirements in the reauthorization act. The full text of the requirements, as they appear in the  statute reauthorizing the programs, is as follows:  The Inspector General of each Federal agency that participates in the  SBIR program or STTR program shall cooperate to prevent fraud, waste,  and abuse in the SBIR program and the STTR program by:
Establishing fraud detection indicators.
Why GAO Did This Study

For about 35 years, federal agencies have made awards to small businesses for technology research and development through the SBIR program and, for the last 25 years, through the STTR program. Following a 2009 congressional hearing about fraud in the programs, the SBIR/STTR Reauthorization Act of 2011 included separate requirements for SBA and OIGs to address and prevent fraud, waste, and abuse.
The act also included a provision for GAO to review what the agencies and their OIGs have done to address fraud, waste, and abuse in the programs. This report examines (1) the extent to which SBA and the participating agencies have implemented measures to prevent fraud, waste, and abuse for the SBIR and STTR programs and (2) the extent to which the agencies' OIGs have implemented the act's requirements.
GAO compared documentation from SBA, the 11 participating agencies, and the agencies' OIGs to their respective requirements and interviewed SBA, agency, and OIG officials.

What GAO Found

The 11 agencies participating in the Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs have varied in their implementation of the fraud, waste, and abuse prevention requirements developed by the Small Business Administration (SBA) after the programs were reauthorized in 2011. SBA, which oversees the programs, amended the SBIR and STTR policy directives in 2012, as required by the reauthorization act, to include 10 minimum requirements to help agencies prevent potential fraud, waste, and abuse in the programs. GAO found that the extent to which the agencies have fully implemented each of the requirements in the directives varies. For example, all 11 agencies have fully implemented 2 requirements, more than half of the agencies have fully implemented 6 other requirements, and 1 and 3 agencies, respectively, have fully implemented the remaining 2 requirements. Officials from 9 agencies told GAO they have implemented other activities beyond the minimum requirements included in the directives, such as conducting site visits to small businesses to confirm that the necessary facilities exist for technical research and development work. Although SBA issued the policy directives, it has taken few actions to oversee agencies' efforts to implement the requirements. SBA officials said they checked on the implementation of one of the requirements, but did not know whether the participating agencies were implementing the other requirements because they had not confirmed this information. Without confirming that each participating agency is implementing the fraud, waste, and abuse prevention requirements in the policy directives, SBA does not have reasonable assurance that each agency has a system in place to reduce its' vulnerability to fraud, waste, and abuse.
Similarly, Offices of Inspectors General (OIG) varied in their implementation of the fraud, waste, and abuse prevention requirements specifically assigned to them in the reauthorization act, with between 5 and 11 OIGs implementing each requirement. For example, OIGs at each of the 11 agencies have shared information on fraud, waste, and abuse. Of the 11 participating agencies, the Department of Defense (DOD) is the only one whose oversight and audit responsibilities are separated between its various OIGs and specific investigative services, so that DOD has both an OIG as well as an investigative service as do each of the military services. By law, the OIGs of each military service within DOD—Army, Navy, and Air Force—are each required to implement these requirements. However, GAO found that none of the three military service OIGs had taken actions to implement the requirements, although the DOD OIG had taken some steps to implement them. The division of duties between the military services' OIGs and their respective investigative services makes it difficult to track the implementation of these requirements at DOD. Without the three military services' OIGs implementing the requirements themselves or delegating the implementation of the requirements to the investigative services, the DOD OIGs may not be able to detect fraud, waste, and abuse in DOD's SBIR and STTR programs, which have the largest budgets for these programs.

What GAO Recommends

GAO is making six recommendations, including that SBA confirm agency implementation of the fraud, waste, and abuse requirements, and that the Army, Navy, and Air Force OIGs implement the OIG requirements or delegate them to the investigative services. These agencies generally agreed with the recommendations addressed to them.