A set-aside  restricts competition for a federal contract to specified contractors. SBA agreed with the recommendation and changed its certification  procedures. SBA Adopted Criteria and Guidance for a Risk-Based Approach to HUBZone Certification and Recertification but the Extent to Which It Conducted a Risk Assessment of the Recertification Process Is Unclear SBA Adopted New Documentation Requirements for Recertifying Certain HUBZone Firms

In response to the PROMESA provision to implement a risk-based  approach to HUBZone certification and recertification, SBA adopted  certification and recertification criteria and guidance on March 27, 2017,  for requesting and verifying information. (Before March 2017, firms  seeking HUBZone recertification were not required to submit  documentation to demonstrate continued compliance with eligibility  requirements.) HUBZone firms seeking recertification that have not received $1 million in  HUBZone contract dollars are not required to submit documentation  supporting continual eligibility for the program. We recommended that SBA conduct an  assessment of the recertification process and implement additional  controls, such as developing criteria and guidance on using a risk-based  approach to requesting and verifying firm information. However, as of July 31, 2018, SBA had not provided documentation of  when the risk assessment was performed or of what risks were identified  and considered in developing the criteria and guidance. As of July 31, 2018, SBA also had not provided documentation of what  analysis was performed to establish the $1 million threshold. However, in 2015, we found that SBA lacked key controls  for its recertification process. We continue to believe that conducting a risk  assessment of the recertification process would help inform a risk-based  approach to reviewing and verifying information from firms that appear to  pose the most risk to the program. SBA Did Not Consistently Document or Follow Its Policies and Procedures for Certification Reviews for Firms in Puerto Rico That We Reviewed SBA Had Complete Documentation for Office Location but Not Employee Residency for Firms in Puerto Rico We Reviewed and Had Not Updated Its Policies

Our review of 12 case files for Puerto Rican firms that recently received  HUBZone certification found incomplete documentation for certification  reviews (and by extension, recertification reviews) and undocumented  procedures. However, these procedures are not documented in SBA’s internal written  policies for certifying HUBZone firms and analysts did not document their  use of these procedures in the case files we reviewed. Without such review, SBA may not have  reasonable assurance that firms meet the eligibility criteria for HUBZone  participation—which increases the risk of ineligible firms participating in  the program. SBA’s internal policy states that the certification process has three levels  of review: (1) an analyst reviews the application documents and makes a  recommendation to approve or deny the firm, (2) a senior analyst reviews  the application and the first analyst’s recommendation, and (3) the  program director or deputy finalizes the approval or denial and notifies the  firm of the decision. SBA provided an assurance letter prepared in response to the Federal  Managers Financial Integrity Act that stated the agency evaluated the  Office of HUBZone’s internal controls and concluded the controls were  effective. However, it is not known to what extent SBA reviewed staff’s  compliance with certification and recertification quality review procedures  as part of this assessment, because the letter does not describe what  steps SBA took to conduct the evaluation. This increases  the risk that ineligible firms could receive HUBZone certification and thus  contracting preferences to which they are not entitled. Conclusions

Our review of a sample of 12 case files for Puerto Rican firms certified  between March 2017 and March 2018 found that SBA lacked complete  documentation for one of two requirements we reviewed and did not  consistently follow its own procedures for quality control reviews when  approving firms. SBA has not updated its policy  manuals and, it is not known to what extent it has reviewed staff  compliance with the quality review procedures. Although SBA provided an  assurance letter stating its internal controls are effective, the letter did not  describe steps taken in the evaluation. Specifically:  The Administrator of SBA should update the agency’s internal policy  manuals for certification and recertification reviews to reflect existing  policies and procedures not currently in written guidance. SBA generally agreed with both of our  recommendations. Appendix I: Objectives, Scope, and Methodology

Our objectives in this report were to (1) examine the Small Business  Administration’s (SBA) development of criteria and guidance on using a  risk-based approach for certifying and recertifying Historically  Underutilized Business Zone (HUBZone) firms, (2) examine SBA’s  implementation of the revised policies and procedures for firms located in  Puerto Rico, and (3) describe any economic impacts of HUBZone  expansion and recent trends in federal small business contracting in  Puerto Rico. Results from this  sample are not generalizable to all HUBZone-certified firms.
Why GAO Did This Study

The HUBZone program is intended to stimulate economic development in economically distressed areas. Certified HUBZone firms are eligible for federal contracting benefits, including limited competition awards such as set-aside contracts, and are required to be recertified every 3 years. The Puerto Rico Oversight, Management, and Economic Stability Act of 2016 required SBA to develop criteria and guidance for a risk-based approach to verify firm eligibility for the program and included a provision for GAO to review SBA's development and implementation of the required criteria and guidance. This report examines, among other objectives, (1) SBA's development of criteria and guidance on using a risk-based approach for certifying and recertifying HUBZone firms, and (2) SBA's implementation of the revised policies and procedures for firms located in Puerto Rico.
GAO analyzed SBA documents and reviewed files of a non-generalizable sample of 12 firms located in Puerto Rico that received certification between March 2017 and March 2018. GAO also interviewed SBA officials, representatives from HUBZone-certified firms in Puerto Rico, and local economic development agencies in Puerto Rico.

What GAO Found

The Small Business Administration (SBA) adopted criteria and guidance for a risk-based approach to certifying and recertifying firms for the Historically Underutilized Business Zone (HUBZone) program in March 2017, but the extent to which it conducted a risk assessment to inform its approach is unclear. In 2009, in response to GAO's prior recommendations to address weaknesses in the HUBZone certification process, SBA increased documentation requirements for certification, but not recertification (which every 3 years determines continued program eligibility).
In March 2017, SBA changed its recertification criteria and guidance to require firms with $1 million or more in HUBZone contract awards to provide documentation to support continuing eligibility.
SBA officials stated they completed a risk assessment of the HUBZone recertification process, but as of July 2018, had not provided GAO with documentation on when they performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold.
GAO previously found SBA lacked key controls for its recertification process and recommended in 2015 that SBA assess the process.
GAO continues to believe that an assessment of the recertification process would help inform a risk-based approach to reviewing and verifying information from firms that appear to pose the most risk to the program.
Based on GAO's review of case files for a non-generalizable sample of 12 firms in Puerto Rico that received HUBZone certification in March 2017–March 2018, SBA did not consistently document or follow its policies and procedures for certification reviews.
SBA did not have complete documentation in 9 of 12 cases. SBA officials described alternative procedures they used to determine firms' eligibility, but SBA has not updated its internal policy manuals to reflect these procedures and analysts did not document use of such procedures in the files GAO reviewed.
In 4 of 12 cases, SBA did not follow its policy to conduct three levels of review (by an analyst, a senior analyst, and the program director or deputy) when determining to approve or deny a firm.
It is not known to what extent SBA reviewed staff compliance with certification and recertification review procedures. SBA provided an assurance letter stating it evaluated the Office of HUBZone's internal controls and concluded the controls were effective, but the letter did not specify what steps SBA took for the evaluation.
Standards for internal control state management should document its control policies and conduct periodic reviews to ensure controls are effective. Because SBA has not updated its internal policy manuals or conducted a documented review of staff compliance with its quality review procedures, it lacks reasonable assurance that firms are eligible or its review process is effective. In turn, this increases the risk of ineligible firms participating in the HUBZone program and receiving contracting preferences to which they are not entitled.

What GAO Recommends

GAO recommends that SBA (1) update internal policy manuals to reflect current policies and procedures, and (2) review and document staff compliance with procedures for certification and recertification reviews of firms. SBA generally agreed with GAO's recommendations.