The SBA Watchdog Says Data, Collaboration and Proper Controls Are Vital for COVID Oversight

Data analytics and collaboration have been critical to oversight of the pandemic relief for small businesses, according to  Hannibal “Mike” Ware, the Small Business Administration inspector general, who  also stresses the need to implement proper controls before the federal government distributes funds. 

Since the pandemic began in early 2020, Congress has tasked SBA with administering more than $1 trillion through relief programs such as the Paycheck Protection Program, Economic Injury Disaster Loans, Shuttered Venue Operators Grant program and Restaurant Revitalization Fund. Ware, along with his partners in the oversight community, has been at the forefront of combating fraud and alerting the agency of ways to prevent it. The final numbers aren’t known yet, but the office has already identified billions in potential fraud.

“As soon as we realized what kind of money was coming our way, we sought to do things differently,” said Ware, who has been SBA IG since May 2018 and has over 30 years of experience in the IG community. “Whereas normally, an audit looks at things that have already transpired, what we sought to do was to inform folks up front that, ‘hey, with this much money, you need to raise the controls. You need to eliminate some of these vulnerabilities we have in our internal control systems and we need to do them now.’” 

The SBA IG office continues to issue reports on the various relief programs started under the Trump and Biden administrations, and has its ongoing and planned work posted online. 

Government Executive recently interviewed Ware on his office’s ongoing oversight of COVID-19 programs. The following has been edited lightly for length and clarity. 

GE: To start off, I'd love to hear how your approach to oversight has evolved since the start of the pandemic. 

SBA IG: That's a good question and it is good that you folks recognize that we had to do some kind of evolving in order to meet what was before us. As soon as we realized what kind of money was coming our way, we sought to do things differently. We looked to have a proactive approach to oversight. Whereas normally, an audit looks at things that have already transpired, what we sought to do was to inform folks up front that, “hey, with this much money, you need to raise the controls. You need to eliminate some of these vulnerabilities we have in our internal control systems and we need to do them now.” On top of it, we need to educate the public on what they may be seeing in terms of fraudsters trying to get their identity, in terms of people trying to impersonate SBA. So, to address that we put out three reports before the first loan even went through the door trying to get the agency to know what was necessary to stem the tide of fraud that we thought we would be seeing when this much money comes through the door and is expected to move that quickly. On top of that, we joined with the Secret Service. We put out some fraud alerts up front to educate the public on what they could expect and how not to fall prey to fraudsters.

With this much funds moving the way it was, that amount of loans, millions and millions of loans issued, up to a trillion dollars in authorized funds, we had to leverage data analytics like we've never leveraged it before. Fortunately, a couple of years before the pandemic hit, we had kicked it off the ground and within our office with a huge investment in terms of getting data analytics off the ground. And we had, not too long ago, hired some key data scientists and data analysts who were able to call through this information rather quickly, which allowed us to go after the most egregious ones real quick and to notify Congress and notify the agency and notify the public that, because the controls weren't raised, like we suggested in those proactive reports, there was now $87 billion in potential fraud that we had identified with the first tranche of  [Economic Injury Disaster Loan program] funds and with like $6 or $7 billion on the [Paycheck Protection Program] side in just the first few days, and it was data analytics that allowed us to move with that type of speed. 

Next, [a] traditional audit takes 10 months, 11 months, a year to be complete. The money would be finished by the time we put a product down, so we basically developed some agile work products that allowed us to get reports out to the public, in the hands of the agency and Congress, within 30 days in some instances, 90 days in other instances, and they were really impactful, allowed legislation to be changed on the fly and allowed the agency to eventually build up the control structure to stem the tide of fraud. 

We’ve always been an office that has depended on collaboration. And you could see why. We're the Small Business Administration and we're responsible for government contracting. Government contracting touches all of government. So, we were accustomed to partnering with [inspectors general] in the different departments and agencies. Now, though it was on hyper-speed. We joined a whole lot of task forces in order to expand the reach of my office. 

There's one more that's critical. We evolved into more of a remote workforce because we had to, right? Everybody went home, but that money was still going through the door. We already had a pretty robust telework policy, so we seized on that and continued to evolve hand in hand with our staff in terms of what works best for us. And that resulted in this office being more productive than at any time in the history of this office and we have the metrics. 

GE: And to go off on that point, are you in a hybrid situation now? What does the future of work look like? 

SBA IG: Again, I have the data to show that we've been more productive than at any point in the history of the office and when surveyed about what type of work environment we want going into the future, 90% of the staff responded in less than an hour, which is unheard of for any survey that you would put out. And it was a resounding, “this works for us.” We move[d] forward with one of the more forward leading telework and remote work postures that probably is within government at this time where our folks are able to work exclusively from home, but they have always, even through the pandemic, had access to our offices, except for when the official shutdown was. Now, for our criminal investigators that model is not one that works that well. They need to be able to meet with the U.S. attorneys across the country and with their partner agents…Their work right now in terms of arrests, in terms of seizures, convictions, all that that's in the field anyway. So, with the exception of storing evidence, interview rooms and stuff, they're doing all their work on the road. 

GE: Now going back to pandemic fraud, do you have any sense so far how much pandemic small business relief has been subject to fraud or is it too soon to really tell?

SBA IG: We are in the middle of putting out a report that will place a stamp on exactly where we think that mark is. I'm not at liberty to speak about that currently because it's still being deliberated internally and hasn't been discussed with the agency as yet. But I could tell you this, what we did report before is $87 billion in potential fraud for the [Economic Injury Disaster Loan program]. And I can't remember what the exact figure was [for the Paycheck Protection Program]; it’s somewhere between $6 and $9 billion that we reported and so those things we stand by based on what our data analytics have demonstrated. To date, we've pulled back over $4 billion in terms of seizures. When you think about an office the size of mine, that basically has a $22 million budget, that's significant in terms of return on investment and that was just straight seizures. That's not even the ones tied to criminal convictions. That's another half a billion, as of when we reported on the last semi-annual and those numbers continue to rise daily. 

GE: Now, you mentioned return on investment, are there any other resources, maybe personal or funding that you think you need from Congress or the agency itself in order to be more successful? 

SBA IG: Courtney, that's a tricky question, right? Because I can't be out here advocating for that in the public realm, right? Those discussions are normally held with the Office of Management and Budget and then with our appropriators it's a no-no to discuss that one. But from a resource perspective, I could tell you that I have done everything within my power to leverage our resources and to partner with law enforcement agencies across government and that's something that we've done very well. You've heard that in the hearings, sitting next to folks responsible for task forces in the Department of Justice and throughout. So, we've been able to really leverage resources in that way. And of course, to answer in a more general way, we could always use more.

GE: Now, throughout the Trump administration and then after there's been many allegations of fraud in the Small Business Administration programs and there's allegations that the Trump administration did nefarious things and acted with political motivations. Have you found any of that to be true? Is this a black and white issue or is it more complicated than just the Trump versus the Biden administrations’ handling of these programs? 

SBA IG: Courtney, it's never that straightforward. It's certainly not black and white. The control structure, a proper control structure, that was necessary to protect the integrity of the funds on the onset rather than having me in a pay and chase environment that I am now where we are arresting hundreds and hundreds and number going up to thousands of people and we're pulling back all this money, that's the most ineffective way to fight fraud that you can find. The most effective one is to make sure that you have a proper control structure up front.

What they were faced with at the time as an agency, that's what I'm talking about, was the pressure of delivering much needed funds to small businesses who were suffering and the normal go to of “well, the controls just slow everything down” rather than trying to have a balance. So, when you talk about something not being black and white at all, they were given what five days or something like that to stand the programs up. The first tranche of money was gone within 14 days. They had that kind of pressure. 

So, I'm coming to the table with, “hey, hold on, we need control, controls have to be in place right now, I'm not going to be able to chase down all this stuff on the back end. We need to stop these people on the front end.” I sounded like a wet blanket, but it was necessary and I don't know what anyone could have done with that amount of money moving that quickly. 

And in terms of controls, eventually my message started to get through and by December 2020 they started to really implement the controls that we were asking for [and] at that time made several key changes that strengthened the integrity of it. Now, being able to look backward in terms of seeing what's working, what's not, we have done a great deal with the current administrator and administration in terms of making sure that the control structure is considered prior to the implementation of any new program. And as a matter of fact, I think that the White House has mandated that approach for all government agencies to follow. 

GE: That actually leads into my next question. I was going to ask about that guidance that OMB put out last December on inspectors general and agencies working together better and the gold standard meetings OMB has held on implementation of the American Rescue Plan. Have you found all those to be helpful? 

SBA IG: Definitely. So, I've been a part of, of some of those. As an IG, all of us, we have to be careful to always maintain our independence. Clearly, we cannot build the program and then provide oversight of the program. However, almost all of us in the IG community, all the IGs have a comprehensive body of work in terms of looking into these programs that when pulled out and summarized, tell quite a convincing story about what should be considered prior to the program kicking off. And we were able to utilize our 40 plus years of work to speak to this, which was very helpful. At least if the agency partner has to come to the table and justify to any White House why a program should get kicked off and what controls they have in place to make sure that the funds aren't stolen, I think that's a good thing.

GE: For future emergencies, do you have any suggestions on how relief programs can be distributed so that there's no racial bias in the programs and they go to the small businesses that actually need them? I know there's a lot of issues with this with COVID programs, especially early on.

SBA IG: So, we've done quite a bit of work in these areas since the pandemic. I am a statutory member of the [Pandemic Response Accountability Committee] and when I'm meeting with my PRAC counterparts, these are some of the things that we're talking about in terms of leaving legacy documents behind that spell out, in detail, what needs to be done to make sure that what we saw happen never happens again. 

We're working on a document like that; that will be all encompassing in terms of the folks who receive CARES Act funds and [those] afterwards. It basically spells out…a proper control structure where different government systems are allowed to speak to one another, like for example, one of the things we got SBA to do was they now check Treasury’s “Do Not Pay” list. That wasn't happening. They couldn't check it upfront because of how the statute was written, but they now check the tax returns…They check to see that the tax identification numbers were created within the mandated period. None of that was happening at the outset.

Clear rules on these programs have to be put out, so people are not confused as well. That's another, another big thing. But for me, my number one message has been, and will be until the end, [is] that a proper control environment must be in place prior to any government funds going out the door.

GE: Is there anything else I didn't ask about that you think I should know or be aware of?

SBA IG: No, I think we covered a lot in that short period of time. [But] I wanted to back up a little bit to the agile work products that I spoke about in terms of getting the message out to your stakeholders in a way that is timely and impactful, that allows them to make changes on the fly. I'm the audit subcommittee chair for the [Pandemic Response Accountability Committee] and we got a group together and we put together a playbook on this. So, there's a document called the agile work products toolkit that you could find on the [committee's] website that spells out how exactly to meet standards when you're doing these things. With that utilized, that's transformative in terms of oversight throughout government.