Independent Auditors’ Report on SBA’s Fiscal Year 2023 Financial Statements

Determine enforceable actions and controls to hold lenders accountable for submitting loan status reports timely and correctly.

Design and implement an automated system control to accurately reduce the outstanding principal balance after the processing of all forgiveness payments.

Design, implement, and document an effective PPP forgiveness review process for loan guarantees that were forgiven that addresses both the eligibility and the accuracy of the loan approval and forgiveness amounts.

Perform a thorough and complete analysis of all requirements communicated to lenders for the PPP program and determine how to evaluate whether lenders met the requirements prior to disbursing a PPP loan. The analysis should include evidence to support the adequacy of SBA’s review process when determining which purchase requests will require additional review.

Develop and implement an effective funds recovery plan to ensure funds related to PPP purchases disbursed to ineligible recipients are recovered and reported accurately in a timely manner. The plan should include an effective process to provide the information necessary to the Office of Performance, Planning, and the Chief Financial Officer to record any required accounting adjustments.

Design and implement an effective funds recovery plan to ensure COVID-19 EIDLs funds disbursed to ineligible recipients are recovered and reported accurately and in a timely manner. The plan should include an effective process to provide the information necessary to the Office of Planning, Performance, and the Chief Financial Officer to record any required accounting adjustments.

Perform and update the program’s internal control assessment to identify changes to risks that may require the design and implementation of effective monitoring controls and review processes of RRF awards to identify recipients that may not have been eligible to receive awards or that may have spent awards on ineligible expenses in accordance with the program’s terms.

Design and implement an effective funds recovery plan and controls to ensure RRF awards disbursed to ineligible recipients or spent on ineligible expenses are recovered and reported accurately and in a timely manner. In conjunction with the Office of Planning, Performance, and the Chief Financial Officer, design and implement an effective process to provide the information necessary to record any required accounting adjustments.

Design and implement effective follow-up procedures for SVOG award recipients that are not complying with the program’s terms and to ensure complete, accurate, and timely reporting for the use of the award.

Develop and document the policies and procedures for the recovery of funds, the accounts receivable, and the allowance for estimated uncollectible amounts related to the programs created or expanded by the CARES Act and related legislation.

Inquire with standard setting bodies to confirm the appropriate accounting treatment throughout each step of the recovery lifecycle for COVID-19 EIDLs and the PPP loans that have been charged-off or forgiven. Memorialize the response by updating management’s documented policies and procedures including the respective accounting entries under generally accepted accounting principles for all applicable scenarios.

Continue implementing controls in collaboration with relevant program offices for the PPP and COVID19 EIDLs portfolios to accumulate relevant, complete, and accurate data on which to base the subsidy reestimate.

Refine existing review and approval controls to ensure the reestimate output is in accordance with accounting standards for charged-off loans.

Assess the risk posed by the service organizations’ control environments and obtain sufficient assurance over the operating effectiveness of relevant and significant controls to determine the integrity of loan guarantee programs transactions processed on behalf of and recorded by SBA. To achieve this, consider obtaining a SOC 1 report for the relevant control environments at the service organizations, and perform and document the following:• SOC 1 report is sufficiently scoped to cover transaction processing and related control activities performed by the service organizations on behalf of SBA.• All exceptions noted in the SOC 1 report – not just those described in the independent service auditor’s report – are evaluated to determine applicability to SBA’s internal controls over financial reporting, the potential impact to SBA’s financial statements, and mitigating controls considerations made during their risk assessment. • All complementary user entity controls described in the SOC 1 reports are evaluated using current information and with consideration to their applicability to SBA’s internal controls over financial reporting. • Evaluation procedures performed to assess whether complementary user entity controls and other SBA-performed controls were tested on a frequency determined by SBA and found operating effectively and, if they are not, assess the impact of such deficiencies on SBA’s internal controls over financial reporting. • All complementary subservice organization controls described in SOC 1 reports are evaluated to determine whether they provided services and performed controls considered relevant to SBA’s internal controls over financial reporting and, if relevant subservice organizations were identified, an evaluation is performed to obtain an understanding of the subservice organization(s) and their controls. • SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient coverage to assess impacts on SBA’s internal controls over financial reporting.

Assess the risk posed by the service organizations’ control environments and obtain sufficient assurance over the operating effectiveness of relevant and significant controls to determine the integrity of SVOG program transactions processed on behalf of and recorded by SBA. To achieve this, consider obtaining a SOC 1 report for the relevant control environments at the service organizations, and perform and document the following:• SOC 1 report is sufficiently scoped to cover transaction processing and related control activities performed by the service organizations on behalf of SBA.• All exceptions noted in the SOC 1 report – not just those described in the independent service auditor’s report – are evaluated to determine applicability to SBA’s internal controls over financial reporting, the potential impact to SBA’s financial statements, and mitigating controls considerations made during their risk assessment. • All complementary user entity controls described in the SOC 1 reports are evaluated using current information and with consideration to their applicability to SBA’s internal controls over financial reporting. • Evaluation procedures performed to assess whether complementary user entity controls and other SBA-performed controls were tested on a frequency determined by SBA and found operating effectively and, if they are not, assess the impact of such deficiencies on SBA’s internal controls over financial reporting. • All complementary subservice organization controls described in SOC 1 reports are evaluated to determine whether they provided services and performed controls considered relevant to SBA’s internal controls over financial reporting and, if relevant subservice organizations were identified, an evaluation is performed to obtain an understanding of the subservice organization(s) and their controls. • SOC 1 reports cover the appropriate period or corresponding gap letters provide sufficient coverage to assess impacts on SBA’s internal controls over financial reporting.

Design, implement, and monitor the operating effectiveness of key controls that respond to significant risks of material misstatements and compliance with relevant laws and regulations.

Design and implement controls that demonstrate oversight over the contractor, including documentation that provides evidence over the adequate review and validation of the contractor’s work product.

Based on the results of the risk assessment performed, design and implement appropriate controls to ensure an effective post payment review of payments for covered loans under the Debt Relief Program.

Develop procedures to validate that access for separated employees is removed in accordance with required timeframes.

Design, implement, and document controls for monitoring job failures to ensure complete and accurate reports are generated.

Implement monitoring controls to track compliance with the multi-factor authentication controls.

Design and implement effective communication processes with other relevant offices, including the Office of General Counsel, to ensure subsequent events are timely identified and reported completely and accurately.

Reassess existing policies to ensure they are supported by quality information stemming from an effective control environment that reviews the root causes of borrower delinquency prior to charge-off and referral to Treasury. Perform a regular review of the implemented policies to ensure they are responding to relevant risks of noncompliance for the current fiscal year.

Reevaluate the operational infrastructure to address relevant risks of noncompliance and ensure that borrowers are notified timely of delinquency, and if applicable, subsequently referred to Treasury timely.

In conjunction with relevant program offices, perform and document the internal control evaluation for significant programs or processes affecting the financial statements. This should include entity level controls, manual controls, general information technology controls, and system application controls covering key financial statement line items and risks.

Address the control deficiencies over transactions arising from the implementation of the CARES Act and related legislation by working with the Office of Capital Access and the Office of Disaster Recovery and Resilience to implement the recommendations in Appendix I – Material Weaknesses.