Audit of SBA’s Desktop Loss Verification Process

This report presents the results of our audit of Small Business Administration’s (SBA’s) desktop loss verification process, with the objective to assess the desktop loss verification process. Loss verification is used to estimate and validate the cost of restoring disaster-damaged property to its pre-disaster condition. In the past, loss verifiers conducted damage assessments solely through on-site inspections. However, in January 2017, SBA implemented the desktop loss verification process.

We found that the desktop loss verification process contributed to SBA meeting its timeliness goals for processing disaster loan applications for Hurricanes Harvey, Irma, and Maria. However, controls needed strengthening to mitigate the risk of fraud and ensure program integrity for the loss verification process. Specifically, SBA did not always validate the cause and extent of damages and repair and replacement costs prior to disbursing loan funds. Further, SBA inappropriately relied on FEMA reports that did not contain pertinent information to validate damages and losses reported in the initial loss verification; and loan files did not contain sufficient documentation to support loan-making decisions. As a result, SBA disbursed 36,869 of the 73,313, or 50 percent, loans included in our scope, totaling $594,286,878 of $1.4 billion, without validating the cause and extent of damages, and there was no assurance that disaster loans were only provided to individuals impacted by Hurricanes Harvey, Irma, or Maria.

We made four recommendations to improve controls over the disbursement of loan funds and support for post desktop review (PDR) conclusions. Management partially agreed with recommendations 1 and 2 and agreed with recommendations 3 and 4. Management’s planned actions resolved recommendations 3 and 4. Management plans to explore substitutes to the PDR and ensure they contain the information needed to support the damages estimated during the initial desktop loss verification. Further, management stated that it will implement additional controls to require loss verifiers to provide documentation that sufficiently supports the PDR conclusions. While SBA partially agreed with recommendations 1 and 2, its proposed actions did not fully address them.