Background The HUBZone Act of 1997 (which established the HUBZone program)  identified HUBZones as (1) qualified census tracts, which are determined  generally by area poverty rate or household income; (2) qualified  nonmetropolitan counties, which are determined generally by area  unemployment rate or median household income; and (3) lands meeting  certain criteria within the boundaries of an Indian reservation. Congress  subsequently expanded the criteria for HUBZones to add former military  bases, counties in difficult development areas outside the continental  United States, and certain areas affected by disasters. According to SBA  officials, 5,306 firms were HUBZone certified as of July 1, 2018. As of that  date, there were 20,154 HUBZone qualified census tracts, 834 HUBZone  qualified non-metropolitan counties, 125 HUBZone base realignment and  closure areas, 593 HUBZone Native American lands (Indian lands), and  95 HUBZone qualified disaster areas (87 qualified disaster census tracts  and 8 qualified disaster non-metropolitan counties). The HUBZone program provides certified small businesses located in  designated areas with contracting opportunities in the form of set-asides,  sole-source awards, and price-evaluation preferences. A set-aside  restricts competition for a federal contract to specified contractors. For  example, competition may be restricted to SBA-certified HUBZone  businesses if there is a reasonable expectation of at least two SBA- certified HUBZone bidders and a fair market price. A sole-source award is  a federal contract awarded, or proposed for award, without competition.  Also, in any full and open competition for a federal contract, the HUBZone  price evaluation preference allows the price that a HUBZone firm offers to  be deemed lower than the price of another offeror (if the HUBZone firm’s  offer is not more than 10 percent higher than the other offer and the other  offeror is not a small business concern). HUBZone Certification and  Recertification Processes  and Related GAO  Recommendations To be certified to participate in the HUBZone program, a firm must meet  the following criteria: when combined with its affiliates, be small by SBA size be at least 51 percent owned and controlled by U.S. citizens, or  owned by an Indian Tribal Government, Alaska Native  Corporation, Community Development Corporation, or small  agricultural cooperative; have its principal office—the location where the greatest number  of employees perform their work—in a HUBZone; and have at least 35 percent of its employees reside in a HUBZone. In a 2008 report, we found that SBA had relied on information that firms  entered into an online application system called the HUBZone Certification Tracking System to indicate they met the size, ownership,  location, and employee residence standards. At the time, SBA  performed limited verification of the self-reported information. Although  agency staff could request additional supporting documentation, SBA did  not have specific guidance or criteria for such requests. Thus, we  recommended that SBA develop and implement guidance to more  routinely and consistently obtain supporting documentation from applicant  firms. SBA agreed with the recommendation and changed its certification  procedures. Since fiscal year 2009, SBA has required all firms applying for HUBZone  certification to provide supporting documentation about their size,  ownership, location, and employees’ residence, which the agency then is  to review to verify the firm’s eligibility for the program. According to SBA  officials, the current initial certification process has two components: (1)  submission and review of an online application, which is processed by  SBA through the HUBZone Certification Tracking System; and (2)  submission of corroborative documentation, which SBA processes  through a document review. The tracking system contains information on  firms that apply to the HUBZone program, as well as on certified firms  that apply for recertification. Firms wishing to remain in the program must  recertify their continued eligibility to SBA every 3 years. The tracking  system automatically identifies firms that are due for recertification and  sends notifications to those firms. In 2015, we reported that SBA implemented controls for certification, but  generally did not require firms seeking recertification to submit any  information to verify continued eligibility. Instead, the agency relied on  firms’ attestations of continued eligibility. According to SBA officials at  the time, they did not believe they needed to request supporting  documentation from recertifying firms because all firms in the program  had undergone a full document review. We noted that SBA could apply a  risk-based approach to its recertification process to review and verify information from firms that appeared to pose the most risk to the program.  We concluded that recertification essentially remained a self-certification  process. We recommended that SBA reassess its recertification process  and add additional controls, such as developing criteria and guidance on  using a risk-based approach to requesting and verifying firm information.  SBA agreed with our recommendation and noted it would assess the  process. In March 2017, we reported that SBA planned to address our  recommendation using a technology solution. GAO’s Fraud Risk  Framework and Related  Legislation According to federal internal control standards and GAO’s fraud risk  framework, managers in executive branch agencies are responsible for  managing fraud risks and implementing practices for combating those  risks. When fraud risks can be identified and mitigated, fraud may be  less likely to occur. Federal internal control standards call for agency  management officials to assess the internal and external risks their  entities face as they seek to achieve their objectives. The standards state  that management should consider the potential for fraud when identifying,  analyzing, and responding to risks. Risk management is a formal and  disciplined practice for addressing risk and reducing it to an acceptable  level. In July 2015, we issued the fraud risk framework, which provides a  comprehensive set of key components and leading practices that serve  as a guide for agency managers to use when developing efforts to  combat fraud in a strategic, risk-based way. The Fraud Reduction and  Data Analytics Act of 2015 required the Office of Management and  Budget to establish guidelines for federal agencies to create controls to  identify and assess fraud risks and design and implement antifraud  control activities. In July 2016, the Office of Management and Budget  issued guidelines that, among other things, affirm managers should  adhere to the leading practices identified in GAO’s fraud risk framework. National Defense  Authorization Act for Fiscal  Year 2018 The National Defense Authorization Act for Fiscal Year 2018 includes a  number of provisions relating to the HUBZone program. For example,  the act requires SBA (by January 1, 2020) to verify the accuracy of  documentation provided by a HUBZone firm seeking recertification to  determine whether the firm remains qualified for HUBZone certification.  The act also requires SBA to begin conducting examinations of qualified  HUBZone firms by January 1, 2020, using a risk-based analysis to select  firms to be examined. According to the act, these risk-based  examinations are intended to ensure that each firm examined meets the  program requirements for certification. The act also specifies that any  small business that SBA determines to have misrepresented its status as  a qualified HUBZone firm be subject to liability for fraud. HUBZone Expansion in  Puerto Rico On June 16, 2016, SBA announced it had revised the definition of  qualified census tracts eligible to be designated as HUBZones to provide  more opportunities for firms in Puerto Rico. Previously, in addition to  poverty rate and income, SBA applied a statutory population cap that  limited the number of eligible census tracts. According to the  announcement, SBA had determined that the 20 percent population cap  was not in keeping with the spirit and intent of the HUBZone program. On  June 30, 2016, PROMESA authorized an exemption to the 20 percent  cap for HUBZone designations in Puerto Rico for a limited time (10 years  or until the date on which the Financial Oversight and Management Board  for Puerto Rico ceased to exist, whichever came first). It also required  SBA to promulgate regulations to implement the exemption. SBA promulgated the regulations, which became effective December 22,  2017. By lifting the population cap in June 2016, SBA increased the number of  eligible census tracts in Puerto Rico by 516 (from 260 to 776). As a result,  nearly all of Puerto Rico now qualifies as a HUBZone (see fig.1). 2017 Hurricanes In 2017, two major hurricanes (Irma and Maria) hit Puerto Rico. Hurricane  Irma skirted Puerto Rico and left more than 1 million people without  power. Hurricane Maria, a Category 4 hurricane, made landfall and  caused catastrophic damage. For instance, Hurricane Maria wiped out  the power grid, resulting in outages across Puerto Rico that continued for  months after the storm. The majority of the island had its power restored  by April 4, 2018, according to the Department of Energy. However, the  power grid remains fragile. For example, Puerto Rico experienced an  island-wide outage on April 18, 2018. SBA Adopted Criteria  and Guidance for a  Risk-Based Approach  to HUBZone  Certification and  Recertification but the  Extent to Which It  Conducted a Risk  Assessment of the  Recertification  Process Is Unclear  SBA Adopted New  Documentation  Requirements for  Recertifying Certain  HUBZone Firms In response to the PROMESA provision to implement a risk-based  approach to HUBZone certification and recertification, SBA adopted  certification and recertification criteria and guidance on March 27, 2017,  for requesting and verifying information. Since 2009 and in response to  a prior GAO recommendation, SBA has required and reviewed  documentation from all small businesses seeking initial certification to  show compliance with HUBZone eligibility requirements. The criteria  and guidance adopted by SBA in March 2017 did not change the  HUBZone certification process. SBA’s internal guidance directs staff to  review and confirm the accuracy of all documentation provided by the  firms applying for HUBZone certification. However, the 2017 guidance and criteria introduced some documentation  requirements to the recertification process. (Before March 2017, firms  seeking HUBZone recertification were not required to submit  documentation to demonstrate continued compliance with eligibility  requirements.) Currently, any certified firm seeking recertification that  received $1 million or more in HUBZone contract dollars since its last  certification or recertification has to demonstrate compliance with the 35  percent HUBZone employee residency and principal office requirements. More specifically, under the March 2017 guidance and  criteria, certified HUBZone small business concerns that have received  $1 million or more in HUBZone contract dollars since their initial  certification or most recent recertification must submit (1) a list of all  current employees, identifying the name of the employees, their  addresses, the number of hours they worked per month, and the location  at which they performed their work; and (2) payroll documentation.  HUBZone firms seeking recertification that have not received $1 million in  HUBZone contract dollars are not required to submit documentation  supporting continual eligibility for the program. Extent to Which SBA  Conducted a Risk  Assessment of the  Recertification Process Is  Unclear SBA officials stated that they had completed a risk assessment of their  HUBZone recertification process to develop the March 2017 guidance  and criteria. In our 2015 report, we found SBA did not require firms to  submit supporting documentation as part of the recertification process—in  effect, firms self-certified. We recommended that SBA conduct an  assessment of the recertification process and implement additional  controls, such as developing criteria and guidance on using a risk-based  approach to requesting and verifying firm information. However, as of July 31, 2018, SBA had not provided documentation of  when the risk assessment was performed or of what risks were identified  and considered in developing the criteria and guidance. SBA officials  stated that out of necessity, given their current information system and  staffing resources, they chose the $1 million threshold as the only  criterion for their risk-based approach. As of July 31, 2018, SBA also had not provided documentation of what  analysis was performed to establish the $1 million threshold. According to  SBA officials, the threshold was determined based on the belief that,  when a firm received contract awards over $1 million, it increased  opportunity for the firm to fall out of compliance with HUBZone  requirements. SBA officials noted that they plan to review the current threshold at the  end of fiscal year 2018 and that the threshold amount will likely decrease  because a relatively small number of firms have exceeded the $1 million  threshold. Based on our analysis of Federal Procurement Data System- Next Generation data, we estimated that from fiscal year 2015 through  fiscal year 2017 about 9 percent of HUBZone firms nationally exceeded  the $1 million threshold. SBA officials also noted that the agency has  been developing a new information system to replace the current  certification tracking system. According to SBA officials, the new system  will help simplify the application process and allow firms to submit  additional documentation more easily. SBA officials said the 2017 criteria  and guidance will be built into the parameters of the new information  system, which will allow SBA to expand the review of documentation  submitted by firms seeking recertification. Officials have stated that  subject to funding and resources, the HUBZone Certification Tracking  System is scheduled to be decommissioned in fiscal year 2019. In the past, SBA has implemented a number of actions to better ensure  that only eligible firms participate in the HUBZone program and to  address internal control weaknesses that we have identified in previous  GAO reports. However, in 2015, we found that SBA lacked key controls  for its recertification process. Specifically, SBA did not require firms to  submit supporting documentation as part of the recertification process—in  effect, firms self-certified. We reported that by not routinely requiring and  reviewing key supporting documentation from recertification applicants,  SBA was missing an additional opportunity to reduce the risk that  ineligible firms obtain HUBZone contracts. We recommended that SBA  conduct an assessment of the recertification process and implement  additional controls, such as developing criteria and guidance on using a  risk-based approach to requesting and verifying firm information. Standards for Internal Control in the Federal Government state that  management should identify, analyze, and respond to risks related to  achieving the defined objectives of the program. Additionally, the  standards state that management should use a risk assessment to  identify and analyze risks related to achieving the defined objectives to  form a basis for designing risk responses. Once identified, management  can analyze the identified risks to estimate their significance and design  responses to the analyzed risks. Similarly, according to GAO’s fraud risk  framework, leading practices for managing fraud risk include identifying  inherent fraud risks affecting the program, assessing the likelihood and  impact of inherent fraud risks, and examining the suitability of existing  fraud controls. The Fraud Reduction and Data Analytics Act of 2015  states that agencies shall conduct an evaluation of fraud risks using a  risk-based approach, and then design and implement financial and  administrative control activities to mitigate identified fraud risks.  Additionally, as discussed above, the National Defense Authorization Act  for Fiscal Year 2018 requires that SBA perform examinations of  HUBZone firms using a risk-based selection process. As we reported in 2015, the characteristics of firms and the status of  HUBZone areas—the bases for program eligibility—can often change,  and need to be monitored. We continue to believe that conducting a risk  assessment of the recertification process would help inform a risk-based  approach to reviewing and verifying information from firms that appear to  pose the most risk to the program. For example, a risk assessment could  help inform SBA’s planned review of the current threshold for requesting  and verifying information from firms seeking HUBZone recertification. SBA Did Not  Consistently  Document or Follow  Its Policies and  Procedures for  Certification Reviews  for Firms in Puerto  Rico That We  Reviewed  SBA Had Complete  Documentation for Office  Location but Not  Employee Residency for  Firms in Puerto Rico We  Reviewed and Had Not  Updated Its Policies Our review of 12 case files for Puerto Rican firms that recently received  HUBZone certification found incomplete documentation for certification  reviews (and by extension, recertification reviews) and undocumented  procedures. SBA also did not consistently follow its procedures to  complete three distinct levels of review when approving the 12 firms for  certification. Representatives of firms in Puerto Rico with whom we spoke  said certification was generally straightforward, but identified some  challenges, including with providing documentation. We found that all 12 cases we reviewed in a non-generalizable sample of  Puerto Rican firms that had received HUBZone certification between  March 2017 and March 2018 had complete documentation to  demonstrate that the primary office was located in a HUBZone. However,  we also found that documents were missing, illegible, or did not  corroborate the information claimed regarding employees’ residency for 9  of 12 firms that we reviewed. We focused on the document review  process for the principal office location and the employee residency  requirements because, according to SBA’s March 2017 guidance for the  certification and recertification processes, firms must corroborate their  compliance with these requirements at both certification and  recertification. In addition, SBA officials told us that the document review  process is essentially the same for firms seeking certification as it is for  firms seeing recertification. We also reviewed the files of two HUBZone  firms in Puerto Rico that were subject to recertification between March  2017 and March 2018, but neither met the threshold to trigger a  document review under the updated criteria and guidance. SBA’s guidance for the certification process requires firms to submit  documentation so that SBA can verify that a firm meets the employee residency and principal location requirements. The documentation must  show that each individual is an employee of the firm (payroll documentation), each individual asserted to be a HUBZone resident lives at the  address they claim (proof of address, such as a driver’s license),  and  the address is in a HUBZone (copy of a HUBZone map indicating  the employee and his or her address), and  the firm’s primary office is located in a HUBZone (such as a copy  of a lease or rental agreement and list of employees who work  there). Additionally, SBA’s internal policy manuals describe procedures that  analysts are to follow in reviewing and verifying these documents,  including the types of documents that firms may submit to demonstrate  eligibility, and scenarios in which analysts should request additional  information or clarification from the firm (for example, if a driver’s license  is expired). For 9 of 12 cases we reviewed, SBA lacked complete documentation to  verify that every employee asserted to be a HUBZone resident lived in a  HUBZone. That is, although SBA analysts contacted firms during the  certification process to obtain additional documentation, and firms  responded to the requests, SBA analysts still had incomplete information  for 9 of the 12 cases at the time they approved the firms. In 5 of these 9 cases, the firm would not be eligible for HUBZone  certification if the SBA analyst had not counted employees for which  documentation was missing or did not corroborate the information  claimed regarding an employee’s address. Specifically,  in 3 cases, the address on the employee’s identification for at  least one employee did not match the address at which the firm  claimed the employee lived.  in 3 cases, the identification for at least one employee was  expired.  in 1 case, the copies of the HUBZone maps did not indicate to  which employees they referred.  in 1 case, payroll documentation demonstrating that individuals  were employees of the firm was missing.  in the other 4 cases, the firm still would be eligible for HUBZone  certification (would meet the 35 percent residency requirement)  even if the analyst had not counted the employee for which  documentation was missing or illegible (1 case) or for which  identification did not match the claimed residency address (4  cases). We also identified an inconsistency when reviewing the case files for the  only Puerto Rican HUBZone firm recertified between June 2017 and May  2018. Specifically, the firm reported on its application that it had zero  employees, but also claimed 19 of its employees lived in a HUBZone. The  firm did not provide any supporting documentation because it did not  meet the threshold in the new recertification criteria to require a document  review. SBA officials said this likely resulted from a display error in the  online system. SBA officials said that they did not contact the recertifying  firm because the firm was not required to submit corroborating  documentation. However, without confirmation of the correct total number  of employees, SBA analysts would not be able to determine the firm’s  compliance with the employee residency requirement (35 percent living in  a HUBZone) and therefore would not be able to determine the firm’s  eligibility to continue HUBZone participation. SBA officials explained how they handled incomplete information  provided by firms by describing other procedures that analysts followed in  these cases. For example, if any employee’s address did not match  across the firm’s employee list, the employee’s identification, or the  HUBZone map, the analyst reviewing the firm’s application would request  clarification and enter the address from the identification into the current  HUBZone map. Or if the address could not be plotted, the analyst would  presume the employee lived in a HUBZone if the broader geographic  area on their identification (such as zip code) was clearly in a HUBZone. SBA officials said this approach is useful for applications from firms in  Puerto Rico, because of difficulties with mapping addresses in the  territory. SBA officials also said that if a firm did not provide  documentation for an employee or SBA could not verify it, but the firm  clearly met the 35 percent resident requirement, the analyst would not  follow up with additional documentation requests and not count that  employee as a HUBZone resident. However, these procedures are not documented in SBA’s internal written  policies for certifying HUBZone firms and analysts did not document their  use of these procedures in the case files we reviewed. Specifically, the  policy manuals do not include certain procedures SBA officials explained  to us they used for the document review process, such as assumptions of  eligibility for addresses located in a broader geographic area that is  clearly a HUBZone. SBA has not updated its three internal policy manuals  since 2014, 2010 and 2007, respectively. According to SBA officials, analysts rely on oral direction from the  HUBZone program director or deputy to review and process HUBZone  certifications and recertifications to supplement outdated policy  documents. Internal control standards state that management should  document in policies the internal control responsibilities of the  organization. Because SBA has not updated its internal policy manuals, analysts who  review applications for HUBZone certification and recertification may not  be consistently following applicable internal policies and procedures. As a  result, management does not have reasonable assurance that analysts  are following procedures correctly to obtain and review all of the required  documents from firms. Without such review, SBA may not have  reasonable assurance that firms meet the eligibility criteria for HUBZone  participation—which increases the risk of ineligible firms participating in  the program. Because SBA officials told us that firms seeking  recertification that meet the threshold for additional document review  undergo essentially the same reviews as firms seeking certification, the gaps in certification cases that we observed suggest that gaps are  possible in recertification as well. SBA Did Not Consistently  Follow Its Quality Review  Procedures When  Certifying Firms In Puerto  Rico That We Reviewed SBA did not consistently follow its quality review procedures to complete  three distinct levels of review when approving the 12 Puerto Rican firms  in our non-generalizable sample for certification. In 4 of 12 cases, one  person reviewed the application for two levels of review; in the other 8  cases, three different analysts reviewed the application. We found that  SBA notified all 12 firms of their approval in writing, in accordance with its  policy. SBA’s internal policy states that the certification process has three levels  of review: (1) an analyst reviews the application documents and makes a  recommendation to approve or deny the firm, (2) a senior analyst reviews  the application and the first analyst’s recommendation, and (3) the  program director or deputy finalizes the approval or denial and notifies the  firm of the decision. The three levels of review are intended to provide  quality assurance. For example, the second analyst reviews the case file  and the first analyst’s recommendation for completeness, accuracy, and  consistency with eligibility criteria. SBA officials told us that, in some cases, one individual’s review may  count as two of the three levels of reviews in order to make the most  efficient use of available analyst capacity. SBA officials said the deputy  director reviewed several applications from Puerto Rican firms, including  the four cases we identified, as part of work to develop an application  screening tool and to engage the Puerto Rico district office when  processing applications from firms in Puerto Rico. These reviews were  counted as two of the three levels of review. Officials said that in these  cases, the program director completes the final review and should  annotate the case file notes about the quality assurance actions that were  taken. In three of the four cases, the program director noted that she  completed the final review and approval but not what quality assurance  actions were taken; the deputy director completed both the second and  final review in the other case. SBA officials described the third-level  review (final approval or denial) as a high-level review to ensure no  questions or unresolved matters are outstanding in order to approve or  deny the application. Therefore, it is not likely that the program director  would be reviewing supporting documents to identify any problems that  could be identified if an additional analyst conducted a second-level,  quality assurance review. Internal control standards state that management should design control  activities at various levels with a segregation of duties, and periodically  review its procedures and associated internal control activities for  effectiveness. Management should also monitor its internal control  system through ongoing monitoring to assess the quality and  effectiveness of the internal control system’s performance over time. SBA provided an assurance letter prepared in response to the Federal  Managers Financial Integrity Act that stated the agency evaluated the  Office of HUBZone’s internal controls and concluded the controls were  effective. However, it is not known to what extent SBA reviewed staff’s  compliance with certification and recertification quality review procedures  as part of this assessment, because the letter does not describe what  steps SBA took to conduct the evaluation. Without reviewing staff compliance with certification and recertification  procedures, SBA lacks reasonable assurance that analysts follow such  procedures and that internal controls function effectively. This increases  the risk that ineligible firms could receive HUBZone certification and thus  contracting preferences to which they are not entitled. Representatives of Firms  in Puerto Rico We  Interviewed Said  Certification Process  Generally Was  Straightforward, but  Documentation Requests  Presented Some  Challenges Representatives of nine HUBZone firms we interviewed in Puerto Rico  were not aware of changes made to the recertification process, but said  that the certification process they followed was straightforward and  generally easy. However, they reported some challenges, including with  documentation. Representatives of most of the firms said that the most difficult part of the  certification process was documenting the address for their primary office  location and employees’ residences to show they are located in a  HUBZone. They said this is time-consuming and tedious, especially for  firms with many employees. Although they felt that SBA’s HUBZone  mapping software had improved, they said the formatting of addresses in  Puerto Rico creates a challenge, consistent with what we reported in  2017. One representative described having to pinpoint locations manually in Google Maps to obtain geographic coordinates, and then  enter the coordinates into SBA’s HUBZone map instead of street  addresses. Other representatives noted that some of their employees  have informal living arrangements and cannot easily provide proof of  address. Some representatives said that they struggled with the specific time  frames that payroll documentation must cover. SBA requires firms to  submit payroll documentation for the pay period that includes the date of  their application and a sufficient number of preceding payrolls to cover a  4-week period, but firms said it was difficult to submit payroll reports at  exactly the right time to meet this requirement. According to representatives from HUBZone firms and two economic  development organizations we interviewed, some challenges with  certification may be unique to firms in Puerto Rico, including the address  format issue described above. Representatives from one firm and the  economic development organizations said that some firms in Puerto Rico  may face language barriers if Spanish is their primary language, or if they  lack formal documentation required for certification, such as not having  computerized records. The 2017 hurricanes also created several  challenges for firms. For example, some firms did not have electricity and  closed for several months. Firms that closed while trying to obtain  HUBZone certification could not respond to follow-up requests from SBA  immediately or provide documentation of their business operations for the  time period in which they were affected. Representatives from firms we interviewed said they had little contact with  SBA other than in relation to compliance. Although some have attended  SBA events, representatives said they generally worked with SBA partner  organizations, such as the Federal Contracting Center and Small  Business and Technology Development Center to obtain assistance with  gaining HUBZone certification and applying for federal contracts.  Representatives from three firms we interviewed said that officials from  SBA visited their offices to provide technical assistance support. According to SBA officials in Washington, D.C., they have improved their  communications with firms and increased outreach for the HUBZone  program in recent years. For example, the HUBZone tracking system  automatically generates emails to firms, such as reminders that they are  due for recertification, which according to SBA officials, has eliminated  the backlog of recertifications on which we reported in February 2017.  Representatives from the Puerto Rico District Office also said they  increased promotion of the HUBZone program in recent years through  monthly events and seminars on all SBA programs across Puerto Rico,  including a seminar on obtaining HUBZone certification. Representatives  from the district office said they are not involved with the certification and  recertification processes, but provide support by conducting from three to  six site visits to HUBZone firms annually in Puerto Rico and the U.S.  Virgin Islands. HUBZone Set-Aside  Contracting Was  Minimal in  Comparison to Other  Small Business  Contracting in Puerto  Rico; However,  Assessment of  HUBZone Expansion  Impacts Might Be  Premature An increase in HUBZone set-aside contracts could theoretically help  deliver economic impact to Puerto Rico, but it is likely too soon to assess  larger-scale economic benefits resulting from HUBZone program  expansion in Puerto Rico as of June 2018. From fiscal years 2006  through June 2018, the share of HUBZone set-aside contracts as a  percentage of small business contracts in Puerto Rico has remained low  despite sharp increases in the number of HUBZone firms and overall  federal contracting in Puerto Rico. Over this period, small businesses in  Puerto Rico have been winning a large and increasing percentage of total  federal contracting obligations in Puerto Rico. Firms, economic  development organizations, and SBA representatives said any impacts of  HUBZone expansion in Puerto Rico may not yet be observable due to  hurricane-related setbacks. They also identified longer-standing  challenges that Puerto Rican firms have faced in obtaining HUBZone set- aside contracts consistent with those we identified in 2017. In 2018,  SBA established a procurement center representative (PCR) in Puerto  Rico, which the agency expects will help address some of those  challenges. Economic Impacts of  HUBZone Expansion in  Puerto Rico Not Yet  Apparent Based on our analysis as of June 30, 2018, it appears that larger-scale  economic benefits from HUBZone expansion have not been realized (it  may be too early to assess the impact of program expansion). While  HUBZone certification alone likely would not have a direct economic  impact (such as on job creation) in Puerto Rico, the expansion of  HUBZones in Puerto Rico, which now cover nearly the entire island, gives  opportunities to more firms to qualify for and pursue preferential  contracting opportunities. The number of HUBZone firms has risen since  the expansion—from 20 in September 2016 to 101 as of June 30, 2018. The program could help deliver economic impacts if HUBZone firms  received contract awards as a result of contract preferences such as set- aside or sole-source contracts. For instance, employees hired to fulfill  HUBZone set-aside contracts could represent jobs created in Puerto Rico  (if those contracts otherwise would have been awarded to a firm outside  Puerto Rico). However, if the contract otherwise would have been  awarded to another Puerto Rican firm, the new jobs would represent an  economic transfer, not jobs created. Our analysis of HUBZone set-aside contracts in Puerto Rico indicated  that a few, newly certified HUBZone firms received set-aside contracts,  which can be a source of job creation. Six of the nine firms that received HUBZone set-aside contracts in  fiscal years 2017 and 2018 (through June 2018), totaling $5.1  million, were certified after the 2016 program expansion. One newly certified HUBZone firm that we interviewed said that  program expansion resulted in the firm becoming HUBZone- eligible. The firm’s representative said that it obtained a 5-year  HUBZone set-aside contract for $700,000, which resulted in the  firm hiring six employees to fulfill the contract. But HUBZone set-aside contract obligations have remained largely  unchanged in recent years, and firms face both temporary and longer- standing challenges in accessing and winning contract awards, as we  discuss later in this section. For a description of contracting trends in  Puerto Rico, see appendix II. Federal Contracting to  Small Businesses in  Puerto Rico More Than  Doubled Over the Past 3  Years Based on our analysis, federal contracts to businesses in Puerto Rico  increased from $355 million in fiscal year 2015 to $841 million in fiscal  year 2018 (through June 2018). Similarly, federal contracts to small  businesses in Puerto Rico increased from $244 million to $688 million in  the same period (see fig. 2). Although HUBZone set-aside contract obligations have remained largely  unchanged in recent years, small businesses in Puerto Rico also have  been winning a large and increasing percentage of total federal  contracting obligations in Puerto Rico. Specifically, federal contract  obligations to small businesses located in Puerto Rico as a percentage of  total federal contract obligations in Puerto Rico increased from 69 percent  in fiscal year 2015 to 82 percent in fiscal year 2018 (through June 2018).  A significant portion of the increase in overall contracting and small  business contracting to Puerto Rican firms in fiscal year 2018 (through  June 2018) was related to hurricane relief. Specifically, we calculated that  55 percent of total federal contracting obligations in Puerto Rico and 64  percent of obligations awarded to Puerto Rican small businesses in fiscal  2018 were associated with hurricane relief. HUBZone Set-Aside  Contracts as a Share of  Federal and Small  Business Contracts in  Puerto Rico Remained  Relatively Low in Recent  Years While the obligations for federal contracting to small businesses in Puerto  Rico sharply increased in recent years, as did the number of HUBZone  firms, the share of HUBZone set-asides as a percentage of small  business contracts in Puerto Rico remained low and relatively unchanged  (see fig. 3). HUBZone set-aside contract obligations increased from  negative $20,881 in fiscal year 2016 to $3.8 million in fiscal year 2017 (1  percent of the total value of small business contracts in Puerto Rico). The  set-aside obligations dropped to $1.7 million through June 2018 (0.2  percent of the total value of small business contracts in Puerto Rico). Representatives of two economic development organizations that we  interviewed stated that continued low use of HUBZone set-aside  contracts by contracting agencies could subsequently decrease firms’  willingness to participate in the HUBZone program in Puerto Rico.  Representatives of firms and two economic development organizations  noted that the process of monitoring, identifying, and applying for  HUBZone set-aside contracts is time consuming and without the  availability of set-aside contracts program participation may not be  worthwhile for firms in Puerto Rico. Temporary Challenges  May Hinder Use of  HUBZone Set-Aside  Contracts in Puerto Rico in  the Short Term Representatives of firms and two economic development organizations  and SBA officials in Washington D.C. and the Puerto Rico District Office  told us that use of HUBZone set-aside contracts and any resulting  economic impacts of HUBZone expansion in Puerto Rico may not yet be  observable because of temporary challenges, such as advance contracts  and outmigration due to the 2017 hurricanes. Advance Contracts One temporary challenge they cited was the use of advance contracts by  agencies in response to the 2017 hurricanes. In advance contracts, an  agency establishes contracts before a disaster for goods and services  typically needed during a disaster response. Such contracts may prevent contracting officers from establishing a  HUBZone set-aside on contracts awarded for disaster response and  recovery. For example, a representative from one firm we interviewed  said that in the wake of the 2017 hurricanes it had ample supplies of a  vaccine in high demand on the island. The firm’s representative thought  that contracting officers previously established an advance contract with a  company in the continental United States to supply the vaccine.  Therefore, contracting officers were unable to contract the Puerto Rican  HUBZone firm to supply the vaccine to the island. However, SBA officials  in the Puerto Rico District Office told us that once advance contracts are  completed, the contracting agency can replace the contract with another  contract to perform those services, which could be a HUBZone set-aside  contract. Outmigration from 2017  Hurricanes Representatives of firms and one economic development organization  and SBA officials in the Puerto Rico District Office told us that  outmigration from Puerto Rico after the 2017 hurricanes reduced the  amount of talent and workers available to fulfill contracts. Representatives  of one firm said that contracting officers may be concerned that the  defection of talent from Puerto Rico could limit firms’ abilities to complete  contracts, limiting the contracting officers’ willingness to set aside  contracts. However, representatives of firms and one economic development  organization said that contracts can be fulfilled by multiple Puerto Rican  firms if necessary. Also, representatives of firms and one economic  development organization said that people who left the island have  started returning and replenishing the workforce. Longer-Standing  Challenges Also May  Hinder Use of HUBZone  Set-Aside Contracts Representatives of firms and two economic development organizations  and SBA officials in Washington D.C. and the Puerto Rico District Office  also identified longer-standing challenges to increased use of HUBZone  set-aside contracts in Puerto Rico, including difficulty meeting  procurement requirements, limited knowledge of the federal contracting  process, lack of access to contracting officers, and award of contracts to  firms outside Puerto Rico. These concerns are similar to those we  recognized in our 2017 report on SBA contracting program in Puerto  Rico. Difficulty Meeting Procurement  Requirements Representatives of some firms we interviewed stated that procurement  requirements for federal contracts (such as performance history for  construction contracts) posed challenges for small businesses in Puerto  Rico. Representatives of some firms said that as an island, Puerto Rico  faces specific challenges in meeting procurement requirements. For  example, one firm’s representative said that the construction of a school  required a business to demonstrate experience in developing several  schools in the past. According to this representative, opportunities to  construct schools are limited in Puerto Rico and many Puerto Rican firms  would be capable of fulfilling these contracts, but relevant experience  constructing similar buildings is not considered as meeting this  requirement. In 2017, we reported that the experience of construction businesses in  Puerto Rico does not match procurement requirements, which are often  standardized to mainland building standards and do not consider unique  conditions in Puerto Rico. As a result, firms and associations that we  interviewed in 2017 said that agencies’ contracting officers may not  consider the experience of Puerto Rican businesses as qualifying.  Representatives from four associations that we interviewed in 2017 stated  that construction businesses in Puerto Rico demonstrate in their  construction plans greater understanding of building requirements in  Puerto Rico, such as accounting for tropical climate or the risk of seismic  activity, but these factors were not incorporated into federal procurement  requirements. Limited Knowledge of the  Federal Contracting Process Representatives of firms and two economic development organizations  and SBA officials in the Puerto Rico District Office said that limited  knowledge of the federal contracting process can be a challenge for  HUBZone firms in Puerto Rico. One firm’s representative explained that  responding to agencies’ requests for information was important because  to create a HUBZone set-aside contract a federal agency must  demonstrate that at least two firms could compete for the contract.  Another firm’s representative said that because it was unaware of the  importance of responding to the requests for information, it had not  responded to requests for information for any contract opportunities.  Firms’ representatives also noted that the process of responding to  requests for information and requests for proposals is time consuming  and often infeasible because they lack the financial and personnel  resources of larger businesses. Firms can obtain information about federal and small business contracting  from several sources. Firms’ representatives we interviewed said that  they generally seek assistance from SBA partner organizations, such as  the Federal Contracting Center and Small Business and Technology  Development Center, to gain a better understanding of the contracting  process. Officials from SBA’s Puerto Rico District Office said that they  hold regular training on contracting programs and how to navigate the  contracting process. The District Office also holds one-on-one  appointments with businesses to help them navigate the federal  contracting process and has offered training on proposal writing. Lack of Access to Contracting  Officers Representatives of firms we interviewed said that obtaining HUBZone set- aside contracts was difficult for small businesses in Puerto Rico partially  because of a lack of access to contracting officers. Most firms’  representatives we interviewed said that, similar to obtaining assistance  in navigating the contracting process, they seek assistance from SBA  partner organizations, such as the Federal Contracting Center and Small  Business and Technology Development Center, to identify HUBZone  contract opportunities and connect with contracting officers. Firms’ representatives also said that they attend conferences and  matchmaking events at which they meet contracting officers; however,  they said that this approach has not yet helped them to obtain increased  HUBZone set-aside contracts in Puerto Rico. One firm’s representative  said that the advice at networking events is that firms should approach  contracting officers, but small businesses do not have the contacts to  approach contracting officers. Representatives of some firms said that  SBA should act as an advocate or facilitator to provide connections  between small businesses and contracting officers. Some of the firms’  representatives noted that in the absence of HUBZone set-aside  contracts, they tend to pursue subcontracts with companies that have  prime federal contracts. Award of Contracts to Firms  Outside of Puerto Rico Representatives of two economic development organizations we  interviewed said that most HUBZone set-aside contracts and most of the  hurricane relief-related contracts performed in Puerto Rico were awarded  to firms outside Puerto Rico. In 2017, we similarly reported that  representatives from four associations stated that challenges such as lack  of access to contracting officers and difficulty meeting procurement  requirements led to concerns about contracts being awarded to  businesses located outside of Puerto Rico for work to be performed in  Puerto Rico. Representatives of firms and one economic development organization  also pointed out that for some industries, work does not need to be  physically performed at the contract location; therefore, Puerto Rican  HUBZone firms could be competitive for contracts located in other states.  According to firms and one economic development organization, this is  especially true in the technology industry, which is well represented in  Puerto Rico with multiple HUBZone firms. However, representatives of  the Puerto Rican technology firms we contacted noted that they have  experienced great difficulty obtaining HUBZone contracts. One firm’s  representative suggested that this challenge might be partially due to  Puerto Rican firms having less experience than firms outside of Puerto  Rico in competing for HUBZone set-aside contracts. To compete for  contracts, one firm said that its chief executive officer permanently moved  to Washington, D.C., and another firm said its staff travels to Washington,  D.C., once a month. Procurement Center  Representative Based in  Puerto Rico May Help  Address Some Challenges  Faced by HUBZone Firms  in Puerto Rico In 2018, SBA established a PCR in Puerto Rico and SBA officials said the  agency expects that the PCR will help address some of the challenges  discussed previously. SBA PCRs work with federal agencies and small  businesses to identify contracting opportunities for small businesses.  The Puerto Rico PCR said that she plans to hold events for HUBZone  firms to help them better understand and navigate the federal contracting  process. For example, she plans to hold a Federal Acquisition Regulation  “boot camp,” a 40-hour training to educate firms on the federal contracting  process. She also stated that through regular interaction with other PCRs  and with contracting officers, she can identify and discuss opportunities  for HUBZone set-aside contracts for Puerto Rican small businesses. One  economic development organization we interviewed said that it is too  early to see an effect of the new Puerto Rico PCR, but that they have met  with her and have been encouraged by her efforts to date. In 2017, we reported that several stakeholders identified the lack of an  SBA PCR in Puerto Rico as a disadvantage for small businesses in  Puerto Rico seeking contracts with the federal government. According  to a representative from the Federal Contracting Center that we  interviewed in 2017, having a PCR in Puerto Rico is important because  the PCR can advocate for small businesses there. For example, the PCR  can work with contracting officers to determine small business set-asides,  make adjustments to procurement requirements, and make agency  contracting officers more aware of businesses in Puerto Rico. According  to one economic development organization’s representative, the PCR  could assist local businesses and promote businesses located in Puerto  Rico to federal agencies. Conclusions Our review of a sample of 12 case files for Puerto Rican firms certified  between March 2017 and March 2018 found that SBA lacked complete  documentation for one of two requirements we reviewed and did not  consistently follow its own procedures for quality control reviews when  approving firms. This suggests potential gaps in internal controls for both  the certification and recertification processes, as SBA reviews firms’  compliance with program requirements at both certification and  recertification. Although SBA policy includes documentation reviews and  a quality control process, its internal policy manuals do not reflect all  document review procedures, and analysts did not always follow  procedures for quality control reviews. SBA has not updated its policy  manuals and, it is not known to what extent it has reviewed staff  compliance with the quality review procedures. Although SBA provided an  assurance letter stating its internal controls are effective, the letter did not  describe steps taken in the evaluation. Documenting all procedures would  help ensure that analysts consistently follow policy when certifying and  recertifying firms. Documented reviews of staff compliance also could  serve to identify and remediate any noncompliance with certification and  recertification processes. Both actions would serve to strengthen the  verification function in the HUBZone program, which is necessary to help  ensure that only eligible firms participate in the program. Recommendations for  Executive Action We are making two recommendations to SBA. Specifically:  The Administrator of SBA should update the agency’s internal policy  manuals for certification and recertification reviews to reflect existing  policies and procedures not currently in written guidance.  (Recommendation 1) The Administrator of SBA should conduct and document reviews of staff  compliance with procedures associated with HUBZone certification and  recertification. (Recommendation 2) Agency Comments  and Our Evaluation We provided a draft of this report for review and comment to SBA. In  response, SBA provided written comments, which are reproduced in  appendix III. SBA also provided technical comments, which we  incorporated as appropriate. SBA generally agreed with both of our  recommendations. However, SBA disagreed with three of our findings in  the draft report. In the draft report, we stated that SBA’s guidance for the certification  process requires firms to submit documentation so that SBA can verify  that a firm meets the employee residency requirement, including  documentation showing that each employee’s address is located in a  HUBZone, for employees claimed to be HUBZone residents. We noted  that documents were missing, illegible, or did not corroborate the  information claimed regarding at least one employee’s residency for 9 of  12 certifying firms that we reviewed. We also stated that in 5 of these 9  cases, the firm would not be eligible for HUBZone certification if the SBA  analyst had not counted such employees. In its comments, SBA stated  that it is only required to verify that no fewer than 35 percent of a  HUBZone firm’s employees reside in a HUBZone. SBA asserted that it  had sufficient documentation to conclude that at least 35 percent of each  firm’s employees resided in a HUBZone for each of the 12 firms we  reviewed. While SBA analysts may have addressed insufficient  documentation by following additional procedures, which are described in  the report, we found that these procedures were not documented in  SBA’s internal written policies for certifying HUBZone firms and analysts  did not document their use of these procedures in the case files we  reviewed. Therefore, we were not able to verify that SBA took such steps  to verify the employees’ addresses. In the draft report, we identified an inconsistency when reviewing the case  files for the only Puerto Rican HUBZone firm recertified between June  2017 and May 2018. Specifically, the firm reported on its application that  it had zero employees, but also claimed 19 of its employees lived in a  HUBZone. In its comments, SBA stated that these numbers came from a  program examination system that is no longer used by the agency and  therefore would not have been administratively correct to use in the 2017  recertification process. However, the file we received from SBA’s  HUBZone Certification Tracking System asks for such information and  had a response date noted as December 26, 2017. We recognize and  noted that the firm was not required to submit corroborating  documentation to verify employee information, because it was under the  $1 million threshold. However, SBA policy states that recertifying firms  must represent that the circumstances relative to their eligibility at the  time of certification have not materially changed. In this instance, SBA  recertified the firm when basic information obtained for the firm appeared  to be erroneous and did not indicate that the firm was in compliance with  the employee residency requirement. In the draft report, we stated that SBA did not consistently follow its  quality review procedures to complete three distinct levels of review when  approving the 12 Puerto Rican firms in our non-generalizable sample for  certification. In its comments, SBA stated that while its legacy system, the  HUBZone Certification Tracking System, requires three levels of review,  its internal policies do not require that each level of review be performed  by different staff. However, SBA internal policies that we reviewed state  that the three levels of review should be conducted by different people,  specifically an analyst, a senior analyst, and the program director.  Furthermore, internal control standards state that management should  design control activities at various levels with a segregation of duties, and  periodically review its procedures and associated internal control activities  for effectiveness. We are sending copies of this report to congressional committees, the  Small Business Administration, and other interested parties. In addition,  this report will be available at no charge on GAO’s website at  http://www.gao.gov. If you or your staff members have any questions about this report, please  contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV. Appendix I: Objectives, Scope, and  Methodology Our objectives in this report were to (1) examine the Small Business  Administration’s (SBA) development of criteria and guidance on using a  risk-based approach for certifying and recertifying Historically  Underutilized Business Zone (HUBZone) firms, (2) examine SBA’s  implementation of the revised policies and procedures for firms located in  Puerto Rico, and (3) describe any economic impacts of HUBZone  expansion and recent trends in federal small business contracting in  Puerto Rico. To examine SBA’s development of its criteria and guidance for HUBZone  certification and recertification, we reviewed SBA’s policies and  procedures for certifying and monitoring HUBZone firms. To learn about  SBA’s risk-based approach, we interviewed officials at the headquarters  level responsible for certifying and recertifying HUBZone firms. We  reviewed prior GAO and SBA Office of Inspector General reports,  applicable statutes and regulations, and SBA documents. We also  compared the development of SBA’s certification and recertification  processes with federal internal control standards and relevant federal  guidance and statutes for managing fraud risk. To examine SBA’s implementation of the revised recertification processes  in Puerto Rico, we used SBA’s Dynamic Small Business Search database  to identify HUBZone firms located in Puerto Rico that received HUBZone  certification after March 27, 2017. We examined SBA’s document review  process for Puerto Rican firms that received HUBZone certification or  were due for recertification between March 2017 and March 2018. We  reviewed the case files for a non-generalizable sample of 12 firms that  received initial certification and two firms that were due for recertification  during this time period. We reviewed documents submitted by firms to  SBA as part of the initial certification process. But we were unable to  examine the document review component of recertification directly.  According to SBA officials, only two firms in Puerto Rico recertified  between March 27, 2017, and May 30, 2018, when we received the  applicant case files from SBA, and neither met the threshold of $1 million  in contract awards to trigger a full document review. From SBA’s small business database, we identified 443 firms in Puerto  Rico that had had HUBZone certification at any point as of March 12,  2018, and removed 350 firms that exited the program in order to review  only currently certified firms (leaving 93 certified firms). From this  universe, we identified 47 HUBZone-certified firms located in Puerto Rico  with a certification date later than March 27, 2017, after removing  duplicates. We chose a judgmental sample of 12 firms that we randomly  selected from the total of 47 firms using a random number generator. We  checked the city and industry of each of the 12 firms to confirm the firms  provided some geographical and industry variation. Results from this  sample are not generalizable to all HUBZone-certified firms. We examined the contents of the case files for each of the 12 firms, which  included the application the firm submitted through SBA’s HUBZone  Certification Tracking System and supporting documents that firms  submitted to corroborate their eligibility, including proof of office location,  payroll documentation, HUBZone maps, and employees’ identification  such as driver’s licenses. We compared the case file contents to SBA’s  guidance on which documents firms must submit and internal guidance  for analysts reviewing applications. To determine which documents to review, we compared SBA’s list  of required documents for certification to those required at  recertification and identified which are similar. We reviewed SBA  analysts’ notes, which are recorded in the HUBZone tracking  system to verify that they reviewed the documents to determine  the firms’ eligibility. We also reviewed any emails exchanged  between SBA and the applicant to identify cases in which SBA  requested follow-up from the firm. We reviewed the name of the SBA analyst who completed each  level of review, as indicated in the tracking system file, to  determine whether SBA followed its policy of completing three  levels of review. We also reviewed the tracking system files to  verify the final approval and whether SBA sent the certification  notice to the firm. We compared these files to SBA’s internal  policy manuals. To describe any economic impacts of the expansion of the HUBZone  program in Puerto Rico, and to describe recent federal contracting trends,  we used SBA’s small business database and federal procurement data  from the Federal Procurement Data System-Next Generation. We  analyzed the number of firms in designated HUBZones in Puerto Rico  and the amount of federal contract obligations awarded to the firms from  fiscal year 2006 through June of fiscal year 2018—that is, from the  starting point for the analysis we used in our 2017 report to the most  recent available data at the time of our current review. We assessed the  reliability of the two databases by reviewing database guides and prior  GAO work, and determined them to be reliable for the purposes of that  analysis. For all of the objectives, we also interviewed SBA officials in Washington,  D.C., and Puerto Rico and representatives from the Puerto Rico Chamber  of Commerce and the Federal Contracting Center. In addition, we  conducted a site visit to San Juan, Puerto Rico, in May 2018. There, we  conducted two discussion groups and one interview with representatives  from nine HUBZone firms located in Puerto Rico to obtain their  perspectives on the HUBZone certification process, federal contracting  opportunities, economic impacts of HUBZone expansion in Puerto Rico,  and economic impacts of the 2017 hurricanes. We invited every Puerto  Rican HUBZone firm to participate in the discussion groups and met with  the nine firms that responded to our email. The views of representatives  from these firms are not generalizable. We conducted this performance audit from February 2018 to September  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. Appendix II: Federal Contracting Trends and  Use of Socioeconomic Set-Asides in Puerto  Rico, Fiscal Years 2006–2018 This appendix provides information, based on our analysis of federal  procurement data, on small business contracting in Puerto Rico, including  the use of socioeconomic set-aside contracts and contracting by sector  and agency. Small Business  Contracting in Puerto Rico Annual federal contract obligations to small businesses in Puerto Rico  more than doubled from fiscal year 2015 through June 2018. Small  businesses in Puerto Rico also won a larger percentage of total federal  contracting obligations in Puerto Rico. Use of Socioeconomic  Set-Asides in Puerto Rico Although federal contract obligations to small businesses in Puerto Rico  sharply increased in recent years, obligations through set-aside contracts  for the Historically Underutilized Business Zone (HUBZone), 8(a)  Business Development, Women-Owned Small Business, and Service- Disabled Veteran-Owned Small Business programs remained relatively  unchanged (see fig. 4). The increases in federal contract obligations to  small businesses in fiscal years 2017 and 2018 came mostly through free  and open competition and awards reserved for small businesses that  excluding those for the 8(a), HUBZone, Women-Owned Small Business,  and Service-Disabled Veteran-Owned Small Business programs. HUBZone set-aside contract obligations increased from negative $20,881  in fiscal year 2016 to $3.8 million in fiscal year 2017 (1 percent of the total  value of small business contracts in Puerto Rico), but dropped to $1.7  million through June 2018 (0.2 percent of the total value of small business  contracts in Puerto Rico). Furthermore, 17.3 percent of the $21.9 million  in contract obligations awarded to Puerto Rican HUBZone firms in fiscal  year 2017 were through HUBZone set-aside contracts, and 3.3 percent of  the $50.5 million awarded in fiscal year 2018 (see fig. 5). Other  socioeconomic set-asides accounted for the highest share of obligations  awarded (76.6 percent in 2017 and 80.1 percent in 2018) and free and  open competition accounted for the rest (6.1 percent in 2017 and 16.6  percent in 2018). The fiscal year 2017 increase in federal contracting obligations in Puerto  Rico were not substantially tied to hurricane relief since Hurricane Irma  and Hurricane Maria hit Puerto Rico in September, the last month of the  fiscal year. One percent of total federal contracting obligations in Puerto  Rico and 1 percent of obligations awarded to Puerto Rican small  businesses were associated with hurricane relief (see table 1). However,  a significant portion of the increase in overall contracting and small  business contracting to Puerto Rican firms in fiscal year 2018 (through  June 2018) was related to hurricane relief. Specifically, 55.3 percent of  total federal contracting obligations in Puerto Rico and 64.3 percent of  obligation awarded to Puerto Rican small businesses were associated  with hurricane relief. Furthermore, 16.1 percent of HUBZone set-aside  contract obligations awarded to Puerto Rican firms were hurricane-related  through June 2018. Contracting in Puerto Rico  by Sector In fiscal years 2017 and 2018, overall federal prime contracting  obligations in Puerto Rico and those awarded to small businesses in  Puerto Rico were concentrated in the construction sector (about 25  percent in 2018), the manufacturing sector (about 20 percent in 2018),  and the administrative and support and waste management sector (about  36 percent in 2018). For contracts awarded using HUBZone set-asides  in Puerto Rico, the construction sector (about 52 percent in 2018), the  information sector (about 11 percent in 2018), and the health care sector  (about 37 percent in 2018) were most represented (see table 2). Contracting in Puerto Rico  by Agency Among federal agencies, the Department of Defense has awarded the  greatest percentage of overall federal prime contracting obligations,  obligations to small businesses, and HUBZone set-aside contract  obligations to firms located in Puerto Rico. Specifically, in fiscal year  2018, Department of Defense contract obligations represented 58 percent  of total obligations, 64 percent of obligations to small businesses, and 84  percent of HUBZone set-aside obligations to Puerto Rican firms (see  table 3). Although, Department of Homeland Security contract obligations  in Puerto Rico typically have represented less than 3 percent of total  obligations and less than 5 percent of obligations to small businesses in  Puerto Rico, those percentages increased to 21 percent and 23 percent,  respectively, in fiscal year 2018 due to hurricane-related contracts  awarded to Puerto Rican firms. Appendix III: Comments from SBA Appendix IV: GAO Contact and Staff  Acknowledgments GAO Contact William B. Shear, (202) 512-8678 or shearw@gao.gov. Staff  Acknowledgements In addition to the contact named above, Harry Medina (Assistant  Director), Chris Ross (Analyst in Charge), Tarik Carter, Lilia Chaidez,  Pamela Davidson, Erika Huber, Julia Kennon, John McGrail, John  Mingus, Barbara Roesmann, and Jena Sinkfield made key contributions  to this report.
The HUBZone program is intended to stimulate economic development in economically distressed areas. Certified HUBZone firms are eligible for federal contracting benefits, including limited competition awards such as set-aside contracts, and are required to be recertified every 3 years. The Puerto Rico Oversight, Management, and Economic Stability Act of 2016 required SBA to develop criteria and guidance for a risk-based approach to verify firm eligibility for the program and included a provision for GAO to review SBA's development and implementation of the required criteria and guidance. This report examines, among other objectives, (1) SBA's development of criteria and guidance on using a risk-based approach for certifying and recertifying HUBZone firms, and (2) SBA's implementation of the revised policies and procedures for firms located in Puerto Rico. GAO analyzed SBA documents and reviewed files of a non-generalizable sample of 12 firms located in Puerto Rico that received certification between March 2017 and March 2018. GAO also interviewed SBA officials, representatives from HUBZone-certified firms in Puerto Rico, and local economic development agencies in Puerto Rico. The Small Business Administration (SBA) adopted criteria and guidance for a risk-based approach to certifying and recertifying firms for the Historically Underutilized Business Zone (HUBZone) program in March 2017, but the extent to which it conducted a risk assessment to inform its approach is unclear. In 2009, in response to GAO's prior recommendations to address weaknesses in the HUBZone certification process, SBA increased documentation requirements for certification, but not recertification (which every 3 years determines continued program eligibility). In March 2017, SBA changed its recertification criteria and guidance to require firms with $1 million or more in HUBZone contract awards to provide documentation to support continuing eligibility. SBA officials stated they completed a risk assessment of the HUBZone recertification process, but as of July 2018, had not provided GAO with documentation on when they performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold. GAO previously found SBA lacked key controls for its recertification process and recommended in 2015 that SBA assess the process. GAO continues to believe that an assessment of the recertification process would help inform a risk-based approach to reviewing and verifying information from firms that appear to pose the most risk to the program. Based on GAO's review of case files for a non-generalizable sample of 12 firms in Puerto Rico that received HUBZone certification in March 2017–March 2018, SBA did not consistently document or follow its policies and procedures for certification reviews. SBA did not have complete documentation in 9 of 12 cases. SBA officials described alternative procedures they used to determine firms' eligibility, but SBA has not updated its internal policy manuals to reflect these procedures and analysts did not document use of such procedures in the files GAO reviewed. In 4 of 12 cases, SBA did not follow its policy to conduct three levels of review (by an analyst, a senior analyst, and the program director or deputy) when determining to approve or deny a firm. It is not known to what extent SBA reviewed staff compliance with certification and recertification review procedures. SBA provided an assurance letter stating it evaluated the Office of HUBZone's internal controls and concluded the controls were effective, but the letter did not specify what steps SBA took for the evaluation. Standards for internal control state management should document its control policies and conduct periodic reviews to ensure controls are effective. Because SBA has not updated its internal policy manuals or conducted a documented review of staff compliance with its quality review procedures, it lacks reasonable assurance that firms are eligible or its review process is effective. In turn, this increases the risk of ineligible firms participating in the HUBZone program and receiving contracting preferences to which they are not entitled.