The Small Business Administration got back less than 1 percent of the overpayments it flagged for recovery last fiscal year, and it does not run recovery audits at all on its two main non-pandemic loan programs. That is the central finding of a Government Accountability Office report to the Senate Committee on Small Business and Entrepreneurship (GAO-27-107701), dated October 2026 and publicly released November 9. GAO found that SBA identified $616.2 million in overpayments for recovery in fiscal 2025, while agencies across the government recovered 62 percent of theirs.
The report covers four programs: the Paycheck Protection Program (PPP), the COVID-19 Economic Injury Disaster Loan (EIDL) program, the 7(a) loan guaranty program and standard EIDL. For fiscal 2025, agencies reported about $186 billion in improper payment estimates, including about $2 billion for the SBA programs GAO examined.
How SBA Collected Less Than 1 Percent of $616.2 Million
GAO's numbers line up with what SBA reports on its own page at PaymentAccuracy.gov. That page lists $616.18 million in overpayments identified through recovery activities, $3.81 million recovered, and a recovery activities recovery rate of 0.62 percent.
SBA told GAO it recovers overpayments in other ways. On a loan with an overpayment, for example, part of the overpayment comes back with each regular loan payment. GAO put the result bluntly: "However, SBA recovered less than 1 percent of the $616.2 million in overpayments it identified across its programs in fiscal year 2025, compared to 62 percent government-wide."
On PaymentAccuracy.gov, SBA defends its approach by pointing to earlier cost studies. The agency writes that "In prior years, SBA has conducted cost-benefit analysis on programs subject to payment recapture audit and deemed the cost to perform a payment recapture audit outweighed the benefits of the audit." SBA adds that it "makes every effort to recover any improper payments identified through the improper payment review process or other internal review process," and says it "anticipates having a more outlined process in FY 2027."
Why 7(a) and Standard EIDL Skip Recovery Audits
The Payment Integrity Information Act of 2019 requires agencies to estimate improper payments in programs at risk and to run recovery audits when doing so is cost-effective. GAO describes recovery audits as reviews of accounting and financial records meant to find and recover overpayments. According to GAO, SBA has determined that recovery audits would not be cost-effective for any of the four programs.
The issue GAO raises is how old those decisions are. For 7(a) and standard EIDL, the report says, SBA "had not reevaluated these decisions for 10 years and 15 years, respectively." SBA's standard EIDL decision dates to 2011. At the time, SBA concluded that borrower repayment would recover overpayments and that collateral on most standard EIDLs would help. For 7(a), SBA told GAO in March 2026 that it had recently decided again that recovery audits would not be cost-effective. Before that, its last review was in 2015, when SBA officials said a recovery audit they conducted was not cost-effective because its cost exceeded the return.
GAO argues that interest rates, collateral requirements and other cost factors "have changed over the past 10 to 15 years," and that SBA has no process that tells it when to take another look. SBA decided in November 2023 that recovery audits would not be cost-effective for PPP and COVID-19 EIDL, because it was already running other recovery activities.
Where SBA's Improper Payment Estimates Fall Short
GAO reviewed SBA's estimates for fiscal years 2020 through 2024 and found they met the Office of Management and Budget's basic statistical requirements. "However, SBA did not document the basis for key decisions it made to develop those estimates," the report says. One example is the agency's assumption that small and large loans are equally likely to be improper.
SBA also did not consider whether its PPP and COVID-19 EIDL estimates reflected known fraud risks. GAO says the criteria SBA used to select improper payment samples did not include fraud or suspected fraud. GAO concluded that SBA "cannot be sure that its estimates accurately reflect improper payment risks."
The pandemic figures are large. GAO's Table 1 lists a PPP loan approval improper amount of $29,027.0 million for fiscal 2022, a 4.2 percent rate. PPP loan forgiveness shows $18,738.3 million in fiscal 2023, a 40.5 percent rate, and $379.1 million in fiscal 2024, at 25.2 percent.
Oversight bodies have pointed to the same weaknesses. GAO notes that SBA's Office of Inspector General reported the agency was not compliant with the Payment Integrity Information Act for both fiscal 2024 and fiscal 2025, in part because of issues affecting the reliability of its estimates.
Which GAO Recommendations SBA Rejected
GAO made four recommendations to SBA:
- Validate that SBA's sampling and estimation decisions reflect how improper payment risk is distributed in each program.
- Make sure estimation plans consider known fraud risks and the possible scale of fraud.
- Set up a process that triggers new cost-effectiveness reviews of recovery audits for 7(a) and standard EIDL.
- Apply relevant federal guidance and GAO's key factors when choosing recovery options.
SBA disagreed with the first two. On the first, SBA said it reviews its methodology every year, sends revised plans to OMB for approval, and that the independent auditor used by the OIG has not cited findings on these choices. GAO replied that OMB approval "does not address the concern underlying our recommendation," because agencies, not OMB, are responsible for making sure their estimates are accurate. On the second, SBA argued that the pandemic relief programs were abnormal because of how fast they were enacted and disbursed. SBA agreed with the third and partially agreed with the fourth. In GAO's words: "SBA disagreed with the first two recommendations and agreed or partially agreed with the others. GAO maintains the recommendations are valid, as discussed in the report."
What It Means for Contractors
Firms that work on payment integrity, such as recovery audit contractors, statistical sampling specialists and fraud analytics vendors, should note that SBA agreed to establish a process to periodically monitor risks in standard EIDL and 7(a) and reevaluate whether recovery audits are cost-effective. If those reviews lead SBA to reverse its 2011 and 2026 decisions, it could start buying recovery audit services, though nothing in the sources says that will happen. Combined with SBA's statement that it anticipates "a more outlined process in FY 2027," that makes SBA's fiscal 2027 payment integrity planning worth tracking.
For 7(a) lenders and their servicing partners, the report signals more scrutiny of how SBA identifies and collects overpayments on guaranteed loans. SBA's disagreement on fraud risk also suggests PPP and COVID-19 EIDL estimates may stay disputed between the agency, its inspector general and GAO. Watch SBA's next annual financial report and the next PIIA compliance review of SBA.
