Paycheck Protection Program Audits Are Upon Us—Borrowers Prepare!


By Merle M. DeLancey Jr., Craig Stetson, and Jennifer A. Short

Published in the July 2021 edition of Pratt’s Government Contracting Law Report (Vol. 7, No. 7), an A.S. Pratt Publication, LexisNexis

In our last post on this topic, we touched on how the acceptance, use, and forgiveness of Paycheck Protection Program (“PPP”) loans can be viewed in the context of a Defense Contract Audit Agency (“DCAA”) audit. This post focuses on audits and investigations involving PPP loans. Close scrutiny of PPP loans is not a prediction; it is reality. The Small Business Administration (“SBA”) has announced it will audit all PPP loans in excess of two million dollars following a lender’s submission of a borrower’s loan forgiveness application, and it reserves the right to “spot check” any PPP loan of a lesser amount at its discretion. The Department of Justice has already charged multiple individuals with PPP fraud. And this is just the beginning of what many think will be a tidal wave of enforcement activity involving PPP loans.

Overview of the PPP

The PPP is the largest relief measure for small businesses under the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”). The government has made available nearly one trillion dollars in PPP relief funds through four separate funding measures ($349 billion via the CARES Act; $310 billion via the PPP and Health Care Enhancement Act; $284 billion via the Consolidated Appropriations Act of 2021; and $7.25 billion via American Rescue Plan Act of 2021).

The PPP makes available guaranteed SBA loans to small business that meet certain eligibility requirements. In addition, PPP loans can be forgiven fully if used properly to cover specified business expenses such as payroll, rent, utilities, mortgage interest, and other limited uses. As of April 11, 2021, the SBA had approved more than 9.5 million loans totaling more than $755 billion using more than 5,400 lenders.

PPP Loan Recipients Are Ripe for Audit

The SBA Office of Inspector General (“SBA-OIG”) and the Government Accountability Office (“GAO”) have flagged PPP loans as fertile hunting ground for fraud. First, because the loans are fully guaranteed by the government, lenders may exercise less diligence in originating the loans. Second, the unprecedented volume of loans, lenders, and loan amounts makes monitoring extremely difficult. Third, the speed at which PPP loans were processed and approved made it more difficult for lenders and the SBA to identify red flags in loan applications. All of these factors suggest an increased potential for fraud.

GAO has been sounding the alarm about PPP loan risk for nearly a year, echoing the SBA-OIG’s concerns. GAO included the PPP on its latest “High Risk List” as a troubled federal government program in need of significant improvement. Since June 2020, GAO has recommended that SBA develop and implement plans to identify and respond to risks in the PPP to address possible fraud. Those recommendations extend to loans of less than two million dollars, which rely on borrowers’ self-certifications, leaving the PPP vulnerable to exploitation.

Areas Auditors and Investigators Likely Will Scrutinize

With that background, there are numerous areas on which PPP auditors and investigators are likely to focus, including whether borrowers met all of the PPP loan eligibility requirements. PPP applicants need to be careful in making the multiple certifications required to obtain a loan. Some eligibility requirements have changed from Round 1 (First Draw), Round 2 (Second Draw), and Round 3 of PPP funding. The good news is that many eligibility requirements were eased. For example, Round 3 expanded lending to some who were previously precluded from applying, including: small business owners with non-fraud related felonies, those with delinquent federal student loans, and non-citizen lawful U.S. residents. Even so, applicants need to be mindful of the program requirements and exclusions so as to avoid making false statements or certifications.

Some eligibility requirements are objective and easily tested by auditors or negotiators. For example:

  • Having 500 or fewer employees to be eligible for Round 1 funds (lowered to 300 or fewer employees for Round 2 loans);
  • The business has been in operation since February 15, 2020, and has not permanently closed;
  • The company has not filed for bankruptcy protection; and
  • The applicant does not have other pending PPP loans, or has not received duplicative PPP loans.

Other eligibility requirements are more subjective in nature. For example, an applicant’s certification that the “uncertainty of current economic conditions” makes the loans “necessary” was the subject of much debate last year, when businesses that reportedly had access to other lines of capital were able to obtain large PPP loans. The SBA announced that it will be reviewing loans of two million dollars and more to assess whether this certification was made in good faith at the time borrower applied for a PPP loan. But, at the end of the day, SBA officials admit that this certification is largely subjective. Time will tell whether the agency takes action to demand loan repayment based on this certification requirement.

Finally, remember: in addition to the PPP-specific eligibility and certification requirements, the usual SBA rules regarding small business status and affiliation also apply.


Thus far, Department of Justice (“DOJ”) and SBA-OIG enforcement actions involving the PPP have focused on low-hanging fruit, where loan applicants have patently lied on their applications (e.g., inflating payroll expenses or applying on behalf of companies that do not exist) or used PPP proceeds for improper purposes (e.g., purchasing real estate, cars, and luxury items). In some cases, applicants resorted to submitting fake tax records, creating “dummy” payroll and business income records, and stealing personal identification information from unsuspecting victims.

Over time, auditors and investigators will likely use more sophisticated methods to identify fraudulent PPP activity. DOJ has said that it is using data analytics to identify redundant personally identifiable information across multiple PPP applications, to flag inconsistencies between PPP applications and data in other government databases, and to identify the repeated use of information across applications such as identical supporting documents and bank accounts.

To date, more than 120 defendants have been charged with criminal offenses related to the PPP program. As of December 2020, DOJ had initiated 66 criminal fraud investigations involving over $250 million in PPP loans. DOJ has charged unscrupulous borrowers with a range of offenses, including bank fraud, wire fraud, false statements, false claims, and money laundering.

In addition to potential criminal liability, DOJ has signaled its willingness to pursue civil penalties against those who manipulate or misuse the PPP. The first civil settlement of an alleged PPP fraud was announced in January 2021. That case involved a borrower who misreported its bankruptcy status on its PPP loan applications, but subsequently disclosed the error—and returned the $350,000 in loan proceeds. Nonetheless, the government pursued claims under the False Claims Act (“FCA”) and the Financial Institutions Reform, Recovery, and Enforcement Act (“FIRREA”), asserting that the borrower faced legal exposure under those statutes of more than four million dollars.

PPP Whistleblower Complaints

In addition to enforcement efforts initiated through government oversight, private citizen whistleblowers are another likely source of enforcement activity. In the fall of 2020, SBA-OIG reported that it had received 42 times the number of calls to its fraud hotline compared to the previous year. In addition, the FCA allows whistleblowers to file lawsuits on behalf of the United States against those who allegedly have engaged in fraud against the government. Those cases are filed under seal while DOJ investigates whether and how to proceed. Anecdotal information from attorneys who regularly represent whistleblowers and the DOJ attorneys who handle these investigations suggests that a fair number of the FCA cases filed in the last year relate to COVID-relief programs, including the PPP.

Companies Should Prepare Now to Mitigate Risk

Companies that have received, or might apply for, a PPP loan can take several steps now to prepare for a potential government audit, review, investigation, or enforcement action:

1. Document, Maintain, and Organize Relevant Records

If not already done, companies should collect and organize the information necessary to defend a government audit or investigation of its PPP loan. Such information includes: 

  • Records supporting a company’s determination that the loan is necessary to support the company’s ongoing business operations. Additional eligibility requirements were created under the Economic Aid Act for second-draw PPP loans, including the 25 percent revenue decline test. Documenting a company’s reasonable and good faith judgments in connection with its representations and certifications in loan applications can help reduce exposure.
  • E-mails and other communications with lenders.These communications may help establish a company’s state of mind and demonstrate that it acted in good faith. Companies should be aware of the eligibility and certification requirements that were in effect at the time they submitted their PPP loan application and forgiveness application, and be able to explain their understanding of any ambiguous or conflicting instructions.
  • Records of how any received funds are used.Best practices would segregate PPP loan proceeds into a separate account or accounting categories so the company can easily demonstrate that the funds were applied to appropriate, covered expenses.

2. Monitor Corporate Spending of PPP Loan Proceeds

Companies should be mindful of all corporate activity after receiving any federal assistance. Following the financial crisis of 2007–2008, several firms that received federal assistance came under scrutiny for throwing “lavish” parties and other activities. Company spending, pay increases, outsourcing, and other activities will all be closely scrutinized.

PPP loans are intended to assist businesses in covering specific categories of expenses during the COVID-19 crisis. While segregation of funds is not required by the SBA regulations or guidance, as a best practice, companies should separate their PPP loan proceeds either by account or category, and be able to trace how and when those funds were used for the designated business expenses.

3. Treat Your PPP Loan Like a Government Contract (Because It Is)

Companies should document any government modifications or waivers of requirements and ensure they are authorized in writing by a government official or agency with sufficient authority to act. Have effective reporting systems in place to receive notice of potential compliance issues and then investigate them appropriately.

Put in place mechanisms to implement any new guidance issued by the government (such as the SBA’s guidance related to the forgiveness of PPP loans related to payroll and non-payroll expenses). A robust compliance program is a crucial part of preparing for and responding to any government scrutiny of the receipt and use of government funds.

Notwithstanding all of the activity around the PPP over the last year, audit and enforcement activity is in its infancy and the government’s approach is evolving. For example, while the SBA has said that, if it reviews a PPP loan and finds that the borrower was ineligible based on its necessity certification, it will not refer the matter for enforcement if the borrower repays the loan. On the other hand, even where a borrower paid back a loan in full, DOJ still pursued FIRREA and FCA penalties.

Because so much uncertainty still exists, diligent borrowers are advised to remain vigilant about creating and maintaining contemporaneous notes and records that can assist in responding to any government audit or inquiry that may be on the horizon.

Merle DeLanceyMerle DeLancey is a partner with Blank Rome LLP where his practice focuses on a wide variety of government procurement law. He represents clients contracting with federal and state governments, with an emphasis in the healthcare industry. Merle has experience in a broad spectrum of government contracting issues and litigation. He can be reached at or 202.420.2282.


Craig StetsonCraig Stetson is a partner with Capital Edge Consulting where he focuses on assisting contractors interpret and apply the accounting and regulatory compliance requirements associated with federal government contracts. Craig routinely deals with a wide range of compliance matters related to accounting, pricing, contract administration, business systems, financial reporting and interpreting the requirements of the Federal Acquisition Regulation (“FAR”) and Cost Accounting Standards (“CAS”). Craig frequently speaks and writes on a wide variety of government contracting compliance matters, regulatory updates and current events.


Jennifer ShortJennifer Short is a partner with Blank Rome LLP’s White Collar Defense & Investigations group. She has broad experience in the public and private sectors with government and internal investigations, particularly related to government contractors and healthcare providers. Jennifer advises clients about how best to manage the risks of government enforcement, whether through disclosures, compliance counseling, or litigation, and always with an eye towards the client’s overall business objectives and needs. She can be reached at or 202.420.2698.