Tips for a successful PPP audit

The Small Business Administration’s (SBA) Paycheck Protection Program (PPP) is a historic financial landmark and has served as a lifeline for small businesses during the COVID-19 pandemic. The nature of PPP loans, and the process for the borrower to request forgiveness of some or all of the loan proceeds, have created some unique audit challenges for the community banks that made those loans.

“The SBA’s goal was to get the funds out to businesses as quickly and efficiently as possible,” says James Kendrick, ICBA’s first vice president of accounting and capital policy. “Community banks had to get up to speed very quickly, with limited knowledge about exactly how the program would work. They pushed forward to address the challenges.”

Kendrick says community bankers anticipated early on that there could be issues related to audit for the loans. With the help of ICBA, bankers’ concerns were elevated, and the SBA clarified that a community bank needs to review documentation from borrowers for completeness and accuracy but is not responsible for independently verifying every aspect of the information.

“For example, the burden is on the borrower to provide payroll records. Banks should verify the use of a third-party payroll processor or obtain spreadsheets of payroll records,” Kendrick says. “However, the bank does not have to independently verify each employee.”

What’s included in an audit

Borrowers must provide the bank with narrative explanations, supporting documents, signatures and certifications. PPP audits should include comprehensive reviews for 1) borrower eligibility, 2) justification of loan amount, 3) supporting documentation for loan forgiveness, 4) acknowledgment that loan proceeds were spent for eligible purposes and 5) good faith certifications.

For each, community banks should document and maintain records that are applicable to each decision and calculations relied upon for requests for loans and forgiveness.

The audit scope should cover SBA’s interim final rules, frequently asked questions and procedures. ICBA has dedicated resources on its website for PPP Q&As, loan forgiveness and loan review, and has conducted a number of interactive webinars about PPP developments.

The SBA confirmed it will review every PPP loan greater than $2 million to determine loan forgiveness, but community banks are encouraged to review all PPP loan files regardless of loan amount.

“We should take the prudent approach and assume every loan could be subject to review or scrutiny,” Kendrick says. “We’ve learned from bankers that many small-dollar loan forgiveness requests have been held up pending review, and there already have been instances in which PPP loans have been reviewed and have not been fully forgiven.”

He notes that policy and procedure changes were needed, such as whether a bank would lend to customers or noncustomers and adherence to regulatory rules. The loans and resulting deposits have caused some bank balance sheets to become quite large, and some have bumped up against loan-to-deposit and regulatory capital ratios. Management should be prepared to articulate to auditors and regulators the flow of PPP funds and their impact.

“It’s important for community banks to gather and maintain robust documentation from applicants and borrowers to support applications for PPP loans and forgiveness.”

—James Kendrick, ICBA

Working with borrowers

While many PPP loan applicants are current bank customers, some were new customers. The energized environment surrounding PPP lending and the pandemic in general should heighten a community bank’s attention to potential compliance issues, such as customer due diligence and identification, suspicious activity and fraud prevention. The SBA offers guidance specific to the Bank Secrecy Act (BSA) and anti-money laundering (AML) in its frequently asked questions.

The onus is on borrowers to show that they qualify for loan forgiveness. Community banks should ensure loan files are fully documented to prepare for and process loan forgiveness requests. Borrowers must submit documentation and certifications; falsified records expose them to investigation and possible prosecution.

The Department of Justice investigates, and the SBA audits, companies and individuals who qualified for—or attempted to qualify for—PPP money for which they were not legally entitled. The focus is to confirm true and accurate borrower certifications. That may include the number of employees, the amount of the borrower’s payroll and whether the loan was necessary to support ongoing business operations. While SBA guidance in its interim final rules states that lenders may rely on borrower representations, community banks need to ensure that files include supporting documentation for the borrower’s certifications.

Prior to the PPP, community banks were funding 60% of small business loans across the country. According to SBA data, community banks provided $2.8 million in PPP loans. That’s 57.5% of all PPP loans and 48.1% of all the PPP loans that went to U.S. small businesses. These loans made it to businesses in communities of all kinds, including 98.2% of low-income or economically distressed counties, 96.6% of rural counties and 92.4% of urban counties.

“It’s important for community banks to gather and maintain robust documentation from applicants and borrowers to support applications for PPP loans and forgiveness,” Kendrick says. “Loan reviews and internal audits should cover all loans regardless of size.”