PPP Loans

Your organization could be audited for taking a PPP Loan...

Are You Prepared For a PPP Loan Audit?

As a fellow entrepreneur, I understand that it has been a difficult year, to say the least.  As a result, the government has been trying to assist with the approval of the Paycheck Protection Program, and its respective acts.  I often wonder if organizations are aware of all the consequences of receiving the PPP loan funding, specifically from a records retention standpoint.  It appears that many PPP recipients will be asking for, and may even receive, forgiveness for the PPP loan.  I would like to warn the readers that if your organization has accepted PPP funding, it may be subject to an audit.  Also, it may be foolish to believe, that if forgiveness is granted, then an audit will not happen.  In all reality, we just don’t know yet, as it is too early to tell.  Therefore, any organization that has received PPP funding, should maintain their records responsibly.

Keeping records related to the PPP funding is two pronged. First, the organization had to submit the application and supporting records for the PPP application. Second, records must be maintained to prove how those accepted funds were spent to sustain the business or the purpose of the funding. The SBA has the right to ask for access to the business records, and an organization must ensure it maintains these supporting records, for a specific period of time. It is also important that organizations keep their business records in compliance with all Federal and State statutes. Earlier this year I attended a webinar, where it was announced that any organization that received over $2 million in PPP funding, should anticipate being audited. Therefore, if you received any PPP funding, it is reasonable for you to anticipate an audit as well.

Professionally, over the years, I have assisted many organizations with their records and information governance programs. Also, I have assisted many organizations with audits and litigation involving the production of records and information. Trust me, having auditors or lawyers show up to investigate the organization’s records can be a bit nerve racking. Therefore, I recommend having a plan on how the organization will ensure it has the necessary records, should an audit or investigation arise, as a result of receiving PPP funds. That plan should include the following seven points:

  1. Know the Purpose of the Loan: Be sure to address each area of the PPP “purpose of the loan”, as there are several, depending on how the application was submitted.
    • Payroll Costs If indicated that the primary reason for taking the PPP funds was payroll, ensure that all payroll records for the specific period of time are retained. Note that the loans are for 8-weeks or 24-weeks. Be prepared to provide payroll reports (in some cases this may be a third-party payroll service provider report), as well as proof of payment by providing bank statements, IRS payroll filings such as 941 forms, and State quarterly business and individual employee wage reporting, and unemployment insurance tax filings.
      • The SBA recommends using the Schedule A Worksheet, or equivalent, indicating each individual employee, their compensation, documentation of job offers and refusals to accept restoration of reductions in hours, firings for cause, voluntary resignations, written requests by any employee for reductions in work schedule, and any inability to hire similarly qualified employees for unfilled positions on or before December 31, 2020 (and this may be longer if a second round of PPP funding was involved).
      • Documentation supporting the certification, if applicable, that the borrower was unable to operate between February 15, 2020, and the end of the covered period, at the same level of business activity as before February 15, 2020, due to compliance with requirements established or guidance issued between March 1, 2020 and December 31, 2020, by the Secretary of Health and Human Services, the Director of the Centers for Disease Control and Prevention, or the Occupational Safety and Health Administration, related to the maintenance of standards of sanitation, social distancing, or any other work or customer safety requirement related to COVID-19. This documentation must include copies of the applicable requirements, for each borrower location, and relevant borrower financial records.
      • Documentation supporting the PPP Schedule A Worksheet “FTE Reduction Safe Harbor 2”. 1
    • Benefits Records: If indicated that the primary reason for taking the PPP funds was payroll, ensure that all group benefits records such as employer contributions, for health insurance and retirement plans, etc. and any proof of payment for those benefits, and those policies for the benefits, are retained.
    • Rent/Mortgage: If indicated that the loan funds are for rent or mortgage payments on the application, be sure to have the lender or lessor account statements, lender amortization schedule or lease agreement, and payment receipts or cancelled checks for the claimed period.
    • Benefits Records: If indicated that the primary reason for taking the PPP funds was payroll, ensure that all group benefits records such as employer contributions, for health insurance and retirement plans, etc. and any proof of payment for those benefits, and those policies for the benefits, are retained.
    • Utilities: If indicated that the reason for the loan funds was for business utility payments on the application, be sure to maintain utility invoices, payment receipts, cancelled checks or account statements for the claimed period.
    • Covered Operations Expenditures: For the second round of PPP, it could have been indicated that the funds were to be used for operations expenditures. This could include software licensing, cloud computing services, product or service delivery, processing of payroll, and other operational costs. Be sure to keep all records of expenses related to these costs such as invoices, payment receipts, cancelled checks and/or account statements verifying the costs.
    • Covered Property Damage: For the second round of PPP, it may have been indicated that the funds would be used to cover the costs associated to property damage, which may have been a result of the domestic violence or vandalism that occurred during 2020. Be sure to keep all records of expenses related to the repairs, such as invoices, payment receipts, cancelled checks and/or account statements, verifying that the repairs were paid for in total.
    • Covered Supplier Costs: If it was identified on the second round of PPP funding that the organization had supplier costs, such as expenditures for the supply of goods that are essential to the operation of the business, and are made pursuant to a contract, purchase order, or order that previously existed or with respect to perishable goods, in effect before or any time during the covered period, then you should keep those purchase orders, orders, contracts, invoices, receipts, cancelled checks and/or account statements verifying that those costs occurred.
    • Covered Worker Protection Expenditures: For the second round of PPP, the application may have indicated that the funding would cover the costs associated for providing workers with personal protection equipment (PPE) such as masks, dividers, etc. If that is the case, be sure to keep all records of expenses related to such equipment, including invoices, payment receipts, cancelled checks and/or account statements verifying that the equipment was purchased.
  2. Consider Engaging a Certified Records Manager: For taxes, accounting, and legal issues, organizations typically hire experts. So why would records be any different? Consider hiring someone who has a Certified Records Manager designation and over 10 years of experience in the records management field. The CRM designation ensures that you are working with a qualified expert in the field and is viewed by courts as having a responsible and reasonable approach. I’m not saying that all organizations need a full-time person for records, unless it is large and has complex records issues. Many consultants exist in this field and hiring an expert should be considered.
  3. Capture the Records: Ensure that there is a fool-proof way to capture all the records identified in number 1 above. This does not mean having to print out paper copies of everything. Most organizations today produce the bulk of their records electronically. In fact, electronic records have been accepted as legally defensible for many years, with few exceptions (like real property deeds). If the company’s records are electronic, ensure that they are retrievable and easily produced. It is not recommended that the organization rely on electronic data backups, for records retention purposes, as these backups are only meant for disaster recovery purposes. If those records are being kept in the cloud by a service provider, ensure that all the aspects of the contract with that vendor are understood, and that the organization owns, and can retrieve the records, in accordance with all necessary time frames. If records are physical and sent off-site, ensure that detailed inventories of all boxes exist, know where all those boxes are located, and how they will be retrieved. I don’t recommend co-mingling the contents of boxes either. Make sure they are sent off with only one record type per box (e.g., payroll records, operations records, etc.) if possible.
  4. Use Metadata (Information about Information): Be sure to identify the records by using metadata to tag them electronically or physically. Such tags would include the record type, the date ranges reflected, or the alpha ranges reflected in the records, along with the retention period needed. Further, have a way to use the metadata, to put these records on “legal hold”, as discussed next in number 5.
  5. Anticipate an Audit: I would argue that the pandemic, and the PPP, is a special situation that may warrant a “legal hold” status, because the organization has a reason to believe they may be audited by the SBA already. This sense of reasonable anticipation, has great legal precedence, and is a guiding rule in litigation. If a company knows that a client is unhappy, or knows that an employee is disgruntled, it should reasonably anticipate possible litigation, and not destroy any evidence/records. It is my belief that the same rule applies here, by applying for the PPP loan that is funded by the government (and possibly forgiven), any organization that received funding should anticipate an audit. If it does not happen, no harm no foul, but at least the company will be prepared.
  6. Know the Retention: The SBA is indicating that all these records should be retained for 6 years after the date of loan forgiveness, or the date that the loan was repaid in full. In the records management world, these are known as triggering events that start the clock ticking, and you must be able to produce these records, for the SBA, upon request. This timeframe supports the rule that the SBA has up to six years to audit the loans. Don’t forget that there are other requirements to be considered as well, like any Federal or State requirements. See the PPP Records Retention Guidance below, for a general listing of the records to be retained for the SBA, and the typical retention requirements.
  7. Have a Destruction Process: All records have a lifecycle and should be destroyed at some point. Those records subject to litigation, or audits, must be maintained for a specific timeframe (which usually means a trigger does not start until a much later date down the road). Be sure to keep all of your records in accordance with Federal and State regulations. Also, be sure to consider your business needs. If your business needs sales records for 10 years, and if Federal and State guidance only indicate 3 years, you should keep them for 10 years. Just don’t keep them indefinitely! Ensure the retention timeframes are identified and assigned to all records accordingly. This will help to lower your organization’s risk profile. Finally, destruction should only happen once the records have met their defined timeframe, and a destruction approval process should be in place. Make sure there is NO WAY any records can be destroyed, without a “C Suite” or “Owner” signing off as the responsible person who has authorization to approve destruction.

Keep in mind that maintaining complete records, on the repayment of a PPP loan, will be important as well. Knowing and managing the records and information your company has, is a guiding principle of any successful organization. After all the organization’s information may in fact be its #1 asset. Responsibly managing information can potentially drive success, and even build brand recognition. The records and information provided for the PPP application, as well as how the funding would have been spent to keep the business afloat, is no different. If your organization manages their records reasonably and responsibly, it will be prepared to respond to any audit, or requests, from the SBA.

1 “Updated Key Considerations for PPP Documentation under the Economic Aid Act”, January 27, 2021 https://www.schwabe.com/newsroom-publications-updated-key-considerations-for-ppp-documentation-under-the-economic-aid-act

Be Prepared! Get The PPP Records Retention Guide Here:

Our Specialties

Get In Touch For a Free Consultation

Records Management + Information Governance

Records Policy programs

Retention Schedule Development

Risk Assessments

Records inventory analysis

Inventories + Archiving