The $2 trillion economic relief package from Congress' Coronavirus Aid, Relief, and Economic Security (CARES) Act has been steadily infused into our economy since March. One well-known example of these stimulus funds is the Small Business Administration's (SBA) Paycheck Protection Program (PPP), through which over 4.9 million businesses received $521 billion in forgivable loans to help maintain payroll, rehire employees and cover rent and utilities. Compared to other government-backed loan programs, the speed with which lenders processed and approved PPP applications was unprecedented.

Early on, the government made clear its commitment to rooting out fraudsters attempting to pilfer PPP funds. In late April, Treasury Secretary Steven Mnuchin said the SBA would conduct a full audit of PPP loans over $2 million prior to forgiveness and that borrowers may face criminal liability if they make false loan certifications. Based on loan data released by the SBA and Treasury Department (as of June 30), a modest number of the 4.9 million PPP loans fall above the $2 million mark—approximately 294,000, or 0.6%. But the value of these loans is significant—over $10 billion—and underscores the importance of government monitoring and enforcement.

The government appears to be fulfilling its commitment to rooting out PPP fraud, even when the amount at issue falls below the $2 million threshold. On July 13, the Department of Justice announced charges against the owner of a Washington, D.C.-based residential construction contracting firm for allegedly submitting a fraudulent tax return and bogus Social Security numbers for fake independent contractors when applying for a $400,000 PPP loan. Similar cases have been brought against business owners in other parts of the country, including Georgia ($2 million loan), Florida ($22,000 loan) and Texas ($1.1 million loan). Notably, the SBA's Office of Inspector General worked closely with DOJ on these prosecutions, showing close coordination between the agencies for PPP-related fraud.

No matter the size of the loan, a company that obtained PPP funds is not immune from a possible government investigation or audit. Prior to forgiving loans, PPP lenders will require that borrowers provide documentation showing that the funds were used for authorized purposes. Borrowers have already started to submit loan forgiveness applications, and many more will be submitted in the weeks ahead. If at no other time, both lenders and the government will be scouring these submissions for red flags.

What Can a Business Do to Prepare for an Investigation Before It Happens?

Businesses that are focused on economic recovery in the midst of the COVID-19 pandemic may not be able to afford the time and costs associated with responding to a government investigation. These investigations can span years, may require locating and assembling thousands (sometimes millions) of documents and often drain resources from core business operations. Fortunately, the old adage is true here—an ounce of prevention is worth a pound of cure.

Here are three things every company can do today to save time and money before a government investigation begins.

• Segregate the funds. Segregate PPP loan proceeds from other revenue or loan sources to ensure that the funds do not commingle.  This will make it easier for lenders and the government to identify PPP loans during an audit or investigation and will minimize the need for third parties to comb through the business' other sources of capital. Opening or using a separate account can easily accomplish this task.
• Create a paper trail. Keep detailed records of all PPP loan expenditures. Electronic payments from the PPP-designated bank account may streamline this record-keeping, but it also be done manually or by a third party. No matter the method, businesses should be able to clearly trace the funds from their bank account to authorized uses, such as payroll and rent.
• Limit authorized access. Ensure that the number of individuals who can access the PPP funds are limited and that those individuals understand how the funds should be used. This will reduce the opportunity for inadvertent errors or intentional misuse of funds.

What Should A Business Do If It Finds a Problem?

After receiving CARES Act funds, no business owner wants to hear these fateful words: "We have a problem." But, if this happens, it is imperative that the company find the problem before the government does. Below are critical steps that every company can take:

• Scope the problem. Although the initial identification of the problem is important, the company should conduct due diligence to determine the depth and breadth of the underlying issue. For example, which departments or personnel appear to be at the heart of the issue? Does the problem appear to be a one-time incident (such as a one-time small payment to a vendor that does not fit within the authorized use requirements), or is there evidence of prolonged noncompliance?
• Conduct an internal investigation. After the company scopes the problem, the company should conduct its own internal investigation. By doing so, the company will be able to rigorously gather and assess information from company records, employees and other relevant sources of information to fully answer the questions noted above. This investigation also will help companies determine whether and how remedial steps should be taken.
• Don't go at it alone. Whether in-house or outside counsel, attorneys who have extensive investigations experience can be a valuable resource for companies that want to undertake an internal investigation. Counsel can discuss with companies whether and how to fix the problem and how to handle disclosure to the government, should it become necessary. This is particularly important for organizations that may have violated the terms of their CARES Act funding, as noncompliance implicates violations of federal law and may give rise to civil and criminal penalties.

Companies that have received CARES Act funds should take seriously their responsibility to comply with the funding terms, to proactively identify instances of noncompliance cand to respond swiftly, once these problems are identified. By doing so, companies will be able to reduce compliance and litigation risk while focusing on the CARES Act's intended purpose—preserving jobs and rebuilding critical operations.

Nekia Hackworth Jones is a partner at Nelson Mullins who counsels and represents companies in connection with government investigations, internal investigations, and business litigation.