Complete Guide to PPP Audit Defense

A PPP audit is a formal review of your Paycheck Protection Program loan by the U.S. Small Business Administration (SBA), the Department of Justice (DOJ), or the SBA Office of Inspector General (OIG). The purpose is to determine whether you were eligible for the loan, whether you used funds according to program rules, and whether your forgiveness application was accurate.

There are three distinct levels of PPP scrutiny, and understanding which one you face is critical to determining your response:

The critical distinction is this: an SBA loan review is an administrative process with relatively limited consequences. A DOJ investigation or False Claims Act case is a legal proceeding that can destroy your business, your personal finances, and your freedom. Knowing which category you fall into determines everything about your defense approach.

PPP audits do not happen randomly. The SBA and DOJ use specific criteria and data-driven approaches to identify loans for review. Understanding these triggers helps you assess your own risk level and prepare accordingly.

Automatic Triggers

Secondary Risk Factors

Beyond the automatic triggers, several factors increase your likelihood of being selected for review:

• Multiple PPP loans across related entities (especially if employee counts overlap)
• Businesses formed shortly before the PPP application period (2020)
• Significant changes in reported employee count between application and forgiveness
• Use of funds that don't clearly align with the 60/40 payroll-to-expenses ratio
• Prior SBA loan defaults or compliance issues
• Loans processed by lenders under enhanced scrutiny (certain fintech lenders)
• Geographic concentration in areas with high PPP fraud rates
• EIDL loans in addition to PPP (cross-referencing between programs)

If your loan is selected for SBA review, here is what the process looks like from start to finish. Understanding each stage helps you prepare appropriate responses and avoid escalation.

The False Claims Act (31 U.S.C. §§ 3729-3733) is the federal government's primary tool for recovering money obtained through fraud. In the context of PPP loans, the FCA creates exposure that goes far beyond simply repaying the loan.

What the False Claims Act Means for PPP Borrowers

When you signed your PPP loan application, you made certifications to the federal government about your business eligibility, employee count, payroll costs, and intended use of funds. If any of those certifications were inaccurate — even if you believed them to be true at the time — you may face FCA liability.

The Qui Tam Threat

Perhaps the most dangerous aspect of FCA exposure for PPP borrowers is the qui tam provision. This allows private citizens — called "relators" — to file lawsuits on behalf of the government. The relator receives 15-30% of any recovery, creating powerful financial incentives for former employees, business partners, accountants, or competitors to report suspected PPP fraud.

Qui tam cases are filed under seal, meaning you may not know a lawsuit exists against you for months or even years while the DOJ investigates. By the time you learn about it, the government has already built its case using your own records, bank statements, and tax filings.

For a deeper understanding of False Claims Act defense strategies specific to PPP cases, see our FCA Defense Resource Hub.

When a PPP case moves beyond administrative SBA review into a DOJ or OIG investigation, the dynamics change completely. You are no longer dealing with a bureaucratic process — you are facing federal law enforcement with the full power of the United States government.

The DOJ PPP Strike Force

In 2021, the DOJ created the COVID-19 Fraud Enforcement Task Force, which includes a dedicated PPP Strike Force. Under the Vance DOJ, this task force has been expanded and given additional resources. As of 2026, the Strike Force has:

• Charged over 3,500 defendants with PPP-related fraud
• Recovered billions in fraudulently obtained PPP funds
• Referred 562,000+ unforgiven PPP loans to U.S. Treasury for collection
• Signaled continued aggressive enforcement through the full statute of limitations period
• Partnered with the FBI, IRS-CI, and USPS Inspection Service for investigations

Signs You Are Under Investigation

Unlike an SBA loan review, a federal investigation may not announce itself clearly. Watch for these indicators:

Criminal vs. Civil Exposure

Effective PPP audit defense is not about hiding information or obstructing the process. It is about understanding the rules, organizing your evidence, and presenting your case in the most favorable light possible while protecting your legal rights.

Strategy 1: Document Everything — Now

The single most important thing you can do is organize your documentation before you need it. This includes:

• Original PPP loan application and all certifications signed
• Payroll records for the covered period (8 or 24 weeks)
• Bank statements showing fund disbursement and use
• Tax returns (Form 941, Schedule C) for relevant periods
• Employee records (hire dates, termination dates, compensation)
• Rent/lease agreements and mortgage statements
• Utility bills paid during the covered period
• Forgiveness application and all supporting calculations
• Any correspondence with your lender about the PPP loan
• Business formation documents and ownership records

Strategy 2: Understand the Program Rules

Many PPP borrowers are surprised to learn that the program rules were more nuanced than they understood at the time of application. Key areas where borrowers commonly have defensible positions include:

Strategy 3: Know Your Rights

Whether you are facing an SBA review or a DOJ investigation, you have constitutional and statutory rights:

• Right to counsel at every stage of the process
• Right to remain silent (5th Amendment) in criminal investigations
• Right to appeal SBA determinations through OHA
• Right to challenge the adequacy of qui tam complaints
• Right to present mitigating evidence and context
• Right to negotiate settlements before trial

Strategy 4: Consider Voluntary Disclosure

In some cases, proactively returning PPP funds or making a voluntary disclosure to the SBA can significantly reduce your exposure. The DOJ has historically treated voluntary disclosures more favorably than cases discovered through investigation. However, this strategy must be carefully evaluated with legal counsel — voluntary disclosure is not appropriate in every situation and can sometimes create additional exposure.

Understanding the timeline of PPP enforcement is critical for assessing your ongoing risk. Many borrowers mistakenly believe that because their loan was forgiven years ago, they are safe. This is incorrect.

Key Dates and Deadlines

Why "It's Been Years" Doesn't Mean You're Safe

The False Claims Act has a unique statute of limitations structure. Under 31 U.S.C. § 3731(b), a civil FCA action may be brought within the later of:

• A.6 years after the date of the violation, OR
• B.3 years after the date when the government knew or should have known about the violation, but no more than 10 years after the violation

Because many PPP fraud cases are only now being discovered through data analysis, whistleblower tips, and cross-referencing with tax records, the 10-year outer limit is the operative deadline for most borrowers. This means enforcement actions can continue through 2030-2031.

Additionally, qui tam cases filed under seal toll the statute of limitations while the case remains sealed. A relator could have filed a case in 2022 that remains sealed in 2026, with the SOL paused during that entire period.

Regardless of whether you have received any communication from the SBA, DOJ, or OIG, there are immediate steps every PPP borrower should take to protect themselves.

In our experience working with PPP borrowers facing audits and investigations, these are the most common — and most costly — mistakes people make: