by David Wright

On September 23, SBA and IRS announced a new enforcement step involving pandemic-era PPP and COVID EIDL data. Legitimate borrowers should not panic—but they should make sure their loan, tax, payroll, banking, forgiveness, and supporting records can be located and reconciled.

Key takeaway

A discrepancy is not automatically fraud. Good records let a business explain what happened, support what was reported, and respond efficiently if an agency, lender, accountant, or attorney needs documentation.

What SBA and IRS announced

On September 23, 2026, the U.S. Small Business Administration said it had earlier referred more than $200 billion in suspected PPP and COVID EIDL fraud to the IRS. According to the agencies’ announcement, an IRS comparison of tax information borrowers provided to SBA when applying for pandemic relief loans with information reported to the IRS identified discrepancies associated with approximately $100 billion in loans, and the IRS opened examinations to determine whether additional taxes or penalties may apply.

The announcement repeatedly describes suspected fraud and discrepancies. It does not establish that every borrower associated with a discrepancy committed wrongdoing. SBA also said individual cases will be evaluated under the facts and applicable law.

What legitimate borrowers should gather now

Create a single index of the documents that support your application, use of proceeds, forgiveness or repayment, and tax reporting. Depending on the program and your business, that may include the original application, promissory note, forgiveness documents, payroll reports, Forms 941, W-2s and 1099s, bank statements, canceled checks, invoices, leases, utility records, ownership records, accounting ledgers, tax returns, and correspondence with the lender or SBA.

Do not alter old records to make them look cleaner. Preserve originals and, if you create a reconciliation or explanatory schedule now, date it as a current workpaper.

Reconcile the numbers before you need to explain them

Compare key figures across the loan application, tax returns, payroll filings, accounting system, and bank statements. A difference can have an innocent explanation—timing, amended returns, bookkeeping classification, aggregation, or a different measurement period—but the explanation is easier to evaluate when the underlying records are complete.

Document material differences in a short reconciliation memo that identifies the source documents and the reason for the difference. If you cannot explain a significant discrepancy, involve a qualified tax professional or attorney rather than guessing.

Do not use a generic “three-year rule” to destroy pandemic records

IRS guidance says record-retention periods depend on the action, expense, or event involved. Three years is a common general income-tax period, but important exceptions apply; employment-tax records generally must be kept for at least four years, and other records can require longer retention.

The IRS also advises businesses not to discard records merely because they are no longer needed for one tax purpose until they check whether another purpose—such as creditors, insurance, property basis, program rules, or an ongoing matter—requires longer retention. Given continuing PPP/EIDL enforcement activity, businesses should verify program-specific and professional retention advice before destroying pandemic-era records.

How to respond if an official notice arrives

First, verify that the notice is authentic using an official contact method rather than a phone number or link in an unexpected message. Calendar the response deadline. Preserve the envelope, notice, attachments, and any online account messages. Do not ignore it, but do not send an unreviewed document dump either.

Where the issue could involve taxes, alleged misrepresentation, penalties, or significant financial exposure, coordinate the response with a CPA, enrolled agent, or attorney whose scope matches the issue. ASBI can help a business organize operations and records, but it is not a substitute for legal or tax representation.

Turn the lesson into a better records system

The best compliance file is not built during an examination. Use standardized folders by year and program, consistent naming, read-only copies of submitted forms, periodic bank/accounting reconciliations, and a retention schedule that states who owns the record and when destruction is permitted.

Good records do more than reduce compliance risk. They improve cash-flow analysis, lender readiness, due diligence, tax preparation, and business continuity when a key employee or owner is unavailable.

Questions readers often ask

Does the September announcement mean every PPP or EIDL borrower is being audited?
No. The agencies described suspected fraud, discrepancies, referrals, and examinations of identified cases. It did not say every borrower is under examination.

Should I destroy old PPP or EIDL records if more than three years have passed?
Not automatically. Retention periods vary, and other program, employment-tax, legal, lender, insurance, or ongoing-matter requirements may apply.

What if my tax return and loan application numbers are different?
A difference is not automatically wrongdoing. Reconcile the source documents and get professional help if the explanation is unclear or material.

Bottom line

The September 2026 SBA/IRS announcement is a strong reason for small businesses to make pandemic-era records locatable, reconcilable, and defensible. Legitimate borrowers do not benefit from panic; they benefit from orderly documentation, careful review, and qualified advice when a notice or unexplained discrepancy raises the stakes.

Next step

ASBI can help small businesses build better document-control, accounting-process, and operational-readiness systems. For tax examinations, penalties, or legal exposure, work with an appropriately qualified tax or legal professional.

Sources: U.S. Small Business Administration — SBA Referral Leads IRS to Investigate Tax Liabilities Related To Potentially $100 Billion in COVID Loan Fraud; IRS — Recordkeeping; IRS — How long should I keep records?.

Educational business information only; not legal, tax, accounting, or financial advice. Program rules and retention requirements can depend on the specific facts and documents involved.