This is the accessible text file for GAO report number GAO-12-395T entitled 'Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization' which was released on February 8, 2012. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Testimony: Before the Committee on Small Business, House of Representatives: For Release on Delivery: Expected at 1:00 p.m. EST: Wednesday, February 8, 2012: Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization: Statement of David A. Powner, Director: Information Technology Management Issues: GAO-12-395T: Mr. Chairman and Members of the Committee: I am pleased to participate in today's hearing on the Small Business Administration's (SBA) efforts to modernize its Loan Management and Accounting System (LMAS). As you are aware, SBA performs a range of significant activities intended to strengthen small businesses and relies extensively on information technology (IT) systems to accomplish these activities. Among these are financial systems used to support loan accounting and track loans through origination, servicing, and liquidation. The loan systems, collectively called the Loan Accounting System, were implemented in the 1970s and outsourced to be run on a contractor's mainframe hardware. SBA has been pursuing efforts to upgrade and modernize its financial systems for several years. The current effort, referred to as LMAS, dates from 2005 and was a response to concerns about the age and information security risks of the legacy system. The effort was intended to result in a single, integrated loan management and loan accounting solution. However, after an independent study and two reviews by the Office of Management and Budget (OMB) raised concerns about SBA's management of the program, it was restructured into a series of seven more focused projects with shorter time frames, referred to as LMAS-Incremental Improvement Projects (IIP). You asked us to testify on the status of SBA's LMAS modernization effort and whether SBA has adequate processes and procedures in place to manage and oversee this effort. My statement today is based on our report, Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization, which is being released today at this hearing.[Footnote 1] This report summarizes the results of our study--which specifically describes the status of the modernization effort and determines whether SBA has adequate process and procedures in place to manage and oversee its LMAS modernization effort. All work on which this testimony is based was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: SBA's mission is to aid, counsel, assist, and protect the interests of small business concerns; to preserve free competitive enterprise; and to maintain and strengthen the overall economy of the Unites States. One way that SBA works to grow businesses is through managing a $90 billion portfolio, which includes direct and guaranty loan programs that provide small businesses with access to capital. This portfolio includes disaster loans, in which SBA makes direct loans to individuals, small businesses, and non-profit organizations in declared disaster areas. The portfolio also includes loan guaranty programs, through which SBA guarantees loans to small businesses that private sector lending institutions would not make otherwise. To administer its loan programs, SBA relies on electronic systems to support the full life cycle of loans. SBA has made several attempts to upgrade its financial software and migrate it off a mainframe environment. The current effort to modernize SBA's loan systems was designed to, among other things, update and improve the agency's outdated Loan Accounting System. The legacy system, implemented in the 1970s, runs on outsourced mainframe software and hardware that requires costly contracts to use and maintain. This system is programmed in COBOL (Common Business Oriented Language), a business application programming language that was introduced in the 1960s and is now becoming obsolete and difficult to manage. The Loan Accounting System is the primary system used to manage and account for loans and loan-related activities for all SBA loan programs, including allotment of funds, loan origination, servicing, liquidation, collections, and disbursements. New technologies added to the loan accounting environment over the years have created a web of stove-piped systems and databases, causing issues with interoperability. Maintaining data integrity in such an environment requires SBA to employ expensive data reconciliations. In November 2005, SBA announced the initiation of the LMAS program, with estimated total costs of approximately $217 million over a 9-year period. Its goal was to implement a single, integrated loan management and loan accounting solution that aligned with the agency's strategic goals. SBA began work on the LMAS program in early 2006, but was unable to replace the legacy system prior to the expiration of its mainframe contract in February 2007, making it necessary for SBA to negotiate new contracts for mainframe and application services until December 2011 at a total cost of approximately $30 million. Following recommendations from an outside study and two reviews by OMB, SBA subsequently reduced the overall scope of the LMAS modernization project and decided to pursue the modernization through a number of smaller projects with shorter time frames. The revised approach, called the LMAS Incremental Improvement Projects (LMAS- IIPs), was approved by OMB in January 2011. It consists of seven projects that are to move software off of the legacy mainframe environment, upgrade two administrative accounting systems, develop new interfaces that are to interact with updated applications, and develop plans for future improvements. Modernization Projects Have Experienced Increasing Costs and Schedule Delays, and SBA Has Not Fully Implemented Key IT Management Practices: As discussed in our report, SBA had completed one of the seven LMAS- IIPs and awarded contracts for work on three others as of October 2011. However, the projects have experienced increasing costs and schedule delays. Specifically, according to the most recent project schedule, dated August 2011, SBA completed one project in May 2011, 2 months later than planned and expects five of the remaining six projects to finish between 4 and 11 months later than the dates reported to Congress in October 2010. Further, according to the agency's most recent report to Congress available at the time of our review, dated March 2011, the total projected cost of the projects increased approximately $5 million since October 2010 and the costs of individual projects had risen between approximately 3 and 53 percent. SBA plans to complete the seven IIPs at a total cost of approximately $28 million by July 2013. Table 1 shows the initial and current expected completion dates and projected costs for the seven LMAS-IIPs. Table 1: IIP Initial and Current Expected Completion Dates and Projected Costs: LMAS-IIP: Oracle Upgrade; Current status: Completed May 2011; Expected completion date as of October 2010: March 2011; Expected completion date as of August 2011: Completed May 2011; Projected costs as of October 2010: $8.45 million; Projected costs as of March 2011: $8.66 million; Percentage increase in costs: 2.5%. LMAS-IIP: Migration of User Interfaces; Current status: Contract awarded and work in progress; Expected completion date as of October 2010: December 2011; Expected completion date as of August 2011: May 2012; Projected costs as of October 2010: $3.32 million; Projected costs as of March 2011: $3.76 million; Percentage increase in costs: 13.3%. LMAS-IIP: Migrate to New Version of COBOL; Current status: Contract awarded to conduct assessment; Expected completion date as of October 2010: May 2012; Expected completion date as of August 2011: April 2013; Projected costs as of October 2010: $6.05 million; Projected costs as of March 2011: $8.72 million; Percentage increase in costs: 44.1%. LMAS-IIP: Sybase to Oracle Migration; Current status: Contract awarded to conduct assessment; Expected completion date as of October 2010: October 2011; Expected completion date as of August 2011: September 2012; Projected costs as of October 2010: $2.51 million; Projected costs as of March 2011: $3.11 million; Percentage increase in costs: 23.9%. LMAS-IIP: Root Cause Analyses; Current status: Planning initiated; Expected completion date as of October 2010: October 2011; Expected completion date as of August 2011: June 2012; Projected costs as of October 2010: n/a; Projected costs as of March 2011: n/a; Percentage increase in costs: 41.0%. LMAS-IIP: Implement Improvements; Current status: Expected to start in March 2012; Expected completion date as of October 2010: March 2013; Expected completion date as of August 2011: July 2013; Projected costs as of October 2010: n/a; Projected costs as of March 2011: n/a; Percentage increase in costs: 47.8%. LMAS-IIP: Document Loan Accounting; Current status: Expected to start in November 2011; Expected completion date as of October 2010: March 2013; Expected completion date as of August 2011: January 2013; Projected costs as of October 2010: n/a; Projected costs as of March 2011: n/a; Percentage increase in costs: 52.5%. Source: GAO analysis of SBA data. Note: Cells marked "n/a" represent potentially sensitive cost estimates, which are therefore not printed here. [End of table] Our report also raises concerns about SBA's inconsistent implementation of key management practices. The success of large IT projects is dependent on agencies' implementing management practices in areas that include software requirements management, IT risk management, IT human capital management, and enterprise architecture. In addition, IT investment management, which constitutes effective institutional oversight, is necessary to ensure that projects adhere to these management capabilities and achieve expected results. SBA partially implemented the management practices we reviewed. Specifically: * Requirements management-SBA appropriately managed changes to requirements for the two projects for which this process would be appropriate; however, it did not validate the requirements for one of the ongoing IIPs. In addition, requirements were not documented for two of the ongoing projects. * Risk management-risks were identified for three of four active projects; however, SBA did not fully prioritize risks related to one IIP or develop plans to mitigate them. * IT human capital management-SBA inventoried existing human capital capabilities; however, it did not fully identify gaps in project workforce skills and did not develop strategies to close them. * Enterprise architecture-SBA drafted target segment architectures for the IIPs; however, the architectures have not been approved by the appropriate officials. In addition, the agency did not fully implement other basic enterprise architecture practices, including maintaining and prioritizing its segment architectures. * IT investment management-the agency had the overall direction of the IIP effort approved by an executive review committee. However, SBA did not address other capital planning requirements for the program, including approving a schedule baseline or reviewing its risk management plan, or provide evidence that it approved the subsequent changes to the budget estimates reported to Congress. Inconsistencies in SBA's application of IT management practices occurred, in part, because it did not provide adequate executive oversight through its investment management process, even though it is using two executive bodies to oversee the projects. While these bodies have overlapping responsibilities and lines of authority, several basic oversight responsibilities, including executive approval of the project's schedule, were left unaddressed by either body. In addition, the cost baselines approved by SBA's executive oversight body differ from the projected costs reported to Congress 2 months later. According to SBA officials, additional oversight was provided through undocumented meetings and reviews of reports to Congress. Nevertheless, these weaknesses in the use of basic management practices make it less likely that SBA will be able to complete the IIPs within the time, budget, and scope parameters originally planned. SBA Needs to Apply Appropriate Information Technology Management Practices and Clarify Roles of Oversight Bodies: To better ensure that the loan management Incremental Improvement Projects are completed as planned and provide anticipated capabilities, we are making several recommendations to the Administrator of SBA in our report. Specifically, we are recommending that SBA apply the appropriate information technology management practices to the IIPs, by ensuring that: * IIP requirements are managed appropriately, including elicitation, documentation, and verification and validation; * IT risks to the IIPs are adequately managed, including preparing for risk management, identifying and analyzing risks, mitigating risks, and providing executive oversight of risk management activities; * the human capital necessary for the IIPs is managed appropriately, including the determination of human capital needs, the identification of gaps between current capabilities and needs, the development of a strategy to close those gaps, and the documentation of these activities; and: * the enterprise architecture segments related to the IIPs are managed appropriately, including the development, prioritization, and maintenance of the segments. In addition, we are recommending that SBA clarify the responsibilities of the executive bodies responsible for the IIPs and ensure they provide the appropriate oversight of the project's progress. Specifically, these executive bodies should conduct and document executive review and approval of the LMAS modernization's risk management approach, target segment architectures, and cost and schedule baselines. In written comments on the draft of this report, the Small Business Administration's Assistant Administrator, Office of Congressional and Legislative Affairs, stated that SBA generally agreed with our recommendations. The Assistant Administrator also asked that we clarify two points. First, he stated that the costs of the LMAS modernization had not increased, and that the figures we included from an October 2010 report to Congress included only contractor costs while the figures from a March 2011 report included both contractor and government costs. However, neither the original request nor SBA's response specifically indicate that the costs discussed included only contractor costs. Further, this lack of clarity on the projected cost of the modernization reinforces the need for an approved cost and schedule baseline that can be used to evaluate program progress, as discussed in our briefing. Second, the Assistant Administrator stated that SBA's executive oversight bodies reviewed the LMAS modernization's overall schedule and cost estimates through both formal and informal discussions, including executive-level meetings in August and September 2010. We considered this information in our initial assessment. However, we do not believe that the records he cites demonstrate that SBA is maintaining current cost or schedule baselines because the approved project cost estimates are inconsistent with estimates subsequently reported to Congress and neither of the meetings' minutes included project-level schedule estimates. The Assistant Administrator stated that SBA is considering formalizing the additional reviews that are currently undocumented. We agree that fully documenting decisions about the projects' costs and schedules would improve SBA's ability to manage the improvement projects. In conclusion, Mr. Chairman, while SBA has made progress in modernizing its loan accounting system, cost increases and schedule slippage raise concerns about SBA's ability to complete the modernization as planned. More consistent application of basic information management techniques and stronger executive oversight could help SBA arrest or reverse these conditions. Mr. Chairman, this concludes my prepared statement. I would be pleased to answer any questions you or other Members of the Committee may have. GAO Contact and Staff Acknowledgments: If you have questions concerning this statement, please contact David A. Powner, Director, Information Technology Management Issues, at (202) 512-9286. Other individuals who made key contributions include James R. Sweetman (Assistant Director), Eric Costello, Franklin Jackson, Lee McCracken, Meredith Raymond, and Karl Seifert. [End of section] Footnote: [1] GAO, Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization, [hyperlink, http://www.gao.gov/products/GAO-12-295] (Washington, D.C.: Jan. 25, 2012). [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E- mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125 Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548.