Skip to main content

SBA Loan Monitoring System: Substantial Progress Yet Key Risks and Challenges Remain

AIMD-00-124 Published: Apr 25, 2000. Publicly Released: Apr 25, 2000.
Jump To:
Skip to Highlights

Highlights

Pursuant to a congressional request, GAO reviewed the Small Business Administration's (SBA) progress in performing planning actions for its loan monitoring system.

Recommendations

Recommendations for Executive Action

Agency Affected Recommendation Status
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should complete the analyses of benefits and costs of alternatives being considered for each business process identified through SBA's business reengineering effort, and complete an implementation plan for the new business processes.
Closed – Implemented
In January 2002, SBA contracted for assistance to identify alternatives and provide recommendations for further developing a loan monitoring system. The contractor provided a report on alternatives in June 2002. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System and, in 2003, SBA contracted with Dun & Bradstreet to provide loan and lender monitoring services.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should perform benefit-cost analyses for systems alternatives to increase the probability that SBA will obtain a system that meets its needs at the lowest cost.
Closed – Implemented
In January 2002, SBA contracted for assistance to identify alternatives and provide recommendations for further developing a loan monitoring system. SBA also chartered a loan monitoring system project management board with overall leadership and responsibility for the vision, direction, and results of the loan monitoring system effort. The contractor provided a report on alternatives in June 2002. Subsequently, the board decided to stop the development of the system and, in April 2003, SBA contracted with Dun & Bradstreet to provide loan and lender monitoring services.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should develop the information architecture's rules and standards for interoperability and maintainability of interrelated systems.
Closed – Implemented
SBA has developed the "SBA Enterprise Architecture Program Policies and Procedures." The policy became effective on August 1, 2003, and requires all systems development and infrastructure information technology projects to follow a standard set of enterprise architecture policies, procedures, and processes in planning, executing, and maintaining information technology at SBA. The document contains policy and standards for the interoperability and maintainability of interreleated systems.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should identify high-level requirements for all internal reports and define detailed input and output data elements necessary for the timely generation of reports.
Closed – Implemented
SBA changed its strategy regarding the Loan Monitoring System. SBA stopped the development of that system and in April 2003, contracted with Dun & Bradstreet to provide loan and lender monitoring services. In acquiring these services, SBA's statement of work requested a loan monitoring capability that would apply monitoring and evaluation services to existing loan data, apply industry standards and best practices for loan and lender monitoring, and enable SBA to identify high-risk lenders for their loan programs. In addition, SBA provided a layout of the data fields used in its main databases and a data requirements matrix. Dun & Bradstreet provides SBA with standard lender performance reports each quarter. These reports are based on profiles of each loan and lender portfolio.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should complete the definition of specific data quality standards, develop a schedule of planned actions to improve data quality in the current systems, and implement data quality measures.
Closed – Implemented
SBA changed its strategy regarding the Loan Monitoring System. In 2003 SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA has established controls to help ensure the integrity of the data entered in the Dun & Bradstreet database. These controls are intended to ensure that misstatements or inaccuracies are detected and corrected on a timely basis, and the level of data errors in the system would not significantly affect the loan monitoring service's risk profiling capabilities. SBA's monthly reconciliation process, combined with lender incentives and loan sales, should help ensure the quality of the underlying data.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should define system capacity and performance requirements for the systems requirements documentation.
Closed – Implemented
SBA changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to establish processes for defining system capacity and performance requirements for the agency. Included in SBA's Systems Development Methodology are steps necessary to document these. Specifically, it addresses performance-related characteristics such as online response time, batch turnaround time, capacity limits, accuracy and validity requirements, input and output effects on performance, and failure contingencies.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should develop an acquisition strategy that ensures that a sound justification exists for pursuing custom-developed functions.
Closed – Implemented
In January 2002, SBA contracted for assistance to identify alternatives and provide recommendations for further developing a loan monitoring system. It also chartered a loan monitoring system project management board to oversee the acquisiton and provide overall leadership and responsibility for the vision, direction, and results of the loan monitoring system effort. The board decided to stop the development of the system and in 2003, SBA contracted with Dun & Bradstreet to provide loan and lender monitoring services. Thus, SBA did revise its strategy and abandoned its efforts for pursuing custom-developed functions.
Small Business Administration The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should continue to refine the cost-to-completion estimate following the completion of the benefit-cost analysis of alternatives and selection of the best alternatives for implementation, and develop a lifecycle cost estimate for the system and its components.
Closed – Implemented
SBA changed its strategy regarding the Loan Monitoring System. After comparing costs and alternatives, SBA stopped the development of that system and in April 2003, contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA has annual renewal options for this service for four subsequent years. The total value of the contract for the five years is $9.6 million.
Small Business Administration The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should implement project tracking and oversight capabilities.
Closed – Implemented
SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to implement project tracking and oversight capabilities for the agency. Specifically, in fiscal year 2004, SBA purchased earned value management and project management tools for all IT investment project managers. The agency conducted training on these tools and also trained the project managers on earned value management concepts and practices. In addition, SBA developed a standard tool for project managers to use in preparing monthly status reports to be presented at regular intervals to the Business Technology Investment Advisory Committee. This Committee was created in January 2004 and is comprised of operating level deputies from each major program component of the agency and is cochaired by the Deputy CIO and Deputy CFO.
Small Business Administration The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should finalize and implement configuration management processes.
Closed – Implemented
SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to implement configuration management processes for the agency. Specifically, SBA's September 2001 Systems Development Methodology contains appendicies on configuration management that describe the Configuration Management Program and includes the policy that requires an established baseline and configuration management.
Small Business Administration The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should acquire independent verification and validation for the loan monitoring system project.
Closed – Not Implemented
SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA's current Systems Development Methodology does not require independent verification and validation for systems that are being developed.
Small Business Administration The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should establish an internal quality assurance function.
Closed – Implemented
SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to establish quality assurance processes for the agency. Specifically, SBA's September 2001 Systems Development Methodology contains an appendix describing the Quality Assurance Program, including related training, and requires that a quality assurance plan be developed for IT projects.
Small Business Administration The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should address the security challenge posed by Internet-based access to loan monitoring system functions and data, complete the security architecture, and update the security operating procedure.
Closed – Implemented
SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA has updated its Automated Information System Security Program policy that provides specific policies relating to the Internet. For example, the security operating procedures govern employees' use of the internet, privacy expectations, accessing secure internet servers, and provides guidelines for using SBA's internet. In addition, the agency is transitioning to a managed network that houses an improved Internet monitoring system. This system should provide improved analysis and reporting capabilities and more detailed control over Internet access.

Full Report

Office of Public Affairs

Topics

IT acquisitionsInformation resources managementInternal controlsLoan accounting systemsPerformance measuresSmall business loansStrategic information systems planningSystems conversionsSystems designSmall business