Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization
Highlights
What GAO Found
As of October 2011, SBA had completed one of the seven projects and awarded contracts for work on three others. However, the projects are experiencing increasing costs and schedule delays. Specifically, according to the most recent project schedule, SBA completed one project in May 2011, 2 months later than planned, and SBA expects five of the remaining six projects to finish between 4 and 11 months later than the dates reported to Congress. Further, according to the agency’s most recent report to Congress, dated March 2011, the total cost of the projects increased approximately $5 million since October 2010. SBA plans to complete the seven IIPs at a total cost of approximately $28 million by July 2013.
SBA has inconsistently implemented key information technology management practices for successfully managing and overseeing its LMAS modernization efforts; these practices include software requirements management, risk management, IT human capital management, enterprise architecture, and investment management. For example, SBA appropriately managed changes to IIP requirements, identified risks for three of four active projects, inventoried existing human capital capabilities, drafted target segment architectures, and had the overall direction of the IIP effort approved by an executive review committee. However, it has not fully implemented other key aspects of these practices and policies. For example, it did not validate the requirements for one of the ongoing IIPs. Also, the agency did not fully prioritize risks related to one IIP or plan to mitigate them. In addition, it did not fully identify gaps in project workforce skills, and did not fully implement basic enterprise architecture practices, including maintaining and prioritizing its segment architectures, which provide the modernization details needed to develop and implement portions, or segments, of an agency’s IT portfolio. In addition, the cost baselines approved by SBA’s executive oversight body differ from the projected costs reported to Congress 2 months later. Further, there is no evidence that the projects have approved schedule baselines. These weaknesses in basic management practices make it less likely that SBA will be able to complete the projects within the time, budget, and scope parameters originally planned.
Inconsistencies in SBA’s application of IT management practices occurred, in part, because it did not provide adequate executive oversight through its investment management process, even though it is using two executive boards to oversee the IIPs. While these boards have overlapping responsibilities and lines of authority, several basic oversight responsibilities, including executive approval of the project’s schedule, were left unaddressed by either body.
Why GAO Did This Study
The Small Business Administration (SBA) performs a range of significant activities intended to strengthen small businesses and relies extensively on information technology (IT) systems to do so. These systems are used to support loan accounting and track loans through origination, servicing, and liquidation. SBA has been attempting to modernize these systems for several years through its Loan Management and Accounting System (LMAS) modernization effort. The most recent iteration of this effort is a series of more focused development efforts, known as the LMAS-Incremental Improvement Projects (IIP).
GAO was asked to describe the status of SBA’s LMAS modernization effort and determine whether SBA has adequate processes and procedures in place to manage and oversee its LMAS modernization effort. In performing this work, GAO reviewed cost and schedule reports to Congress and assessed SBA’s current management of the projects against best practices and relevant guidance.
Recommendations
GAO is recommending that the Administrator of SBA ensure that appropriate IT management practices are applied to the projects as described in this report and clarify the responsibilities of the executive bodies with purview over the LMAS-IIPs and ensure they provide the appropriate oversight of the projects progress.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Small Business Administration | To better ensure that the loan management incremental improvement projects are completed as planned and provide anticipated capabilities, the Administrator of SBA should direct the Chief Information Officer to ensure that SBA is applying the appropriate information technology management practices to the IIPs. Specifically, SBA should ensure that (1) IIP requirements are managed appropriately, including elicitation, documentation, and verification and validation; (2) IT risks to the IIPs are adequately managed, including preparing for risk management, identifying and analyzing risks, mitigating risks, and providing executive oversight of risk management activities; (3) the human capital necessary for the IIPs is managed appropriately, including the determination of human capital needs, the identification of gaps between current capabilities and needs, the development of a strategy to close those gaps, and the documentation of these activities; and (4) the enterprise architecture segments related to the IIPs are managed appropriately, including the development, prioritization, and maintenance of the segments. |
In written comments on our report, the Small Business Administration (SBA) generally concurred with our recommendation. SBA later indicated that it instituted changes to provide consistent project management and completed LMAS development in March 2015. However, SBA was unable to provide sufficient evidence that its changes specifically addressed the key information technology management practices cited in our report. Further, the Program Manager in SBA's Office of Congressional and Legislative Affairs told us that SBA decided to let the recommendation close as not implemented.
|
| Small Business Administration | The Administrator of SBA should clarify the responsibilities of the executive bodies responsible for the IIPs and ensure they provide the appropriate oversight of the project's progress. Specifically, these executive bodies should conduct and document executive review and approval of the LMAS modernization's (1) risk management approach; (2) target segment architectures; and (3) cost and schedule baselines, including ongoing oversight of progress against those baselines. |
In written comments on our report, the Small Business Administration (SBA) generally concurred with our recommendation. SBA later indicated that it instituted changes to provide consistent project management. However, SBA was unable to provide evidence that it clarified the responsibilities of the two oversight bodies responsible for LMAS before its completion in 2015. Further, the Program Manager in SBA's Office of Congressional and Legislative Affairs told us that SBA decided to let the recommendation close as not implemented.
|