Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization
Highlights
What GAO Found
This testimony discusses the Small Business Administration’s (SBA) efforts to modernize its Loan Management and Accounting System (LMAS). As discussed in our report, SBA had completed one of the seven LMAS-Incremental Improvement Projects (IIPs) and awarded contracts for work on three others as of October 2011. However, the projects have experienced increasing costs and schedule delays. However, the projects have experienced increasing costs and schedule delays. Specifically, according to the most recent project schedule, dated August 2011, SBA completed one project in May 2011, 2 months later than planned and expects five of the remaining six projects to finish between 4 and 11 months later than the dates reported to Congress in October 2010. Further, according to the agency’s most recent report to Congress, dated March 2011, the total projected cost of the projects increased approximately $5 million since October 2010 and the costs of individual projects had risen between approximately 3 and 53 percent. SBA plans to complete the seven IIPs at a total cost of approximately $28 million by July 2013. Our report also raises concerns about SBA’s inconsistent implementation of key management practices.
SBA partially implemented the management practices we reviewed. Specifically:
- Requirements management–SBA appropriately managed changes to requirements for the two projects for which this process would be appropriate; however, it did not validate the requirements for one of the ongoing IIPs. In addition, requirements were not documented for two of the ongoing projects.
- Risk management–risks were identified for three of four active projects; however, SBA did not fully prioritize risks related to one IIP or develop plans to mitigate them.
- IT human capital management–SBA inventoried existing human capital capabilities; however, it did not fully identify gaps in project workforce skills and did not develop strategies to close them.
- Enterprise architecture–SBA drafted target segment architectures for the IIPs; however, the architectures have not been approved by the appropriate officials. In addition, the agency did not fully implement other basic enterprise architecture practices, including maintaining and prioritizing its segment architectures.
- IT investment management–the agency had the overall direction of the IIP effort approved by an executive review committee. However, SBA did not address other capital planning requirements for the program, including approving a schedule baseline or reviewing its risk management plan, or provide evidence that it approved the subsequent changes to the budget estimates reported to Congress.
Inconsistencies in SBA’s application of IT management practices occurred, in part, because it did not provide adequate executive oversight through its investment management process, even though it is using two executive bodies to oversee the projects. While these bodies have overlapping responsibilities and lines of authority, several basic oversight responsibilities, including executive approval of the project’s schedule, were left unaddressed by either body. In addition, the cost baselines approved by SBA’s executive oversight body differ from the projected costs reported to Congress 2 months later. According to SBA officials, additional oversight was provided through undocumented meetings and reviews of reports to Congress. Nevertheless, these weaknesses in the use of basic management practices make it less likely that SBA will be able to complete the IIPs within the time, budget, and scope parameters originally planned.
Why GAO Did This Study
Congress asked us to testify on the status of SBA’s LMAS modernization effort and whether SBA has adequate processes and procedures in place to manage and oversee this effort. This statement is based on our report, Information Technology: SBA Needs to Strengthen Oversight of Its Loan Management and Accounting System Modernization, which is being released today at this hearing. This report summarizes the results of our study—which specifically describes the status of the modernization effort and determines whether SBA has adequate process and procedures in place to manage and oversee its LMAS modernization effort.
Recommendations
- IIP requirements are managed appropriately, including elicitation, documentation, and verification and validation;
- IT risks to the IIPs are adequately managed, including preparing for risk management, identifying and analyzing risks, mitigating risks, and providing executive oversight of risk management activities;
- the human capital necessary for the IIPs is managed appropriately, including the determination of human capital needs, the identification of gaps between current capabilities and needs, the development of a strategy to close those gaps, and the documentation of these activities; and
- the enterprise architecture segments related to the IIPs are managed appropriately, including the development, prioritization, and maintenance of the segments.