This is the accessible text file for GAO report number GAO-06-860 
entitled 'Small Business Administration: Actions Needed to Provide More 
Timely Disaster Assistance' which was released on July 28, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Addressees: 

July 2006: 

Small Business Administration: 

Actions Needed to Provide More Timely Disaster Assistance: 

GAO-06-860: 

GAO Highlights: 

Highlights of GAO-06-860, a report to congressional addressees 

Why GAO Did This Study: 

Hurricanes Katrina, Rita, and Wilma (the Gulf Coast hurricanes) caused 
more than $118 billion in estimated property damages across the Gulf 
Coast region in 2005. The Small Business Administration (SBA) helps 
individuals and businesses recover from disasters through its Disaster 
Loan Program. GAO initiated work to determine how well SBA provided 
victims of the Gulf Coast hurricanes with timely assistance. This 
report, the first of two, focuses primarily on the Disaster Credit 
Management System (DCMS) and disaster loan process. Here, GAO evaluates 
(1) what affected SBA’s ability to provide timely disaster assistance 
and (2) actions SBA took after the disasters to improve its response to 
disaster victims. In conducting this study, GAO analyzed data on loan 
applications and assessed key aspects of SBA’s acquisition and 
implementation of DCMS. 

What GAO Found: 

Although DCMS provided SBA with a number of benefits, several factors 
affected SBA’s ability to provide timely disaster assistance to victims 
of the Gulf Coast hurricanes. First, the large volume of applications 
SBA processed greatly exceeded any previous disaster, including the 
1994 Northridge earthquake—the largest single disaster SBA previously 
faced. Second, SBA primarily used this earthquake as the basis for 
planning the maximum user capacity for DCMS and did not consider 
information available from catastrophe risk modeling firms and disaster 
simulations, such as the likelihood and severity of damages from 
potential catastrophes, to help predict the expected application volume 
from such events. SBA’s limited planning contributed to insufficient 
DCMS user capacity, which restricted the number of staff that could 
access the system and process the large volume of applications in a 
timely manner. SBA also did not receive the correct computer hardware 
from its contractor, and the agency did not completely stress test DCMS 
before implementation, which contributed to the system instability, 
outages, and slow response times initially experienced by SBA staff. As 
a result of these and other factors, SBA faced significant delays and 
backlogs in processing loan applications, as depicted in the figure 
below. This backlog peaked at more than 204,000 applications 4 months 
after Hurricane Katrina. As of May 27, 2006, SBA processed 
applications, on average, in about 74 days compared with its goal of 
within 21 days. 

Some of the actions SBA took after the Gulf Coast hurricanes helped to 
improve its response to disaster victims. For example, SBA addressed 
system-related issues by increasing the number of users that could 
access DCMS, and it plans to further increase the system’s maximum user 
capacity. SBA implemented other initiatives that had limited success. 
For example, SBA made only a few loan guarantees under its Gulf 
Opportunity Pilot Loan Program for small businesses in communities 
affected by the disasters. SBA would benefit by expediting its planned 
business process reengineering efforts to analyze ways to more 
efficiently process loan applications, such as implementing a secure 
Internet-based application feature for home loan applicants. 

Figure: Backlog of Applicants in Loss Verification and Application 
Processing: 

[See PDf for Image] 

Source: GAO analysis of SBA data. 

[End of Figure] 

What GAO Recommends: 

GAO recommends four actions including reassessing DCMS’s maximum user 
capacity based on such things as lessons learned from the Gulf Coast 
hurricanes, a review of information available from catastrophe risk 
modeling firms and disaster simulations, and related cost 
considerations. In comments on a draft of this report, SBA generally 
agreed with our recommendations but said more credit should have been 
given to its improvement efforts. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-860]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact William B. Shear at (202) 
512-8678 or shearw@gao.gov 

[End of Section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

Large Volume of Applications, Limited Planning, and Various System and 
Processing Related Challenges Affected SBA's Ability to Provide Timely 
Disaster Assistance: 

SBA's Actions after the Gulf Coast Hurricanes Had Varying Degrees of 
Success: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendixes: 

Appendix I: Scope and Methodology: 

Appendix II: SBA's Acquisition and Implementation of the Disaster 
Credit Management System: 

Appendix III: Comments from the Small Business Administration:  

Appendix IV: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: Significant U.S. Natural Disasters (1988-2005): 

Table 2: SBA Application Statistics for Gulf Coast Hurricanes and 
Previous Disasters: 

Table 3: Other Changes SBA Made after Gulf Coast Hurricanes That 
Improved Response to Disaster Victims: 

Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That Had 
Limited Success: 

Figures: 

Figure 1: SBA's Disaster Loan Process:

Figure 2: Number of Disaster Loan Applications Processed and Average 
Staffing Levels by Month, September 2005 to May 2006: 

Figure 3: FEMA IA Applicants' Current Location by State as of April 10, 
2006: 

Figure 4: Backlog of Applications in Loss Verification and Application 
Processing: 

Figure 5: Average Processing Time Frames for Approval and Decline 
Decisions, October 2005 to May 2006: 

Figure 6: Time Line of DCMS Activities: 

Abbreviations:

ALCS: Automated Loan Control System: 

COTS: commercial-off-the-shelf: 

DAO: Disaster Area Office: 

DCMS: Disaster Credit Management System: 

FEMA: Federal Emergency Management Agency: 

IA: Individual Assistance: 

IHP: Individuals and Households Program: 

IV&V: Independent Verification and Validation: 

IRS: Internal Revenue Service: 

ODA: Office of Disaster Assistance: 

PDC: Processing and Disbursement Center: 

SBA: Small Business Administration: 

July 28, 2006: 

Congressional Addressees: 

In 2005, Hurricanes Katrina, Rita, and Wilma battered the U.S. Gulf 
Coast region, causing more than $118 billion in estimated property 
damages and over 1,400 deaths.[Footnote 1] As the federal government's 
primary lender to victims of disasters, the Small Business 
Administration (SBA) provides financial assistance through its Disaster 
Loan Program to help homeowners, renters, and businesses of all sizes 
recover from disasters such as earthquakes, hurricanes, and terrorist 
attacks. In this capacity, SBA plays a crucial role in the long-term 
recovery of the Gulf Coast region. Nine months following Hurricane 
Katrina, SBA had approved more than 148,700 disaster assistance loans 
totaling $9.7 billion to individuals and businesses that suffered 
losses from the Gulf Coast hurricanes.[Footnote 2] However, Congress 
and press reports have expressed concerns that SBA's response has been 
slow, leaving many disaster victims without the timely assistance that 
they needed. 

In January 2005, SBA began using its new Disaster Credit Management 
System (DCMS) to process loan applications for all new disaster 
declarations. SBA intended for DCMS to improve the quality and 
timeliness of its disaster loan process and enhance its overall 
response to disasters compared with SBA's previous system. However, 
after the Gulf Coast hurricanes, both press reports and Congress were 
critical of DCMS, citing system outages and slow response times as 
contributing to delays that disaster victims experienced in receiving 
assistance. We have prepared this report under the Comptroller 
General's authority to conduct evaluations on his own initiative as 
part of a continued effort to assist Congress in reviewing how well SBA 
provided victims of the Gulf Coast hurricanes with timely assistance. 
In this report, we evaluate: (1) what affected SBA's ability to provide 
timely disaster assistance and (2) the actions SBA took after the 
disasters to improve its response to disaster victims. This report 
focuses primarily on DCMS and the disaster loan process. We plan to 
issue a subsequent report that focuses on other factors not related to 
DCMS or the disaster loan process that may have affected SBA's ability 
to provide timely assistance.[Footnote 3] 

In conducting this review, we visited the Gulf Coast region to observe 
conditions and meet with federal, state, and local officials and 
victims of the disasters. We obtained documents related to SBA's 
disaster lending policy and procedures and SBA's acquisition and 
implementation of DCMS. We also obtained and analyzed SBA's data on 
disaster loan applications processed through May 27, 2006. In addition, 
we interviewed officials from SBA's headquarters and its two Field 
Operations Centers in California and Georgia, Customer Service Center 
in New York, and Processing and Disbursement Center (PDC) in Texas. See 
appendix I for a detailed description of our scope and methodology. We 
conducted our work between November 2005 and July 2006 in accordance 
with generally accepted government auditing standards. 

Results in Brief: 

We identified several factors that affected SBA's ability to provide 
timely disaster assistance to Gulf Coast hurricane victims. The sheer 
volume of applications was a significant challenge to SBA. For example, 
SBA mailed more than 2.1 million disaster loan applications and 
received over 418,000 in return as of May 27, 2006, which greatly 
exceeded the volume from any previous disaster, including the 1994 
Northridge earthquake--the single largest disaster SBA previously 
faced. Although DCMS provided a number of benefits compared with its 
previous system and process, such as allowing certain manual tasks to 
be performed electronically, SBA's limited planning for the maximum 
number of concurrent users in DCMS reduced its ability to provide 
timely disaster assistance. Specifically, SBA used the volume of 
applications received during the Northridge earthquake and other 
historical data as the basis for planning the maximum number of 
concurrent users that DCMS could accommodate. SBA did not consider 
information available from catastrophe risk modeling firms and disaster 
simulations, such as the likelihood and severity of damages from 
potential catastrophes, to help predict the expected application volume 
from such events and the concurrent user capacity needed to process 
expected volumes. Insurance companies and some government agencies use 
this information to plan for catastrophic events. SBA's limited 
planning contributed to insufficient DCMS user capacity, which 
restricted the number of staff that could access the system and process 
the large volume of applications in a timely manner. If SBA had 
considered information available from catastrophe risk modeling firms 
and disaster simulations in planning for DCMS, the agency may have 
acquired additional capacity that would have enabled it to reduce its 
backlog of applications sooner. In addition, SBA's hosting contractor 
provided incorrect computer hardware and ineffective technical support, 
which contributed to the initial system instability, outages, and slow 
response times SBA staff experienced with DCMS following the Gulf Coast 
hurricanes.[Footnote 4] We also found that SBA did not completely 
stress test DCMS before implementation. If SBA had conducted complete 
stress testing, the agency might have detected that it did not receive 
the correct equipment and had an opportunity to address this issue 
before implementing the system.[Footnote 5] As a result of these and 
other processing-related challenges, SBA developed a large backlog of 
applications during the initial months following Hurricane Katrina. 
This backlog peaked at more than 204,000 applications 4 months after 
Hurricane Katrina. As of May 27, 2006, SBA processed applications on 
average in about 74 days, compared with its goal of within 21 
days.[Footnote 6] 

Some of the actions SBA took to improve its response to disaster 
victims after the Gulf Coast hurricanes were more successful than 
others. For example, SBA enhanced its ability to provide more timely 
disaster assistance by addressing DCMS's instability issues. 
Specifically, in October 2005, SBA obtained the computer hardware as 
agreed to with its contractor and increased the processing capacity of 
the system. By November 2005, SBA added a second work shift for its 
loan processing staff to better balance DCMS's workload. In November 
2005, SBA also began to utilize DCMS to conduct preprocessing decline 
decisions faster for applicants with credit scores that indicated a 
high degree of default risk under a pilot program; 
this enabled these applicants to be referred to the Federal Emergency 
Management Agency (FEMA) for possible grant assistance sooner. SBA 
implemented other initiatives with limited success, including the Gulf 
Opportunity Pilot Loan Program (GO Loan Program) in November 2005 that 
provided an 85 percent guaranty to qualified lenders, such as banks 
that made expedited loans available up to $150,000 under the agency's 
7(a) loan program to small businesses located in communities affected 
by the disasters. Because these lenders could charge interest rates 
significantly higher than SBA's disaster loan rates, these loans were 
not very attractive to disaster victims, and SBA guaranteed only 222 
loans under the program. During the course of our work, we also 
identified other potential opportunities to help SBA improve its loan 
processing, such as implementing a secure Internet-based application 
feature for home loan applications. 

To provide more timely assistance to disaster victims in the future, 
this report makes four recommendations designed to improve the 
efficiency and effectiveness of DCMS and the disaster loan process. 
Specifically, we recommend that the Administrator of SBA direct the 
Office of Disaster Assistance (ODA) to (1) reassess DCMS's maximum user 
capacity and related loan processing resource needs based on such 
things as lessons learned from the Gulf Coast hurricanes, a review of 
information available from catastrophe risk modeling firms and disaster 
simulations, and related cost considerations; (2) improve management 
controls over assessing contractor performance through inspections of 
equipment purchases for DCMS; (3) conduct complete stress testing to 
ensure that DCMS can function at planned for maximum user capacity 
levels; and (4) expedite plans to resume business process reengineering 
efforts to analyze the disaster loan process and identify ways to more 
efficiently process loan applications. 

We obtained written comments on a draft of this report from SBA's 
Associate Administrator for Disaster Assistance. SBA generally agreed 
with our recommendations and said that it intends to improve the 
delivery of its program for events of all sizes. However, SBA disagreed 
with some of the report findings and conclusions. Specifically, SBA 
disagreed with our conclusions that it performed limited planning and 
that it would have been better prepared to reduce the backlog of 
applications through the use of catastrophe risk models rather than 
relying primarily on the Northridge earthquake to establish its 
capacity needs. SBA also stated that we did not sufficiently recognize 
the improvement it made before and after the Gulf Coast hurricanes. 
Further, SBA challenged our finding regarding its expedited approval 
process. We continue to believe that catastrophe risk modeling firms 
and disaster simulations provide critical information, such as the 
likelihood and severity of damages from potential catastrophes that 
would have been useful in planning the maximum user capacity of DCMS. 
If SBA had considered this information, it may have expanded the 
maximum user requirement for DCMS and been better prepared to reduce 
the backlog of loan applications more timely. We believe that our 
report provides a fair and balanced presentation of SBA's performance 
during a difficult period and that our recommendations are aimed at 
helping the agency to be more prepared in the event of another large 
disaster. The last section of this report provides a complete 
assessment of SBA's comments, and its letter is presented in appendix 
III. 

Background: 

The Gulf Coast hurricanes collectively represented the most costly 
natural disaster in recent U.S. history. As table 1 shows, the 
estimated property damage from these hurricanes exceeded $118 billion, 
nearly five times greater than the damage from the 1994 Northridge 
earthquake and more than two and one-half times greater than the damage 
from the 2004 Florida hurricanes. Hurricane Katrina was the first of 
these disasters, causing fatalities and damage in southern Florida in 
late August 2005 before striking the northern Gulf Coast region. This 
region received the brunt of the storm, including extensive damage and 
significant loss of life in Louisiana and Mississippi. Damage from 
Hurricane Katrina also extended into the Florida panhandle, Georgia, 
and Alabama and covered approximately 90,000 square miles--an area 
larger than the size of Great Britain. Hurricane Rita was the next 
disaster to strike the Gulf Coast region, making landfall near the 
Texas and Louisiana border on September 24, 2005, and causing a wide 
swath of damage from eastern Texas to Alabama, flooding some areas in 
Louisiana that had already been impacted by Hurricane Katrina about 1 
month earlier. Hurricane Wilma was the last of these disasters to 
strike the region, making landfall in southern Florida on October 24, 
2005, and inflicting widespread damage across the state. 

Table 1: Significant U.S. Natural Disasters (1988-2005): 

Dollars in billions. 

Event: Gulf Coast hurricanes; 
Year: 2005; 
Property damage: > $118.0[A]. 

Event: Severe drought/heat wave (central and eastern states); 
Year: 1988; 
Property damage: 59.3[B]. 

Event: Florida hurricanes[C]; 
Year: 2004; 
Property damage: > 46.2[B]. 

Event: Hurricane Andrew; 
Year: 1992; 
Property damage: 35.0. 

Event: Midwest flooding; 
Year: 1993; 
Property damage: 26.6. 

Event: Northridge earthquake; 
Year: 1994; 
Property damage: 24.9[B]. 

Event: Hurricane Hugo; 
Year: 1989; 
Property damage: > 12.9. 

Event: Severe drought (eastern, western, and Great Plains states); 
Year: 2002; 
Property damage: > 10.8. 

Event: Severe weather and flooding (southeast and southwest states); 
Year: 1995; 
Property damage: > 7.3. 

Event: Northern Plains flooding; 
Year: 1997; 
Property damage: 4.4. 

Event: Southern California wildfires; 
Year: 2003; 
Property damage: > 2.6. 

Source: National Oceanic and Atmospheric Administration, U.S. 
Geological Survey. 

Note: Damage amounts are adjusted to 2005 dollars using gross domestic 
product price index. 

[A] Preliminary estimate. 

[B] Estimated damages. 

[C] Includes Hurricanes Charley, Frances, Ivan, and Jeanne. 

[End of table] 

The federal government provides funding and assistance after disasters 
through a variety of agencies and programs. Congress created FEMA to 
coordinate response and recovery efforts under presidential disaster 
declarations. FEMA works with other federal, state, and local agencies 
to assist victims after major disasters, and volunteer organizations 
such as the American Red Cross also participate in these efforts. 
Following a presidential disaster declaration, FEMA will open Disaster 
Recovery Centers where disaster victims can meet with representatives, 
obtain information about the recovery process, and register for federal 
disaster assistance. Victims may also register with FEMA by telephone 
or via FEMA's Internet site. FEMA provides housing assistance to 
disaster victims through the Individuals and Households Program 
(IHP).[Footnote 7] Under the IHP, FEMA can make grants available to 
repair or replace housing damaged in a disaster that is not covered by 
insurance. However, the IHP is a minimal repair program that is 
designed to make the victim's home habitable and functional, not to 
restore the home to its predisaster condition. When disaster victims 
register for FEMA assistance, they are asked to provide their 
approximate household income. If the applicant's income exceeds certain 
thresholds, FEMA automatically refers them to SBA's Disaster Loan 
Program.[Footnote 8] 

SBA's Disaster Loan Program is the primary federal program for funding 
long-range recovery for private sector, nonfarm disaster victims and 
the only form of SBA assistance not limited to small businesses. The 
Small Business Act authorizes SBA to make available the following two 
types of disaster loans: 

* Physical disaster loans--These loans are for permanent rebuilding and 
replacement of uninsured or underinsured disaster-damaged property. 
They are available to homeowners, renters, businesses of all sizes and 
nonprofit organizations. These loans are intended to repair or replace 
the disaster victim's damaged property to its predisaster condition. 

* Economic injury disaster loans--These loans provide small businesses 
with necessary working capital until normal operations resume after a 
disaster declaration. They cover operating expenses the business could 
have paid had the disaster not occurred. The act restricts economic 
injury disaster loans to small businesses only. 

Under a presidential disaster declaration, SBA disaster assistance 
staff members secure space within FEMA--established Disaster Recovery 
Centers and begin meeting with victims to explain the agency's disaster 
loan process, issue loan applications and, if requested, assist victims 
in completing applications. Figure 1 illustrates SBA's disaster loan 
process. 

Figure 1: SBA's Disaster Loan Process: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

During the application entry stage, SBA screens all incoming 
applications to determine if they are acceptable.[Footnote 9] In 
addition, SBA conducts a preliminary financial analysis of home loan 
applications to determine whether the applicant's income falls below 
the agency's minimum income thresholds or if repayment ability is 
evident based on a review of the applicant's gross income and fixed 
debts.[Footnote 10] SBA declines home loan applicants that do not meet 
its minimum income requirements or demonstrate repayment ability. SBA 
also obtains a credit bureau report for business and home loan 
applicants, and SBA may decline an applicant based on information 
contained in the report. SBA refers to denials made during the 
application entry stage as preprocessing declines. SBA intended for 
these declines to eliminate delays in notifying applicants about loan 
denials. SBA will refer most home loan applicants denied a loan to FEMA 
for possible grant assistance under a presidential disaster 
declaration.[Footnote 11] After the application entry stage, 
applications move to the loss verification stage, and SBA staff members 
scan application documents into DCMS.[Footnote 12] 

During the loss verification stage, loss verifiers conduct on-site 
damage inspections for physical disaster loan applications to estimate 
the cost of restoring damaged property to predisaster condition. Loss 
verifiers use tablet personal computers with software tailored to 
complete and submit reports electronically into DCMS. The verified loss 
becomes the basis for the loan amount. Once the loss verification is 
complete, an application moves to the application processing stage, 
where loan officers check for duplication of benefits and assess the 
applicant's credit history and ability to obtain credit 
elsewhere.[Footnote 13] Loan officers also examine other applicant 
eligibility criteria, including compliance with child support 
obligations and history on other federal debt, such as student loans. 
Loan officers use a financial analysis tool within DCMS to determine if 
the applicant has the ability to repay the loan. As with preprocessing 
declines, SBA generally refers home loan applicants denied a loan in 
application processing to FEMA for possible grant assistance under 
presidential disaster declarations. 

For secured loans, legal staff members review the draft loan 
authorization and agreement for sufficiency of collateral instruments 
and other legal concerns.[Footnote 14] They also create a loan closing 
checklist--a list of the requirements necessary to generate the loan 
closing and other legal documents. Attorneys enter a legal concurrence 
into DCMS, which obligates the loan funds through an interface with 
SBA's accounting system. Legal support staff members prepare closing 
documents and mail them to the applicant or nearest Disaster Recovery 
Center. SBA can make a maximum initial disbursement, without 
collateral, of up to $10,000 for physical disaster loans and $5,000 for 
economic injury disaster loans, once the agency receives signed closing 
documents from the applicant. SBA can make a maximum initial 
disbursement of up to $25,000 for physical disaster loans with 
collateral--preferably real estate.[Footnote 15] SBA generally makes 
subsequent disbursements on physical disaster loans based on the 
applicant's needs and how they spent prior disbursements. 

DCMS replaced SBA's largely manual, paper-based loan process and its 
Automated Loan Control System (ALCS), which it had used since the early 
1990s. ALCS enabled SBA to track the movement of paper loan application 
files from one stage of the process to another, but the manual loan 
process required the movement and storage of large volumes of paper. In 
December 1998, SBA began planning for a replacement disaster loan 
system. SBA purchased a commercial-off-the-shelf package as the 
foundation for DCMS in 2003 and had the package customized. SBA 
intended for DCMS to help it move toward a paperless processing 
environment by automating many of the functions staff members had 
performed manually, such as obtaining FEMA referral data and credit 
bureau reports, as well as completing and submitting loss verification 
reports from remote locations. SBA began a phased implementation of 
DCMS in November 2004 at its former Niagara Falls Disaster Area Office 
(DAO).[Footnote 16] In January 2005, SBA began using DCMS to process 
loan applications for all new disaster declarations and by March 2006, 
SBA completed the migration of all data for disaster loan applications 
processed since 2000 from ALCS to DCMS. According to SBA, the cost for 
planning, acquiring, implementing, and operating DCMS totaled about $32 
million through April 2006. See appendix II for a more detailed 
discussion of SBA's acquisition and implementation of DCMS. 

Large Volume of Applications, Limited Planning, and Various System and 
Processing Related Challenges Affected SBA's Ability to Provide Timely 
Disaster Assistance: 

We identified several factors that affected SBA's ability to provide 
timely disaster assistance, including a large volume of applications 
that exceeded any previous disaster. In addition, although DCMS allowed 
SBA to streamline the disaster loan process, SBA focused only on its 
historical experience and did not consider the possibility of a single 
or series of disasters of the magnitude of the Gulf Coast hurricanes 
when planning the system's maximum user requirements. SBA's limited 
planning contributed to insufficient DCMS user capacity, which 
restricted the number of staff that could access the system and process 
the large volume of applications in a timely manner. Further, SBA did 
not completely stress test DCMS before implementation to help ensure 
that it could function at its maximum user capacity and thus did not 
detect that the wrong processors had been installed by its hosting 
contractor and that the system could not support planned capacity. As a 
result of these and other processing-related factors, SBA experienced 
significant backlogs and delays in processing applications. Overall, 
SBA processed disaster loan applications in 74 days, on average, as of 
May 27, 2006, compared with its goal of within 21 days. 

Large Volume of Loan Applications Affected SBA's Response to Hurricane 
Victims: 

According to SBA officials, the large volume of disaster loan 
applications it processed for victims of the Gulf Coast hurricanes was 
a significant challenge. The volume of applications associated with 
these hurricanes greatly exceeded any disaster in SBA's history. As 
table 2 shows, as of May 27, 2006, SBA had issued more than 2.1 million 
applications to victims affected by the Gulf Coast hurricanes. This 
represented almost four times as many applications as SBA issued to 
victims of the Northridge earthquake--the single largest disaster SBA 
had previously faced. In addition, our analysis showed that SBA 
received a large influx of applications during the initial months 
following Hurricane Katrina--at the same time that SBA hired and 
trained a large number of temporary staff to process applications 
received from victims of the disasters. Specifically, SBA received 
about 280,000 applications during the first 3 months following 
Hurricane Katrina, approximately 30,000 more applications than SBA 
received over a period of about 1 year from victims of the Northridge 
earthquake. 

Table 2: SBA Application Statistics for Gulf Coast Hurricanes and 
Previous Disasters: 

Event: Gulf Coast hurricanes[B]; 
Applications issued: 2,152,793; 
Applications received[A]: 418,157. 

Event: Florida hurricanes[C] (2004); 
Applications issued: 869,577; 
Applications received[A]: 179,025. 

Event: Northridge, California earthquake (1994); 
Applications issued: 566,260; 
Applications received[A]: 250,402. 

Event: Hurricane Andrew, Florida (1992); 
Applications issued: 110,539; 
Applications received[A]: 40,568. 

Event: Upper Midwest floods (1997); 
Applications issued: 46,968; 
Applications received[A]: 18,752. 

Event: September 11 terrorist attacks (2001); 
Applications issued: 66,893; 
Applications received[A]: 25,825. 

Source: SBA. 

Note: According to SBA officials, in 1996, the agency implemented a 
combined application for business physical disaster and economic injury 
disaster loan applications from the same applicant. The number of 
applications issued and received for Hurricane Andrew and the 
Northridge earthquake has not been adjusted to reflect this change. 

[A] Represents applications accepted into DCMS. According to SBA, these 
numbers exclude applications that SBA declined during the application 
entry stage where the applicant did not meet the agency's minimum 
income thresholds or demonstrate repayment ability. 

[B] Statistics for Hurricanes Katrina, Rita, and Wilma as of May 27, 
2006. 

[C] Includes Hurricanes Charley, Frances, Ivan, and Jeanne. 

[End of table] 

SBA officials told us that the large volume of applications that it 
mailed and received resulted in part from the large number of referrals 
FEMA made to SBA's Disaster Loan Program without applying SBA's income 
thresholds, specifically for disaster victims who registered for 
disaster assistance via FEMA's Internet site and did not report any 
income. According to a FEMA official, disaster victims who register via 
FEMA's Internet site can select the "Income Unavailable/Refused" option 
if they do not wish to or cannot provide their income. The official 
stated that these individuals are advised that selecting this option 
will result in an SBA referral. The FEMA official also stated that, per 
an SBA request, FEMA refers all applicants who claim self-employment as 
their primary source of income to SBA's Disaster Loan Program, 
regardless of their income, because the income tests are not a valid 
measure of repayment ability for self-employed applicants. In both 
cases, FEMA's registration system automatically fills $0 as the 
disaster victim's income and refers these individuals to SBA's Disaster 
Loan Program. The FEMA official stated that about 17 percent of the 
individuals referred to SBA for Hurricanes Katrina and Rita refused to 
provide their income, and another 17 percent indicated that they were 
self-employed. SBA officials referred to these cases as "$0 income" 
referrals. 

In February 2006, SBA's Office of Inspector General issued an advisory 
memorandum, stating that many $0 income referrals ultimately failed 
SBA's criteria for disaster loan eligibility and were processed as 
declines.[Footnote 17] SBA's Office of Inspector General added that 
these referrals impacted SBA by: 

* increasing the cost incurred by SBA in mailing loan applications to 
disaster victims that normally would not be referred to SBA's Disaster 
Loan Program; 

* delaying response times for those applicants who did qualify for 
SBA's Disaster Loan Program; 

* lowering SBA's disaster loan approval rates; 
and: 

* increasing the transaction flow through DCMS, which was near maximum 
capacity. 

SBA's Office of Inspector General recommended that SBA improve its 
screening processes within DCMS when processing $0 income referrals and 
work with FEMA to reduce unnecessary online disaster referrals. In 
commenting on a draft of the advisory memorandum, SBA agreed that it 
should work with FEMA to improve their joint screening process prior to 
referral and issuing an SBA disaster loan application. 

Limited Planning for DCMS User Capacity Reduced SBA's Ability to 
Provide Timely Disaster Assistance: 

DCMS provided SBA with a number of benefits compared with its previous 
system, such as the capability to complete loss verification reports 
and other processing-related tasks electronically. However, SBA planned 
DCMS's maximum user capacity based solely on the volume of applications 
it received from victims of the Northridge earthquake and its other 
historical data; it did not consider the information available from 
catastrophe risk modeling firms or disaster simulations such as the 
likelihood and severity of damages from potential catastrophes. 
Although agencies are not specifically required to consider such 
information in developing their system's user capacity requirements, 
this information could have helped SBA predict the volume of loan 
applications to expect and the necessary user capacity needed to 
process such a volume. SBA officials acknowledged that they could have 
considered this information in planning DCMS's user capacity 
requirements but lacked the funding to do so. SBA's limited planning 
and other system and processing related issues diminished the agency's 
ability to provide disaster assistance in a timely manner. 

Many insurance companies and government agencies currently use computer 
programs offered by several modeling firms to estimate the financial 
consequences of various natural catastrophe scenarios. Risk modeling 
firms, which have existed since the late 1980s, rely on sophisticated 
mathematical modeling techniques and large databases containing 
information on past catastrophes, population densities, construction 
techniques, and other relevant information to assess the severity of 
potential catastrophes so that other organizations can plan 
accordingly. For example, one modeling firm recently estimated that 1.5 
million people were vulnerable to an earthquake on the San Andreas 
Fault in the San Francisco area and that an earthquake similar to the 
1906 earthquake would cause an estimated $260 billion in damages to 
residential and commercial properties. This study also noted that the 
U.S. Geological Survey estimated that there was a 21 percent 
probability of a major earthquake on this fault occurring before 
2032.[Footnote 18] Another modeling firm study of a strong hurricane 
striking the densely populated Northeast region estimated this event 
could cause more than $200 billion in economic losses, including 
significant damage from flooding to properties and infrastructure in 
lower Manhattan and Long Island.[Footnote 19] While SBA would not 
utilize this information the way insurance companies do to assess the 
financial consequences of potential disasters, catastrophe risk 
modeling firms provide important information on the severity of damages 
from such events. This information could be helpful in estimating the 
potential number of loan applications that SBA could receive for 
processing and the concurrent user capacity necessary to process such 
applications in a timely manner if such an event were to occur. 

Government agencies and other organizations also participate in 
disaster simulation exercises to prepare for their response to natural 
disasters. While SBA would not use this disaster simulation information 
to plan a response to victims' immediate needs, the estimated number of 
buildings damaged and number of people evacuated provides important 
information that can be considered in planning the user capacity of a 
disaster loan system. For example, FEMA brought together numerous 
officials from local, state, federal, and volunteer organizations to 
conduct an exercise referred to as Hurricane Pam in July 2004. This 
exercise used realistic weather and damage information developed by the 
National Weather Service, the U.S. Army Corps of Engineers, the 
Louisiana State University Hurricane Center, and other state and 
federal agencies to help officials develop joint response plans for a 
catastrophic hurricane in Louisiana. This fictional hurricane brought 
sustained winds of 120 miles per hour, up to 20 inches of rain in parts 
of southeast Louisiana, and storm surge that topped levees in the New 
Orleans area. Hurricane Pam, as projected, destroyed between 500,000 
and 600,000 buildings and forced the evacuation of more than 1 million 
residents from the New Orleans area. 

In planning the maximum user capacity for DCMS, SBA relied solely on 
the volume of applications it received from victims of the Northridge 
earthquake and its other historical data, such as the average number of 
applications processed for the previous 5 years. SBA did not plan for 
the likelihood of a single disaster or series of disasters of the 
magnitude of the Gulf Coast hurricanes. If SBA had considered the 
information available from catastrophe risk modeling firms or disaster 
simulations, such as the likelihood and potential damages from 
catastrophic events, to help it predict the volume of loan applications 
that might be expected and the user capacity needed to process this 
volume, the agency may have acquired additional capacity that would 
have enabled it to reduce its backlog of applications sooner. SBA's 
limited planning contributed to insufficient DCMS user capacity, which 
restricted the number of staff that could access the system and process 
the large volume of applications in a timely manner. 

Ineffective Technical Support Affected the Stability of DCMS and SBA's 
Ability to Provide Timely Disaster Assistance: 

SBA experienced instability with DCMS during the initial months 
following Hurricane Katrina, as users experienced outages, difficulties 
connecting to the system, and slow response times in completing loan 
processing tasks. For example, our review of DCMS system logs showed 
that between September and December 2005 SBA experienced the following 
incidents: 

* 19 incidents where DCMS was not available to all system users due to 
an unscheduled outage, and: 

* 26 incidents where DCMS was not available to various units due to an 
unscheduled outage. 

SBA officials told us that the longest period of time DCMS was 
unavailable to users due to an unscheduled outage was 1 business day. 
These unscheduled outages and other system-related issues slowed 
productivity and affected SBA's ability to provide timely disaster 
assistance; however, we could not determine the specific impact on the 
agency's time frames for processing disaster loan applications received 
from Gulf Coast hurricane victims. 

According to SBA officials, ineffective technical support contributed 
to the system instability experienced by users, as its hosting 
contractor did not properly monitor the DCMS network as contractually 
required and did not make the agency aware of incidents that could make 
the system unstable prior to DCMS users being affected. In addition, 
SBA officials told us that its hosting contractor did not provide the 
agency with the correct computer hardware for DCMS as contractually 
required, which further contributed to the instability users initially 
experienced with the system and reduced processing power by about one- 
third. Specifically, in developing DCMS, SBA planned for a maximum 
capacity of 1,500 concurrent users. SBA officials told us that they 
discovered that DCMS was operating near 100 percent capacity in 
September 2005 before the agency had reached its maximum user capacity. 
At that time, SBA discovered that the hosting contractor had not 
provided the agency with the correct computer hardware required per its 
contract in order to support 1,500 concurrent users. 

However, SBA did not verify that its hosting contractor provided the 
agency with the correct computer hardware specified in its contract. 
Federal procurement policies require agencies to have trained and 
experienced officials available to judge whether contractors are 
performing according to contract terms and conditions, particularly 
when contracting for highly specialized or technical services.[Footnote 
20] In addition, SBA's internal procurement procedures require that the 
agency inspect each item or service provided under a contract, report 
capital equipment acquisitions immediately--including computer 
equipment, and provide a serial number for capital equipment 
acquisitions for tracking purposes. SBA officials did not have an 
explanation for why the agency did not verify that the hosting 
contractor provided the correct computer hardware. If SBA had verified 
this equipment as required, the agency might have discovered this issue 
prior to the Gulf Coast hurricanes and been able to take the 
appropriate corrective action. 

SBA Did Not Completely Stress Test DCMS to Ensure It Could Function at 
Maximum Capacity: 

Prior to implementation, SBA did not completely stress test DCMS to 
ensure that the system could operate effectively at maximum capacity, 
which contributed to the initial system instability SBA experienced. In 
2003, SBA began testing various aspects of DCMS, including the core 
application interfaces and additional components such as loss 
verification and scanning. Although SBA conducted performance testing 
for DCMS, we found that the agency only stress tested the system for up 
to 120 concurrent users due to limitations with the hardware in the 
testing environment. The testing environment simulated an increasing 
number of concurrent users and exercised different functional 
scenarios, but the hardware used in the simulation reached its capacity 
earlier than anticipated. Even if the testing environment functioned as 
planned, an estimate showed that DCMS could accommodate approximately 
600 concurrent users at this time--significantly less than the system's 
planned maximum capacity of 1,500. 

According to leading information technology organizations, to be 
effective, practices for testing software should be planned and 
conducted in a structured and disciplined environment.[Footnote 21] 
Typically, this involves testing increasingly larger increments of a 
system until the complete system and all of its functionality are 
tested and accepted. It also involves stress testing and fully 
demonstrating the effectiveness and accuracy of the system. 
Additionally, SBA's internal systems development manual requires that 
the agency determine testing and acceptance criteria that must be met 
for a system to be accepted as "fit for use" by the user or sponsoring 
organization and requires user or sponsoring organization approval of 
all acceptance criteria. Further, the manual identifies how acceptance 
testing is to be conducted and reported to determine whether the system 
meets its requirements upon completion of its development. In doing 
limited stress testing of DCMS, SBA did not completely follow its own 
requirements or industry best practices for systems testing. When these 
requirements are not met, there is potential risk that the implemented 
system will not meet the system requirements. If SBA had conducted 
complete stress testing, the agency might have detected that it did not 
receive the correct equipment and had an opportunity to address this 
issue before implementing DCMS. 

Other Processing Related Challenges Affected SBA's Ability to Provide 
Timely Disaster Assistance: 

Because of the unpredictable nature of disasters and the cost of 
maintaining staff that it might not need, SBA hires and trains a large 
number of temporary staff to help process loan applications following 
any large scale disaster, such as the Gulf Coast hurricanes. SBA also 
has a disaster reserve corps, a group of experienced individuals it 
relies upon who have worked with the agency in responding to previous 
disasters and are trained in its disaster loan process. SBA officials 
told us that it generally took approximately 30 days for loan officers 
without prior SBA experience to become fully productive. This slows 
processing during the initial months following a disaster, as loan 
officers become familiar with SBA's disaster loan process and DCMS. In 
response to the Gulf Coast hurricanes, SBA also had to secure 
additional space and equipment to support loan processing. According to 
SBA officials, this process took approximately 30 to 60 days. As figure 
2 shows, as the average number of loan processing staff increased, SBA 
generally processed more applications than it did during the first 2 
months following Hurricane Katrina. 

Figure 2: Number of Disaster Loan Applications Processed and Average 
Staffing Levels by Month, September 2005 to May 2006: 

[See PDF for image] 

Source: GAO analysis of SBA data. 

[End of figure] 

Because SBA normally relies on temporary staff to help process loan 
applications after large disasters, it might be unrealistic to expect 
the agency to process a large volume of applications quickly during the 
initial period following such disasters. 

The geographic dispersion of disaster victims--in particular for 
Hurricanes Katrina and Rita--also affected SBA's ability to provide 
timely disaster assistance. Figure 3 illustrates the location of 
displaced applicants affected by these disasters that registered for 
FEMA IA. These applicants relocated to all 50 states, with the largest 
concentrations in Louisiana, Mississippi, and Texas. SBA officials told 
us that FEMA referred many of these applicants to its Disaster Loan 
Program, and their widespread geographic dispersion made it more 
challenging to provide timely disaster assistance. Loan officers we met 
with also told us that contacting applicants to discuss the status of 
their loan application was difficult in some cases--particularly during 
the initial months following the disasters, as some applicants had 
moved or changed employment several times since applying for disaster 
assistance. Thus, SBA did not always have an applicant's most current 
information, which slowed the processing of their application. 

Figure 3: FEMA IA Applicants' Current Location by State as of April 10, 
2006: 

[See PDF for image] 

Source: Copyright Corel Corp. All rights reserved (map) and FEMA 
(data). 

[End of figure] 

Note: These are applicants that registered for Hurricanes Katrina and 
Rita only. 

As a Result of These Factors, SBA Did Not Significantly Reduce Its 
Backlog of Applications until Several Months after Hurricane Katrina: 

Our analysis showed that it took SBA several months to significantly 
reduce the backlog of applications that developed in various stages of 
its disaster loan process because of the large volume of applications, 
limited planning for DCMS, and other processing-related challenges. For 
example, SBA did not clear the backlog in the application entry stage 
until nearly 3 months following Hurricane Katrina. SBA nearly cleared 
the backlog in the loss verification stage 8 months after the disaster 
when the backlog was reduced to less than 1,800 applications. However, 
at that time, SBA still needed to complete loan processing for about 
25,000 applications. 

As figure 4 shows, SBA's backlog in the loss verification and 
application processing stages increased significantly during the first 
3 months following Hurricane Katrina as SBA began receiving a large 
volume of applications from victims of the other hurricanes. These 
backlogs combined peaked at over 204,000 applications in late December 
2005. Figure 4 also shows that, individually, SBA's backlog in the loss 
verification stage peaked at almost 129,200 applications about 3 months 
following Hurricane Katrina, and the backlog in the application 
processing stage peaked at more than 121,700 applications nearly 6 
months after the disaster. As a result of the backlogs, victims of the 
Gulf Coast hurricanes waited about 74 days on average for SBA to 
process their loan applications, compared with the agency's goal of 
within 21 days. 

Figure 4: Backlog of Applications in Loss Verification and Application 
Processing: 

[See PDF for image] 

Source: GAO analysis of SBA data. 

[End of figure] 

Figure 5 shows SBA's average processing time frames for approval and 
decline decisions made between mid-October 2005 and May 2006 compared 
with its goal of within 21 days. Although SBA began to reduce the total 
backlog in loss verification and application processing in late 
December 2005, average processing time frames for approval and decline 
decisions generally increased through May 2006 because of the average 
age of applications in the backlog. For example, SBA reduced the 
backlog in application processing to less than 4,500 by late May 2006; 
however, average processing time frames were still significantly higher 
than its goal because loan applications had been in the application 
processing queue for a long time--about 63 days on average. 

Figure 5: Average Processing Time Frames for Approval and Decline 
Decisions, October 2005 to May 2006: 

[See PDF for image] 

Source: GAO analysis of SBA data for 2005 Gulf Coast hurricanes. 

[End of figure]  

SBA's processing average for approvals does not include additional time 
frames for loan closings and initial disbursements. For example, SBA 
received signed closing documents from borrowers about 35 days, on 
average, after making the approval, as of May 27, 2006. According to 
SBA officials, delays in closing loans were mostly the result of 
factors beyond their control. For example, SBA officials stated that 
they scheduled loan closings at the convenience of the borrower. These 
officials added that because of the displacement of Gulf Coast 
hurricane victims, SBA had closed about 50 percent of disaster loans by 
mail, a higher percentage than previous disasters, which generally 
takes more time than closings done in person. SBA officials also stated 
that there were a significant number of disaster victims who had not 
returned to the affected area and who had expressed uncertainty about 
rebuilding their homes and businesses. As a result, these victims had 
been reluctant to quickly close on their loans. SBA's disaster lending 
procedures generally require applicants to close loans within 60 days 
of the date on the loan authorization and agreement. These procedures 
also allow SBA to accept loan closing documents after 60 days on a 
discretionary basis. SBA officials told us they had allowed Gulf Coast 
hurricane victims additional time to determine if they really wanted 
the loan. To facilitate loan closings, SBA officials also told us they 
used staff to conduct follow-up calls with borrowers after closing 
documents were mailed. 

In addition, our analysis of an SBA data extract further showed that 
the agency made an initial disbursement for approved loans on average 
about 9 days after the receipt of closing documents. As of May 27, 
2006--9 months after Hurricane Katrina--SBA had disbursed about $1.4 
billion or 14 percent of the $9.7 billion approved loan dollars. As of 
the same date, about 73,000 approved loans had not been fully disbursed 
to disaster victims. As with loan closings, SBA officials stated that 
the length of time it took to disburse disaster loans was primarily 
determined by the borrower. SBA's disaster lending procedures require 
borrowers to arrange for and obtain all loan funds within 12 months 
from the date of the loan agreement. However, SBA officials told us 
that it might be difficult for some disaster victims to meet this 
requirement. In our subsequent report on SBA's response to the Gulf 
Coast hurricanes, we plan to discuss the perspectives of disaster 
victims related to the disaster loan process. 

SBA's Actions after the Gulf Coast Hurricanes Had Varying Degrees of 
Success: 

Although SBA took several actions after the Gulf Coast hurricanes to 
improve its response to disaster victims, our analysis showed that some 
of these actions were more successful at reducing the backlog of loan 
applications than others. For example, SBA increased the number of 
concurrent users that could access DCMS by acquiring additional 
computer hardware and adding a second work shift for loan processing 
staff to better balance the system's workload. In addition, SBA 
initiatives to relax filing requirements for applicants whose business 
records were destroyed and establish a satellite office to process 
disaster loans at its former Sacramento DAO allowed SBA to improve its 
response to disaster victims. However, SBA did not experience as much 
success with its initiatives to expedite small business financing to 
communities affected by the disasters and use private sector banks to 
process disaster loan applications. As a result, some of SBA's 
initiatives did not significantly reduce the backlog of loan 
applications or the time victims waited for SBA to process their 
disaster loan applications. 

SBA Took Actions to Address DCMS Instability and Other System-Related 
Issues: 

As previously discussed, SBA initially experienced instability and 
other issues with DCMS. However, the agency took actions to address 
these issues. In October 2005, SBA obtained the computer hardware, as 
agreed to with its contractor, that increased DCMS's capacity to about 
2,000 concurrent users. SBA also obtained additional support from its 
hosting contractor, at no additional cost, to ensure adequate 
monitoring of the DCMS network. By November 2005, because DCMS 
continued to operate near its maximum capacity, SBA added a second 
shift for loan processing staff at its Fort Worth processing facility 
to better balance DCMS's workload. According to SBA officials, DCMS had 
been stable since January 2006, and users reported having a greater 
comfort level and more success in processing applications using the 
system. The officials added that the hosting contractor had provided 
better oversight over DCMS compared with the initial months following 
Hurricane Katrina. In April 2006, SBA officials advised us that the 
agency had not made any payments to its hosting contractor since August 
2005 because it did not satisfy contract requirements, and negotiations 
were under way to determine the amount of any subsequent payments. 

In preparation for the 2006 hurricane season, SBA awarded a new 
contract in April 2006 for up to $54 million to its integration 
contractor to provide project management and information technology 
support for DCMS over the next 5 years. This contractor will continue 
to upgrade the system to support increased loan processing activity by 
implementing software changes and hardware upgrades, providing ongoing 
support to DCMS users, and supporting all information technology 
operations associated with the system under the contract. In addition, 
SBA has plans to increase DCMS's maximum user capacity to at least 
8,000 concurrent users by the summer of 2006. However, we could not 
determine how SBA selected this number or whether the agency considered 
the information available from catastrophe risk modeling firms or 
disaster simulations in determining the planned for increase in maximum 
user capacity. To facilitate this planned capacity increase, SBA added 
on to and extended the contract with its hosting contractor in February 
2006. Although SBA had experienced problems with the initial oversight 
provided by this hosting contractor, according to agency officials, the 
contractor's performance had improved. For example, the contractor had 
dedicated a project manager to this effort. Because of these 
improvements and the contractor's familiarity with SBA's needs, agency 
officials decided that the contractor could provide a hardware solution 
for the expanded capacity within the agency's time frames. 

SBA's Processing Changes and Other Initiatives Had Varied Success: 

After the Gulf Coast hurricanes, SBA made several changes to its 
disaster loan process and implemented other initiatives intended to 
improve its response to victims. While some of these initiatives 
improved SBA's ability to process large numbers of disaster loan 
applications, others did not. For example, in October 2005, SBA 
established a satellite office to process disaster loans at its former 
Sacramento DAO.[Footnote 22] SBA increased the number of loan 
processing staff in this Sacramento satellite office from approximately 
40 in late August 2005 to more than 250 by February 2006. According to 
SBA, 8 months after Hurricane Katrina, the Sacramento satellite office 
had processed about 95,500 home and 4,800 business applications through 
DCMS for Gulf Coast hurricane victims.[Footnote 23] Table 3 describes 
other SBA changes or initiatives that improved its response to disaster 
victims by making the application process easier or referring some 
applicants to FEMA for grant assistance sooner. 

Table 3: Other Changes SBA Made after Gulf Coast Hurricanes That 
Improved Response to Disaster Victims: 

Name: Revised filing requirements for business applications[A]; 
Date: October 2005; 
Description: Reduced filing requirements for all business applicants, 
such as tax returns for past three years and monthly sales analysis 
because these records may have been destroyed. This initiative enabled 
victims to file their applications sooner. 

Name: Alternate loss verification methods; 
Date: October 2005; 
Description: Authorized loss verification staff to perform 
verifications for home loan applicants using third party documentation 
in certain areas and to verify property damages without the applicant 
being present in certain cases. 

Name: Revised preprocessing decline procedures; 
Date: November 2005; 
Description: Used DCMS to automatically decline applicants with credit 
scores indicating a high degree of default risk to refer applicants to 
FEMA for possible grant assistance sooner than the normal process. 

Source: GAO analysis of SBA data. 

[A] Change made for Hurricanes Katrina and Rita only. 

[End of table] 

In contrast to these actions, SBA implemented other initiatives that 
had more limited success. For example, in November 2005, SBA 
implemented the GO Loan Program. SBA intended for this program to 
expedite small business financing for communities severely impacted by 
Hurricanes Katrina and Rita. This program provided an 85 percent 
guaranty to qualified lending partners, such as banks, that agreed to 
make expedited loans available under the agency's 7(a) loan program up 
to $150,000 to small businesses located in communities affected by the 
disasters. Under the GO Loan Program, small businesses applied directly 
to qualified lenders, who evaluated their creditworthiness and 
determined if they required an SBA guaranty to make the loan. SBA 
agreed to make a decision on whether to apply a guaranty to the loan 
within 24 hours. While SBA prescribed the maximum interest rate lenders 
could charge, the lender and borrower negotiated the actual rate. For 
loans of $50,000 or less, lenders could charge a maximum interest rate 
of 6.5 percentage points over the prime rate and a maximum rate of 4.5 
percentage points over the prime rate for loans over $50,000. Thus, 
lenders could charge disaster victims interest rates that were 
significantly higher under the GO Loan Program than the rates SBA 
charged under the Disaster Loan Program. For example, a disaster victim 
applying for a $60,000 GO Loan could have been charged an interest rate 
up to 11.5 percent in November 2005 when the prime rate was 7 percent. 
In contrast, a business owner not able to obtain credit elsewhere would 
have received a 4 percent rate under the Disaster Loan Program. SBA 
only guaranteed 222 GO Loans totaling $19 million through May 2006. The 
higher interest rates lenders could charge under the GO Loan Program 
made these loans less attractive than SBA disaster loans and likely 
contributed to the small number of loans made under the program. 

In December 2005, SBA implemented a pilot program to expedite the 
processing of disaster loan applications. Under this program, DCMS made 
automatic approval recommendations for applicants with credit scores 
indicating that they were less likely to default on a loan, and loan 
officers did not have to conduct the lengthy repayment analysis for 
these applications. According to SBA, loan officers processed 8 to 10 
home loan applications per day, on average, under the pilot program-- 
about twice as many applications as under the normal process. However, 
loan officers did not review DCMS-generated approval recommendations 
until after the loss verification stage under the program. In addition, 
when SBA implemented the pilot program, the agency faced a significant 
backlog of 115,000 applications in the loss verification stage, and 
these applications had been in the queue for 39 days on 
average.[Footnote 24] As a result, SBA's data showed that the agency 
actually took longer to process expedited approvals compared with SBA's 
average processing time frames for all approvals. Specifically, SBA 
processed expedited approvals in about 104 days on average between 
December 2005 and April 2006, compared with 94 days for all approvals 
processed through the end of April 2006. If SBA had implemented this 
initiative sooner when the backlog in loss verification was not so 
large or if the agency had implemented an expedited loss verification 
process for these applications, the pilot program may have been more 
effective in reducing the amount of time disaster victims waited for a 
decision on their application. Table 4 describes other SBA actions or 
initiatives that did not significantly reduce the backlog of loan 
applications because they were either not implemented in a timely 
manner or did not fully incorporate the use of DCMS to process 
applications. 

Table 4: Other Changes SBA Made after Gulf Coast Hurricanes That Had 
Limited Success: 

Name: Give a Lending Hand Initiative; 
Date: November 2005; 
Description: Requested volunteers from the business lending community 
to help process business disaster loan applications. SBA hired only 14 
individuals under the initiative. 

Name: District office processing of disaster home loan applications; 
Date: January 2006; 
Description: Used district office staff to manually process home loan 
applications using paper copies of the loan applications. This was a 
labor and time intensive process because district office staff did not 
have access to DCMS, and SBA's Fort Worth PDC staff had to compile and 
ship files, make corrections to files returned, and input completed 
decisions into DCMS. 

Name: Presolicitation notice for loss verification services[A]; 
Date: January 2006; 
Description: Issued a presolicitation notice for contractors to perform 
loss verifications nearly 5 months after Hurricane Katrina. SBA decided 
not to issue a solicitation because the agency had significantly 
reduced the backlog of applications in loss verification by February 
2006. 

Name: Disaster Loan Partners; 
Date: February 2006; 
Description: Solicited proposals from local banks and other entities to 
process disaster loan applications. Similar proposal made by private 
sector banking association in October 2005. According to SBA, the 
agency decided to make three separate awards but received requests for 
debriefings from several unsuccessful entities. SBA determined it could 
not move forward on awarding specific task orders under the initiative 
until the agency conducted the debriefings, and the protests were 
resolved. 

Source: GAO analysis of SBA data. 

[A] Change made for Hurricanes Katrina and Rita only. 

[End of table] 

SBA May Be Able to Process Applications More Efficiently: 

DCMS provided SBA with opportunities to help the agency move toward a 
paperless processing environment by automating many of the functions 
the agency previously performed manually, such as obtaining FEMA 
referral data and credit bureau reports as well as completing and 
submitting loss verification reports from remote locations. SBA 
officials also told us that DCMS improved its ability to process 
disaster loans, and the agency would have experienced even greater 
processing delays using its previous system and loan process. However, 
we found other potential opportunities during our review that might 
help SBA to process loans more efficiently and move closer to its goal 
of processing loan applications within 21 days when faced with 
disasters. 

For example, SBA may be able to increase the efficiency of its 
application entry process by implementing a secure Internet-based 
application feature for home loan applicants. Currently, SBA accepts 
only paper loan application documents from disaster victims, and data- 
entry staff manually input application data into DCMS. According to the 
Direct Loan Systems Requirements issued by the Joint Financial 
Management Improvement Program, federal agency loan systems "should 
provide for an electronic application process using various media, such 
as a secure Internet application."[Footnote 25] SBA could reduce the 
number of paper application documents it receives, the number of 
documents it subsequently scans into DCMS, and the resources and time 
required to input application data by capturing much of this 
information electronically. According to SBA officials, DCMS has the 
capability to interface with a secure Internet-based application 
feature where this data could be captured electronically. However, SBA 
did not attempt to add this functionality after the Gulf Coast 
hurricanes because of the instability it initially experienced with 
DCMS. SBA officials added that the agency concentrated its efforts on 
expanding the capacity of DCMS and would examine adding this 
functionality to the system in the future. 

SBA officials told us that, prior to the Gulf Coast hurricanes, the 
agency initiated a business process reengineering effort within ODA to 
reevaluate the disaster loan process. As part of this effort, ODA 
planned to (1) determine what type financial analysis would be 
performed for applicants with credit scores indicating a high degree of 
default risk, (2) design a streamlined loan application (both paper and 
electronic), and (3) identify policy and legislative changes required 
to implement the new process. However, ODA postponed this effort after 
the Gulf Coast hurricanes because of the resources needed to meet the 
demands of the disaster loan program. Business process reengineering 
can help organizations identify, analyze, and redesign their core 
business processes with the aim of achieving dramatic improvements in 
critical performance measures such as cost, quality, service, and 
speed. According to SBA officials, it has plans to resume this effort 
in 2006 in order to identify ways to more efficiently process disaster 
loan applications and to maximize the benefits of DCMS. 

Conclusions: 

The Gulf Coast hurricanes presented SBA with unprecedented challenges 
that, in combination, led to significant backlogs and delays in 
processing disaster loan applications. For example, SBA faced the 
largest volume of disaster loan applications in its history, as the 
United States experienced three extremely destructive natural disasters 
over a period of about 2 months. This large volume was due in part to 
the large number of applicants automatically referred to SBA by FEMA's 
Internet site, many of whom ultimately did not qualify for disaster 
loans. We also agree that SBA should improve its screening process 
within DCMS when processing "$0 income" referrals and continue to work 
with FEMA to reduce unnecessary online disaster referrals, as 
recommended by SBA's Office of Inspector General. In addition, various 
system and processing-related issues also challenged SBA, such as a new 
disaster loan system that was not designed to effectively respond to a 
disaster of this magnitude and that was unable to operate at the 
planned maximum capacity. Moreover, SBA based the maximum number of 
concurrent users for DCMS solely on its historical experience rather 
than considering information available from catastrophe risk modeling 
firms and disaster simulations, such as the likelihood and severity of 
damages from potential catastrophes to help predict the volume of 
applications that it might expect from such events. While SBA has plans 
to greatly expand its capacity of concurrent users for DCMS and should 
be more capable of processing larger volumes of loan applications once 
it achieves this increased capacity, it is not clear how the agency 
determined the new maximum number of concurrent users and whether this 
new capacity will be appropriate to handle future large scale disasters 
like the Gulf Coast hurricanes. If SBA had considered information 
available from catastrophe risk modeling firms and disaster simulations 
to help predict the volume of loan applications it could expect to 
receive, SBA could have made better informed decisions and might have 
acquired additional capacity that could have enabled SBA to reduce the 
backlog of applications in a more timely manner. Such an analysis would 
also better position SBA to determine its loan processing capacity for 
future disasters. SBA's limited planning was further exacerbated by the 
lack of complete stress testing and the ineffective technical support 
provided by the hosting contractor. If SBA had appropriately stress 
tested the system before implementation, it might have discovered 
before the Gulf Coast hurricanes struck that it had received the 
incorrect computer hardware. Going forward, SBA would benefit from 
improving its process for verifying that the equipment provided by 
contractors meets all required specifications. 

While some of SBA's initiatives improved its response to disaster 
victims, other efforts did not help the agency significantly reduce the 
large backlog of applications because they were either not implemented 
in a timely manner, not attractive to the applicant, or did not fully 
incorporate the use of DCMS to process applications. If some of these 
initiatives had been implemented soon after the Gulf Coast hurricanes 
struck, they might have enhanced SBA's ability to process a large 
volume of loan applications in a timely manner. In addition, DCMS has 
the capability to interface with an Internet-based application feature 
that could reduce the resources and time required to input application 
data for home loan applicants by capturing much of this information 
electronically. As the 2006 Atlantic hurricane season has already 
begun, SBA would benefit by expediting its plans to resume its business 
processing reengineering efforts to analyze ways to more efficiently 
process loan applications, including an evaluation of implementing an 
Internet-based application feature. 

Recommendations for Executive Action: 

In order to provide more timely disaster assistance in the future, we 
recommend that the Administrator of SBA direct the Office of Disaster 
Assistance to take the following four actions: 

* reassess DCMS's maximum user capacity and related loan processing 
resource needs based on such things as lessons learned from the Gulf 
Coast hurricanes, a review of information available from catastrophe 
risk modeling firms and disaster simulations, and related cost 
considerations; 

* conduct complete stress testing to ensure that DCMS can function at 
planned for maximum user capacity levels; 

* improve management controls over assessing contractor performance 
through inspections of all equipment purchased or leased to support 
DCMS; and: 

* expedite plans to resume business process reengineering efforts to 
analyze the disaster loan process and identify ways to more efficiently 
process loan applications including an evaluation of the feasibility of 
implementing a secure Internet-based application feature for home loan 
applicants. 

Agency Comments and Our Evaluation: 

We provided SBA with a draft of this report for review and comment. The 
Associate Administrator for Disaster Assistance provided written 
comments that are presented in appendix III. In these comments, SBA 
provided additional context regarding the magnitude of the disasters 
and the impact on the Disaster Loan Program. SBA stated that it 
generally agreed with our recommendations and intended to improve the 
delivery of the Disaster Loan Program for events of all sizes. However, 
SBA disagreed with the following four findings and conclusions in our 
draft. 

First, SBA disagreed with our conclusions that it performed limited 
planning and that it would have been better prepared to reduce the 
backlog of applications through the use of catastrophe risk models 
rather than relying primarily on the Northridge earthquake to establish 
its capacity needs. As we noted in our report, SBA planned the maximum 
user capacity for DCMS based on the volume of applications it received 
from victims of the Northridge earthquake--the single largest disaster 
SBA had previously faced--and did not anticipate the likelihood of a 
single disaster or series of disasters of the magnitude of the Gulf 
Coast hurricanes. We continue to believe that catastrophe risk modeling 
firms and disaster simulations provide critical information, such as 
the likelihood and severity of damages from potential catastrophes. 
Combined with other elements of a comprehensive planning process, such 
information would have been useful in planning the maximum user 
capacity of DCMS. If SBA had considered this information, the agency 
may have concluded that the likelihood of large scale disasters 
exceeding the magnitude of the Northridge earthquake was significant 
enough to expand its maximum concurrent user requirement. This 
additional capacity would have better prepared SBA to reduce the 
backlog of loan applications more rapidly because additional staff in 
all phases of the loan application process would have been able to 
access DCMS. 

Second, SBA stated in its comments that our draft report does not 
include an analysis of the difference between using DCMS and ALCS-- 
SBA's previous system. SBA also highlighted in its comment letter many 
of the benefits offered by DCMS. While it was not in the scope of our 
work to conduct a comparative analysis of ALCS and DCMS, our report 
recognized some of the benefits realized by adopting DCMS. For example, 
we noted that ALCS tracked the movement of paper loan application files 
from one stage of the loan process to another and required the movement 
and storage of large volumes of paper. We also noted that DCMS helped 
SBA move toward a paperless processing environment by automating many 
of the functions staff members had performed manually using ALCS such 
as obtaining FEMA referral data and credit bureau reports, as well as 
completing and submitting loss verification reports from remote 
locations. 

Third, SBA stated that the draft report does not indicate that the 
specific computer components, which the hosting contractor incorrectly 
provided, were processing chips that were embedded subcomponents of the 
computer servers, which SBA personnel could only detect by opening and 
dismantling the computer hardware. We agree that the hardware was 
embedded in the computer servers and could have been verified by 
physical inspection. SBA conducted such an inspection in September 
2005. However, alternative ways of verifying the computer hardware were 
possible. For example, SBA staff could have used its system utilities 
to view details of the hardware and operating system after the 
processors were installed and may have detected the incorrect 
processors and taken corrective actions in a more timely manner. 

Finally, SBA took issue with our finding that it actually took longer 
to process expedited approvals under a pilot program, compared with its 
average processing time frames for all approvals. SBA stated that our 
interpretation of the data was misleading because it did not adjust for 
the length of time an application was in the loss verification 
inventory before being assigned to the loan department for processing. 
We disagree that our interpretation of the data was misleading because 
all physical disaster loan applications had to go through loss 
verification before a decision was made, regardless of whether the 
application was part of the expedited pilot program. While the 
expedited approval pilot program may have reduced the amount of time 
for loan officers to complete the underwriting decision, our intent, 
consistent with our overall objective, was to show the total time 
disaster victims waited for SBA to make a decision on their 
application. This includes the time an application is in other stages 
of the disaster loan process, such as application entry and loss 
verification. As we noted in our report, SBA implemented the pilot 
program when the agency faced a significant backlog of 115,000 
applications in the loss verification stage, and these applications had 
been in the queue for 39 days on average. SBA's data showed that the 
agency actually took longer to process expedited approvals, about 104 
days on average, compared with 94 days on average for all approvals. We 
continue to believe that it is appropriate to consider the total 
processing time frames when comparing applications approved under the 
pilot program with all approved applications. 

SBA also provided other technical corrections and comments, which have 
been incorporated in this report, where appropriate. 

We are sending copies of this report to appropriate congressional 
committees, the Administrator of the Small Business Administration, and 
other interested parties and will make copies available to others upon 
request. In addition, the report will be available at no charge on the 
GAO Web site at [Hyperlink, http://www.gao.gov.]

If you or your staff have any questions regarding this report, please 
contact me at (202) 512-8678 or shearw@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on 
the last page of this report. GAO staff who made major contributions to 
this report are listed in appendix IV. 

Signed by: 

William B. Shear: 
Director, Financial Markets and Community Investment: 

List of Addressees: 

The Honorable William Thad Cochran: 
Chair: 
Committee on Appropriations: 
United States Senate: 

The Honorable Susan M. Collins: 
Chair: 
The Honorable Joseph I. Lieberman: 
Ranking Minority Member: 
Committee on Homeland Security and Governmental Affairs: 
United States Senate: 

The Honorable Olympia J. Snowe: 
Chair: 
The Honorable John F. Kerry: 
Ranking Minority Member: 
Committee on Small Business and Entrepreneurship: 
United States Senate: 

The Honorable Richard C. Shelby: 
Chair: 
The Honorable Barbara A. Mikulski: 
Ranking Minority Member: 
Subcommittee on Commerce, Justice, and Science: 
Committee on Appropriations: 
Unites States Senate: 

The Honorable Tom Davis: 
Chair: 
The Honorable Henry A. Waxman: 
Ranking Minority Member: 
Committee on Government Reform: 
House of Representatives: 

The Honorable Donald Manzullo: 
Chair: 
The Honorable Nydia M. Velazquez: 
Ranking Minority Member: 
Committee on Small Business: 
House of Representatives: 

The Honorable Frank R. Wolf: 
Chair: 
The Honorable Alan B. Mollohan: 
Ranking Minority Member: 
Subcommittee on Science, State, Justice, Commerce, and Related 
Agencies: 
Committee on Appropriations: 
House of Representatives: 

The Honorable Dianne Feinstein: 
United States Senate: 

The Honorable Mary L. Landrieu: 
United States Senate: 

[End of section] 

Appendix I: Scope and Methodology: 

In this report, we evaluate: (1) what affected the Small Business 
Administration's (SBA) ability to provide timely disaster assistance 
and (2) the actions SBA took after the disasters to improve its 
response to disaster victims. This report focuses primarily on the 
Disaster Credit Management System (DCMS) and the disaster loan process. 
We visited the Gulf Coast region to observe conditions and meet with 
federal, state, and local officials and victims of the disasters. We 
also interviewed officials from the Office of Disaster Assistance at 
SBA's headquarters and officials from the Processing and Disbursement 
Center in Texas, Field Operations Centers East and West in Georgia and 
California, Customer Service Center in New York, DCMS Operations Center 
in Virginia, and Georgia District Office. We reviewed SBA's standard 
operating procedures for approving, declining, and withdrawing disaster 
loans. In addition, we reviewed documents related to the agency's 
response to the Gulf Coast hurricanes, congressional testimony, and 
other program documentation. 

We reviewed documents related to SBA's acquisition and implementation 
of DCMS. In addition, we discussed the acquisition process with 
officials from SBA's DCMS Operations Center, which provides technical 
and program management support for the system. We also reviewed SBA's 
standards for system development and compared the acquisition process 
for DCMS with industry standards for effective information technology 
acquisition. Further, we interviewed officials from SBA's Office of 
Inspector General and reviewed their reports related to the 
implementation of DCMS and SBA's Disaster Loan Program. We did not 
conduct a comparative analysis of DCMS and ALCS--SBA's previous system-
-as part of our work. To obtain the perspectives of system users, we 
interviewed loan processing staff at various SBA locations. We also 
obtained SBA's total costs for planning, acquiring, and implementing 
DCMS through April 2006. However, we did not audit the reported costs 
and thus cannot attest to their accuracy or completeness. 

We obtained documents related to the performance of DCMS, including 
system status reports, troubleshooting reports, and system change 
requests. We reviewed these documents to assess the extent to which 
system-related problems detailed in the documents affected SBA's 
ability to provide timely disaster assistance. In addition, we obtained 
various reports on SBA's disaster lending activity for victims of 
Hurricanes Katrina, Rita, and Wilma. We used these reports to calculate 
descriptive statistics on the number of applications mailed and 
received, the number and amount of approved loans, the backlog of 
applications in various stages, and other characteristics for 
applications processed through May 27, 2006. For comparative purposes, 
we also obtained summary statistical reports related to SBA's disaster 
lending for past significant disasters. We also obtained data extracts 
from DCMS of disaster loan applications SBA received from victims of 
Hurricanes Katrina, Rita, and Wilma for various dates. We used the 
extracts to calculate average time frames for various stages of the 
disaster loan process. 

In assessing the reliability of SBA's data, we reviewed documents such 
as the DCMS Privacy Act Assessment and met with appropriate SBA 
officials. To increase our confidence in the reliability of SBA's data, 
we compared information from selected hard copy application files with 
the information recorded in DCMS. We also performed various tests of 
the information in the data extracts we obtained to ensure the 
completeness of the data. We concluded that SBA's data were 
sufficiently reliable for the purposes of our report. 

To evaluate actions SBA took after the disasters to improve its 
response to disaster victims, we reviewed documents related to changes 
SBA made to DCMS and changes SBA planned to make to the system. We 
discussed these changes with officials from SBA's DCMS Operations 
Center. In addition, we obtained and reviewed documents related to 
changes SBA made to the disaster loan process and other initiatives 
intended to improve SBA's response to disaster victims. We discussed 
these changes and initiatives with the appropriate SBA officials and 
obtained data on the impact of these efforts where available. 

We reviewed documents related to the Federal Emergency Management 
Agency's (FEMA) Individuals and Households Program, which makes 
assistance available to victims of major disasters. We also contacted 
FEMA to obtain additional information regarding the agency's process 
for referring applicants to SBA's Disaster Loan Program. 

We performed our work in Atlanta, Ga; Buffalo, N.Y; Fort Worth, Tex; 
New Orleans and Metarie, La; Sacramento, Calif; Bay St. Louis, Biloxi, 
Gulfport, and Waveland, Miss; Herndon, Va; and Washington, D.C. We 
conducted our work between November 2005 and July 2006 in accordance 
with generally accepted government auditing standards. 

[End of section] 

Appendix II: SBA's Acquisition and Implementation of the Disaster 
Credit Management System: 

Since the early 1990s, SBA utilized its Automated Loan Control System 
to track the movement of paper application files from each stage of the 
process until it made a decision on the application, disbursed funds 
for approved applications, and transferred the application file to 
servicing. SBA also obtained data manually from external data sources, 
including FEMA, the Internal Revenue Service (IRS), and the credit 
reporting agencies. In December 1998, after using a significant number 
of resources in response to victims of Hurricane Georges, which struck 
Puerto Rico that previous September, SBA began an effort to modernize 
its manual and paper-based disaster loan process. 

SBA intended for its new disaster loan system to support: (1) a 
"paperless" electronic loan application and loan process, (2) loan 
processing from any location where the system is implemented, (3) 
multiple interaction methods between loan applicants and the Office of 
Disaster Assistance (e.g., by Internet or telephone), and (4) access to 
external data sources. The modernization effort entailed the following 
actions: 

* documenting SBA's current loan process and proposed future loan 
process; 

* performing requirements analysis, conducting a commercial-off-the- 
shelf (COTS) market survey, and developing a business case; 
and: 

* acquiring, customizing, and implementing the system. 

In March 1999, SBA completed a business process reengineering study to 
document the current process and proposed future process. In August 
2000, SBA completed the initial development of the new system 
requirements. Subsequently, SBA contracted for a COTS survey of 
products meeting its requirements and leveraging its other information 
technology resources. The survey identified two products that met a 
significant number of SBA's requirements, with some customization and 
integration of additional products needed to meet all requirements. 

After the contractor completed the survey, SBA's information technology 
investment review board required the agency to complete a business case 
analysis for the proposed disaster loan system. SBA's analysis involved 
researching the existing requirements, evaluating potential 
alternatives, and providing a recommendation. In March 2001, SBA 
completed the analysis, which evaluated three alternatives: (1) develop 
a custom solution, (2) acquire a COTS product, or (3) stay with the 
current environment. SBA determined that the COTS product represented 
the best solution after considering the costs and time frames 
associated with each alternative. 

In June 2002, a SBA contractor developed more specific requirements for 
the project because a considerable amount of time had passed since the 
first survey and because of the uniqueness of certain aspects of the 
disaster loan process, such as loss verification and a check for 
duplication of benefits. Later that year, SBA contracted for a separate 
COTS survey that utilized the Carnegie Mellon University's Software 
Engineering Institute process for evaluating COTS products.[Footnote 
26] SBA evaluated products from 10 different vendors, and after 
narrowing the selection to two products, received vendor demonstrations 
in January 2003. In March 2003, the contractor recommended a COTS 
product for SBA to use as the foundation for the Disaster Credit 
Management System (DCMS). 

In September 2003, SBA completed an analysis of the DCMS design to 
identify potential gaps between the recommended COTS product and the 
requirements for the system. For example, SBA recognized that the COTS 
product did not have the functionality to perform loss verification 
activities; therefore, SBA decided to implement a custom loss 
verification application and link the application to the core system. 
This ensured that loss verification data would automatically 
synchronize with DCMS. 

In 2003, SBA also began to test various aspects of its new system. In 
November 2003, the agency began testing the core application, 
interfaces, and additional components (loss verification, scanning, 
etc.) User validation readiness testing was conducted between December 
2003 and March 2004. In October 2004, SBA contracted for an Independent 
Verification and Validation (IV&V) of an initial release of DCMS. An 
IV&V can help provide reasonable assurance that a system satisfies its 
intended use and user needs, and its use is recognized as an industry 
best practice. The IV&V conducted for DCMS found that the system was 
supported by strong requirements, test plans, test cases, and other 
supporting documentation. In addition, the IV&V found that DCMS was 
developed with a high level of user involvement. However, the IV&V did 
not evaluate performance testing, including tests to help ensure that 
the system could function at its maximum user capacity, because these 
tests were not completed until December 2004 after the agency had begun 
implementation. This performance testing was conducted with only up to 
120 concurrent users due to problems with the hardware associated with 
the testing environment. If the testing environment had functioned as 
planned, it was estimated the system could accommodate approximately 
600 concurrent users. 

SBA used a phased approach for implementing DCMS. In November 2004, SBA 
first implemented DCMS in its Niagara Falls, New York, Disaster Area 
Office. In January 2005, SBA implemented DCMS in its Fort Worth, Texas, 
and Sacramento, California DAO. SBA also began using DCMS to process 
applications for all new disaster declarations. As figure 6 
illustrates, SBA's process of moving from its former manual, paper- 
based disaster loan process to a more automated process using DCMS took 
about 6 years. SBA's costs for planning, acquiring, implementing, and 
operating DCMS totaled about $32 million through April 2006. 

Figure 6: Time Line of DCMS Activities: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

[End of section] 

Appendix III: Comments from the Small Business Administration: 

U.S. Small Business Administration: 
Washington, D.C. 20416: 

July 17, 2006: 

William B. Shear: 
Director: 
Financial Markets and Community Investment: 
United States Government Accountability Office: 
441 G Street N.W. 
Washington, DC 20545: 

Dear Mr. Shear: 

We appreciate the opportunity to provide comments on the U.S. Small 
Business Administration's (SBA) response to the catastrophic Hurricanes 
Katrina, Rita and Wilma in 2005 as articulated in the Government 
Accountability Office's (GAO) draft report entitled Small Business 
Administration, Actions Needed to Provide More Timely Disaster 
Assistance. 

In reviewing SBA's performance to this unprecedented series of events 
we think it is helpful to fully appreciate the context of these 
hurricanes as well as the long-term recovery efforts of the Agency. In 
the summer and fall of 2005, Hurricanes Katrina, Rita and Wilma 
destroyed significant portions of Louisiana, Mississippi, Alabama, 
Florida and Texas. These hurricanes wrecked devastation on home and 
business owners and collectively represent the worst natural disaster 
in American history. The declared disaster area was approximately 
90,000 square miles, covering an area equivalent to that of Great 
Britain. The after-effects of the hurricanes, including the devastation 
of critical infrastructure, damage to roads and bridges, loss of basic 
utilities (i.e., electrical, gas, water), hampered communications, and 
the inability to access parts of the disaster area in order to perform 
damage inspections also adversely affected the speed at which SBA was 
able to deliver its Disaster Loan Program. 

The magnitude of these disasters caused over 420,000 home and business 
owners to apply for SBA assistance. To date, SBA has approved over 
154,000 disaster loans for over $10.2 billion to victims of these 
horrific storms. Put into context 20 percent of all the disaster loan 
dollars approved in the 53-year history of SBA occurred this past 
disaster season. The Gulf Coast hurricanes represent the largest 
collection of disasters the Agency has ever faced, vastly surpassing 
our previous largest disaster, the Northridge earthquake in 1994, where 
we received approximately 250,000 applications and approved over $4 
billion in disaster loans. 

To build from the lessons learned from 2005, and in preparation for the 
2006 Hurricane season. SBA convened an Agency-wide Disaster Oversight 
Council comprised of Agency leadership as well as other key senior 
personnel. The purpose of-the Disaster Oversight Council was to better 
leverage the resources of the Agency as a whole, and incorporate new 
ideas and best practices from SBA program areas into our disaster 
preparedness capability. To pre-position the Agency, SBA has completed 
a series of process improvements and reengineering initiatives to 
improve service delivery, which include the following: 

* Upgraded System Capacity. Today the Disaster Credit Management System 
(DCMS) has been tested and verified to support a minimum of 8,000 
concurrent users. This represents a four-fold increase in capacity over 
peak usage during the 2005 Gulf Coast hurricanes. 

* Enhanced Disaster Workforce. SBA's Disaster Assistance capability 
expands and contracts in size based on level of disaster activity. 
Prior to Hurricane Katrina making landfall, SBA had about 800 employees 
on the payroll but quickly surged to over 4,300 employees in response 
to these unprecedented storms. Today, SBA's Disaster Loan Program has 
roughly 3,500 employees across all key functions. Additionally, SBA has 
selected over 1,000 employees in the expansion of the Disaster reserve 
corps. The number of trained employees on board and in the reserve core 
increases the Agency's capacity to quickly respond to catastrophic 
events in 2006 if required. 

* Partnered with Private Sector. As a result of the unprecedented 
application volume received. SBA created the Disaster Loan Partners 
Initiative and selected three private sector contracts to assist with 
SBA's loan processing and loan closing activities. This unique 
partnership with the private sector provides the Agency with additional 
experienced personnel to enhance program delivery to disaster victims. 

* Leveraged SBA's Nationwide Infrastructure. During the 2005 Hurricane 
season, the Agency utilized SBA's nationwide District Office 
infrastructure to handle increased disaster activity. 

* Expanded Agency Footprint. The Agency has secured over 400,000 sq. 
ft. of space for the current disaster season in multiple locations 
across the country. SBA estimates that this should be sufficient to 
accommodate infrastructure needs for the 2006 Hurricane season. 
However, maintaining this high level of overhead is costly given the 
variable nature of disasters. SBA has a fiscal responsibility to the 
taxpayers and must evaluate if the resources required to maintain this 
space on a continual basis are realistic, cost-effective, or if other 
alternatives exist. 

* Bolstered Forecasting Ability and Risk Monitoring Procedures. The 
Agency has enhanced its capability to immediately forecast application 
volumes when disasters strike. This new model - which includes a 
flexible tool for forecasting purposes - provides a more robust 
methodology for predicting application volume based on assets at risk 
and disaster characteristics. 

* Developed Disaster Scalability Preparedness Tool. The Agency now 
possesses the capability to determine resource needs - financial, human 
capital (by function), and logistics - required to maximize SBA's 
response against a number of different application volume scenarios. 
Action plans that support the requirements outlined in each scenario 
continue to be refined. 

* Enhanced Communications. The SBA is focused on a two pronged 
communications strategy for the current disaster season-emphasizing the 
need for disaster preparedness, and outreach to the public and the 
media about available resources once a disaster is declared-: 

In reviewing the draft report, it seems to place an unreasonable and 
unwarranted emphasis on some key points. More specifically, we disagree 
with the auditors' conclusions SBA performed limited planning, 
resulting in insufficient DCMS user capacity, and that through the use 
of catastrophe risk models we would have been better prepared to reduce 
the backlog of applications. Additionally, the draft report focuses on 
the challenges SBA faced during the response to the 2005 Hurricanes 
without recognizing the improved capability afforded by implementation 
of our recently released new technological platform. 

The draft report indicates that SBA should have used results of data 
from catastrophe risk modeling to plan for the appropriate level of 
DCMS maximum users. Further the draft report indicates that SBA should 
use catastrophic modeling to predict the capacity needed to process the 
volume of activity as a result of such events. However, the report 
provides little guidance on how SBA could use such modeling to 
determine the system requirements. Additionally, the report fails to 
reflect that SBA did design the DCMS to handle the largest disaster it 
had ever faced, the Northridge earthquake, which had produced 
application volume far greater than SBA's usual demand, SBA's only 
failure was to be unable to anticipate a disaster that doubled that 
extraordinary demand SBA strongly suggests that report reflect this set 
of facts. 

The draft report also fails to offer an analysis of the difference 
between using the DCMS system and using SBA's prior, antiquated 
Automated Loan Control System (ALCS) in response to such to such 
catastrophic events. Such a comparison would have revealed that SBA was 
able to handle a disaster twice the size of the Northridge earthquake 
in the same amount of time or less. As a result, the report only 
responds to the potential adverse impact of DCMS related issues to the 
response, and not to the positive contributions offered by the new 
technology. While it is difficult to perform a comparative analysis to 
quantify the benefits of the new technology, there are opportunities 
throughout the report to demonstrate a better balance between the 
benefits of the new system and the problems with the old. 

We suggest that GAO include the immediate improvements of DCMS response 
times to ODA's loan making function in the report, such as: 

* Electronic case files versus paper case files: 

* Automated workflow within DCMS eliminates hundreds of staff who 
performed file control processes: 

* Automated credit report pull for every application eliminates manual 
process. 

* Loss verification assignments are sent and completed inspections 
returned through data sync via secure internet connection eliminating 
file shipping costs and time associated with loss verifier deployment. 

* Loss verification process automated with pre-defined data and 
formulas to eliminate manual steps. 

* Scanning component integrates into the electronic data file to 
provide access to multiple users without need to physically transport 
paper records. 

* Implemented automated loan closing checklist eliminates manual 
creation of document for each case. 

* New interface with the Federal Emergency Management Agency (FEMA) for 
automated Duplication of Benefits retrieval eliminates manual access 
and printing of multiple pages of data. 

* New interface with SBA loan accounting system for automated queries 
on previous loan history of loan applicants eliminates manual search 
and printing of records. 

* New interface to update SBA co-borrower and guarantor data eliminates 
manual data entry. 

* Implemented certain achievable process improvements such as 
reengineered application screening process, pre-processing decline and 
referral process, auto-decline process, expedited approval process, and 
other policy changes relative to system enabled improvements. 

The draft report states that SBA did not verify whether the hosting 
contractor provided the correct computer equipment in contradiction to 
Federal procurement policies. It is true that SBA acquired leased 
equipment which did not contain all of the correct components. However, 
the report fails to point out that the specific components that were 
not correctly provided were the processing chips, embedded 
subcomponents of the servers that could not be detected unless SBA 
personnel had actually opened and dismantled the servers. 

We also believe that the findings in the draft report are misleading 
regarding SBA's pilot of "expedited approvals." We believe that GAO's 
interpretation of the data is misleading because it does not adjust for 
the length of time a file was in loss verification inventory before 
being assigned to the loan department for processing. The conclusion 
that applications took longer to process under the expedited rules is 
not an accurate representation due to the fact that these applications 
were in loss verification and an inspection of the disaster-damaged 
property had to be scheduled and completed before performing the 
financial analysis in loan processing. Once the damage inspection was 
completed, the amount of time to complete the underwriting decision was 
substantially decreased, thus resulting in a shorter wait for a loan 
decision. We believe a more accurate comparison would have been the 
amount of time it took to process "expedited loan approvals" versus 
applications that were processed in the normal manner from the date the 
application was assigned to the loan department to the date of loan 
decision. Inclusion of the days an application was in departments such 
as loss verification prior to loan processing does not accurately 
reflect the positive impact of the pilot program to notify applicants 
of approval decisions faster. 

We note that the comments in the recommendations section in the draft 
report suggest several ways to better improve our program performance. 
We generally agree with the recommendations and intend to improve the 
delivery of our program for events of all sizes. Our response to the 
recommendations is as follows: 

Recommendation 1, Reassess DCMS maximum user capacity. SBA agrees with 
the need to reassess the DCMS maximum user capacity and related 
processing resource needs. To a large extent, this process began during 
the response to the 2005 hurricanes and achievement of an immediate 
step has recently been completed through the implementation of the 
upgraded DCMS hardware which will support in excess 48,000 concurrent 
users. The new hardware was put into production use an June 12, 2006, 
Further efforts to enhance productivity and overall system capacity are 
on-going. The utilization of catastrophe risk models and disaster 
simulations is being considered as part of the disaster planning 
process, and to the extent these processes are useful, SBA will 
incorporate best practices. 

Recommendation 2, Improve management controls over assessing contractor 
performance. SBA has management controls in place to assess contractor 
performance through daily, weekly, and monthly reviews of the technical 
and operational requirements. These repeatable processes were put in 
place during the 2005 disaster response and have been maintained ever 
since. In addition, the DCMS hardware upgrade project was completed 
with a comprehensive and thorough detailed inspection of all equipment 
acquired to support DCMS. Even with these controls in place, the Agency 
will look for additional ways we can improve DCMS contractor oversight. 

Recommendation 3, Conduct complete stress testing on DCMS. The new DCMS 
hardware has undergone significant performance testing prior to release 
to production. The capabilities of the new system are substantially 
improved beyond the previous production environment. SBA will continue 
to enhance the DCMS software and hardware components to further 
optimize performance and capabilities, and will perform additional 
stress testing; as necessary, to assess the impact of these changes to 
the new baseline. 

Recommendation 4, Expedite plans to resume business process 
reengineering. SBA intends to resume its efforts to reengineer its 
business processes in the disaster program, including revised process 
flows for applications and to provide a secure internet-based 
application feature for home and business disaster loan applicants. 

We appreciate the opportunity to provide clarifying comments and have 
included our specific requests for clarifications and/or changes within 
the attachment herein. 

Sincerely, 

Signed by: 

Herbert L. Mitchell: 
Associate Administrator for Disaster Assistance: 

[End of section] 

Appendix IV: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

William B. Shear, (202) 512-8678, s [Hyperlink, shearw@gao.gov] 
hearw@gao.gov: 

Staff Acknowledgments: 

In addition to the individual named above, Daniel Blair, Assistant 
Director; Barbara Oliver, Assistant Director; Bernice Benta; Tania 
Calhoun; Marshall Hamlett; Marc Molino; David Pittman; Jennifer 
Popovic; Rhonda Rose; and Eric Trout made key contributions to this 
report. 

(250263): 

FOOTNOTES 

[1] Preliminary estimates as reported by the National Oceanic and 
Atmospheric Administration. 

[2] In this report, we refer to Katrina, Rita, and Wilma collectively 
as the Gulf Coast hurricanes. 

[3] The objectives of this subsequent review are to determine (1) the 
extent to which SBA has a comprehensive disaster response plan and, if 
so, how it affected the agency's ability to provide timely assistance 
to Gulf Coast hurricane victims; (2) how work force transformation 
affected SBA's ability to respond to victims; (3) how SBA's efforts to 
modify its regulatory and programmatic authority compared with previous 
major disasters; and (4) what outreach strategy SBA used to inform 
victims about the disaster loan program. 

[4] SBA's hosting contractor provides services such as monitoring the 
DCMS network and providing support for leased computer hardware. 

[5] Stress testing refers to measuring a system's performance and 
availability in times of particularly heavy or peak load. 

[6] In this report, we refer to 21 days as the goal because SBA tells 
disaster victims that it will try to make a decision on each completed 
application within this time frame. According to SBA, the agency's 
Government Performance and Results Act goal for fiscal year 2006 is to 
process 85 percent of home loan applications within 14 days and 85 
percent of business applications within 16 days. 

[7] FEMA also refers to the IHP program as Individual Assistance (IA). 

[8] SBA provides the income thresholds to FEMA, which vary based on the 
applicant's household size and are adjusted annually for inflation. For 
example, SBA's minimum income threshold for fiscal year 2005 was 
$13,965 for a household size of one; 
the threshold increased to $14,355 for fiscal year 2006. If the 
applicant's household income falls below the income thresholds, FEMA 
will automatically refer them to its Other Needs Assistance Program. 
This program provides financial assistance to individuals and 
households who have other disaster-related necessary expenses or 
serious needs, such as medical expenses. 

[9] According to SBA's procedures, an acceptable application is one 
that has a signed and reasonably completed application form and a fully 
completed and signed Tax Information Authorization (Internal Revenue 
Service Form 8821) for each required taxpayer or entity. SBA returns 
unacceptable applications and requests the information needed to make 
the application acceptable. 

[10] SBA does not conduct the preliminary financial analysis for home 
loan applicants indicating that they (1) are the sole proprietor of a 
business; (2) have household income which includes rents, farms, or 
other nonsalary sources (not including disability, social security 
pension, etc.); or (3) have household income in excess of $50,000. 
According to SBA officials, the preliminary financial analysis is not a 
valid measure of repayment ability for these individuals because their 
financial circumstances are more complex or their income may be able to 
support a higher debt level. In these cases, SBA officials stated that 
a more thorough financial analysis is warranted, and these applications 
go through the normal process. 

[11] FEMA does not provide assistance to cover business-related losses. 

[12] Economic injury loan applications move directly to the application 
processing stage after application entry. 

[13] SBA is required to determine whether applicants are able to obtain 
financial assistance at reasonable rates and terms from nongovernment 
sources prior to assigning an interest rate. A higher interest rate 
applies for physical disaster loan applicants determined to have credit 
elsewhere, and business physical disaster loan applicants are subject 
to a maximum 3-year term for repayment. Economic injury disaster loan 
applicants are not eligible for disaster loans if SBA determines they 
can obtain credit elsewhere. For the Gulf Coast hurricanes, disaster 
victims unable to obtain credit elsewhere were assessed an interest 
rate of 2.687 percent for home loans and 4 percent for business loans 
and nonprofit organizations. Disaster victims that could obtain credit 
elsewhere were assessed an interest rate of 5.375 percent for home 
loans, 6.557 percent for business loans, and 4.75 percent for nonprofit 
organizations. 

[14] According to SBA procedures, legal review staff members generally 
do not review draft loan authorization and agreements for unsecured 
loans. 

[15] For victims of the Gulf Coast hurricanes, SBA increased to 
$50,000, the maximum initial disbursement for physical disaster loans 
with collateral. 

[16] SBA reorganized its Office of Disaster Assistance in 2005 as part 
of its workforce transformation initiative. SBA centralized all loan 
processing functions for account application and account processing at 
its former Ft. Worth (Texas) DAO, which became its PDC. SBA 
consolidated field operations, verification, congressional, and public 
information office functions at its former Atlanta (Georgia) DAO and 
Sacramento (California) DAO, which became its Field Operations Centers 
East and West. SBA centralized all victim-related support functions at 
its former Niagara Falls DAO, which became its Buffalo (New York) 
Customer Service Center. 

[17] SBA Office of Inspector General, "Disaster Application Referrals 
with $0 Income from FEMA Online Registration Have Increased Costs and 
the Demand for SBA Resources," Advisory Memorandum 06-12 (Feb. 17, 
2006). 

[18] Risk Management Solutions, "The 1906 San Francisco Earthquake and 
Fire: Perspectives on a Modern Super Cat" (2006). 

[19] AIR Worldwide Corporation, "Insuring and Mitigating the Risk of 
Large-Scale Natural Disasters" (2006). 

[20] Office of Management and Budget, "Management Oversight of Service 
Contracting," Policy Letter No. 93-1 (May 18, 1994). 

[21] For more information, see GAO, Aviation Security: Secure Flight 
Development and Testing Under Way, but Risks Should Be Managed as 
System Is Further Developed, GAO-05-356 (Washington, D.C.: Mar. 28, 
2005). 

[22] SBA had planned to phase out loan processing operations at this 
office by the end of October 2005, as it became the Field Operations 
Center West under SBA's transformation initiative. 

[23] SBA also used the Sacramento satellite office to process about 
10,700 home loan applications for smaller disaster declarations. 

[24] Applications for Hurricanes Katrina and Rita only. 

[25] The Joint Financial Management Improvement Program is a joint and 
cooperative initiative to improve financial management practices in the 
government and was authorized under the Budget and Accounting 
Procedures Act of 1950. The program promotes strategies and guides 
financial management improvement across government; reviews and 
coordinates central agencies' activities and policy promulgations; and 
acts as a catalyst and clearinghouse for sharing and disseminating 
information. See JFMIP Direct Loan System Requirement: June 1999. 

[26] The Software Engineering Institute has identified specific 
processes and practices that have proven successful in fostering 
quality software development. The processes and practices identified 
focus on software development and acquisition activities. The institute 
has constructed models for developing and acquiring software, 
developing and implementing software process improvement programs, and 
integrating hardware and software. The institute created the models to 
provide general guidance for software development and acquisition 
activities that programs can tailor to meet their needs (See GAO, 
Defense Acquisitions: Stronger Management Practices Are Needed to 
Improve DOD's Software-Intensive Weapon Acquisitions, GAO-04-393 
(Washington, D.C.: Mar. 1, 2004). 

GAO's Mission: 

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; 
evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000: 

TDD: (202) 512-2537: 

Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director, 

NelliganJ@gao.gov 

(202) 512-4800 

U.S. Government Accountability Office, 

441 G Street NW, Room 7149 

Washington, D.C. 20548: