SBA Loan Monitoring System:

Substantial Progress Yet Key Risks and Challenges Remain

AIMD-00-124: Published: Apr 25, 2000. Publicly Released: Apr 25, 2000.

Contact:

Linda D. Koontz
(202) 512-3000
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Pursuant to a congressional request, GAO reviewed the Small Business Administration's (SBA) progress in performing planning actions for its loan monitoring system.

GAO noted that: (1) SBA had made substantial progress in completing the eight planning actions mandated by the Small Business Reauthorization Act of 1997 but still had to complete work for some actions and implement key functions to effectively manage the development of the loan monitoring system; and (2) this report transmits GAO's recommendations to assist SBA in completing work for the eight planning actions and in strengthening its information technology management practices.

Status Legend:

More Info
  • Review Pending-GAO has not yet assessed implementation status.
  • Open-Actions to satisfy the intent of the recommendation have not been taken or are being planned, or actions that partially satisfy the intent of the recommendation have been taken.
  • Closed-implemented-Actions that satisfy the intent of the recommendation have been taken.
  • Closed-not implemented-While the intent of the recommendation has not been satisfied, time or circumstances have rendered the recommendation invalid.
    • Review Pending
    • Open
    • Closed - implemented
    • Closed - not implemented

    Recommendations for Executive Action

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should perform benefit-cost analyses for systems alternatives to increase the probability that SBA will obtain a system that meets its needs at the lowest cost.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: In January 2002, SBA contracted for assistance to identify alternatives and provide recommendations for further developing a loan monitoring system. SBA also chartered a loan monitoring system project management board with overall leadership and responsibility for the vision, direction, and results of the loan monitoring system effort. The contractor provided a report on alternatives in June 2002. Subsequently, the board decided to stop the development of the system and, in April 2003, SBA contracted with Dun & Bradstreet to provide loan and lender monitoring services.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should develop the information architecture's rules and standards for interoperability and maintainability of interrelated systems.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA has developed the "SBA Enterprise Architecture Program Policies and Procedures." The policy became effective on August 1, 2003, and requires all systems development and infrastructure information technology projects to follow a standard set of enterprise architecture policies, procedures, and processes in planning, executing, and maintaining information technology at SBA. The document contains policy and standards for the interoperability and maintainability of interreleated systems.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should identify high-level requirements for all internal reports and define detailed input and output data elements necessary for the timely generation of reports.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA changed its strategy regarding the Loan Monitoring System. SBA stopped the development of that system and in April 2003, contracted with Dun & Bradstreet to provide loan and lender monitoring services. In acquiring these services, SBA's statement of work requested a loan monitoring capability that would apply monitoring and evaluation services to existing loan data, apply industry standards and best practices for loan and lender monitoring, and enable SBA to identify high-risk lenders for their loan programs. In addition, SBA provided a layout of the data fields used in its main databases and a data requirements matrix. Dun & Bradstreet provides SBA with standard lender performance reports each quarter. These reports are based on profiles of each loan and lender portfolio.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should complete the definition of specific data quality standards, develop a schedule of planned actions to improve data quality in the current systems, and implement data quality measures.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA changed its strategy regarding the Loan Monitoring System. In 2003 SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA has established controls to help ensure the integrity of the data entered in the Dun & Bradstreet database. These controls are intended to ensure that misstatements or inaccuracies are detected and corrected on a timely basis, and the level of data errors in the system would not significantly affect the loan monitoring service's risk profiling capabilities. SBA's monthly reconciliation process, combined with lender incentives and loan sales, should help ensure the quality of the underlying data.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should define system capacity and performance requirements for the systems requirements documentation.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to establish processes for defining system capacity and performance requirements for the agency. Included in SBA's Systems Development Methodology are steps necessary to document these. Specifically, it addresses performance-related characteristics such as online response time, batch turnaround time, capacity limits, accuracy and validity requirements, input and output effects on performance, and failure contingencies.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should develop an acquisition strategy that ensures that a sound justification exists for pursuing custom-developed functions.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: In January 2002, SBA contracted for assistance to identify alternatives and provide recommendations for further developing a loan monitoring system. It also chartered a loan monitoring system project management board to oversee the acquisiton and provide overall leadership and responsibility for the vision, direction, and results of the loan monitoring system effort. The board decided to stop the development of the system and in 2003, SBA contracted with Dun & Bradstreet to provide loan and lender monitoring services. Thus, SBA did revise its strategy and abandoned its efforts for pursuing custom-developed functions.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should continue to refine the cost-to-completion estimate following the completion of the benefit-cost analysis of alternatives and selection of the best alternatives for implementation, and develop a lifecycle cost estimate for the system and its components.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA changed its strategy regarding the Loan Monitoring System. After comparing costs and alternatives, SBA stopped the development of that system and in April 2003, contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA has annual renewal options for this service for four subsequent years. The total value of the contract for the five years is $9.6 million.

    Recommendation: The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should implement project tracking and oversight capabilities.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to implement project tracking and oversight capabilities for the agency. Specifically, in fiscal year 2004, SBA purchased earned value management and project management tools for all IT investment project managers. The agency conducted training on these tools and also trained the project managers on earned value management concepts and practices. In addition, SBA developed a standard tool for project managers to use in preparing monthly status reports to be presented at regular intervals to the Business Technology Investment Advisory Committee. This Committee was created in January 2004 and is comprised of operating level deputies from each major program component of the agency and is cochaired by the Deputy CIO and Deputy CFO.

    Recommendation: The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should finalize and implement configuration management processes.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to implement configuration management processes for the agency. Specifically, SBA's September 2001 Systems Development Methodology contains appendicies on configuration management that describe the Configuration Management Program and includes the policy that requires an established baseline and configuration management.

    Recommendation: The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should acquire independent verification and validation for the loan monitoring system project.

    Agency Affected: Small Business Administration

    Status: Closed - Not Implemented

    Comments: SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA's current Systems Development Methodology does not require independent verification and validation for systems that are being developed.

    Recommendation: The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should establish an internal quality assurance function.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. However, SBA has taken steps to establish quality assurance processes for the agency. Specifically, SBA's September 2001 Systems Development Methodology contains an appendix describing the Quality Assurance Program, including related training, and requires that a quality assurance plan be developed for IT projects.

    Recommendation: The Administrator, SBA, should take a series of actions to ensure that SBA completes the steps mandated by the act, as stated in GAO's February 29, 2000, testimony. Specifically, the Administrator should complete the analyses of benefits and costs of alternatives being considered for each business process identified through SBA's business reengineering effort, and complete an implementation plan for the new business processes.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: In January 2002, SBA contracted for assistance to identify alternatives and provide recommendations for further developing a loan monitoring system. The contractor provided a report on alternatives in June 2002. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System and, in 2003, SBA contracted with Dun & Bradstreet to provide loan and lender monitoring services.

    Recommendation: The Administrator, SBA, should ensure the implementation of key functions to effectively manage the development of the loan monitoring system. Specifically, to strengthen project management processes and controls, the Administrator should address the security challenge posed by Internet-based access to loan monitoring system functions and data, complete the security architecture, and update the security operating procedure.

    Agency Affected: Small Business Administration

    Status: Closed - Implemented

    Comments: SBA chartered a loan monitoring system project management board to oversee the acquisition and provide overall leadership and responsibility for the loan monitoring system effort. Based on a comparison of costs and alternatives, SBA subsequently changed its strategy regarding the Loan Monitoring System. In 2003, SBA stopped the development of that system and contracted with Dun & Bradstreet to provide loan and lender monitoring services. SBA has updated its Automated Information System Security Program policy that provides specific policies relating to the Internet. For example, the security operating procedures govern employees' use of the internet, privacy expectations, accessing secure internet servers, and provides guidelines for using SBA's internet. In addition, the agency is transitioning to a managed network that houses an improved Internet monitoring system. This system should provide improved analysis and reporting capabilities and more detailed control over Internet access.

    Apr 2, 2014

    Feb 26, 2014

    Feb 12, 2014

    Jan 13, 2014

    Nov 13, 2013

    Nov 6, 2013

    Sep 12, 2013

    Sep 11, 2013

    Looking for more? Browse all our products here