Small Business Administration:

New Service for Lender Oversight Reflects Some Best Practices, but Strategy for Use Lags Behind

GAO-04-610: Published: Jun 8, 2004. Publicly Released: Jul 9, 2004.

Additional Materials:


William B. Shear
(202) 512-4325


Office of Public Affairs
(202) 512-4800

The Small Business Administration (SBA) has been challenged in the past in developing a lender oversight capability and a loan monitoring system to facilitate its oversight. While SBA has made progress in its lender oversight program, its past efforts to develop a loan monitoring system were unsuccessful. In 2003, SBA obtained loan monitoring services from Dun & Bradstreet. GAO evaluated SBA's loan monitoring needs, how well those needs are met by the new service, and the similarities and differences for the purposes of credit risk management between SBA and private sector best practices.

Largely because SBA relies on lenders to make the loans it guarantees, the agency needs a loan and lender monitoring capability that will enable it to efficiently and effectively analyze its overall portfolio of loans, its individual lenders, and their portfolios of loans. SBA, along with Dun & Bradstreet, essentially identified these same needs as they obtained the loan monitoring service. In addition, they identified the importance of applying industry standards and best practices for loan and lender monitoring and the need to identify high-risk lenders. Based on our assessment of best practices, SBA's credit risk management efforts need to include a comprehensive infrastructure, appropriate methodologies, and policies. The loan monitoring service could enable SBA to conduct the type of monitoring and analyses typical of best practices among banks and recommended by financial institution regulators, if SBA develops and implements appropriate policies. SBA's newly obtained service provides a credit risk management infrastructure and methodology that appear to be on par with those of many private sector lenders. For example, the database affords analytical capabilities based on common financial models that are used by major financial institutions. Although SBA obtained a useful service, it does not have comprehensive policies needed to implement best practices and address its needs as an agency with a public mission, especially regarding its need to use enforcement actions to address noncompliance. In addition, SBA does not have a contingency plan in the event the Dun & Bradstreet service is discontinued. SBA, similar to private lenders, must determine the level of risk it will tolerate, but it must do so within the context of its mission and its programs' structures, which may consequently translate into different uses of its Dun & Bradstreet loan monitoring service. Since SBA is a public agency with a public mission, its mission obligations will drive its credit risk management policies. For example, different loan products in the 7(a) program have different levels of guarantees, and guarantees on 504 program loans have a different structure from 7(a) guarantees. These differences influence the mix of loans in SBA's portfolio and, consequently, would impact how SBA manages its credit risk. Furthermore, the structure of SBA's loan guarantee programs may also result in different credit risk management policies between SBA and major lenders. Private sector lenders manage credit risk at the loan level and the portfolio level. Since SBA relies on private lenders to originate and service the majority of the loans it guarantees, it also needs to manage the credit risk in its portfolio at the lender level.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: SBA clarified responsibilities for continuous improvement in the loan monitoring service, frequent and routine portfolio reviews, and mandated the involvement of senior SBA managers who are not part of the Offices of Lender Oversight or Capital Access. See April 25, 2005, Federal Register, Vol. 70, No. 78, 21262. In addition, SBA issued an internal directive ("606") that also specifies the responsibilities and composition of two committees (the Portfolio Analysis and the Lender Oversight Committees) responsible for reviewing lender performance. A "Program Management Plan" developed by SBA's loan monitoring service contractor, Dun & Bradstreet, specifies a strategy for continuous improvement. For example, the contractor provides a monthly report to SBA on its service and it is to include recommendations for improvements.

    Recommendation: In developing policies for the use of the Dun & Bradstreet loan monitoring service, SBA should consider the applicability of best practices, including specific policy elements identified in this report. Practices that should be considered include plans for continuous improvement in the service and its tools, frequent and routine portfolio reviews, and active involvement of senior SBA managers in reviewing the use of output.

    Agency Affected: Small Business Administration

  2. Status: Closed - Implemented

    Comments: On December 11, 2008 SBA issued an interim final rule that includes SBA's enforcement regulations. Specifically, the rule lists the types of, grounds for, and procedures governing SBA enforcement actions against 7(a) Lenders, Certified Development Companies, Microloan Intermediaries, and Non-Lending Technical Assistance Providers within consolidated enforcement regulations. The rule went into effect on January 12, 2009.

    Recommendation: SBA should expedite the development of policies for taking enforcement actions against all lending partners to address noncompliance issues identified through the loan monitoring service and to address safety and soundness issues among SBLCs and CDCs, for whom SBA is the only regulator. We have made recommendations calling on SBA to clarify its supervisory and enforcement powers since November 2000. Although SBA has taken some incremental planning steps to address the issue, its current time line estimates finalizing enforcement regulations in April 2005.

    Agency Affected: Small Business Administration

  3. Status: Closed - Implemented

    Comments: Information shown in response to the first, second, and fourth recommendations indicates that SBA has provided sufficient resources to developing appropriate guidance, requirements for senior officials to be involved in oversight of lender performance, creating a risk rating system, and identifying and applying the benefits of the loan monitoring service to other processes at SBA.

    Recommendation: SBA should ensure that resources within SBA are devoted to developing policies for the use of the loan monitoring service, so that the overall time line for completion--April 2005--is met.

    Agency Affected: Small Business Administration

  4. Status: Closed - Implemented

    Comments: SBA's Portfolio Analysis Committee, which meets monthly, includes senior officials from offices other than Lender Oversight and Capital Access, such as the Offices of the Chief Operating Officer, and Chief Financial Officer. In reviewing and discussing data provided by the Dun & Bradstreet service, it identified special risks associated with the LowDoc (i.e., limited documentation required of lenders) loan product. Subsequently, SBA terminated the product. SBA officials provided other examples of the agency's use of the service, such as discussing and assessing the relationship of data to the 7(a) and 504 loan credit subsidy calculations and initiating a special review of loan charge-off activity at the SBA liquidation facility in Herndon.

    Recommendation: SBA should establish an agencywide task force to explore the potential for applying the capabilities of the Dun & Bradstreet service to SBA business processes and responsibilities other than lender oversight, such as overall portfolio risk management or budget projections. Programmatic offices and the Office of the Chief Financial Officer should be included.

    Agency Affected: Small Business Administration

  5. Status: Closed - Implemented

    Comments: SBA developed a contingency plan in May 2016 that details steps the agency will take to continue to manage the risk of the 7(a) and 504 portfolio, including individual lenders, if the Dun & Bradstreet contract were discontinued. The plan describes a negotiated phase out that will allow SBA staff to continue to use and access all data, models, and software provided by Dun & Bradstreet for a period of time. In addition, the plan states that SBA would use the GSA schedule to procure similar or reduced-scope loan credit scoring from a commercial-off-the-shelf provider to serve as a surrogate for the Small Business Predictive Score on a quarterly basis until new vendor services are procured. According to the plan, SBA has identified several nationally-recognized vendors that offer replacement systems. During the months it may take to put another contract in place, the plan states that the agency will also independently conduct portfolio analysis using performance metrics of individual lenders that it receives each month from its own data mart.

    Recommendation: SBA should develop contingency plans that would enable SBA's continued risk management of the 7(a) and 504 portfolio overall, individual lenders, and their portfolios in the event that the Dun & Bradstreet contract is discontinued.

    Agency Affected: Small Business Administration


Explore the full database of GAO's Open Recommendations »

Oct 13, 2020

Oct 1, 2020

Sep 30, 2020

Sep 28, 2020

Jul 30, 2020

Jun 29, 2020

Jun 22, 2020

Apr 27, 2020

  • business icon, source: Photodisc

    Priority Open Recommendations:

    Department of Commerce
    GAO-20-497PR: Published: Apr 20, 2020. Publicly Released: Apr 27, 2020.

Dec 13, 2019

Nov 19, 2019

Looking for more? Browse all our products here